Learn how you can bring together the best-in-class productivity and collaboration capabilities of Office 365 with device management and security solutions to safeguard business data for small and midsize businesses (SMB).
Get help on the most common admin tasks in the Microsoft 365 Business admin center. The Microsoft 365 Business admin center is lot like the Office 365 admin center so the admin guidance we provide for Office 365 admin center also apply to Microsoft 365 Business.
Learn how you can bring together the best-in-class productivity and collaboration capabilities of Office 365 with device management and security solutions to safeguard business data for small and midsize businesses (SMB).
Get help on the most common admin tasks in the Microsoft 365 Business admin center. The Microsoft 365 Business admin center is lot like the Office 365 admin center so the admin guidance we provide for Office 365 admin center also apply to Microsoft 365 Business.
diff --git a/bcs/support/images/pc_customer_m365bpreview_suspend.png b/bcs/support/images/pc_customer_m365bpreview_suspend.png
deleted file mode 100644
index 7017cf8105..0000000000
Binary files a/bcs/support/images/pc_customer_m365bpreview_suspend.png and /dev/null differ
diff --git a/bcs/support/images/pc_customer_m365bpreview_suspend_confirm.png b/bcs/support/images/pc_customer_m365bpreview_suspend_confirm.png
deleted file mode 100644
index f44337889b..0000000000
Binary files a/bcs/support/images/pc_customer_m365bpreview_suspend_confirm.png and /dev/null differ
diff --git a/bcs/support/images/pc_customer_reviewnewsubscription.png b/bcs/support/images/pc_customer_reviewnewsubscription.png
deleted file mode 100644
index 6f67c31383..0000000000
Binary files a/bcs/support/images/pc_customer_reviewnewsubscription.png and /dev/null differ
diff --git a/bcs/support/images/pc_customer_subscriptions.PNG b/bcs/support/images/pc_customer_subscriptions.PNG
deleted file mode 100644
index 77fba8ef8b..0000000000
Binary files a/bcs/support/images/pc_customer_subscriptions.PNG and /dev/null differ
diff --git a/bcs/support/images/pc_customer_subscriptions_1.png b/bcs/support/images/pc_customer_subscriptions_1.png
deleted file mode 100644
index fc27c2c26c..0000000000
Binary files a/bcs/support/images/pc_customer_subscriptions_1.png and /dev/null differ
diff --git a/bcs/support/images/pc_customer_userslicenses_m365b_validate.png b/bcs/support/images/pc_customer_userslicenses_m365b_validate.png
deleted file mode 100644
index 1af38b82af..0000000000
Binary files a/bcs/support/images/pc_customer_userslicenses_m365b_validate.png and /dev/null differ
diff --git a/bcs/support/microsoft-365-business-faqs.md b/bcs/support/microsoft-365-business-faqs.md
deleted file mode 100644
index f1d4a9918c..0000000000
--- a/bcs/support/microsoft-365-business-faqs.md
+++ /dev/null
@@ -1,186 +0,0 @@
----
-title: Microsoft 365 Business Frequently Asked Questions
-description: Find answers to the most frequently asked questions about Microsoft 365 Business, a new solution designed for small and midsize businesses (SMB).
-author: CelesteDG
-ms.author: celested
-ms.topic: article
-ms.prod: microsoft-365-business
-ms.localizationpriority: high
-audience: microsoft-business
-keywords: Microsoft 365 Business, Microsoft 365, SMB, FAQ, frequently asked questions, answers, business
-ms.date: 11/01/2017
----
-
-
-# Microsoft 365 Business Frequently Asked Questions
-
-## General
-
-### What is Microsoft 365 Business?
-Microsoft 365 is an integrated solution that brings together best-in-class productivity tools, security and device management capabilities for small to medium-sized businesses.
-
-**A holistic set of business productivity and collaboration tools**
-* Word, Excel, PowerPoint, Outlook, OneNote, Publisher, and Access
-* Exchange, OneDrive, Skype for Business, Microsoft Teams, SharePoint
-* Business apps from Office (Bookings, Outlook Customer Manager, MileIQ[1](#footnote1), Microsoft Listings[1](#footnote1), Microsoft Connections[1](#footnote1), Microsoft Invoicing[1](#footnote1))
-
-**Enterprise-grade device management and security capabilities**
-* App protection for Office mobile apps
-* Device management for Windows 10 PCs
-* Consistent security configuration across devices
-* Protection of company data across devices
-* Windows Defender, always-on and up-to-date
-
-**Simplified device deployment and user setup**
-* Single admin console to setup and manage users and devices
-* Auto-installation of Office apps on Windows 10 PCs
-* Always up-to-date Office + Windows 10
-* Streamlined deployment of PCs with Windows AutoPilot
-
-### Who should consider adopting Microsoft 365 Business?
-Microsoft 365 Business was built for small and medium-sized customers that have little to no IT resources on staff and want best-in-class productivity and collaboration capabilities of Office 365 together with device management and security solutions that safeguard business data. The Microsoft 365 Business customer is ready to move their IT operations to the cloud and is interested in maintaining a proactive stance to help protect data on both company and employee-owned devices.
-
-### How can I get Microsoft 365 Business for my business?
-Microsoft 365 Business may be purchased through a Microsoft Partner or directly from Microsoft. In choosing whether to purchase directly from Microsoft or via a Microsoft Partner, you should consider your on-staff capability and desire to maintain an IT infrastructure. A Microsoft Partner can help you deploy and manage your IT infrastructure including Microsoft solutions.
-
-### How much does Microsoft 365 Business cost?
-Microsoft 365 Business is offered at USD$20.00 user/month based on an _annual contract_ if purchased directly from Microsoft. When purchased through a Microsoft Partner, pricing can vary based on the services the partner provides and their pricing model for Microsoft 365 Business. There are no planned pricing discounts for government, education or non-profit organizations.
-
-### Is there a cap to how many Microsoft 365 Business seats a customer can have?
-Microsoft 365 Business was designed for small to medium sized businesses with low to medium IT complexity requirements. Customers may purchase up to 300 Microsoft 365 Business licenses for their organization. Customers can mix and match cloud subscriptions; as a result, depending on their organization’s IT requirements, customers may add Microsoft 365 Enterprise licenses to the same account.
-
-When considering an environment consisting of multiple subscription types, customers should work with their trusted IT advisors to determine how best to manage and secure the various subscriptions as Microsoft 365 Business and Microsoft 365 Enterprise use different capabilities to secure and manage applications and data.
-
-### Can I combine Microsoft 365 Business with other Microsoft subscription offerings?
-Yes, customers can combine their Microsoft 365 Business subscriptions with plans and add-ons from Azure, Dynamics 365, Enterprise Mobility + Security, and Office 365.
-
-### Is everyone in my business required to have a Microsoft 365 Business subscription?
-No, not everyone needs a Microsoft 365 Business subscription, although the security and management benefits are available only to those users with devices managed with a Microsoft 365 Business subscription.
-
-Standardizing an IT environment serves to help reduce maintenance and security costs over time and is a state that businesses should strive to attain. However, we recognize that some small and medium size customers update their software primarily when they upgrade their hardware, over an extended period. Businesses can deploy Microsoft 365 Business to part of their organization, but for best protection of sensitive business data and consistent collaboration experiences, deployment to all users is recommended.
-
-### How can I know if the hardware and software I run today is compatible with Microsoft 365 Business?
-If the hardware you run today runs Windows 7 Pro or later, it likely meets the minimum requirements for Microsoft 365 Business. Certain Windows 10 features such as Cortana, Windows Hello and multitouch require specific hardware that is only available on newer PCs. See the Windows 10 Pro system requirements for additional details.
-
-Existing desktop (Win32) application compatibility is strong in Windows 10, with most existing applications working without any changes. Customers and their trusted IT advisors should read the recommended application testing process for Windows 10 compatibility and review the Office system requirements to ensure a smooth transition to Microsoft 365 Business.
-
-### What is Windows 10 Business?
-Windows 10 Business is a set of cloud-services and device management capabilities that complement Windows 10 Pro and enable the centralized management and security controls of Microsoft 365 Business. Windows 10 Business also comes with Windows AutoPilot, a service that streamlines the deployment of new Windows 10 PCs. If you have devices that are licensed for Windows 7, 8 and 8.1 Professional, Microsoft 365 Business provides an upgrade to Windows 10 Pro which is the prerequisite for deploying Windows 10 Business.
-
-### How does Microsoft 365 Business help support our Bring Your Own Device (BYOD) policy?
-Many employees prefer to use their own mobile phones or tablets to access personal and work information rather than carrying multiple devices for each purpose. The use of personal devices for work, while commonplace, increases the risk that business information could end up in the wrong hands. Many competing mobile data protection solutions require users to switch to a specific mode on their device or use another complex mechanism that users may find intrusive and therefore avoid using.
-
-Microsoft 365 Business offers customers a simple but powerful means of enabling employees to use their personal devices for work while providing the business with the ability to prevent those devices from accessing, retaining and/or sharing business information. More specifically:
-* **App Protection for Office mobile apps** helps protect Office data, including email, calendar, contacts, and documents on iOS and Android mobile devices, by enforcing policies such as automatically deleting business data after a prescribed amount of time of not connecting to the service, requiring that information is stored only to OneDrive for Business, requiring a PIN/fingerprint verification to access Office apps, and preventing company data from being copied from an Office app into personal apps.
-* **Device Management for Windows 10 PCs** allows businesses to choose to set and enforce capabilities such as Windows Defender protection for malware, automatic updates, and turning off screens after a prescribed amount of time. In addition, lost or stolen Windows 10 devices can be completely wiped of business applications and data through the Admin center.
-
-### How does Microsoft 365 Business help protect PCs in my organization from malicious attacks?
-PCs managed with Microsoft 365 Business are protected with Windows Defender, which is the No. 1 antivirus feature on Windows 10, protecting more computers against viruses, malware, spyware, and other threats than any other solution. With Microsoft 365 Business, businesses can ensure Windows Defender protection is running and always up to date on all their Windows 10 devices
-
-### What's the difference between Office 365 Business Premium, Microsoft 365 Business and Microsoft 365 Enterprise?
-Microsoft has a variety of productivity and security management offerings that small to medium-sized customers may consider when upgrading their desktop and device infrastructure, each bringing increasingly powerful features and functionality.
-
-**Office 365 Business Premium** delivers best-in-class productivity with Office 365 apps and services but does not include the application protection and device management capabilities of Microsoft 365 Business.
-
-**Microsoft 365 Business** combines Office 365 apps and services with mobile application management and Windows 10 Pro to enable remote management and help protect devices against viruses and malware. It includes a simplified management console through which device and data policies may be administered. Many small to medium-sized businesses can be best served with Microsoft 365 Business, although those in highly regulated industries may require more advanced functionality provided by Microsoft 365 Enterprise plans (E3 and E5).
-
-**Microsoft 365 Enterprise** is a set of licensing plans that offer increased levels of mobility and security management over Microsoft 365 Business and are designed for enterprise customers and those customers that are required or regulated to provide the highest level of protection for their data. In addition, Microsoft 365 Business plans provide additional functionality including business intelligence and analytics tools.
-
-### Can I switch my Office 365 plan to Microsoft 365 Business?
-Yes, customers may switch their plans from a qualifying Office 365 plan to Microsoft 365 Business. Depending on the customer’s current plan there may be a decrease or increase in monthly charges.
-
-### In what regions is Microsoft 365 Business available?
-The Microsoft 365 Business will be available to all partners and customers where Office 365 is available. See the list of Office 365 international availability for languages, countries and regions.
-
-### Is there a Microsoft 365 Business trial I may use to evaluate the offer?
-A Microsoft 365 Business trial will be available later this year both for direct customers and for CSPs.
-
-### What should customers and partners know before running Microsoft 365 Business within their organization?
-Customers that wish to experience the complete capabilities of Microsoft 365 Business must be running Windows 7, 8.1 or 10 Pro[2](#footnote2) on their existing desktops. Customers who use on-premises Active Directory to enable login to PCs will switch devices over cloud identity and management as part of their deployment. Existing Windows 10 Pro PCs should be running Creators Update if they have not already done so.
-
-## Deployment
-
-### What should customers consider when planning a Microsoft 365 Business deployment?
-The most direct path to a successful Microsoft 365 Business deployment is to engage with a Microsoft Partner. They have extensive training and experience with a wide variety of customer scenarios and are best equipped to understand your environment and needs. Customers that have experienced IT on staff can use the Microsoft 365 Business Getting Started to assist them in their Microsoft 365 Business deployment.
-
-### Does Microsoft 365 Business include the full capabilities of Microsoft Intune?
-Microsoft 365 Business includes a robust set of mobile app management capabilities powered by Microsoft’s MDM solution (Microsoft Intune). These are a subset of features, specifically chosen to meet the needs of SMBs and organized to be easily managed via a simplified administration experience. If a company requires the full capabilities of Intune, they can purchase a qualifying plan separately.
-
-### Does Azure Active Directory P1 come with Microsoft 365 Business?
-Microsoft 365 Business is built on technology from across Microsoft and while it shares some features with Azure Active Directory, it is not a full version. The security and management policies created in Microsoft 365 Business rely on some Azure functionality but does not include all features (e.g. selfservice features, conditional access features, and reporting). Customers may choose to purchase Azure Active Directory Premium as an add-on to Microsoft 365 Business.
-
-### Does Microsoft 365 Business allow customers to manage Macs?
-The security and management capabilities of Microsoft 365 Business pertain to iOS and Android mobile and tablet devices, and Windows PCs.
-
-### What is Windows AutoPilot?
-Windows AutoPilot is a service that streamlines the deployment of new Windows 10 PCs. This process can be done when the end-user logs on to Microsoft 365 Business for the first time—without IT ever touching the device—by leveraging centralized management controls of Microsoft 365 Business. You can also use Windows AutoPilot for existing PCs that are running Windows 10 Professional Creators Update (or later) and have been factory reset. Details about Windows AutoPilot can be found in this June blog post.
-
-## Compatibility
-
-### Can I add Office 365 add-ons to Microsoft 365 Business?
-All the add-ons that can be added to Office 365 Business Premium can be added to Microsoft 365 Business. This means that you can purchase Advanced Threat Protection, Office 365 Cloud App Security, Advanced Compliance, Threat Intelligence, MyAnalytics, PowerBI Pro, and Audio Conferencing.
-
-### Can I add Phone System and Calling Plans to Microsoft 365 Business?
-No, Phone System and Calling Plan are reserved for customers who have more advanced needs. Customers who require these capabilities should look at Microsoft 365 Enterprise offerings.
-
-### Can Microsoft 365 Business customers use Windows Defender Advanced Threat Protection?
-No, customers that require Windows Defender Advanced Threat Protection need either Windows 10 Enterprise E5 or Microsoft 365 Enterprise E5.
-
-### Can I use Windows Information Protection with Microsoft 365 Business?
-Yes, Windows Information Protection (WIP) is a feature of Windows 10 Pro and helps businesses prevent accidental leaks by restricting user and app access to business files based on policies you define. Your business data is protected no matter where it lives on your devices—without affecting your user experience. Microsoft 365 Business includes controls to ensure Windows Information Protection is properly configured and automatically deployed to end-user devices.
-
-### Can customers use Microsoft 365 Business with on-premises Active Directory?
-To realize the full value of Windows 10, Windows 10 PCs need to be joined to Azure Active Directory. You may use Microsoft 365 Business with Windows 10 devices joined to on-premises Active Directory but it is not recommended because you won’t be able to enforce policies from the Microsoft 365 Business Admin console.
-
-### Can customers create hosted Windows 10 VMs with a Microsoft 365 Business subscription?
-No, customers that require virtualization should purchase Windows 10 Enterprise or a Microsoft 365 Enterprise subscription.
-
-## Partner opportunity
-
-### Where can I learn more about the opportunities and benefits in becoming a Microsoft Partner?
-IT service providers that are not already Microsoft partners can learn more about the Microsoft Cloud Solution Provider program at
-[https://partners.office.com/microsoft365business](https://partners.office.com/microsoft365business).
-
-### Where can I learn how to sell Microsoft 365 Business?
-Partners now selling Office 365 can use the same consultative selling methods to sell Microsoft 365 Business. In addition, we are introducing more resources and training for your sales team to understand the customers’ existing desktop environment, Active Directory reliance, mobility and security needs to effectively communicate the full value of Microsoft 365 Business in a way that is relevant to the customer. Find these resources on the Office Partner portal at [http://partners.office.com/microsoft365business](http://partners.office.com/microsoft365business).
-
-### How can Microsoft 365 Business help partners increase the profitability?
-Microsoft 365 Business will help partners reduce costs through greater operational efficiencies and enhance revenue through the sale of additional services. The Forrester Research, Microsoft 365 Business Total Economic Impact (TEI) Study, June 2017 (https://partners.office.com/TEIBusiness), demonstrates that Microsoft 365 Business will have positive impact on partner profitability.
-
-In the TEI study partners reported that with Microsoft 365 Business they expect:
-
-- 20%-point increase in \[one-time\] deployment and advisory services revenue
-- 10%-point increase in attach rate of managed services
-- 8%-point increase in consulting and \[ongoing\] managed services profit margins (from lower costs)
-
-### What resources are available to partners to sell, deploy and support Microsoft 365 Business?
-Microsoft provides a wide selection of resources for CSP partners to market, sell, and support Microsoft 365 Business. They can be found at
-[https://partners.office.com/microsoft365business](https://partners.office.com/microsoft365business).
-
-### What up-sell opportunities does Microsoft 365 Business give partners?
-Microsoft 365 Business allows partners to maintain their trusted advisor position with customers, by creating a solid and secure platform upon which to sell additional services and to upgrade existing products and services. Microsoft 365 Business provides an opportunity to have an upgrade discussion with customers now using Exchange Server, Exchange Online or Office 365 Business Essentials. Partners may also gain additional revenue from increased managed services and/or peruser support fees.
-
-With the new Windows AutoPilot feature included in Microsoft 365 Business, partners who have been reluctant to sell new Windows devices due to deployment logistics and costs will find this opportunity much more attractive. Customers who are confident in the security of their on-premise and mobile devices are also more likely to invest in additional services, such as Dynamics 365.
-
-### Should partners sell Microsoft 365 Business over other plans from Microsoft?
-A Microsoft Cloud Solution Provider should always sell the plan that best suits its customer business needs and budget. For example, if a customer must comply with privacy and security regulations, a CSP may sell Microsoft 365 Business plus any add-ons that help the customer meet its requirements or may suggest the advanced security and management provided by Microsoft 365 Business E SKUs.
-
-### Some of my customers have devices that are not genuine; will Microsoft 365 Business make these devices genuine?
-Microsoft 365 Business does not make an otherwise non-genuine version of Windows, genuine. Microsoft 365 Business does provide an upgrade benefit allowing those customers running genuine Windows 7, 8 or 8.1 Pro to upgrade to the most recent, genuine version of Windows 10 Pro.
-
-### What support is available to CSP partners for the Microsoft 365 Business Preview?
-The same support channels available to CSP partners today (premier support and advanced support program) have been trained on Microsoft 365 Business and are ready to provide partners with support.
-
-### What is the GDPR and how does Microsoft 365 Business help customers with their compliance obligations?
-The General Data Protection Regulation (GDPR) is a comprehensive new privacy law that gives residents of the European Union (EU) greater control over their “personal data” and requires organizations to maintain the integrity of that personal data. The GDPR requires organizations that control, or process personal data tied to EU residents to only use third-party data processors that meet the GDPR’s requirements for personal data processing. In March 2017, Microsoft made available contractual guarantees that provide these assurances. Customers that have questions about how Microsoft can help them meet their additional GDPR obligations should learn about the advanced compliance and security capabilities available as add-ons (e.g. Azure Information Protection) and in other Suites (e.g. Microsoft 365 Enterprise E5). To learn more, visit [www.microsoft.com/gdpr](https://www.microsoft.com/gdpr).
-
-
-
-
-## Footnotes
-**1** Available in US, UK, and Canada.
-**2** Devices running Windows 7 or 8.1 Pro are eligible for an upgrade to Windows 10 Pro within the Microsoft 365 Business preview.
-
-
-
-
diff --git a/bcs/support/transition-csp-subscription.md b/bcs/support/transition-csp-subscription.md
deleted file mode 100644
index 7c15aa33b6..0000000000
--- a/bcs/support/transition-csp-subscription.md
+++ /dev/null
@@ -1,103 +0,0 @@
----
-title: Transition a Microsoft 365 Business CSP subscription
-description: Find out how you can transition a Microsoft 365 Business CSP subscription from preview to GA.
-author: CelesteDG
-ms.author: celested
-ms.topic: article
-ms.prod: microsoft-365-business
-ms.localizationpriority: high
-audience: microsoft-business
-keywords: Microsoft 365 Business, Microsoft 365, SMB, transition CSP subscription
-ms.date: 11/01/2017
----
-
-# Transition a Microsoft 365 Business CSP subscription
-
-If you have a Microsoft 365 Business Preview CSP subscription, follow this guide to find out how you can transition your existing preview subscription to Microsoft 365 Business GA (general availability).
-
-**How to transition a preview subscription to GA**
-
-1. Log in to Partner Center.
-2. From the dashboard, select **Customers**, and then find and select the company name.
-
- The subscriptions for the company will be listed.
-
- 
-
-3. In the company's **Subscriptions** page, select **Add subscription**.
-4. In the **New subscription** page, select **Small business** and then select **Microsoft 365 Business** from the list.
-5. Add the number of licenses and then select **Next: Review** to review the subscription and then select **Submit**.
-
- 
-
- The **License-based subscriptions** will show **Microsoft 365 Business Preview** and **Microsoft 365 Business**. You'll need to suspend the Preview subscription next.
-
-6. Select **Microsoft 365 Business Preview**.
-7. In the **Microsoft 365 Business Preview** page, select **Suspended** to suspend the Preview subscription.
-
- 
-
-8. Select **Submit** to confirm.
-
- In the **Subscriptions** page, confirm that the **Microsoft 365 Business Preview** status shows **Suspended**.
-
- 
-
-9. Optionally, you can also validate the license agreement. To do this, follow these steps:
- 1. Select **Users and licenses** from the company's **Subscriptions** page.
- 2. From the **Users and licenses** page, select a user.
- 3. In the user's page, check the **Assign licenses** section and confirm that it shows **Microsoft 365 Business**.
-
- 
-
-## Impact to customers and users during and after transition
-
-There is no impact to customers and users during transition and post transition.
-
-## Impact to customers who don't transition
-
-The following table summarizes the impact to customers who don't transition from a Microsoft 365 Business Preview subscription to a Microsoft 365 Business subscription.
-
-| | T-0 to T+30 | T+30 to T+60 | T+60 to T+120 | Beyond T+120 |
-|-------|-----------------|--------------|---------------|---------------|
-| **State** | In grace period | Expired | Disabled | Deprovisioned |
-| **Service impacts** |
-| **Microsoft 365 Business admin portal** | No impact to functionality | No impact to functionality | Can add/delete users, purchase subscriptions. Cannot assign/revoke licenses. | Customer's subscription and all data is deleted. Admin can manage other paid subscriptions. |
-| **Office apps** | No end user impact | No end user impact | Office enters reduced functionality mode. Users can view files only. | Office enters reduced functionality mode. Users can view files only. |
-| **Cloud services (SharePoint Online, Exchange Online, Skype, Teams, and more)** | No end user impact | No end user impact | End users and admins have no access to data in the cloud. | Customer's subscription and all data are deleted. |
-| **EM+S components** | No admin impact No end user impact | No admin impact No end user impact | Capability will cease to be enforced. See [Mobile device impacts upon subscription expiration](#mobile-device-impacts-upon-subscription-expiration) and [Windows 10 PC impacts upon subscription expiration](#windows-10-pc-impacts-upon-subscription-expiration) for more info. | Capability will cease to be enforced. See [Mobile device impacts upon subscription expiration](#mobile-device-impacts-upon-subscription-expiration) and [Windows 10 PC impacts upon subscription expiration](#windows-10-pc-impacts-upon-subscription-expiration) for more info. |
-| **Windows 10 Business** | No admin impact No end user impact | No admin impact No end user impact | Capability will cease to be enforced. See [Mobile device impacts upon subscription expiration](#mobile-device-impacts-upon-subscription-expiration) and [Windows 10 PC impacts upon subscription expiration](#windows-10-pc-impacts-upon-subscription-expiration) for more info. | Capability will cease to be enforced. See [Mobile device impacts upon subscription expiration](#mobile-device-impacts-upon-subscription-expiration) and [Windows 10 PC impacts upon subscription expiration](#windows-10-pc-impacts-upon-subscription-expiration) for more info. |
-| **Azure AD login to a Windows 10 PC** | No admin impact No end user impact | No admin impact No end user impact | No admin impact No end user impact | Once the tenant is deleted, a user can log in with local credentials only. Re-image the device if there are no local credentials. |
-
-## Mobile device impacts upon subscription expiration
-
-The followint table summarizes the impact to the app management policies on mobile devices.
-
-| | Fully licensed experience | T+60 days post expiration |
-|----------------------------|------------------------------------------------|------------------------------------|
-| **Delete work files from an inactive device** | Work files are removed after selected days | Work files remain on the user's personal devices |
-| **Force users to save all work files to OneDrive for Business** | Work files can only be saved to OneDrive for Business | Work files can be saved anywhere |
-| **Encrypt work files** | Work files are encrypted | Work files are no longer encrypted. Security policies are removed and Office data on apps is removed. |
-| **Require PIN or fingerprint to access Office apps** | Restricted access to apps | No app-level access restriction |
-| **Reset PIN when login fails** | Restricted access to apps | No app-level access restriction |
-| **Require users to sign in again after Office apps have been idle** | Sign-in required | No sign-in required to access apps |
-| **Deny access to work files on jailbroken or rooted devices** | Work files cannot be accessed on jailbroken/rooted devices | Work files can be accessed on jailbroken/rooted devices |
-| **Allow users to copy content from Office apps to Personal apps** | Copy/paste restricted to apps available as part of Microsoft 365 Business subscription | Copy/paste available to all apps |
-
-## Windows 10 PC impacts upon subscription expiration
-
-The following table summarizes the impact to the Windows 10 device configuration policies.
-
-| | Fully licensed experience | T+60 days post expiration |
-|----------------------------|------------------------------------------------|------------------------------------|
-| **Help protect PCs from threats using Windows Defender** | Turn on/off is outside of user control | User may turn on/off Windows Defender on the Windows 10 PC |
-| **Help protect PCs from web-based threats in Microsoft Edge** | PC protection in Microsoft Edge | User may turn on/off PC protection in Microsoft Edge |
-| **Turn off device screen when idle** | Admin defines screen timeout interval policy | Screen timeout can be configured by end user |
-| **Allow users to download apps from Microsoft Store** | Admin defines if a user can download apps from Microsoft Store | User can download apps from Microsoft Store anytime |
-| **Allow users to access Cortana** | Admin defines policy on user access to Cortana | User devices to turn on/off Cortana |
-| **Allow users to receive tips and advertisements from Microsoft** | Admin defines policy on user receive tips and advertisements from Microsoft | User may turn on/off tips and advertisements from Microsoft |
-| **Allow users to copy content from Office apps into personal apps** | Admin defines policy to keep Windows 10 devices up-to-date | Users can decide when to update Windows |
-
-
-
-
diff --git a/browsers/edge/Index.md b/browsers/edge/Index.md
index 11310e783a..a18d463fa8 100644
--- a/browsers/edge/Index.md
+++ b/browsers/edge/Index.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: general
ms.sitesec: library
title: Microsoft Edge - Deployment Guide for IT Pros (Microsoft Edge for IT Pros)
ms.localizationpriority: high
+ms.date: 10/16/2017
---
# Microsoft Edge - Deployment Guide for IT Pros
diff --git a/browsers/edge/available-policies.md b/browsers/edge/available-policies.md
index b7642204dd..215e7cc5a8 100644
--- a/browsers/edge/available-policies.md
+++ b/browsers/edge/available-policies.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: explore
ms.sitesec: library
title: Group Policy and Mobile Device Management settings for Microsoft Edge (Microsoft Edge for IT Pros)
ms.localizationpriority: high
+ms.date: 09/13/2017
---
# Group Policy and Mobile Device Management (MDM) settings for Microsoft Edge
diff --git a/browsers/edge/change-history-for-microsoft-edge.md b/browsers/edge/change-history-for-microsoft-edge.md
index 83fb456c61..1958fa170c 100644
--- a/browsers/edge/change-history-for-microsoft-edge.md
+++ b/browsers/edge/change-history-for-microsoft-edge.md
@@ -5,6 +5,7 @@ ms.prod: edge
ms.mktglfcycl: explore
ms.sitesec: library
ms.localizationpriority: high
+ms.date: 09/19/2017
---
# Change history for Microsoft Edge
diff --git a/browsers/edge/emie-to-improve-compatibility.md b/browsers/edge/emie-to-improve-compatibility.md
index 4889826de3..433e1061bf 100644
--- a/browsers/edge/emie-to-improve-compatibility.md
+++ b/browsers/edge/emie-to-improve-compatibility.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: appcompat
title: Use Enterprise Mode to improve compatibility (Microsoft Edge for IT Pros)
ms.localizationpriority: high
+ms.date: 07/27/2017
---
# Use Enterprise Mode to improve compatibility
diff --git a/browsers/edge/enterprise-guidance-using-microsoft-edge-and-ie11.md b/browsers/edge/enterprise-guidance-using-microsoft-edge-and-ie11.md
index 23dcb3b5b5..e699a000e8 100644
--- a/browsers/edge/enterprise-guidance-using-microsoft-edge-and-ie11.md
+++ b/browsers/edge/enterprise-guidance-using-microsoft-edge-and-ie11.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: support
ms.sitesec: library
ms.pagetype: appcompat
ms.localizationpriority: high
+ms.date: 10/16/2017
---
# Browser: Microsoft Edge and Internet Explorer 11
diff --git a/browsers/edge/hardware-and-software-requirements.md b/browsers/edge/hardware-and-software-requirements.md
index 86a1452f93..6c45062cc6 100644
--- a/browsers/edge/hardware-and-software-requirements.md
+++ b/browsers/edge/hardware-and-software-requirements.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: appcompat
title: Microsoft Edge requirements and language support (Microsoft Edge for IT Pros)
ms.localizationpriority: high
+ms.date: 07/27/2017
---
# Microsoft Edge requirements and language support
diff --git a/browsers/edge/img-microsoft-edge-infographic-lg.md b/browsers/edge/img-microsoft-edge-infographic-lg.md
index 59c2c7a8e8..e9d8b67cc2 100644
--- a/browsers/edge/img-microsoft-edge-infographic-lg.md
+++ b/browsers/edge/img-microsoft-edge-infographic-lg.md
@@ -1,6 +1,7 @@
---
description: A full-sized view of the Microsoft Edge infographic.
title: Full-sized view of the Microsoft Edge infographic
+ms.date: 11/10/2016
---
Return to: [Browser: Microsoft Edge and Internet Explorer 11](enterprise-guidance-using-microsoft-edge-and-ie11.md)
diff --git a/browsers/edge/microsoft-edge-faq.md b/browsers/edge/microsoft-edge-faq.md
index bb633e1460..ca6eea8b48 100644
--- a/browsers/edge/microsoft-edge-faq.md
+++ b/browsers/edge/microsoft-edge-faq.md
@@ -7,7 +7,7 @@ ms.prod: edge
ms.mktglfcycl: general
ms.sitesec: library
ms.localizationpriority: high
-ms.date: 09/07/2017
+ms.date: 09/19/2017
---
# Microsoft Edge - Frequently Asked Questions (FAQs) for IT Pros
diff --git a/browsers/edge/security-enhancements-microsoft-edge.md b/browsers/edge/security-enhancements-microsoft-edge.md
index 8f777c48c3..2e06bbe027 100644
--- a/browsers/edge/security-enhancements-microsoft-edge.md
+++ b/browsers/edge/security-enhancements-microsoft-edge.md
@@ -6,6 +6,7 @@ ms.sitesec: library
ms.pagetype: security
title: Security enhancements for Microsoft Edge (Microsoft Edge for IT Pros)
ms.localizationpriority: high
+ms.date: 10/16/2017
---
# Security enhancements for Microsoft Edge
diff --git a/browsers/internet-explorer/ie11-deploy-guide/activex-installation-using-group-policy.md b/browsers/internet-explorer/ie11-deploy-guide/activex-installation-using-group-policy.md
index 4354799a3d..64f64f1366 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/activex-installation-using-group-policy.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/activex-installation-using-group-policy.md
@@ -8,6 +8,7 @@ ms.prod: ie11
ms.assetid: 59185370-558c-47e0-930c-8a5ed657e9e3
title: ActiveX installation using group policy (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/add-employees-enterprise-mode-portal.md b/browsers/internet-explorer/ie11-deploy-guide/add-employees-enterprise-mode-portal.md
index ef4614e5b5..72e501af4b 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/add-employees-enterprise-mode-portal.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/add-employees-enterprise-mode-portal.md
@@ -7,6 +7,7 @@ author: eross-msft
ms.prod: ie11
title: Add employees to the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
# Add employees to the Enterprise Mode Site List Portal
diff --git a/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md b/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md
index 47e96aaed6..595d31fa6f 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md
@@ -8,6 +8,7 @@ ms.prod: ie11
ms.assetid: 20aF07c4-051a-451f-9c46-5a052d9Ae27c
title: Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1) (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md b/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md
index b39bd8a25e..c8077d0f92 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md
@@ -8,6 +8,7 @@ ms.prod: ie11
ms.assetid: da659ff5-70d5-4852-995e-4df67c4871dd
title: Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2) (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 10/24/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md b/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md
index 46952fd95a..f6061375ab 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md
@@ -8,6 +8,7 @@ ms.prod: ie11
ms.assetid: 042e44e8-568d-4717-8fd3-69dd198bbf26
title: Add sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.1) (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md b/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md
index 0e8d8237e3..eafa1921a5 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md
@@ -8,6 +8,7 @@ ms.prod: ie11
ms.assetid: 513e8f3b-fedf-4d57-8d81-1ea4fdf1ac0b
title: Add sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.2) (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/administrative-templates-and-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/administrative-templates-and-ie11.md
index a88856b77f..8f22d23808 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/administrative-templates-and-ie11.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/administrative-templates-and-ie11.md
@@ -8,6 +8,7 @@ ms.prod: ie11
ms.assetid: 2b390786-f786-41cc-bddc-c55c8a4c5af3
title: Administrative templates and Internet Explorer 11 (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/approve-change-request-enterprise-mode-portal.md b/browsers/internet-explorer/ie11-deploy-guide/approve-change-request-enterprise-mode-portal.md
index 8c0981e62e..24078753c7 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/approve-change-request-enterprise-mode-portal.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/approve-change-request-enterprise-mode-portal.md
@@ -7,6 +7,7 @@ author: eross-msft
ms.prod: ie11
title: Approve a change request using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
# Approve a change request using the Enterprise Mode Site List Portal
diff --git a/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-and-auto-proxy-problems-with-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-and-auto-proxy-problems-with-ie11.md
index 4dd48ddc84..ad2280f2c7 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-and-auto-proxy-problems-with-ie11.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-and-auto-proxy-problems-with-ie11.md
@@ -8,6 +8,7 @@ ms.prod: ie11
ms.assetid: 3fbbc2c8-859b-4b2e-abc3-de2c299e0938
title: Auto configuration and auto proxy problems with Internet Explorer 11 (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-settings-for-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-settings-for-ie11.md
index 4eca33dad5..918969c1b7 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-settings-for-ie11.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-settings-for-ie11.md
@@ -8,6 +8,7 @@ ms.prod: ie11
ms.assetid: 90308d59-45b9-4639-ab1b-497e5ba19023
title: Auto configuration settings for Internet Explorer 11 (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/auto-detect-settings-for-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/auto-detect-settings-for-ie11.md
index 9ac1090d30..825a383e16 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/auto-detect-settings-for-ie11.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/auto-detect-settings-for-ie11.md
@@ -8,6 +8,7 @@ ms.prod: ie11
ms.assetid: c6753cf4-3276-43c5-aae9-200e9e82753f
title: Auto detect settings Internet Explorer 11 (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/auto-proxy-configuration-settings-for-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/auto-proxy-configuration-settings-for-ie11.md
index 4fc46f4332..b1097b8a83 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/auto-proxy-configuration-settings-for-ie11.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/auto-proxy-configuration-settings-for-ie11.md
@@ -8,6 +8,7 @@ ms.prod: ie11
ms.assetid: 5120aaf9-8ead-438a-8472-3cdd924b7d9e
title: Auto proxy configuration settings for Internet Explorer 11 (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/browser-cache-changes-and-roaming-profiles.md b/browsers/internet-explorer/ie11-deploy-guide/browser-cache-changes-and-roaming-profiles.md
index 8196de7ec4..c7d3471de2 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/browser-cache-changes-and-roaming-profiles.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/browser-cache-changes-and-roaming-profiles.md
@@ -8,6 +8,7 @@ ms.prod: ie11
ms.assetid: 85f0cd01-6f82-4bd1-9c0b-285af1ce3436
title: Browser cache changes and roaming profiles (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 10/16/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/change-history-for-internet-explorer-11.md b/browsers/internet-explorer/ie11-deploy-guide/change-history-for-internet-explorer-11.md
index c97e0694da..f93b098ea8 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/change-history-for-internet-explorer-11.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/change-history-for-internet-explorer-11.md
@@ -6,6 +6,7 @@ ms.mktglfcycl: deploy
ms.prod: ie11
ms.sitesec: library
author: eross-msft
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/check-for-new-enterprise-mode-site-list-xml-file.md b/browsers/internet-explorer/ie11-deploy-guide/check-for-new-enterprise-mode-site-list-xml-file.md
index 3f4d25d63c..cf0a576c0e 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/check-for-new-enterprise-mode-site-list-xml-file.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/check-for-new-enterprise-mode-site-list-xml-file.md
@@ -8,7 +8,7 @@ ms.pagetype: appcompat
ms.sitesec: library
author: eross-msft
ms.author: lizross
-ms.date: 08/11/2017
+ms.date: 08/14/2017
ms.localizationpriority: low
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-deploy-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-deploy-ie11.md
index afc154053d..81b5bf84d8 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-deploy-ie11.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-deploy-ie11.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: 21b6a301-c222-40bc-ad0b-27f66fc54d9d
title: Choose how to deploy Internet Explorer 11 (IE11) (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-install-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-install-ie11.md
index 82329fbc99..605f8ef5ff 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-install-ie11.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-install-ie11.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: 9572f5f1-5d67-483e-bd63-ffea95053481
title: Choose how to install Internet Explorer 11 (IE11) (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md b/browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md
index d253c6156f..ff584c1c9d 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: a145e80f-eb62-4116-82c4-3cc35fd064b6
title: Collect data using Enterprise Site Discovery
ms.sitesec: library
+ms.date: 07/27/2017
---
# Collect data using Enterprise Site Discovery
diff --git a/browsers/internet-explorer/ie11-deploy-guide/configure-settings-enterprise-mode-portal.md b/browsers/internet-explorer/ie11-deploy-guide/configure-settings-enterprise-mode-portal.md
index f2e96ee768..36066de055 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/configure-settings-enterprise-mode-portal.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/configure-settings-enterprise-mode-portal.md
@@ -7,6 +7,7 @@ author: eross-msft
ms.prod: ie11
title: Use the Settings page to finish setting up the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
# Use the Settings page to finish setting up the Enterprise Mode Site List Portal
diff --git a/browsers/internet-explorer/ie11-deploy-guide/create-change-request-enterprise-mode-portal.md b/browsers/internet-explorer/ie11-deploy-guide/create-change-request-enterprise-mode-portal.md
index 94d579eef2..18b8b34406 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/create-change-request-enterprise-mode-portal.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/create-change-request-enterprise-mode-portal.md
@@ -7,6 +7,7 @@ author: eross-msft
ms.prod: ie11
title: Create a change request using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
# Create a change request using the Enterprise Mode Site List Portal
diff --git a/browsers/internet-explorer/ie11-deploy-guide/create-install-packages-for-multiple-operating-systems-or-languages.md b/browsers/internet-explorer/ie11-deploy-guide/create-install-packages-for-multiple-operating-systems-or-languages.md
index 7766c1a797..d740a697e0 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/create-install-packages-for-multiple-operating-systems-or-languages.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/create-install-packages-for-multiple-operating-systems-or-languages.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: 44051f9d-63a7-43bf-a427-d0a0a1c717da
title: Create packages for multiple operating systems or languages (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/customize-ie11-install-packages.md b/browsers/internet-explorer/ie11-deploy-guide/customize-ie11-install-packages.md
index 50a6b4da46..8c69271b25 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/customize-ie11-install-packages.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/customize-ie11-install-packages.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: 10a14a09-673b-4f8b-8d12-64036135e7fd
title: Customize Internet Explorer 11 installation packages (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md
index 6407c0ac49..13fd5539cd 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md
@@ -8,6 +8,7 @@ ms.prod: ie11
ms.assetid: 41413459-b57f-48da-aedb-4cbec1e2981a
title: Delete sites from your Enterprise Mode site list in the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/deploy-ie11-using-automatic-version-synchronization-avs.md b/browsers/internet-explorer/ie11-deploy-guide/deploy-ie11-using-automatic-version-synchronization-avs.md
index 147018d84a..89681e6c97 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/deploy-ie11-using-automatic-version-synchronization-avs.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/deploy-ie11-using-automatic-version-synchronization-avs.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: f51224bd-3371-4551-821d-1d62310e3384
title: Deploy Internet Explorer 11 using Automatic Version Synchronization (AVS) (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
# Deploy Internet Explorer 11 using Automatic Version Synchronization (AVS)
diff --git a/browsers/internet-explorer/ie11-deploy-guide/deploy-ie11-using-software-distribution-tools.md b/browsers/internet-explorer/ie11-deploy-guide/deploy-ie11-using-software-distribution-tools.md
index 7b2497adb5..aa62287130 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/deploy-ie11-using-software-distribution-tools.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/deploy-ie11-using-software-distribution-tools.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: fd027775-651a-41e1-8ec3-d32eca876d8a
title: Deploy Internet Explorer 11 using software distribution tools (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/deploy-pinned-sites-using-mdt-2013.md b/browsers/internet-explorer/ie11-deploy-guide/deploy-pinned-sites-using-mdt-2013.md
index 284c39cf4a..98d265dc2f 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/deploy-pinned-sites-using-mdt-2013.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/deploy-pinned-sites-using-mdt-2013.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: 24f4dcac-9032-4fe8-bf6d-2d712d61cb0c
title: Deploy pinned websites using Microsoft Deployment Toolkit (MDT) 2013 (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/deprecated-document-modes.md b/browsers/internet-explorer/ie11-deploy-guide/deprecated-document-modes.md
index 4b095c080f..ec4c251fca 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/deprecated-document-modes.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/deprecated-document-modes.md
@@ -8,6 +8,7 @@ ms.prod: ie11
ms.assetid: 00cb1f39-2b20-4d37-9436-62dc03a6320b
title: Deprecated document modes and Internet Explorer 11 (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
# Deprecated document modes and Internet Explorer 11
diff --git a/browsers/internet-explorer/ie11-deploy-guide/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md
index 3fbdaa6e0f..c6e03cadc0 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md
@@ -8,6 +8,7 @@ ms.prod: ie11
ms.assetid: 76aa9a85-6190-4c3a-bc25-0f914de228ea
title: Edit the Enterprise Mode site list using the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/enable-and-disable-add-ons-using-administrative-templates-and-group-policy.md b/browsers/internet-explorer/ie11-deploy-guide/enable-and-disable-add-ons-using-administrative-templates-and-group-policy.md
index 42b9794117..8650b4702c 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/enable-and-disable-add-ons-using-administrative-templates-and-group-policy.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/enable-and-disable-add-ons-using-administrative-templates-and-group-policy.md
@@ -8,6 +8,7 @@ ms.prod: ie11
ms.assetid: c6fe1cd3-0bfc-4d23-8016-c9601f674c0b
title: Enable and disable add-ons using administrative templates and group policy (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/enhanced-protected-mode-problems-with-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/enhanced-protected-mode-problems-with-ie11.md
index b94efcee8d..4d98f914c6 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/enhanced-protected-mode-problems-with-ie11.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/enhanced-protected-mode-problems-with-ie11.md
@@ -8,6 +8,7 @@ ms.prod: ie11
ms.assetid: 15890ad1-733d-4f7e-a318-10399b389f45
title: Enhanced Protected Mode problems with Internet Explorer (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-overview-for-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-overview-for-ie11.md
index fc72177321..b7d9399d77 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-overview-for-ie11.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-overview-for-ie11.md
@@ -8,6 +8,7 @@ ms.prod: ie11
ms.assetid: d52ba8ba-b3c7-4314-ba14-0610e1d8456e
title: Enterprise Mode for Internet Explorer 11 (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-1-guidance.md b/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-1-guidance.md
index f1ef88dc96..88711fd787 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-1-guidance.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-1-guidance.md
@@ -8,6 +8,7 @@ ms.prod: ie11
ms.assetid: 17c61547-82e3-48f2-908d-137a71938823
title: Enterprise Mode schema v.1 guidance (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-2-guidance.md b/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-2-guidance.md
index b91676a518..237d0411b6 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-2-guidance.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-2-guidance.md
@@ -8,6 +8,7 @@ ms.prod: ie11
ms.assetid: 909ca359-5654-4df9-b9fb-921232fc05f5
title: Enterprise Mode schema v.2 guidance (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 12/04/2017
---
@@ -31,7 +32,7 @@ Because of the schema changes, you can't combine the old version (v.1) with the
- <site-list>. If your schema root node includes this key, you're using the v.2 version of the schema.
-You can continue to use the v.1 version of the schema on Windows 10, but you won't have the benefits of the new v.2 version schema updates and new features. Additionally, if you save the v.1 version of the schema in the new Enterprise Mode Site List Manager for Windows 10, it will automatically update the file to use the v.2 version of the schema.
+You can continue to use the v.1 version of the schema on Windows 10, but you won't have the benefits of the new v.2 version schema updates and new features. Additionally, saving the v.1 version of the schema in the new Enterprise Mode Site List Manager (schema v.2) automatically updates the file to use the v.2 version of the schema.
### Enterprise Mode v.2 schema example
The following is an example of the v.2 version of the Enterprise Mode schema.
diff --git a/browsers/internet-explorer/ie11-deploy-guide/export-your-enterprise-mode-site-list-from-the-enterprise-mode-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/export-your-enterprise-mode-site-list-from-the-enterprise-mode-site-list-manager.md
index 58dccc1956..8e779574c1 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/export-your-enterprise-mode-site-list-from-the-enterprise-mode-site-list-manager.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/export-your-enterprise-mode-site-list-from-the-enterprise-mode-site-list-manager.md
@@ -8,6 +8,7 @@ ms.prod: ie11
ms.assetid: 9ee7c13d-6fca-4446-bc22-d23a0213a95d
title: Export your Enterprise Mode site list from the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md b/browsers/internet-explorer/ie11-deploy-guide/fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md
index 2c2394be4a..c9cb13e685 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md
@@ -8,6 +8,7 @@ ms.prod: ie11
ms.assetid: 4b21bb27-aeac-407f-ae58-ab4c6db2baf6
title: Fix web compatibility issues using document modes and the Enterprise Mode site list (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/fix-validation-problems-using-the-enterprise-mode-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/fix-validation-problems-using-the-enterprise-mode-site-list-manager.md
index cd6d84a04f..62e79b50ba 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/fix-validation-problems-using-the-enterprise-mode-site-list-manager.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/fix-validation-problems-using-the-enterprise-mode-site-list-manager.md
@@ -8,6 +8,7 @@ ms.prod: ie11
ms.assetid: 9f80e39f-dcf1-4124-8931-131357f31d67
title: Fix validation problems using the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-advanced-group-policy-mgmt-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-advanced-group-policy-mgmt-ie11.md
index 098689f0fc..6292d0894b 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-advanced-group-policy-mgmt-ie11.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-advanced-group-policy-mgmt-ie11.md
@@ -8,6 +8,7 @@ ms.prod: ie11
ms.assetid: 63a7ef4a-6de2-4d08-aaba-0479131e3406
title: Group Policy, Advanced Group Policy Management (AGPM), and Internet Explorer 11 (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-group-policy-mgmt-console-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-group-policy-mgmt-console-ie11.md
index 8aca2f5360..c0efadfe3c 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-group-policy-mgmt-console-ie11.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-group-policy-mgmt-console-ie11.md
@@ -8,6 +8,7 @@ ms.prod: ie11
ms.assetid: ae3d227d-3da7-46b8-8a61-c71bfeae0c63
title: Group Policy, the Group Policy Management Console (GPMC), and Internet Explorer 11 (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-ie11.md
index f2ef7bb7bd..a6edc35240 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-ie11.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-ie11.md
@@ -8,6 +8,7 @@ ms.prod: ie11
ms.assetid: 50383d3f-9ac9-4a30-8852-354b6eb9434a
title: Group Policy and Internet Explorer 11 (IE11) (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-local-group-policy-editor-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-local-group-policy-editor-ie11.md
index 6f5e1b4a4e..1addebc886 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-local-group-policy-editor-ie11.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-local-group-policy-editor-ie11.md
@@ -8,6 +8,7 @@ ms.prod: ie11
ms.assetid: 6fc30e91-efac-4ba5-9ee2-fa77dcd36467
title: Group Policy, the Local Group Policy Editor, and Internet Explorer 11 (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/group-policy-compatability-with-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/group-policy-compatability-with-ie11.md
index 54bb62092b..0a51d356c8 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/group-policy-compatability-with-ie11.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/group-policy-compatability-with-ie11.md
@@ -8,6 +8,7 @@ ms.prod: ie11
ms.assetid: 7482c99f-5d79-4344-9e1c-aea9f0a68e18
title: Group Policy and compatibility with Internet Explorer 11 (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/group-policy-objects-and-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/group-policy-objects-and-ie11.md
index 1c208097c9..61e3cff2c2 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/group-policy-objects-and-ie11.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/group-policy-objects-and-ie11.md
@@ -8,6 +8,7 @@ ms.prod: ie11
ms.assetid: e33bbfeb-6b80-4e71-8bba-1d0369a87312
title: Group Policy management tools (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/group-policy-preferences-and-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/group-policy-preferences-and-ie11.md
index 680bd630f4..075c799add 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/group-policy-preferences-and-ie11.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/group-policy-preferences-and-ie11.md
@@ -8,6 +8,7 @@ ms.prod: ie11
ms.assetid: f2264c97-7f09-4f28-bb5c-58ab80dcc6ee
title: Group policy preferences and Internet Explorer 11 (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/group-policy-problems-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/group-policy-problems-ie11.md
index ec141c7c9e..e9b1487a45 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/group-policy-problems-ie11.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/group-policy-problems-ie11.md
@@ -8,6 +8,7 @@ ms.prod: ie11
ms.assetid: 0da0d9a9-200c-46c4-96be-630e82de017b
title: Group Policy problems with Internet Explorer 11 (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/group-policy-shortcut-extensions-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/group-policy-shortcut-extensions-ie11.md
index f757093789..13c812647c 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/group-policy-shortcut-extensions-ie11.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/group-policy-shortcut-extensions-ie11.md
@@ -8,6 +8,7 @@ ms.prod: ie11
ms.assetid: c6fbf990-13e4-4be7-9f08-5bdd43179b3b
title: Group Policy, Shortcut Extensions, and Internet Explorer 11 (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/group-policy-windows-powershell-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/group-policy-windows-powershell-ie11.md
index ccf390f9e1..c262a303fd 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/group-policy-windows-powershell-ie11.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/group-policy-windows-powershell-ie11.md
@@ -8,6 +8,7 @@ ms.prod: ie11
ms.assetid: e3607cde-a498-4e04-9daa-b331412967fc
title: Group Policy, Windows Powershell, and Internet Explorer 11 (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/img-ie11-docmode-lg.md b/browsers/internet-explorer/ie11-deploy-guide/img-ie11-docmode-lg.md
index 7550de81b9..609f525151 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/img-ie11-docmode-lg.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/img-ie11-docmode-lg.md
@@ -2,6 +2,7 @@
description: A full-sized view of how document modes are chosen in IE11.
title: Full-sized flowchart detailing how document modes are chosen in IE11
author: eross-msft
+ms.date: 04/19/2017
---
Return to: [Deprecated document modes and Internet Explorer 11](deprecated-document-modes.md)
diff --git a/browsers/internet-explorer/ie11-deploy-guide/import-into-the-enterprise-mode-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/import-into-the-enterprise-mode-site-list-manager.md
index 921273e4e7..886721387e 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/import-into-the-enterprise-mode-site-list-manager.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/import-into-the-enterprise-mode-site-list-manager.md
@@ -8,6 +8,7 @@ ms.prod: ie11
ms.assetid: cacd5d68-700b-4a96-b4c9-ca2c40c1ac5f
title: Import your Enterprise Mode site list to the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/index.md b/browsers/internet-explorer/ie11-deploy-guide/index.md
index 4f7924e1da..79150cc05c 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/index.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/index.md
@@ -7,6 +7,7 @@ ms.assetid: bddc2d97-c38d-45c5-9588-1f5bbff2e9c3
title: Internet Explorer 11 (IE11) - Deployment Guide for IT Pros (Internet Explorer 11 for IT Pros)
ms.sitesec: library
ms.localizationpriority: low
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/install-and-deploy-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/install-and-deploy-ie11.md
index a6ba3a7bb6..5d114ace45 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/install-and-deploy-ie11.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/install-and-deploy-ie11.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: caca18c1-d5c4-4404-84f8-d02bc562915f
title: Install and Deploy Internet Explorer 11 (IE11) (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-microsoft-intune.md b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-microsoft-intune.md
index 17ac01f346..9acf8fd693 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-microsoft-intune.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-microsoft-intune.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: b2dfc08c-78af-4c22-8867-7be3b92b1616
title: Install Internet Explorer 11 (IE11) using Microsoft Intune (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-operating-system-deployment-systems.md b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-operating-system-deployment-systems.md
index 6281115099..ee56fa3c64 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-operating-system-deployment-systems.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-operating-system-deployment-systems.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: e16f9144-170c-4964-a62d-0d1a16f4cd1f
title: Install Internet Explorer 11 (IE11) using Microsoft Deployment Toolkit (MDT) and your Windows images (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-system-center-configuration-manager.md b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-system-center-configuration-manager.md
index 783308e29a..9153cdfb6f 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-system-center-configuration-manager.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-system-center-configuration-manager.md
@@ -8,6 +8,7 @@ ms.prod: ie11
ms.assetid: 9ede9722-29b3-4cb7-956d-ffa91e7bedbd
title: Install Internet Explorer 11 (IE11) using System Center 2012 R2 Configuration Manager (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-the-network.md b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-the-network.md
index bd7c36ded8..4d4a9a3cee 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-the-network.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-the-network.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: 85f6429d-947a-4031-8f93-e26110a35828
title: Install Internet Explorer 11 (IE11) using your network (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-third-party-tools.md b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-third-party-tools.md
index 4f2f21d001..88a9864342 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-third-party-tools.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-third-party-tools.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: 30190c66-49f7-4ca4-8b57-a47656aa0c7e
title: Install Internet Explorer 11 (IE11) using third-party tools (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-windows-server-update-services-wsus.md b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-windows-server-update-services-wsus.md
index c7ea390ba5..6f2a1b756b 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-windows-server-update-services-wsus.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-windows-server-update-services-wsus.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: 6cbd6797-c670-4236-8423-e0919478f2ce
title: Install Internet Explorer 11 (IE11) using Windows Server Update Services (WSUS) (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/install-problems-with-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/install-problems-with-ie11.md
index 3cefac76d0..178528e352 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/install-problems-with-ie11.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/install-problems-with-ie11.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: 3ae77745-86ac-40a9-a37d-eebbf37661a3
title: Install problems with Internet Explorer 11 (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/intranet-problems-and-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/intranet-problems-and-ie11.md
index 815918068a..6912fc0568 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/intranet-problems-and-ie11.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/intranet-problems-and-ie11.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: 3ee71d93-d9d2-48e1-899e-07932c73faa6
title: Fix intranet search problems with Internet Explorer 11 (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/manage-ie11-overview.md b/browsers/internet-explorer/ie11-deploy-guide/manage-ie11-overview.md
index a50b6b626c..24f70c2132 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/manage-ie11-overview.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/manage-ie11-overview.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: eb3cce62-fc7b-41e3-97b6-2916b85bcf55
title: Manage Internet Explorer 11 (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/missing-internet-explorer-maintenance-settings-for-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/missing-internet-explorer-maintenance-settings-for-ie11.md
index e9b77343c8..6a9333717f 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/missing-internet-explorer-maintenance-settings-for-ie11.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/missing-internet-explorer-maintenance-settings-for-ie11.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: 89084e01-4e3f-46a6-b90e-48ee58d6821c
title: Missing Internet Explorer Maintenance settings for Internet Explorer 11 (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/missing-the-compatibility-view-button.md b/browsers/internet-explorer/ie11-deploy-guide/missing-the-compatibility-view-button.md
index 48920354dc..02bae6d9ba 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/missing-the-compatibility-view-button.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/missing-the-compatibility-view-button.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: 501c96c9-9f03-4913-9f4b-f67bd9edbb61
title: Missing the Compatibility View Button (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/net-framework-problems-with-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/net-framework-problems-with-ie11.md
index b346d9663e..2bc8d0a284 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/net-framework-problems-with-ie11.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/net-framework-problems-with-ie11.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: b0b7f60f-9099-45ab-84f4-4ac64d7bcb43
title: .NET Framework problems with Internet Explorer 11 (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/new-group-policy-settings-for-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/new-group-policy-settings-for-ie11.md
index 549d485a7d..c484e544ab 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/new-group-policy-settings-for-ie11.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/new-group-policy-settings-for-ie11.md
@@ -8,6 +8,7 @@ ms.prod: ie11
ms.assetid: 669cc1a6-e2cb-403f-aa31-c1de52a615d1
title: New group policy settings for Internet Explorer 11 (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/out-of-date-activex-control-blocking.md b/browsers/internet-explorer/ie11-deploy-guide/out-of-date-activex-control-blocking.md
index 812ea91600..7bd0c006f9 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/out-of-date-activex-control-blocking.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/out-of-date-activex-control-blocking.md
@@ -8,6 +8,7 @@ ms.prod: ie11
ms.assetid: e61866bb-1ff1-4a8d-96f2-61d3534e8199
title: Out-of-date ActiveX control blocking (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/problems-after-installing-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/problems-after-installing-ie11.md
index 058f277137..39ff7286c9 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/problems-after-installing-ie11.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/problems-after-installing-ie11.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: c4b75ad3-9c4a-4dd2-9fed-69f776f542e6
title: Problems after installing Internet Explorer 11 (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 10/16/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/remove-all-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/remove-all-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md
index 006b713c0d..963880eb75 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/remove-all-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/remove-all-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md
@@ -8,6 +8,7 @@ ms.prod: ie11
ms.assetid: 90f38a6c-e0e2-4c93-9a9e-c425eca99e97
title: Remove all sites from your Enterprise Mode site list using the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/remove-sites-from-a-local-compatibililty-view-list.md b/browsers/internet-explorer/ie11-deploy-guide/remove-sites-from-a-local-compatibililty-view-list.md
index 281568ca5a..546fe2133e 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/remove-sites-from-a-local-compatibililty-view-list.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/remove-sites-from-a-local-compatibililty-view-list.md
@@ -8,6 +8,7 @@ ms.prod: ie11
ms.assetid: f6ecaa75-ebcb-4f8d-8721-4cd6e73c0ac9
title: Remove sites from a local compatibility view list (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/remove-sites-from-a-local-enterprise-mode-site-list.md b/browsers/internet-explorer/ie11-deploy-guide/remove-sites-from-a-local-enterprise-mode-site-list.md
index 58d4be5197..8b15e9ddd5 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/remove-sites-from-a-local-enterprise-mode-site-list.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/remove-sites-from-a-local-enterprise-mode-site-list.md
@@ -8,6 +8,7 @@ ms.prod: ie11
ms.assetid: c7d6dd0b-e264-42bb-8c9d-ac2f837018d2
title: Remove sites from a local Enterprise Mode site list (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/save-your-site-list-to-xml-in-the-enterprise-mode-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/save-your-site-list-to-xml-in-the-enterprise-mode-site-list-manager.md
index 173cc8e6ae..7ec1867c5b 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/save-your-site-list-to-xml-in-the-enterprise-mode-site-list-manager.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/save-your-site-list-to-xml-in-the-enterprise-mode-site-list-manager.md
@@ -8,6 +8,7 @@ ms.prod: ie11
ms.assetid: 254a986b-494f-4316-92c1-b089ee8b3e0a
title: Save your site list to XML in the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/schedule-production-change-enterprise-mode-portal.md b/browsers/internet-explorer/ie11-deploy-guide/schedule-production-change-enterprise-mode-portal.md
index f2e75998a0..f49ad80a75 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/schedule-production-change-enterprise-mode-portal.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/schedule-production-change-enterprise-mode-portal.md
@@ -7,6 +7,7 @@ author: eross-msft
ms.prod: ie11
title: Schedule approved change requests for production using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
# Schedule approved change requests for production using the Enterprise Mode Site List Portal
diff --git a/browsers/internet-explorer/ie11-deploy-guide/search-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/search-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md
index 88a167124d..5292cf3570 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/search-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/search-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md
@@ -8,6 +8,7 @@ ms.prod: ie11
ms.assetid: e399aeaf-6c3b-4cad-93c9-813df6ad47f9
title: Search your Enterprise Mode site list in the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/set-the-default-browser-using-group-policy.md b/browsers/internet-explorer/ie11-deploy-guide/set-the-default-browser-using-group-policy.md
index 734c2d3528..899c3da6e3 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/set-the-default-browser-using-group-policy.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/set-the-default-browser-using-group-policy.md
@@ -8,6 +8,7 @@ ms.prod: ie11
ms.assetid: f486c9db-0dc9-4cd6-8a0b-8cb872b1d361
title: Set the default browser using Group Policy (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-logging-and-data-collection.md b/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-logging-and-data-collection.md
index 4090e6204f..bfb9659bd0 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-logging-and-data-collection.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-logging-and-data-collection.md
@@ -8,6 +8,7 @@ ms.prod: ie11
ms.assetid: 2e98a280-f677-422f-ba2e-f670362afcde
title: Set up Enterprise Mode logging and data collection (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-portal.md b/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-portal.md
index 589b6569fd..0aca62e070 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-portal.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-portal.md
@@ -7,6 +7,7 @@ author: eross-msft
ms.prod: ie11
title: Set up the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
# Set up the Enterprise Mode Site List Portal
diff --git a/browsers/internet-explorer/ie11-deploy-guide/setup-problems-with-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/setup-problems-with-ie11.md
index 4a466fb09f..a5f7888b6a 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/setup-problems-with-ie11.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/setup-problems-with-ie11.md
@@ -8,6 +8,7 @@ ms.prod: ie11
ms.assetid: 2cd79988-17d1-4317-bee9-b3ae2dd110a0
title: Setup problems with Internet Explorer 11 (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/system-requirements-and-language-support-for-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/system-requirements-and-language-support-for-ie11.md
index dde74d8390..c756e654f2 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/system-requirements-and-language-support-for-ie11.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/system-requirements-and-language-support-for-ie11.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: 27185e3d-c486-4e4a-9c51-5cb317c0006d
title: System requirements and language support for Internet Explorer 11 (IE11) (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/troubleshoot-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/troubleshoot-ie11.md
index 48b4ca2166..145aa1c678 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/troubleshoot-ie11.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/troubleshoot-ie11.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: 0361c1a6-3faa-42b2-a588-92439eebeeab
title: Troubleshoot Internet Explorer 11 (IE11) (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/turn-off-enterprise-mode.md b/browsers/internet-explorer/ie11-deploy-guide/turn-off-enterprise-mode.md
index 3547f5a51e..12a4ee7ffd 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/turn-off-enterprise-mode.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/turn-off-enterprise-mode.md
@@ -8,6 +8,7 @@ ms.prod: ie11
ms.assetid: 5027c163-71e0-49b8-9dc0-f0a7310c7ae3
title: Turn off Enterprise Mode (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/turn-off-natural-metrics.md b/browsers/internet-explorer/ie11-deploy-guide/turn-off-natural-metrics.md
index 24332033a5..15e7a25f21 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/turn-off-natural-metrics.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/turn-off-natural-metrics.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: e31a27d7-662e-4106-a3d2-c6b0531961d5
title: Fix font rendering problems by turning off natural metrics (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list.md b/browsers/internet-explorer/ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list.md
index fbf438a035..c84927f98c 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list.md
@@ -8,7 +8,7 @@ ms.pagetype: appcompat
ms.sitesec: library
author: eross-msft
ms.author: lizross
-ms.date: 08/11/2017
+ms.date: 08/14/2017
ms.localizationpriority: low
diff --git a/browsers/internet-explorer/ie11-deploy-guide/turn-on-local-control-and-logging-for-enterprise-mode.md b/browsers/internet-explorer/ie11-deploy-guide/turn-on-local-control-and-logging-for-enterprise-mode.md
index 32e4dc1a7b..0f5ff8d1f9 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/turn-on-local-control-and-logging-for-enterprise-mode.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/turn-on-local-control-and-logging-for-enterprise-mode.md
@@ -8,6 +8,7 @@ ms.prod: ie11
ms.assetid: 6622ecce-24b1-497e-894a-e1fd5a8a66d1
title: Turn on local control and logging for Enterprise Mode (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/updated-features-and-tools-with-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/updated-features-and-tools-with-ie11.md
index b3d5c7bda5..9d2835bb5e 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/updated-features-and-tools-with-ie11.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/updated-features-and-tools-with-ie11.md
@@ -8,6 +8,7 @@ ms.prod: ie11
ms.assetid: f53c6f04-7c60-40e7-9fc5-312220f08156
title: List of updated features and tools - Internet Explorer 11 (IE11) (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/use-the-enterprise-mode-portal.md b/browsers/internet-explorer/ie11-deploy-guide/use-the-enterprise-mode-portal.md
index 55e577f222..d57c5f411b 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/use-the-enterprise-mode-portal.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/use-the-enterprise-mode-portal.md
@@ -6,6 +6,7 @@ description: Use the topics in this section to learn about how to use the Enterp
ms.prod: ie11
title: Use the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
# Use the Enterprise Mode Site List Portal
diff --git a/browsers/internet-explorer/ie11-deploy-guide/use-the-enterprise-mode-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/use-the-enterprise-mode-site-list-manager.md
index 35f92c7b1c..166e02285f 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/use-the-enterprise-mode-site-list-manager.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/use-the-enterprise-mode-site-list-manager.md
@@ -8,6 +8,7 @@ ms.prod: ie11
ms.assetid: f4dbed4c-08ff-40b1-ab3f-60d3b6e8ec9b
title: Use the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 12/04/2017
---
@@ -28,10 +29,10 @@ You can use IE11 and the Enterprise Mode Site List Manager to add individual web
## Enterprise Mode Site List Manager versions
There are currently two versions of the Enterprise Site List Manager, both based on your schema and operating system. Download the [Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) or the [Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) tool, based on your operating system.
-|Operating system |Schema version |Enterprise Site List Manager version |
+|Schema version |Operating system |Enterprise Site List Manager version |
|-----------------|---------------|------------------------------------|
-|Windows 10 |Enterprise Mode schema, version 2 (v.2)
-OR-
Enterprise Mode schema, version 1 (v.1) |Windows 10 supports both versions of the enterprise mode schema. However, the Enterprise Mode Site List Manager (schema v.2) only supports the v.2 version of the schema. If you import a v.1 version schema into the Enterprise Mode Site List Manager (schema v.2), it will save the XML into the v.2 version of the schema.
For more info about the different schema versions, see [Enterprise Mode schema v.2 guidance](enterprise-mode-schema-version-2-guidance.md) |
-|Windows 7
-OR-
Windows 8.1 |Enterprise Mode schema v.1 |Uses the Enterprise Mode Site List Manager (schema v.1).
For more info about the different schema versions, see [Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md) |
+|Enterprise Mode schema, version 2 (v.2) |Windows 10 -OR- Windows 8.1 -OR- Windows 7|Uses the Enterprise Mode Site List Manager (schema v.2) and the v.2 version of the schema. If you import a v.1 version schema into the Enterprise Mode Site List Manager (schema v.2), the XML is saved into the v.2 version of the schema.
For more info about the v.2 version of the schema, see [Enterprise Mode schema v.2 guidance](enterprise-mode-schema-version-2-guidance.md).|
+|Enterprise Mode schema, version 1 (v.1) |Windows 10 -OR- Windows 8.1 -OR- Windows 7|Uses the Enterprise Mode Site List Manager (schema v.1) and the v.1 version of the schema.
For more info about the v.1 version of the schema, see [Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md)|
## Using the Enterprise Mode Site List Manager
The following topics give you more information about the things that you can do with the Enterprise Mode Site List Manager.
diff --git a/browsers/internet-explorer/ie11-deploy-guide/user-interface-problems-with-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/user-interface-problems-with-ie11.md
index 2a1c9fc1fe..1db6c00d44 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/user-interface-problems-with-ie11.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/user-interface-problems-with-ie11.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: 7324faff-ccb6-4e14-ad91-af12dbca575e
title: User interface problems with Internet Explorer 11 (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/using-enterprise-mode.md b/browsers/internet-explorer/ie11-deploy-guide/using-enterprise-mode.md
index 3eec3b0b6b..313a07e8e8 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/using-enterprise-mode.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/using-enterprise-mode.md
@@ -8,6 +8,7 @@ ms.prod: ie11
ms.assetid: 238ead3d-8920-429a-ac23-02f089c4384a
title: Using IE7 Enterprise Mode or IE8 Enterprise Mode (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/using-ieak11-to-create-install-packages.md b/browsers/internet-explorer/ie11-deploy-guide/using-ieak11-to-create-install-packages.md
index 2fefd87543..b86a7c45c5 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/using-ieak11-to-create-install-packages.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/using-ieak11-to-create-install-packages.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: af93742f-f955-44ab-bfa2-7bf0c99045d3
title: Using Internet Explorer Administration Kit 11 (IEAK 11) to create packages (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/using-inf-files-to-create-install-packages.md b/browsers/internet-explorer/ie11-deploy-guide/using-inf-files-to-create-install-packages.md
index e0f6bb66c8..16d9272749 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/using-inf-files-to-create-install-packages.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/using-inf-files-to-create-install-packages.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: 04fa2ba8-8d84-4af6-ab99-77e4f1961b0e
title: Using Setup Information (.inf) files to create packages (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/verify-changes-preprod-enterprise-mode-portal.md b/browsers/internet-explorer/ie11-deploy-guide/verify-changes-preprod-enterprise-mode-portal.md
index 3d375dbc9e..94de88ee4e 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/verify-changes-preprod-enterprise-mode-portal.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/verify-changes-preprod-enterprise-mode-portal.md
@@ -7,6 +7,7 @@ author: eross-msft
ms.prod: ie11
title: Verify your changes using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
# Verify your changes using the Enterprise Mode Site List Portal
diff --git a/browsers/internet-explorer/ie11-deploy-guide/verify-changes-production-enterprise-mode-portal.md b/browsers/internet-explorer/ie11-deploy-guide/verify-changes-production-enterprise-mode-portal.md
index c0eb8995ed..00fb099e3f 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/verify-changes-production-enterprise-mode-portal.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/verify-changes-production-enterprise-mode-portal.md
@@ -7,6 +7,7 @@ author: eross-msft
ms.prod: ie11
title: Verify the change request update in the production environment using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
# Verify the change request update in the production environment using the Enterprise Mode Site List Portal
diff --git a/browsers/internet-explorer/ie11-deploy-guide/view-apps-enterprise-mode-site-list.md b/browsers/internet-explorer/ie11-deploy-guide/view-apps-enterprise-mode-site-list.md
index 6408a81893..29d1d8afe9 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/view-apps-enterprise-mode-site-list.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/view-apps-enterprise-mode-site-list.md
@@ -7,6 +7,7 @@ author: eross-msft
ms.prod: ie11
title: View the apps included in the active Enterprise Mode Site List from the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
# View the apps included in the active Enterprise Mode Site List from the Enterprise Mode Site List Portal
diff --git a/browsers/internet-explorer/ie11-deploy-guide/view-enterprise-mode-reports-for-portal.md b/browsers/internet-explorer/ie11-deploy-guide/view-enterprise-mode-reports-for-portal.md
index 19789bc48b..f7407d28f6 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/view-enterprise-mode-reports-for-portal.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/view-enterprise-mode-reports-for-portal.md
@@ -7,6 +7,7 @@ author: eross-msft
ms.prod: ie11
title: View the available Enterprise Mode reports from the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
# View the available Enterprise Mode reports from the Enterprise Mode Site List Portal
diff --git a/browsers/internet-explorer/ie11-deploy-guide/virtualization-and-compatibility-with-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/virtualization-and-compatibility-with-ie11.md
index bfd4682de3..f1e4f5365d 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/virtualization-and-compatibility-with-ie11.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/virtualization-and-compatibility-with-ie11.md
@@ -8,6 +8,7 @@ ms.prod: ie11
ms.assetid: b0388c04-2584-4b6d-a7a8-4e0476773a80
title: Virtualization and compatibility with Internet Explorer 11 (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/what-is-enterprise-mode.md b/browsers/internet-explorer/ie11-deploy-guide/what-is-enterprise-mode.md
index 57ef5c82da..7c4b70d2bf 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/what-is-enterprise-mode.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/what-is-enterprise-mode.md
@@ -8,6 +8,7 @@ ms.prod: ie11
ms.assetid: 3c77e9f3-eb21-46d9-b5aa-f9b2341cfefa
title: Enterprise Mode and the Enterprise Mode Site List (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 12/04/2017
---
@@ -37,7 +38,7 @@ Based on the size of your legacy web app dependency, determined by the data coll
For more info about when to use which option, and which option is best for you, see the [Continuing to make it easier for Enterprise customers to upgrade to Internet Explorer 11 — and Windows 10](https://blogs.windows.com/msedgedev/2015/11/23/windows-10-1511-enterprise-improvements) blog.
## What is Enterprise Mode?
-Enterprise Mode, a compatibility mode that runs on Internet Explorer 11 on Windows 10 devices, lets websites render using a modified browser configuration that’s designed to emulate either Windows Internet Explorer 7 or Windows Internet Explorer 8, avoiding the common compatibility problems associated with web apps written and tested on older versions of Internet Explorer.
+Enterprise Mode, a compatibility mode that runs on Internet Explorer 11 on Windows 10, Windows 8.1, and Windows 7 devices, lets websites render using a modified browser configuration that’s designed to emulate either Windows Internet Explorer 7 or Windows Internet Explorer 8. Running in this mode helps to avoid many of the common compatibility problems associated with web apps written and tested on older versions of Internet Explorer.
Many customers identify web app compatibility as a significant cost to upgrading because web apps need to be tested and upgraded before adopting a new browser. The improved compatibility provided by Enterprise Mode can help give customers confidence to upgrade to IE11, letting customers benefit from modern web standards, increased performance, improved security, and better reliability.
@@ -163,4 +164,4 @@ Because the tool is open-source, the source code is readily available for examin
- [Microsoft Services Support](https://www.microsoft.com/en-us/microsoftservices/support.aspx)
-- [Find a Microsoft partner on Pinpoint](https://partnercenter.microsoft.com/pcv/search)
\ No newline at end of file
+- [Find a Microsoft partner on Pinpoint](https://partnercenter.microsoft.com/pcv/search)
diff --git a/browsers/internet-explorer/ie11-deploy-guide/what-is-the-internet-explorer-11-blocker-toolkit.md b/browsers/internet-explorer/ie11-deploy-guide/what-is-the-internet-explorer-11-blocker-toolkit.md
index 570bd3b72b..ea04329097 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/what-is-the-internet-explorer-11-blocker-toolkit.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/what-is-the-internet-explorer-11-blocker-toolkit.md
@@ -8,6 +8,7 @@ ms.prod: ie11
ms.assetid: fafeaaee-171c-4450-99f7-5cc7f8d7ba91
title: What is the Internet Explorer 11 Blocker Toolkit? (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-deploy-guide/workflow-processes-enterprise-mode-portal.md b/browsers/internet-explorer/ie11-deploy-guide/workflow-processes-enterprise-mode-portal.md
index f0e1333a10..02d3275c5c 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/workflow-processes-enterprise-mode-portal.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/workflow-processes-enterprise-mode-portal.md
@@ -7,6 +7,7 @@ author: eross-msft
ms.prod: ie11
title: Workflow-based processes for employees using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-faq/faq-for-it-pros-ie11.md b/browsers/internet-explorer/ie11-faq/faq-for-it-pros-ie11.md
index c403f68d94..9d9574cd8a 100644
--- a/browsers/internet-explorer/ie11-faq/faq-for-it-pros-ie11.md
+++ b/browsers/internet-explorer/ie11-faq/faq-for-it-pros-ie11.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: 140e7d33-584a-44da-8c68-6c1d568e1de3
title: Internet Explorer 11 - FAQ for IT Pros (Internet Explorer 11 for IT Pros)
ms.sitesec: library
+ms.date: 10/16/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/accelerators-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/accelerators-ieak11-wizard.md
index dc8a3b1dd6..ef7b62be89 100644
--- a/browsers/internet-explorer/ie11-ieak/accelerators-ieak11-wizard.md
+++ b/browsers/internet-explorer/ie11-ieak/accelerators-ieak11-wizard.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: 208305ad-1bcd-42f3-aca3-0ad1dda7048b
title: Use the Accelerators page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/add-and-approve-activex-controls-ieak11.md b/browsers/internet-explorer/ie11-ieak/add-and-approve-activex-controls-ieak11.md
index 70d6fb8c90..e5159000fc 100644
--- a/browsers/internet-explorer/ie11-ieak/add-and-approve-activex-controls-ieak11.md
+++ b/browsers/internet-explorer/ie11-ieak/add-and-approve-activex-controls-ieak11.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: 33040bd1-f0e4-4541-9fbb-16e0c76752ab
title: Add and approve ActiveX controls using IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/add-root-certificate-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/add-root-certificate-ieak11-wizard.md
index 1d2860516a..d7ec6692b6 100644
--- a/browsers/internet-explorer/ie11-ieak/add-root-certificate-ieak11-wizard.md
+++ b/browsers/internet-explorer/ie11-ieak/add-root-certificate-ieak11-wizard.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: 7ae4e747-49d2-4551-8790-46a61b5fe838
title: Use the Add a Root Certificate page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/additional-settings-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/additional-settings-ieak11-wizard.md
index 8556b6edd2..48566257bc 100644
--- a/browsers/internet-explorer/ie11-ieak/additional-settings-ieak11-wizard.md
+++ b/browsers/internet-explorer/ie11-ieak/additional-settings-ieak11-wizard.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: c90054af-7b7f-4b00-b55b-5e5569f65f25
title: Use the Additional Settings page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/auto-config-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/auto-config-ieak11-wizard.md
index b17332600a..37a45e2b99 100644
--- a/browsers/internet-explorer/ie11-ieak/auto-config-ieak11-wizard.md
+++ b/browsers/internet-explorer/ie11-ieak/auto-config-ieak11-wizard.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: de5b1dbf-6e4d-4f86-ae08-932f14e606b0
title: Use the Automatic Configuration page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/auto-detection-dhcp-or-dns-servers-ieak11.md b/browsers/internet-explorer/ie11-ieak/auto-detection-dhcp-or-dns-servers-ieak11.md
index 6c653f08fc..b44afa30dd 100644
--- a/browsers/internet-explorer/ie11-ieak/auto-detection-dhcp-or-dns-servers-ieak11.md
+++ b/browsers/internet-explorer/ie11-ieak/auto-detection-dhcp-or-dns-servers-ieak11.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: c6bfe7c4-f452-406f-b47e-b7f0d8c44ae1
title: Set up auto detection for DHCP or DNS servers using IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/auto-version-sync-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/auto-version-sync-ieak11-wizard.md
index c8ad903c3a..08a43eb829 100644
--- a/browsers/internet-explorer/ie11-ieak/auto-version-sync-ieak11-wizard.md
+++ b/browsers/internet-explorer/ie11-ieak/auto-version-sync-ieak11-wizard.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: bfc7685f-843b-49c3-8b9b-07e69705840c
title: Use the Automatic Version Synchronization page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/before-you-create-custom-pkgs-ieak11.md b/browsers/internet-explorer/ie11-ieak/before-you-create-custom-pkgs-ieak11.md
index c25d42016e..d8c5cb0595 100644
--- a/browsers/internet-explorer/ie11-ieak/before-you-create-custom-pkgs-ieak11.md
+++ b/browsers/internet-explorer/ie11-ieak/before-you-create-custom-pkgs-ieak11.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: 6ed182b0-46cb-4865-9563-70825be9a5e4
title: Before you start using IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/branding-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/branding-ins-file-setting.md
index 279fa2b311..08ee07f8b4 100644
--- a/browsers/internet-explorer/ie11-ieak/branding-ins-file-setting.md
+++ b/browsers/internet-explorer/ie11-ieak/branding-ins-file-setting.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: cde600c6-29cf-4bd3-afd1-21563d2642df
title: Use the Branding .INS file to create custom branding and setup info (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/browser-ui-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/browser-ui-ieak11-wizard.md
index 1862eda60d..6ac05013ef 100644
--- a/browsers/internet-explorer/ie11-ieak/browser-ui-ieak11-wizard.md
+++ b/browsers/internet-explorer/ie11-ieak/browser-ui-ieak11-wizard.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: c4a18dcd-2e9c-4b5b-bcc5-9b9361a79f0d
title: Use the Browser User Interface page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/browsertoolbars-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/browsertoolbars-ins-file-setting.md
index e06625af10..0bd9e797de 100644
--- a/browsers/internet-explorer/ie11-ieak/browsertoolbars-ins-file-setting.md
+++ b/browsers/internet-explorer/ie11-ieak/browsertoolbars-ins-file-setting.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: 83af0558-9df3-4c2e-9350-44f7788efa6d
title: Use the BrowserToolbars .INS file to customize the Internet Explorer toolbar and buttons (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/browsing-options-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/browsing-options-ieak11-wizard.md
index d3d191860d..bb57b71af9 100644
--- a/browsers/internet-explorer/ie11-ieak/browsing-options-ieak11-wizard.md
+++ b/browsers/internet-explorer/ie11-ieak/browsing-options-ieak11-wizard.md
@@ -7,6 +7,7 @@ ms.prod: ie111
ms.assetid: d6bd71ba-5df3-4b8c-8bb5-dcbc50fd974e
title: Use the Browsing Options page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/cabsigning-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/cabsigning-ins-file-setting.md
index 0ae82866c4..1f1568989d 100644
--- a/browsers/internet-explorer/ie11-ieak/cabsigning-ins-file-setting.md
+++ b/browsers/internet-explorer/ie11-ieak/cabsigning-ins-file-setting.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: 098707e9-d712-4297-ac68-7d910ca8f43b
title: Use the CabSigning .INS file to customize the digital signature info for your apps (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/compat-view-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/compat-view-ieak11-wizard.md
index 12383d14d1..d1b7a58fc8 100644
--- a/browsers/internet-explorer/ie11-ieak/compat-view-ieak11-wizard.md
+++ b/browsers/internet-explorer/ie11-ieak/compat-view-ieak11-wizard.md
@@ -8,6 +8,7 @@ ms.prod: ie11
ms.assetid: 51d8f80e-93a5-41e4-9478-b8321458bc30
title: Use the Compatibility View page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/connection-mgr-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/connection-mgr-ieak11-wizard.md
index 2f256e9354..caff7eef0b 100644
--- a/browsers/internet-explorer/ie11-ieak/connection-mgr-ieak11-wizard.md
+++ b/browsers/internet-explorer/ie11-ieak/connection-mgr-ieak11-wizard.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: 1edaa7db-cf6b-4f94-b65f-0feff3d4081a
title: Use the Connection Manager page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/connection-settings-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/connection-settings-ieak11-wizard.md
index a2eaa01f8f..188bf23d91 100644
--- a/browsers/internet-explorer/ie11-ieak/connection-settings-ieak11-wizard.md
+++ b/browsers/internet-explorer/ie11-ieak/connection-settings-ieak11-wizard.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: dc93ebf7-37dc-47c7-adc3-067d07de8b78
title: Use the Connection Settings page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/connectionsettings-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/connectionsettings-ins-file-setting.md
index cad1e630c5..e62028f5b1 100644
--- a/browsers/internet-explorer/ie11-ieak/connectionsettings-ins-file-setting.md
+++ b/browsers/internet-explorer/ie11-ieak/connectionsettings-ins-file-setting.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: 41410300-6ddd-43b2-b9e2-0108a2221355
title: Use the ConnectionSettings .INS file to review the network connections for install (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/create-build-folder-structure-ieak11.md b/browsers/internet-explorer/ie11-ieak/create-build-folder-structure-ieak11.md
index 142e588090..7c8092e8e7 100644
--- a/browsers/internet-explorer/ie11-ieak/create-build-folder-structure-ieak11.md
+++ b/browsers/internet-explorer/ie11-ieak/create-build-folder-structure-ieak11.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: e0d05a4c-099f-4f79-a069-4aa1c28a1080
title: Create the build computer folder structure using IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/create-manage-deploy-custom-pkgs-ieak11.md b/browsers/internet-explorer/ie11-ieak/create-manage-deploy-custom-pkgs-ieak11.md
index 0a455e71be..064abc480c 100644
--- a/browsers/internet-explorer/ie11-ieak/create-manage-deploy-custom-pkgs-ieak11.md
+++ b/browsers/internet-explorer/ie11-ieak/create-manage-deploy-custom-pkgs-ieak11.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: fe71c603-bf07-41e1-a477-ade5b28c9fb3
title: Tasks and references to consider before creating and deploying custom packages using IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/create-multiple-browser-packages-ieak11.md b/browsers/internet-explorer/ie11-ieak/create-multiple-browser-packages-ieak11.md
index 8657bcb1fb..b90fa80eca 100644
--- a/browsers/internet-explorer/ie11-ieak/create-multiple-browser-packages-ieak11.md
+++ b/browsers/internet-explorer/ie11-ieak/create-multiple-browser-packages-ieak11.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: 4c5f3503-8c69-4691-ae97-1523091ab333
title: Create multiple versions of your custom package using IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/create-uninstall-inf-files-for-custom-components.md b/browsers/internet-explorer/ie11-ieak/create-uninstall-inf-files-for-custom-components.md
index 90ad44025b..857f487d7f 100644
--- a/browsers/internet-explorer/ie11-ieak/create-uninstall-inf-files-for-custom-components.md
+++ b/browsers/internet-explorer/ie11-ieak/create-uninstall-inf-files-for-custom-components.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: 8257aa41-58de-4339-81dd-9f2ffcc10a08
title: Use Setup information (.inf) files to uninstall custom components (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/custom-components-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/custom-components-ieak11-wizard.md
index baa1c3fc79..16614c697a 100644
--- a/browsers/internet-explorer/ie11-ieak/custom-components-ieak11-wizard.md
+++ b/browsers/internet-explorer/ie11-ieak/custom-components-ieak11-wizard.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: 38a2b90f-c324-4dc8-ad30-8cd3e3e901d7
title: Use the Custom Components page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/custombranding-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/custombranding-ins-file-setting.md
index 5ea1931ea9..7cba88970a 100644
--- a/browsers/internet-explorer/ie11-ieak/custombranding-ins-file-setting.md
+++ b/browsers/internet-explorer/ie11-ieak/custombranding-ins-file-setting.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: 9c74e239-65c5-4aa5-812f-e0ed80c5c2b0
title: Use the CustomBranding .INS file to create custom branding and setup info (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/customize-automatic-search-for-ie.md b/browsers/internet-explorer/ie11-ieak/customize-automatic-search-for-ie.md
index 68231a4a67..80cee645af 100644
--- a/browsers/internet-explorer/ie11-ieak/customize-automatic-search-for-ie.md
+++ b/browsers/internet-explorer/ie11-ieak/customize-automatic-search-for-ie.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: 694e2f92-5e08-49dc-b83f-677d61fa918a
title: Customize Automatic Search using IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/extreginf-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/extreginf-ins-file-setting.md
index 6b5cfadd74..6313b77ce4 100644
--- a/browsers/internet-explorer/ie11-ieak/extreginf-ins-file-setting.md
+++ b/browsers/internet-explorer/ie11-ieak/extreginf-ins-file-setting.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: 53148422-d784-44dc-811d-ef814b86a4c6
title: Use the ExtRegInf .INS file to specify your installation files and mode (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/favorites-favoritesbar-and-feeds-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/favorites-favoritesbar-and-feeds-ieak11-wizard.md
index 41b6867002..ab4693d199 100644
--- a/browsers/internet-explorer/ie11-ieak/favorites-favoritesbar-and-feeds-ieak11-wizard.md
+++ b/browsers/internet-explorer/ie11-ieak/favorites-favoritesbar-and-feeds-ieak11-wizard.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: 84afa831-5642-4b8f-b7df-212a53ec8fc7
title: Use the Favorites, Favorites Bar, and Feeds page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/favoritesex-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/favoritesex-ins-file-setting.md
index a3a9197a05..90775765d1 100644
--- a/browsers/internet-explorer/ie11-ieak/favoritesex-ins-file-setting.md
+++ b/browsers/internet-explorer/ie11-ieak/favoritesex-ins-file-setting.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: 55de376a-d442-478e-8978-3b064407b631
title: Use the FavoritesEx .INS file for your Favorites icon and URLs (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/feature-selection-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/feature-selection-ieak11-wizard.md
index a842d3aea4..66412ddd7b 100644
--- a/browsers/internet-explorer/ie11-ieak/feature-selection-ieak11-wizard.md
+++ b/browsers/internet-explorer/ie11-ieak/feature-selection-ieak11-wizard.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: 9cb8324e-d73b-41ba-ade9-3acc796e21d8
title: Use the Feature Selection page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/file-locations-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/file-locations-ieak11-wizard.md
index 6192ecb053..fa1550cab1 100644
--- a/browsers/internet-explorer/ie11-ieak/file-locations-ieak11-wizard.md
+++ b/browsers/internet-explorer/ie11-ieak/file-locations-ieak11-wizard.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: bd0620e1-0e07-4560-95ac-11888c2c389e
title: Use the File Locations page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/file-types-ieak11.md b/browsers/internet-explorer/ie11-ieak/file-types-ieak11.md
index b77750a229..6dcbc164e7 100644
--- a/browsers/internet-explorer/ie11-ieak/file-types-ieak11.md
+++ b/browsers/internet-explorer/ie11-ieak/file-types-ieak11.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: e5735074-3e9b-4a00-b1a7-b8fd8baca327
title: File types used or created by IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/first-run-and-welcome-page-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/first-run-and-welcome-page-ieak11-wizard.md
index 3ce8f21b44..76e5afbc12 100644
--- a/browsers/internet-explorer/ie11-ieak/first-run-and-welcome-page-ieak11-wizard.md
+++ b/browsers/internet-explorer/ie11-ieak/first-run-and-welcome-page-ieak11-wizard.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: 85f856a6-b707-48a9-ba99-3a6e898276a9
title: Use the First Run Wizard and Welcome Page Options page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/guidelines-toolbar-and-favorites-list-ieak11.md b/browsers/internet-explorer/ie11-ieak/guidelines-toolbar-and-favorites-list-ieak11.md
index 2bd9a5b5e4..f4aeec37b6 100644
--- a/browsers/internet-explorer/ie11-ieak/guidelines-toolbar-and-favorites-list-ieak11.md
+++ b/browsers/internet-explorer/ie11-ieak/guidelines-toolbar-and-favorites-list-ieak11.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: bddc8f23-9ac1-449d-ad71-f77f43ae3b5c
title: Customize the toolbar button and Favorites List icons using IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/hardware-and-software-reqs-ieak11.md b/browsers/internet-explorer/ie11-ieak/hardware-and-software-reqs-ieak11.md
index e778a8a516..37a841bff1 100644
--- a/browsers/internet-explorer/ie11-ieak/hardware-and-software-reqs-ieak11.md
+++ b/browsers/internet-explorer/ie11-ieak/hardware-and-software-reqs-ieak11.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: c50b86dc-7184-43d1-8daf-e750eb88dabb
title: Hardware and software requirements for Internet Explorer 11 and the IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/hidecustom-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/hidecustom-ins-file-setting.md
index d9fabda403..2787a57d1d 100644
--- a/browsers/internet-explorer/ie11-ieak/hidecustom-ins-file-setting.md
+++ b/browsers/internet-explorer/ie11-ieak/hidecustom-ins-file-setting.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: e673f7b1-c3aa-4072-92b0-20c6dc3d9277
title: Use the HideCustom .INS file to hide the GUID for each custom component (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/ie-setup-command-line-options-and-return-codes.md b/browsers/internet-explorer/ie11-ieak/ie-setup-command-line-options-and-return-codes.md
index 4a41872c22..d91e9cf5a9 100644
--- a/browsers/internet-explorer/ie11-ieak/ie-setup-command-line-options-and-return-codes.md
+++ b/browsers/internet-explorer/ie11-ieak/ie-setup-command-line-options-and-return-codes.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: 40c23024-cb5d-4902-ad1b-6e8a189a699f
title: Internet Explorer Setup command-line options and return codes (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/ieak11-wizard-custom-options.md b/browsers/internet-explorer/ie11-ieak/ieak11-wizard-custom-options.md
index 2dec226b06..133cd15ddf 100644
--- a/browsers/internet-explorer/ie11-ieak/ieak11-wizard-custom-options.md
+++ b/browsers/internet-explorer/ie11-ieak/ieak11-wizard-custom-options.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: 4b804da3-c3ac-4b60-ab1c-99536ff6e31b
title: Internet Explorer Administration Kit 11 (IEAK 11) Customization Wizard options (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/iexpress-command-line-options.md b/browsers/internet-explorer/ie11-ieak/iexpress-command-line-options.md
index 2c1d2a51c8..2e17b2bb73 100644
--- a/browsers/internet-explorer/ie11-ieak/iexpress-command-line-options.md
+++ b/browsers/internet-explorer/ie11-ieak/iexpress-command-line-options.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: aa16d738-1067-403c-88b3-bada12cf9752
title: IExpress Wizard command-line options (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/iexpress-wizard-for-win-server.md b/browsers/internet-explorer/ie11-ieak/iexpress-wizard-for-win-server.md
index e419776ec7..060b389a44 100644
--- a/browsers/internet-explorer/ie11-ieak/iexpress-wizard-for-win-server.md
+++ b/browsers/internet-explorer/ie11-ieak/iexpress-wizard-for-win-server.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: 5100886d-ec88-4c1c-8cd7-be00da874c57
title: IExpress Wizard for Windows Server 2008 R2 with SP1 (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/important-urls-home-page-and-support-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/important-urls-home-page-and-support-ieak11-wizard.md
index 9a7f220abd..85f09f674c 100644
--- a/browsers/internet-explorer/ie11-ieak/important-urls-home-page-and-support-ieak11-wizard.md
+++ b/browsers/internet-explorer/ie11-ieak/important-urls-home-page-and-support-ieak11-wizard.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: 19e34879-ba9d-41bf-806a-3b9b9b752fc1
title: Use the Important URLs - Home Page and Support page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/index.md b/browsers/internet-explorer/ie11-ieak/index.md
index 2bfdfbfdd9..fcabf300fc 100644
--- a/browsers/internet-explorer/ie11-ieak/index.md
+++ b/browsers/internet-explorer/ie11-ieak/index.md
@@ -7,6 +7,7 @@ ms.assetid: 847bd7b4-d5dd-4e10-87b5-4d7d3a99bbac
title: Internet Explorer Administration Kit 11 (IEAK 11) - Administrator's Guide (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
ms.localizationpriority: low
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/internal-install-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/internal-install-ieak11-wizard.md
index 774836dae6..e49c34deeb 100644
--- a/browsers/internet-explorer/ie11-ieak/internal-install-ieak11-wizard.md
+++ b/browsers/internet-explorer/ie11-ieak/internal-install-ieak11-wizard.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: 33d078e3-75b8-455b-9126-f0d272ed676f
title: Use the Internal Install page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/isp-security-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/isp-security-ins-file-setting.md
index 0523806f11..def833847a 100644
--- a/browsers/internet-explorer/ie11-ieak/isp-security-ins-file-setting.md
+++ b/browsers/internet-explorer/ie11-ieak/isp-security-ins-file-setting.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: 4eca2de5-7071-45a2-9c99-75115be00d06
title: Use the ISP_Security .INS file to add your root certificate (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/language-selection-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/language-selection-ieak11-wizard.md
index 09392580d3..cf43edbff7 100644
--- a/browsers/internet-explorer/ie11-ieak/language-selection-ieak11-wizard.md
+++ b/browsers/internet-explorer/ie11-ieak/language-selection-ieak11-wizard.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: f9d4ab57-9b1d-4cbc-9398-63f4938df1f6
title: Use the Language Selection page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/licensing-version-and-features-ieak11.md b/browsers/internet-explorer/ie11-ieak/licensing-version-and-features-ieak11.md
index 8bb63453c9..6a0c89fda8 100644
--- a/browsers/internet-explorer/ie11-ieak/licensing-version-and-features-ieak11.md
+++ b/browsers/internet-explorer/ie11-ieak/licensing-version-and-features-ieak11.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: 69d25451-08af-4db0-9daa-44ab272acc15
title: Determine the licensing version and features to use in IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/media-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/media-ins-file-setting.md
index c1ff2be4c5..4dd05077cf 100644
--- a/browsers/internet-explorer/ie11-ieak/media-ins-file-setting.md
+++ b/browsers/internet-explorer/ie11-ieak/media-ins-file-setting.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: c57bae60-d520-49a9-a77d-da43f7ebe5b8
title: Use the Media .INS file to specify your install media (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/pkg-type-selection-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/pkg-type-selection-ieak11-wizard.md
index e853869555..e452b86aef 100644
--- a/browsers/internet-explorer/ie11-ieak/pkg-type-selection-ieak11-wizard.md
+++ b/browsers/internet-explorer/ie11-ieak/pkg-type-selection-ieak11-wizard.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: dd91f788-d05e-4f45-9fd5-d951abf04f2c
title: Use the Package Type Selection page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/platform-selection-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/platform-selection-ieak11-wizard.md
index ff41cfb4b4..fe9ee2e713 100644
--- a/browsers/internet-explorer/ie11-ieak/platform-selection-ieak11-wizard.md
+++ b/browsers/internet-explorer/ie11-ieak/platform-selection-ieak11-wizard.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: 9cbf5abd-86f7-42b6-9810-0b606bbe8218
title: Use the Platform Selection page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/prep-network-install-with-ieak11.md b/browsers/internet-explorer/ie11-ieak/prep-network-install-with-ieak11.md
index a950b3c6a3..b21003374e 100644
--- a/browsers/internet-explorer/ie11-ieak/prep-network-install-with-ieak11.md
+++ b/browsers/internet-explorer/ie11-ieak/prep-network-install-with-ieak11.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: 2c66d22a-4a94-47cc-82ab-7274abe1dfd6
title: Before you install your package over your network using IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/programs-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/programs-ieak11-wizard.md
index 0bcdc1f6c3..8bce1cbea1 100644
--- a/browsers/internet-explorer/ie11-ieak/programs-ieak11-wizard.md
+++ b/browsers/internet-explorer/ie11-ieak/programs-ieak11-wizard.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: f715668f-a50d-4db0-b578-e6526fbfa1fc
title: Use the Programs page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/proxy-auto-config-examples.md b/browsers/internet-explorer/ie11-ieak/proxy-auto-config-examples.md
index a921199911..69d1bc3a0d 100644
--- a/browsers/internet-explorer/ie11-ieak/proxy-auto-config-examples.md
+++ b/browsers/internet-explorer/ie11-ieak/proxy-auto-config-examples.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: 6c94708d-71bd-44bd-a445-7e6763b374ae
title: Use proxy auto-configuration (.pac) files with IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/proxy-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/proxy-ins-file-setting.md
index bea9403375..28227c9b71 100644
--- a/browsers/internet-explorer/ie11-ieak/proxy-ins-file-setting.md
+++ b/browsers/internet-explorer/ie11-ieak/proxy-ins-file-setting.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: 30b03c2f-e3e5-48d2-9007-e3fd632f3c18
title: Use the Proxy .INS file to specify a proxy server (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/proxy-settings-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/proxy-settings-ieak11-wizard.md
index d2052087ce..cb0e99d572 100644
--- a/browsers/internet-explorer/ie11-ieak/proxy-settings-ieak11-wizard.md
+++ b/browsers/internet-explorer/ie11-ieak/proxy-settings-ieak11-wizard.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: 1fa1eee3-e97d-41fa-a48c-4a6e0dc8b544
title: Use the Proxy Settings page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/register-uninstall-app-ieak11.md b/browsers/internet-explorer/ie11-ieak/register-uninstall-app-ieak11.md
index 45a27ee082..f9c3ebee2a 100644
--- a/browsers/internet-explorer/ie11-ieak/register-uninstall-app-ieak11.md
+++ b/browsers/internet-explorer/ie11-ieak/register-uninstall-app-ieak11.md
@@ -6,6 +6,7 @@ author: eross-msft
ms.prod: ie11
ms.assetid: 4da1d408-af4a-4c89-a491-d6f005fd5005
title: Register an uninstall app for custom components using IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros)
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/rsop-snapin-for-policy-settings-ieak11.md b/browsers/internet-explorer/ie11-ieak/rsop-snapin-for-policy-settings-ieak11.md
index 8cc3bcd310..b254a6285e 100644
--- a/browsers/internet-explorer/ie11-ieak/rsop-snapin-for-policy-settings-ieak11.md
+++ b/browsers/internet-explorer/ie11-ieak/rsop-snapin-for-policy-settings-ieak11.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: 0f21b320-e879-4a06-8589-aae6fc264666
title: Use the RSoP snap-in to review policy settings (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/search-providers-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/search-providers-ieak11-wizard.md
index a0e4286e8d..134182e0d0 100644
--- a/browsers/internet-explorer/ie11-ieak/search-providers-ieak11-wizard.md
+++ b/browsers/internet-explorer/ie11-ieak/search-providers-ieak11-wizard.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: 48cfaba5-f4c0-493c-b656-445311b7bc52
title: Use the Search Providers page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/security-and-ieak11.md b/browsers/internet-explorer/ie11-ieak/security-and-ieak11.md
index 809652df55..da06db09c4 100644
--- a/browsers/internet-explorer/ie11-ieak/security-and-ieak11.md
+++ b/browsers/internet-explorer/ie11-ieak/security-and-ieak11.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: 5b64c9cb-f8da-411a-88e4-fa69dea473e2
title: Security features and IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/security-and-privacy-settings-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/security-and-privacy-settings-ieak11-wizard.md
index 9f5cadf768..d947f3023d 100644
--- a/browsers/internet-explorer/ie11-ieak/security-and-privacy-settings-ieak11-wizard.md
+++ b/browsers/internet-explorer/ie11-ieak/security-and-privacy-settings-ieak11-wizard.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: cb7cd1df-6a79-42f6-b3a1-8ae467053f82
title: Use the Security and Privacy Settings page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/security-imports-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/security-imports-ins-file-setting.md
index 2267ccc2c3..5f16ccd492 100644
--- a/browsers/internet-explorer/ie11-ieak/security-imports-ins-file-setting.md
+++ b/browsers/internet-explorer/ie11-ieak/security-imports-ins-file-setting.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: 19791c44-aaa7-4f37-9faa-85cbdf29f68e
title: Use the Security Imports .INS file to import security info (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/troubleshooting-custom-browser-pkg-ieak11.md b/browsers/internet-explorer/ie11-ieak/troubleshooting-custom-browser-pkg-ieak11.md
index 4d655da341..c762eb1d5a 100644
--- a/browsers/internet-explorer/ie11-ieak/troubleshooting-custom-browser-pkg-ieak11.md
+++ b/browsers/internet-explorer/ie11-ieak/troubleshooting-custom-browser-pkg-ieak11.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: 9e22cc61-6c63-4cab-bfdf-6fe49db945e4
title: Troubleshoot custom package and IEAK 11 problems (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/url-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/url-ins-file-setting.md
index 33120276a5..788872c6de 100644
--- a/browsers/internet-explorer/ie11-ieak/url-ins-file-setting.md
+++ b/browsers/internet-explorer/ie11-ieak/url-ins-file-setting.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: 05b09dfa-cf11-408d-92c2-b4ae434a59a7
title: Use the URL .INS file to use an auto-configured proxy server (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/user-experience-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/user-experience-ieak11-wizard.md
index 0fd4a2c8bd..5c4fb45863 100644
--- a/browsers/internet-explorer/ie11-ieak/user-experience-ieak11-wizard.md
+++ b/browsers/internet-explorer/ie11-ieak/user-experience-ieak11-wizard.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: d3378058-e4f0-4a11-a888-b550af994bfa
title: Use the User Experience page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/using-internet-settings-ins-files.md b/browsers/internet-explorer/ie11-ieak/using-internet-settings-ins-files.md
index 6b88d3fa5e..6eafaec05b 100644
--- a/browsers/internet-explorer/ie11-ieak/using-internet-settings-ins-files.md
+++ b/browsers/internet-explorer/ie11-ieak/using-internet-settings-ins-files.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: a24a7cdb-681e-4f34-a53c-6d8383c5f977
title: Using Internet Settings (.INS) files with IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/ie11-ieak/wizard-complete-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/wizard-complete-ieak11-wizard.md
index 96fbaaaa45..53df3948f6 100644
--- a/browsers/internet-explorer/ie11-ieak/wizard-complete-ieak11-wizard.md
+++ b/browsers/internet-explorer/ie11-ieak/wizard-complete-ieak11-wizard.md
@@ -7,6 +7,7 @@ ms.prod: ie11
ms.assetid: aaaac88a-2022-4d0b-893c-b2404b45cabc
title: Use the Wizard Complete - Next Steps page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
+ms.date: 07/27/2017
---
diff --git a/browsers/internet-explorer/index.md b/browsers/internet-explorer/index.md
index 65aa2dda43..303df95ed6 100644
--- a/browsers/internet-explorer/index.md
+++ b/browsers/internet-explorer/index.md
@@ -7,6 +7,7 @@ title: Internet Explorer 11 (IE11) (Internet Explorer 11 for IT Pros)
assetid: be3dc32e-80d9-4d9f-a802-c7db6c50dbe0
ms.sitesec: library
ms.localizationpriority: low
+ms.date: 07/27/2017
---
diff --git a/devices/hololens/TOC.md b/devices/hololens/TOC.md
index 9ee05419db..87ef48bb20 100644
--- a/devices/hololens/TOC.md
+++ b/devices/hololens/TOC.md
@@ -6,4 +6,5 @@
## [Set up HoloLens in kiosk mode](hololens-kiosk.md)
## [Configure HoloLens using a provisioning package](hololens-provisioning.md)
## [Install apps on HoloLens](hololens-install-apps.md)
+## [Enable Bitlocker device encryption for HoloLens](hololens-encryption.md)
## [Change history for Microsoft HoloLens documentation](change-history-hololens.md)
\ No newline at end of file
diff --git a/devices/hololens/change-history-hololens.md b/devices/hololens/change-history-hololens.md
index 00808fc443..6b4a3479c5 100644
--- a/devices/hololens/change-history-hololens.md
+++ b/devices/hololens/change-history-hololens.md
@@ -8,12 +8,19 @@ ms.sitesec: library
ms.pagetype: surfacehub
author: jdeckerms
ms.localizationpriority: medium
+ms.date: 12/20/2017
---
# Change history for Microsoft HoloLens documentation
This topic lists new and updated topics in the [Microsoft HoloLens documentation](index.md).
+## December 2017
+
+New or changed topic | Description
+--- | ---
+[Enable Bitlocker device encryption for HoloLens](hololens-encryption.md) | New
+
## May 2017
| New or changed topic | Description |
diff --git a/devices/hololens/hololens-encryption.md b/devices/hololens/hololens-encryption.md
new file mode 100644
index 0000000000..aef7ea7f69
--- /dev/null
+++ b/devices/hololens/hololens-encryption.md
@@ -0,0 +1,123 @@
+---
+title: Enable Bitlocker encryption for HoloLens (HoloLens)
+description: Enable Bitlocker device encryption to protect files stored on the HoloLens
+ms.prod: w10
+ms.mktglfcycl: manage
+ms.pagetype: hololens, devices
+ms.sitesec: library
+author: jdeckerms
+ms.localizationpriority: medium
+ms.date: 12/20/2017
+---
+
+# Enable encryption for HoloLens
+
+You can enable [Bitlocker device encryption](https://docs.microsoft.com/windows/device-security/bitlocker/bitlocker-overview) to protect files and information stored on the HoloLens. Device encryption helps protect your data by encrypting it using AES-CBC 128 encryption method, which is equivalent to [EncryptionMethodByDriveType method 3](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp#encryptionmethodbydrivetype) in the BitLocker configuration service provider (CSP). Only someone with the right encryption key (such as a password) can decrypt it or perform a data recovery.
+
+
+
+## Enable device encryption using MDM
+
+You can use your mobile device management (MDM) provider to apply a policy that requires device encryption. The policy used is the [Security/RequireDeviceEncryption setting](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-security#security-requiredeviceencryption) in the Policy CSP.
+
+In the following steps, Microsoft Intune is used as the example. For other MDM tools, see your MDM provider's documentation for instructions.
+
+1. Sign in to the [Microsoft Azure portal](https://portal.azure.com/).
+
+2. Use **Search** or go to **More services** to open the Intune blade.
+
+3. Go to **Device configuration > Profiles**, and select **Create profile**.
+
+ 
+
+4. Enter a name of your choice, select **Windows 10 and later** for the platform, select **Custom** for the profile type, and then select **Add**.
+
+ 
+
+5. In **Add Row OMA-URI Settings**, enter or select the following information:
+ - **Name**: a name of your choice
+ - **Description**: optional
+ - **OMA-URI**: `./Vendor/MSFT/Policy/Config/Security/RequireDeviceEncryption`
+ - **Data type**: integer
+ - **Value**: `1`
+
+ 
+
+6. Select **OK**, select **OK**, and then select **Create**. The blade for the profile opens automatically.
+
+7. Select **Assignments** to assign the profile to a group. After you configure the assignment, select **Save**.
+
+
+
+## Enable device encryption using a provisioning package
+
+Provisioning packages are files created by the Windows Configuration Designer tool that apply a specified configuration to a device.
+
+### Create a provisioning package that upgrades the Windows Holographic edition
+
+1. [Create a provisioning package for HoloLens.](hololens-provisioning.md#create-a-provisioning-package-for-hololens)
+
+2. Go to **Runtime settings** > **Policies** > **Security**, and select **RequireDeviceEncryption**.
+
+ 
+
+2. Browse to and select the XML license file that was provided when you purchased the Commercial Suite.
+
+ >[!NOTE]
+ >You can configure [additional settings in the provisioning package](hololens-provisioning.md).
+
+3. On the **File** menu, click **Save**.
+
+4. Read the warning that project files may contain sensitive information, and click **OK**.
+
+ >[!IMPORTANT]
+ >When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed.
+
+3. On the **Export** menu, click **Provisioning package**.
+
+4. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next**.
+
+5. Set a value for **Package Version**.
+
+ >[!TIP]
+ >You can make changes to existing packages and change the version number to update previously applied packages.
+
+6. On the **Select security details for the provisioning package**, click **Next**.
+
+7. Click **Next** to specify the output location where you want the provisioning package to go once it's built. By default, Windows ICD uses the project folder as the output location.
+
+ Optionally, you can click Browse to change the default output location.
+
+8. Click **Next**.
+
+9. Click **Build** to start building the package. The project information is displayed in the build page and the progress bar indicates the build status.
+
+10. When the build completes, click **Finish**.
+
+
+### Apply the provisioning package to HoloLens
+
+1. Connect the device via USB to a PC and start the device, but do not continue past the **fit** page of the initial setup experience (the first page with the blue box).
+
+2. Briefly press and release the **Volume Down** and **Power** buttons simultaneously.
+
+3. HoloLens will show up as a device in File Explorer on the PC.
+
+4. In File Explorer, drag and drop the provisioning package (.ppkg) onto the device storage.
+
+5. Briefly press and release the **Volume Down** and **Power** buttons simultaneously again while on the **fit** page.
+
+6. The device will ask you if you trust the package and would like to apply it. Confirm that you trust the package.
+
+7. You will see whether the package was applied successfully or not. If it failed, you can fix your package and try again. If it succeeded, proceed with device setup.
+
+>[!NOTE]
+>If the device was purchased before August 2016, you will need to sign into the device with a Microsoft account, get the latest OS update, and then reset the OS in order to apply the provisioning package.
+
+## Verify device encryption
+
+Encryption is silent on HoloLens. To verify the device encryption status:
+
+- On HoloLens, go to **Settings** > **System** > **About**. **Bitlocker** is **enabled** if the device is encrypted.
+
+
diff --git a/devices/hololens/hololens-enroll-mdm.md b/devices/hololens/hololens-enroll-mdm.md
index 590709239d..428a49e956 100644
--- a/devices/hololens/hololens-enroll-mdm.md
+++ b/devices/hololens/hololens-enroll-mdm.md
@@ -7,6 +7,7 @@ ms.pagetype: hololens, devices
ms.sitesec: library
author: jdeckerms
ms.localizationpriority: medium
+ms.date: 07/27/2017
---
# Enroll HoloLens in MDM
diff --git a/devices/hololens/hololens-install-apps.md b/devices/hololens/hololens-install-apps.md
index d4ab0de317..badec3873c 100644
--- a/devices/hololens/hololens-install-apps.md
+++ b/devices/hololens/hololens-install-apps.md
@@ -7,16 +7,14 @@ ms.pagetype: hololens, devices
ms.sitesec: library
author: jdeckerms
ms.localizationpriority: medium
+ms.date: 12/20/2017
---
# Install apps on HoloLens
The recommended way to install Universal Windows Platform (UWP) apps on HoloLens is to use Microsoft Store for Business. You can make your own [line-of-business application](https://technet.microsoft.com/itpro/windows/manage/working-with-line-of-business-apps) available through Microsoft Store for Business.
-You can also deploy apps using your mobile device management (MDM) provider or use the Windows Device Portal to install apps, if you enable **Developer Mode** on the HoloLens device.
-
->[!IMPORTANT]
- >When you set up HoloLens to use the Device Portal, you must enable **Developer Mode** on the device.**Developer Mode** on a device that has been upgraded to Windows Holographic for Business enables side-loading of apps, which risks the installation of apps that have not been certified by the Microsoft Store. Administrators can block the ability to enable **Developer Mode** using the **ApplicationManagement/AllowDeveloper Unlock** setting in the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). [Learn more about Developer Mode.](https://msdn.microsoft.com/windows/uwp/get-started/enable-your-device-for-development#developer-mode)
+You can also deploy apps using your mobile device management (MDM) provider or use the Windows Device Portal to install apps.
## Use Microsoft Store for Business to deploy apps to HoloLens
@@ -45,23 +43,32 @@ In your Microsoft Store for Business dashboard, you can also download apps to di
### Install apps on HoloLens from Microsoft Store for Business
-The method that you use to install an app from your Microsoft Store for Business on HoloLens depends on the the distribution method that you choose.
+The method that you use to install an app from your Microsoft Store for Business on HoloLens depends on the distribution method that you choose.
| Distribution method | To install on HoloLens|
| --- | --- |
-| Using private store | Open the Store app and select the tab for your organization to choose from available apps. |
-| Using MDM | [You can configure MDM to synchronize your Store for Business inventory.](https://technet.microsoft.com/itpro/windows/manage/distribute-apps-with-management-tool) |
+| [Using private store](https://docs.microsoft.com/microsoft-store/distribute-apps-from-your-private-store) | Open the Store app and select the tab for your organization to choose from available apps. |
+| Using MDM | [You can configure MDM to synchronize your Store for Business inventory.](https://technet.microsoft.com/itpro/windows/manage/distribute-apps-with-management-tool) See the **Important** note in [Use MDM to deploy apps to HoloLens.](#use-mdm-to-deploy-apps-to-hololens) |
## Use MDM to deploy apps to HoloLens
+>[!IMPORTANT]
+>Online-licensed apps cannot be deployed with Microsoft Store for Business on HoloLens via an MDM provider. If attempted, apps will remain in “downloading” state. Instead, you can use your MDM provider to deploy MDM-hosted apps to HoloLens, or deploy offline-licensed apps to HoloLens via Store for Business
+
+
You can deploy UWP apps to HoloLens using your MDM provider. For Intune instructions, see [Deploy apps in Microsoft Intune](https://docs.microsoft.com/intune/deploy-use/add-apps).
Using Intune, you can also [monitor your app deployment](https://docs.microsoft.com/intune/deploy-use/monitor-apps-in-microsoft-intune).
-## Use the Windows Device Portal to install apps on HoloLens.
+
+## Use the Windows Device Portal to install apps on HoloLens
+
+>[!IMPORTANT]
+>When you set up HoloLens to use the Device Portal, you must enable **Developer Mode** on the device. **Developer Mode** on a device that has been upgraded to Windows Holographic for Business enables side-loading of apps, which risks the installation of apps that have not been certified by the Microsoft Store. Administrators can block the ability to enable **Developer Mode** using the **ApplicationManagement/AllowDeveloper Unlock** setting in the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). [Learn more about Developer Mode.](https://msdn.microsoft.com/windows/uwp/get-started/enable-your-device-for-development#developer-mode)
+
1. [Set up the HoloLens to use the Windows Device Portal](https://developer.microsoft.com/windows/mixed-reality/using_the_windows_device_portal#setting_up_hololens_to_use_windows_device_portal). The Device Portal is a web server on your HoloLens that you can connect to from a web browser on your PC.
2. On a PC, connect to the HoloLens using [Wi-Fi](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#connecting_over_wi-fi) or [USB](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#connecting_over_usb).
diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md
index b2986ac0a3..14ede04e4d 100644
--- a/devices/hololens/hololens-kiosk.md
+++ b/devices/hololens/hololens-kiosk.md
@@ -7,6 +7,7 @@ ms.pagetype: hololens, devices
ms.sitesec: library
author: jdeckerms
ms.localizationpriority: medium
+ms.date: 07/27/2017
---
# Set up HoloLens in kiosk mode
diff --git a/devices/hololens/hololens-provisioning.md b/devices/hololens/hololens-provisioning.md
index 4abed18c01..44d24432f7 100644
--- a/devices/hololens/hololens-provisioning.md
+++ b/devices/hololens/hololens-provisioning.md
@@ -7,6 +7,7 @@ ms.pagetype: hololens, devices
ms.sitesec: library
author: jdeckerms
ms.localizationpriority: medium
+ms.date: 11/29/2017
---
# Configure HoloLens using a provisioning package test
@@ -95,7 +96,7 @@ When you run ADKsetup.exe for Windows 10, version 1607, select **Configuration D
7. You will see whether the package was applied successfully or not. If it failed, you can fix your package and try again. If it succeeded, proceed with OOBE.
>[!NOTE]
->If the device was purchased before August 2016, you will need to sign into the device with aa Microsoft account, get the latest OS update, and then reset the OS in order to apply the provisioning package.
+>If the device was purchased before August 2016, you will need to sign into the device with a Microsoft account, get the latest OS update, and then reset the OS in order to apply the provisioning package.
## What you can configure
diff --git a/devices/hololens/hololens-requirements.md b/devices/hololens/hololens-requirements.md
index e4d0abec41..77ad68eb9e 100644
--- a/devices/hololens/hololens-requirements.md
+++ b/devices/hololens/hololens-requirements.md
@@ -7,6 +7,7 @@ ms.pagetype: hololens, devices
ms.sitesec: library
author: jdeckerms
ms.localizationpriority: medium
+ms.date: 07/27/2017
---
# Microsoft HoloLens in the enterprise: requirements and FAQ
diff --git a/devices/hololens/hololens-setup.md b/devices/hololens/hololens-setup.md
index 485dc497ee..3fa1130923 100644
--- a/devices/hololens/hololens-setup.md
+++ b/devices/hololens/hololens-setup.md
@@ -7,6 +7,7 @@ ms.pagetype: hololens, devices
ms.sitesec: library
author: jdeckerms
ms.localizationpriority: medium
+ms.date: 07/27/2017
---
# Set up HoloLens
diff --git a/devices/hololens/hololens-upgrade-enterprise.md b/devices/hololens/hololens-upgrade-enterprise.md
index 0b22298118..d85bb461aa 100644
--- a/devices/hololens/hololens-upgrade-enterprise.md
+++ b/devices/hololens/hololens-upgrade-enterprise.md
@@ -7,6 +7,7 @@ ms.pagetype: hololens, devices
ms.sitesec: library
author: jdeckerms
ms.localizationpriority: medium
+ms.date: 07/27/2017
---
# Unlock Windows Holographic for Business features
@@ -70,7 +71,7 @@ For more information about groups, see [Use groups to manage users and devices i
## Edition upgrade using a provisioning package
-Provisioning packages are files created by the Windows Imaging and Configuration Designer (ICD) tool that apply a specified configuration to a device.
+Provisioning packages are files created by the Windows Configuration Designer tool that apply a specified configuration to a device.
### Create a provisioning package that upgrades the Windows Holographic edition
@@ -105,7 +106,7 @@ Provisioning packages are files created by the Windows Imaging and Configuration
7. Click **Next** to specify the output location where you want the provisioning package to go once it's built. By default, Windows ICD uses the project folder as the output location.
- Optionally, you can click Browse to change the default output location.
+ Optionally, you can click **Browse** to change the default output location.
8. Click **Next**.
@@ -131,7 +132,7 @@ Provisioning packages are files created by the Windows Imaging and Configuration
7. You will see whether the package was applied successfully or not. If it failed, you can fix your package and try again. If it succeeded, proceed with device setup.
>[!NOTE]
->If the device was purchased before August 2016, you will need to sign into the device with aa Microsoft account, get the latest OS update, and then reset the OS in order to apply the provisioning package.
+>If the device was purchased before August 2016, you will need to sign into the device with a Microsoft account, get the latest OS update, and then reset the OS in order to apply the provisioning package.
diff --git a/devices/hololens/images/about-encryption.png b/devices/hololens/images/about-encryption.png
new file mode 100644
index 0000000000..348e493503
Binary files /dev/null and b/devices/hololens/images/about-encryption.png differ
diff --git a/devices/hololens/images/device-encryption.PNG b/devices/hololens/images/device-encryption.PNG
new file mode 100644
index 0000000000..651429dfe0
Binary files /dev/null and b/devices/hololens/images/device-encryption.PNG differ
diff --git a/devices/hololens/images/encrypt-assign.png b/devices/hololens/images/encrypt-assign.png
new file mode 100644
index 0000000000..f5b0c85a3c
Binary files /dev/null and b/devices/hololens/images/encrypt-assign.png differ
diff --git a/devices/hololens/images/encrypt-create-profile.png b/devices/hololens/images/encrypt-create-profile.png
new file mode 100644
index 0000000000..b0f06ef40f
Binary files /dev/null and b/devices/hololens/images/encrypt-create-profile.png differ
diff --git a/devices/hololens/images/encrypt-custom.png b/devices/hololens/images/encrypt-custom.png
new file mode 100644
index 0000000000..b3635e9ee4
Binary files /dev/null and b/devices/hololens/images/encrypt-custom.png differ
diff --git a/devices/hololens/images/encrypt-oma-uri.png b/devices/hololens/images/encrypt-oma-uri.png
new file mode 100644
index 0000000000..e2754b7db4
Binary files /dev/null and b/devices/hololens/images/encrypt-oma-uri.png differ
diff --git a/devices/hololens/images/wsfb-private.png b/devices/hololens/images/wsfb-private.png
index a71da6b565..35ce83829b 100644
Binary files a/devices/hololens/images/wsfb-private.png and b/devices/hololens/images/wsfb-private.png differ
diff --git a/devices/hololens/index.md b/devices/hololens/index.md
index 138efd9e2b..ddb5c29aea 100644
--- a/devices/hololens/index.md
+++ b/devices/hololens/index.md
@@ -7,6 +7,7 @@ ms.pagetype: hololens, devices
ms.sitesec: library
author: jdeckerms
ms.localizationpriority: medium
+ms.date: 11/29/2017
---
# Microsoft HoloLens
diff --git a/devices/surface-hub/TOC.md b/devices/surface-hub/TOC.md
index 69c603b84d..beb434c374 100644
--- a/devices/surface-hub/TOC.md
+++ b/devices/surface-hub/TOC.md
@@ -31,6 +31,7 @@
#### [Use fully qualified domain name with Surface Hub](use-fully-qualified-domain-name-surface-hub.md)
#### [Wireless network management](wireless-network-management-for-surface-hub.md)
### [Install apps on your Surface Hub](install-apps-on-surface-hub.md)
+### [Configure Surface Hub Start menu](surface-hub-start-menu.md)
### [Set up and use Whiteboard to Whiteboard collaboration](whiteboard-collaboration.md)
### [End a Surface Hub meeting with End session](i-am-done-finishing-your-surface-hub-meeting.md)
### [Sign in to Surface Hub with Microsoft Authenticator](surface-hub-authenticator-app.md)
diff --git a/devices/surface-hub/accessibility-surface-hub.md b/devices/surface-hub/accessibility-surface-hub.md
index 193a5d5235..0e4f926262 100644
--- a/devices/surface-hub/accessibility-surface-hub.md
+++ b/devices/surface-hub/accessibility-surface-hub.md
@@ -9,7 +9,7 @@ ms.pagetype: surfacehub
ms.sitesec: library
author: jdeckerms
ms.author: jdecker
-ms.date: 08/17/2017
+ms.date: 08/16/2017
ms.localizationpriority: medium
---
diff --git a/devices/surface-hub/admin-group-management-for-surface-hub.md b/devices/surface-hub/admin-group-management-for-surface-hub.md
index 8fefe084ae..cd6644429f 100644
--- a/devices/surface-hub/admin-group-management-for-surface-hub.md
+++ b/devices/surface-hub/admin-group-management-for-surface-hub.md
@@ -9,7 +9,7 @@ ms.sitesec: library
ms.pagetype: surfacehub, security
author: jdeckerms
ms.author: jdecker
-ms.date: 06/19/2017
+ms.date: 07/27/2017
ms.localizationpriority: medium
---
diff --git a/devices/surface-hub/appendix-a-powershell-scripts-for-surface-hub.md b/devices/surface-hub/appendix-a-powershell-scripts-for-surface-hub.md
index 8a644c23ba..4f299c72fd 100644
--- a/devices/surface-hub/appendix-a-powershell-scripts-for-surface-hub.md
+++ b/devices/surface-hub/appendix-a-powershell-scripts-for-surface-hub.md
@@ -9,7 +9,7 @@ ms.sitesec: library
ms.pagetype: surfacehub
author: jdeckerms
ms.author: jdecker
-ms.date: 09/25/2017
+ms.date: 01/10/2018
ms.localizationpriority: medium
---
@@ -30,6 +30,14 @@ PowerShell scripts to help set up and manage your Microsoft Surface Hub.
- [Accepting external meeting requests](#accept-ext-meetings-cmdlet)
+## Prerequisites
+
+To successfully execute these PowerShell scripts, you will need to install the following prerequisites:
+
+- [Microsoft Online Services Sign-in Assistant for IT Professionals RTW](https://www.microsoft.com/download/details.aspx?id=41950)
+- [Microsoft Azure Active Directory Module for Windows PowerShell (64-bit version)](http://connect.microsoft.com/site1164/Downloads/DownloadDetails.aspx?DownloadID=59185)
+- [Windows PowerShell Module for Skype for Business Online](https://www.microsoft.com/download/details.aspx?id=39366)
+
## PowerShell scripts for Surface Hub administrators
@@ -1568,7 +1576,7 @@ if ($online)
{
try {
$strRegPool = $null;
- $strRegPool = (Get-CsTenant).TenantPoolExtension
+ $strRegPool = (Get-CsTenant).RegistrarPool
} catch {}
if ($Error)
{
diff --git a/devices/surface-hub/apply-activesync-policies-for-surface-hub-device-accounts.md b/devices/surface-hub/apply-activesync-policies-for-surface-hub-device-accounts.md
index 150021a410..3ea97cffed 100644
--- a/devices/surface-hub/apply-activesync-policies-for-surface-hub-device-accounts.md
+++ b/devices/surface-hub/apply-activesync-policies-for-surface-hub-device-accounts.md
@@ -9,7 +9,7 @@ ms.sitesec: library
ms.pagetype: surfacehub
author: jdeckerms
ms.author: jdecker
-ms.date: 06/19/2017
+ms.date: 07/27/2017
ms.localizationpriority: medium
---
diff --git a/devices/surface-hub/change-history-surface-hub.md b/devices/surface-hub/change-history-surface-hub.md
index 4f7d71f0d7..595a61e131 100644
--- a/devices/surface-hub/change-history-surface-hub.md
+++ b/devices/surface-hub/change-history-surface-hub.md
@@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: surfacehub
author: jdeckerms
ms.author: jdecker
-ms.date: 10/24/2017
+ms.date: 01/17/2018
ms.localizationpriority: medium
---
@@ -16,6 +16,13 @@ ms.localizationpriority: medium
This topic lists new and updated topics in the [Surface Hub Admin Guide]( surface-hub-administrators-guide.md).
+## January 2018
+
+New or changed topic | Description
+--- | ---
+[Configure Surface Hub Start menu](surface-hub-start-menu.md) | New
+[PowerShell for Surface Hub](appendix-a-powershell-scripts-for-surface-hub.md) | Added prerequisites for running the scripts
+
## November 2017
New or changed topic | Description
diff --git a/devices/surface-hub/change-surface-hub-device-account.md b/devices/surface-hub/change-surface-hub-device-account.md
index 0dbb2f0c28..5b3d1e35db 100644
--- a/devices/surface-hub/change-surface-hub-device-account.md
+++ b/devices/surface-hub/change-surface-hub-device-account.md
@@ -9,7 +9,7 @@ ms.sitesec: library
ms.pagetype: surfacehub
author: jdeckerms
ms.author: jdecker
-ms.date: 06/19/2017
+ms.date: 07/27/2017
ms.localizationpriority: medium
---
diff --git a/devices/surface-hub/connect-and-display-with-surface-hub.md b/devices/surface-hub/connect-and-display-with-surface-hub.md
index b8b4074703..1a16c46d86 100644
--- a/devices/surface-hub/connect-and-display-with-surface-hub.md
+++ b/devices/surface-hub/connect-and-display-with-surface-hub.md
@@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: surfacehub
author: jdeckerms
ms.author: jdecker
-ms.date: 06/19/2017
+ms.date: 07/27/2017
ms.localizationpriority: medium
---
diff --git a/devices/surface-hub/create-and-test-a-device-account-surface-hub.md b/devices/surface-hub/create-and-test-a-device-account-surface-hub.md
index d23e2a2012..470db2937e 100644
--- a/devices/surface-hub/create-and-test-a-device-account-surface-hub.md
+++ b/devices/surface-hub/create-and-test-a-device-account-surface-hub.md
@@ -9,7 +9,7 @@ ms.sitesec: library
ms.pagetype: surfacehub
author: jdeckerms
ms.author: jdecker
-ms.date: 06/19/2017
+ms.date: 07/27/2017
ms.localizationpriority: medium
---
diff --git a/devices/surface-hub/device-reset-surface-hub.md b/devices/surface-hub/device-reset-surface-hub.md
index 2cd32d91db..d5d8bbf104 100644
--- a/devices/surface-hub/device-reset-surface-hub.md
+++ b/devices/surface-hub/device-reset-surface-hub.md
@@ -9,7 +9,7 @@ ms.sitesec: library
ms.pagetype: surfacehub
author: jdeckerms
ms.author: jdecker
-ms.date: 06/19/2017
+ms.date: 07/27/2017
ms.localizationpriority: medium
---
diff --git a/devices/surface-hub/differences-between-surface-hub-and-windows-10-enterprise.md b/devices/surface-hub/differences-between-surface-hub-and-windows-10-enterprise.md
index d1a52c56b3..61120d6a25 100644
--- a/devices/surface-hub/differences-between-surface-hub-and-windows-10-enterprise.md
+++ b/devices/surface-hub/differences-between-surface-hub-and-windows-10-enterprise.md
@@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: surfacehub
author: isaiahng
ms.author: jdecker
-ms.date: 10/19/2017
+ms.date: 11/01/2017
ms.localizationpriority: medium
---
@@ -164,8 +164,8 @@ Users can sign in to Microsoft Edge to access intranet sites and online resource
*Organization policies that this may affect:*
-->
-### Telemetry
+### Diagnostic data
-The Surface Hub OS uses the Windows 10 Connected User Experience and Telemetry component to gather and transmit telemetry data. For more information, see [Configure Windows telemetry in your organization](https://technet.microsoft.com/itpro/windows/manage/configure-windows-telemetry-in-your-organization).
+The Surface Hub OS uses the Windows 10 Connected User Experience and Telemetry component to gather and transmit diagnostic data. For more information, see [Configure Windows diagnostic data in your organization](https://technet.microsoft.com/itpro/windows/manage/configure-windows-diagnostic-data-in-your-organization).
-*Organization policies that this may affect:* Configure telemetry levels for Surface Hub in the same way as you do for Windows 10 Enterprise.
+*Organization policies that this may affect:* Configure diagnostic data levels for Surface Hub in the same way as you do for Windows 10 Enterprise.
diff --git a/devices/surface-hub/enable-8021x-wired-authentication.md b/devices/surface-hub/enable-8021x-wired-authentication.md
index c7a55bf866..e23860d5ba 100644
--- a/devices/surface-hub/enable-8021x-wired-authentication.md
+++ b/devices/surface-hub/enable-8021x-wired-authentication.md
@@ -7,7 +7,7 @@ ms.sitesec: library
ms.pagetype: surfacehub
author: jdeckerms
ms.author: jdecker
-ms.date: 11/14/2017
+ms.date: 11/15/2017
ms.localizationpriority: medium
---
diff --git a/devices/surface-hub/exchange-properties-for-surface-hub-device-accounts.md b/devices/surface-hub/exchange-properties-for-surface-hub-device-accounts.md
index 65f8ff0dfe..1c936f687a 100644
--- a/devices/surface-hub/exchange-properties-for-surface-hub-device-accounts.md
+++ b/devices/surface-hub/exchange-properties-for-surface-hub-device-accounts.md
@@ -9,7 +9,7 @@ ms.sitesec: library
ms.pagetype: surfacehub
author: jdeckerms
ms.author: jdecker
-ms.date: 06/19/2017
+ms.date: 07/27/2017
ms.localizationpriority: medium
---
diff --git a/devices/surface-hub/finishing-your-surface-hub-meeting.md b/devices/surface-hub/finishing-your-surface-hub-meeting.md
index cfd7ebf145..7ef7ca904e 100644
--- a/devices/surface-hub/finishing-your-surface-hub-meeting.md
+++ b/devices/surface-hub/finishing-your-surface-hub-meeting.md
@@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: surfacehub
author: jdeckerms
ms.author: jdecker
-ms.date: 06/19/2017
+ms.date: 07/27/2017
ms.localizationpriority: medium
---
diff --git a/devices/surface-hub/first-run-program-surface-hub.md b/devices/surface-hub/first-run-program-surface-hub.md
index 5bbd47ff2e..b0d0d183ef 100644
--- a/devices/surface-hub/first-run-program-surface-hub.md
+++ b/devices/surface-hub/first-run-program-surface-hub.md
@@ -9,7 +9,7 @@ ms.sitesec: library
ms.pagetype: surfacehub
author: jdeckerms
ms.author: jdecker
-ms.date: 06/19/2017
+ms.date: 07/27/2017
ms.localizationpriority: medium
---
diff --git a/devices/surface-hub/images/whats-new-video-thumbnail.PNG b/devices/surface-hub/images/whats-new-video-thumbnail.PNG
new file mode 100644
index 0000000000..44cbffcbb3
Binary files /dev/null and b/devices/surface-hub/images/whats-new-video-thumbnail.PNG differ
diff --git a/devices/surface-hub/index.md b/devices/surface-hub/index.md
index cdde9fd95e..06c8519cfc 100644
--- a/devices/surface-hub/index.md
+++ b/devices/surface-hub/index.md
@@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: surfacehub
author: jdeckerms
ms.author: jdecker
-ms.date: 06/19/2017
+ms.date: 09/07/2017
ms.localizationpriority: medium
---
diff --git a/devices/surface-hub/install-apps-on-surface-hub.md b/devices/surface-hub/install-apps-on-surface-hub.md
index 8449690b59..b0737d1f6b 100644
--- a/devices/surface-hub/install-apps-on-surface-hub.md
+++ b/devices/surface-hub/install-apps-on-surface-hub.md
@@ -164,6 +164,10 @@ There are a few different ways to install apps on your Surface Hub depending on
| Microsoft Store app | | X | |
| Supported MDM provider | | | X |
+## More information
+
+- [Blog post: Deploy Windows Store apps to Surface Hub using Intune](https://blogs.technet.microsoft.com/y0av/2018/01/18/7-2/)
+
## Related topics
diff --git a/devices/surface-hub/local-management-surface-hub-settings.md b/devices/surface-hub/local-management-surface-hub-settings.md
index cb1c078d70..c59fd9ac8a 100644
--- a/devices/surface-hub/local-management-surface-hub-settings.md
+++ b/devices/surface-hub/local-management-surface-hub-settings.md
@@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: surfacehub
author: jdeckerms
ms.author: jdecker
-ms.date: 06/19/2017
+ms.date: 07/27/2017
ms.localizationpriority: medium
---
diff --git a/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md b/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md
index 10881feb16..23eb0e418f 100644
--- a/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md
+++ b/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md
@@ -9,7 +9,7 @@ ms.sitesec: library
ms.pagetype: surfacehub, mobility
author: jdeckerms
ms.author: jdecker
-ms.date: 10/20/2017
+ms.date: 01/17/2018
ms.localizationpriority: medium
---
@@ -185,7 +185,12 @@ The following tables include info on Windows 10 settings that have been validate
| Set Network proxy | Use to configure a proxy server for ethernet and Wi-Fi connections. | [NetworkProxy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/networkproxy-csp) | Yes [Use a custom policy.](#example-intune) | Yes. [Use a custom setting.](#example-sccm) | Yes |
\*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package.
+#### Configure Start menu
+| Setting | Details | CSP reference | Supported with Intune? | Supported with Configuration Manager? | Supported with SyncML*? |
+| --- | ---- | --- |---- | --- | --- |
+| Configure Start menu | Use to configure which apps are displayed on the Start menu. For more information, see [Configure Surface Hub Start menu](surface-hub-start-menu.md) | [Policy CSP: Start/StartLayout](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-start#start-startlayout) | Yes [Use a custom policy.](#example-intune) | Yes. [Use a custom setting.](#example-sccm) | Yes |
+\*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package.
### Generate OMA URIs for settings
You need to use a setting’s OMA URI to create a custom policy in Intune, or a custom setting in System Center Configuration Manager.
diff --git a/devices/surface-hub/manage-surface-hub-settings.md b/devices/surface-hub/manage-surface-hub-settings.md
index e3a2315659..c79f175559 100644
--- a/devices/surface-hub/manage-surface-hub-settings.md
+++ b/devices/surface-hub/manage-surface-hub-settings.md
@@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: surfacehub
author: jdeckerms
ms.author: jdecker
-ms.date: 06/19/2017
+ms.date: 07/27/2017
ms.localizationpriority: medium
---
diff --git a/devices/surface-hub/manage-surface-hub.md b/devices/surface-hub/manage-surface-hub.md
index ec0bfbb284..612bdeb704 100644
--- a/devices/surface-hub/manage-surface-hub.md
+++ b/devices/surface-hub/manage-surface-hub.md
@@ -9,7 +9,7 @@ ms.sitesec: library
ms.pagetype: surfacehub
author: jdeckerms
ms.author: jdecker
-ms.date: 06/19/2017
+ms.date: 01/17/2018
ms.localizationpriority: medium
---
@@ -32,6 +32,7 @@ Learn about managing and updating Surface Hub.
| [Remote Surface Hub management](remote-surface-hub-management.md) |Topics related to managing your Surface Hub remotely. Include install apps, managing settings with MDM and monitoring with Operations Management Suite. |
| [Manage Surface Hub settings](manage-surface-hub-settings.md) |Topics related to managing Surface Hub settings: accessibility, device account, device reset, fully qualified domain name, Windows Update settings, and wireless network |
| [Install apps on your Surface Hub]( https://technet.microsoft.com/itpro/surface-hub/install-apps-on-surface-hub) | Admins can install apps can from either the Microsoft Store or the Microsoft Store for Business.|
+[Configure Surface Hub Start menu](surface-hub-start-menu.md) | Use MDM to customize the Start menu for Surface Hub.
| [Set up and use Whiteboard to Whiteboard collaboration](whiteboard-collaboration.md) | Microsoft Whiteboard’s latest update includes the capability for two Surface Hubs to collaborate in real time on the same board. |
| [End a meeting with End session](https://technet.microsoft.com/itpro/surface-hub/i-am-done-finishing-your-surface-hub-meeting) | At the end of a meeting, users can tap **End session** to clean up any sensitive data and prepare the device for the next meeting.|
| [Sign in to Surface Hub with Microsoft Authenticator](surface-hub-authenticator-app.md) | You can sign in to a Surface Hub without a password using the Microsoft Authenticator app, available on Android and iOS. |
diff --git a/devices/surface-hub/manage-windows-updates-for-surface-hub.md b/devices/surface-hub/manage-windows-updates-for-surface-hub.md
index ada7726198..0de4ed8d77 100644
--- a/devices/surface-hub/manage-windows-updates-for-surface-hub.md
+++ b/devices/surface-hub/manage-windows-updates-for-surface-hub.md
@@ -9,7 +9,7 @@ ms.sitesec: library
ms.pagetype: surfacehub
author: jdeckerms
ms.author: jdecker
-ms.date: 06/19/2017
+ms.date: 11/03/2017
ms.localizationpriority: medium
---
diff --git a/devices/surface-hub/miracast-over-infrastructure.md b/devices/surface-hub/miracast-over-infrastructure.md
index b171da8675..341ce3a1d0 100644
--- a/devices/surface-hub/miracast-over-infrastructure.md
+++ b/devices/surface-hub/miracast-over-infrastructure.md
@@ -7,7 +7,7 @@ ms.sitesec: library
ms.pagetype: surfacehub
author: jdeckerms
ms.author: jdecker
-ms.date: 06/19/2017
+ms.date: 08/03/2017
ms.localizationpriority: medium
---
diff --git a/devices/surface-hub/miracast-troubleshooting.md b/devices/surface-hub/miracast-troubleshooting.md
index 6b4edc0f44..f8843ffe57 100644
--- a/devices/surface-hub/miracast-troubleshooting.md
+++ b/devices/surface-hub/miracast-troubleshooting.md
@@ -7,7 +7,7 @@ ms.sitesec: library
ms.pagetype: surfacehub
author: jdeckerms
ms.author: jdecker
-ms.date: 06/19/2017
+ms.date: 07/27/2017
ms.localizationpriority: medium
---
diff --git a/devices/surface-hub/monitor-surface-hub.md b/devices/surface-hub/monitor-surface-hub.md
index d90926b6e8..7fe0d6aeff 100644
--- a/devices/surface-hub/monitor-surface-hub.md
+++ b/devices/surface-hub/monitor-surface-hub.md
@@ -9,7 +9,7 @@ ms.sitesec: library
ms.pagetype: surfacehub
author: jdeckerms
ms.author: jdecker
-ms.date: 06/19/2017
+ms.date: 07/27/2017
ms.localizationpriority: medium
---
@@ -86,7 +86,7 @@ This table describes the sample queries in the Surface Hub solution:
| Alert type | Impact | Recommended remediation | Details |
| ---------- | ------ | ----------------------- | ------- |
-| Software | Error | **Reboot the device**. Reboot manually, or using the [Reboot configuration service provider](https://msdn.microsoft.com/en-us/library/windows/hardware/mt720802(v=vs.85).aspx). Suggest doing this between meetings to minimize impact to your people in your organization. | Trigger conditions: - A critical process in the Surface Hub operating system, such as the shell, projection, or Skype, crashes or becomes non-responsive. - The device hasn't reported a heartbeat in the past 24 hours. This may be due to network connectivity issue or network-related hardware failure, or an error with the telemetry reporting system. |
+| Software | Error | **Reboot the device**. Reboot manually, or using the [Reboot configuration service provider](https://msdn.microsoft.com/en-us/library/windows/hardware/mt720802(v=vs.85).aspx). Suggest doing this between meetings to minimize impact to your people in your organization. | Trigger conditions: - A critical process in the Surface Hub operating system, such as the shell, projection, or Skype, crashes or becomes non-responsive. - The device hasn't reported a heartbeat in the past 24 hours. This may be due to network connectivity issue or network-related hardware failure, or an error with the diagnostic data reporting system. |
| Software | Error | **Check your Exchange service**. Verify: - The service is available. - The device account password is up to date – see [Password management](password-management-for-surface-hub-device-accounts.md) for details.| Triggers when there's an error syncing the device calendar with Exchange. |
| Software | Error | **Check your Skype for Business service**. Verify: - The service is available. - The device account password is up to date – see [Password management](password-management-for-surface-hub-device-accounts.md) for details. - The domain name for Skype for Business is properly configured - see [Configure a domain name](use-fully-qualified-domain-name-surface-hub.md). | Triggers when Skype fails to sign in. |
| Software | Error | **Reset the device**. This takes some time, so you should take the device offline. For more information, see [Device reset](device-reset-surface-hub.md).| Triggers when there is an error cleaning up user and app data at the end of a session. When this operation repeatedly fails, the device is locked to protect user data. You must reset the device to continue. |
diff --git a/devices/surface-hub/on-premises-deployment-surface-hub-device-accounts.md b/devices/surface-hub/on-premises-deployment-surface-hub-device-accounts.md
index 12476b218a..7ef2ae24a6 100644
--- a/devices/surface-hub/on-premises-deployment-surface-hub-device-accounts.md
+++ b/devices/surface-hub/on-premises-deployment-surface-hub-device-accounts.md
@@ -9,7 +9,7 @@ ms.sitesec: library
ms.pagetype: surfacehub
author: jdeckerms
ms.author: jdecker
-ms.date: 06/19/2017
+ms.date: 07/27/2017
ms.localizationpriority: medium
---
diff --git a/devices/surface-hub/on-premises-deployment-surface-hub-multi-forest.md b/devices/surface-hub/on-premises-deployment-surface-hub-multi-forest.md
index 049a77fe9d..9456eb9891 100644
--- a/devices/surface-hub/on-premises-deployment-surface-hub-multi-forest.md
+++ b/devices/surface-hub/on-premises-deployment-surface-hub-multi-forest.md
@@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: surfacehub
author: jdeckerms
ms.author: jdecker
-ms.date: 06/19/2017
+ms.date: 07/27/2017
ms.localizationpriority: medium
---
diff --git a/devices/surface-hub/online-deployment-surface-hub-device-accounts.md b/devices/surface-hub/online-deployment-surface-hub-device-accounts.md
index 91423ffc82..6dc990e855 100644
--- a/devices/surface-hub/online-deployment-surface-hub-device-accounts.md
+++ b/devices/surface-hub/online-deployment-surface-hub-device-accounts.md
@@ -9,7 +9,7 @@ ms.sitesec: library
ms.pagetype: surfacehub
author: jdeckerms
ms.author: jdecker
-ms.date: 06/19/2017
+ms.date: 08/29/2017
ms.localizationpriority: medium
---
diff --git a/devices/surface-hub/password-management-for-surface-hub-device-accounts.md b/devices/surface-hub/password-management-for-surface-hub-device-accounts.md
index bd6ee1ab26..859034da95 100644
--- a/devices/surface-hub/password-management-for-surface-hub-device-accounts.md
+++ b/devices/surface-hub/password-management-for-surface-hub-device-accounts.md
@@ -9,7 +9,7 @@ ms.sitesec: library
ms.pagetype: surfacehub, security
author: jdeckerms
ms.author: jdecker
-ms.date: 06/19/2017
+ms.date: 07/27/2017
ms.localizationpriority: medium
---
diff --git a/devices/surface-hub/physically-install-your-surface-hub-device.md b/devices/surface-hub/physically-install-your-surface-hub-device.md
index 25d9589595..dc9cdf25ad 100644
--- a/devices/surface-hub/physically-install-your-surface-hub-device.md
+++ b/devices/surface-hub/physically-install-your-surface-hub-device.md
@@ -9,7 +9,7 @@ ms.sitesec: library
ms.pagetype: surfacehub, readiness
author: jdeckerms
ms.author: jdecker
-ms.date: 06/19/2017
+ms.date: 07/27/2017
ms.localizationpriority: medium
---
diff --git a/devices/surface-hub/prepare-your-environment-for-surface-hub.md b/devices/surface-hub/prepare-your-environment-for-surface-hub.md
index 37027821a8..077e16a6a5 100644
--- a/devices/surface-hub/prepare-your-environment-for-surface-hub.md
+++ b/devices/surface-hub/prepare-your-environment-for-surface-hub.md
@@ -9,7 +9,7 @@ ms.sitesec: library
ms.pagetype: surfacehub
author: jdeckerms
ms.author: jdecker
-ms.date: 07/27/2017
+ms.date: 12/04/2017
ms.localizationpriority: medium
---
@@ -40,9 +40,9 @@ Depending on your environment, access to additional ports may be needed:
- For online environments, see [Office 365 IP URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US).
- For on-premises installations, see [Skype for Business Server: Ports and protocols for internal servers](https://technet.microsoft.com/library/gg398833.aspx).
-Microsoft collects telemetry to help improve your Surface Hub experience. Add these sites to your allow list:
-- Telemetry client endpoint: `https://vortex.data.microsoft.com/`
-- Telemetry settings endpoint: `https://settings.data.microsoft.com/`
+Microsoft collects diagnostic data to help improve your Surface Hub experience. Add these sites to your allow list:
+- Diagnostic data client endpoint: `https://vortex.data.microsoft.com/`
+- Diagnostic data settings endpoint: `https://settings.data.microsoft.com/`
### Proxy configuration
diff --git a/devices/surface-hub/provisioning-packages-for-surface-hub.md b/devices/surface-hub/provisioning-packages-for-surface-hub.md
index 4c8f42d3cf..b357f97f9c 100644
--- a/devices/surface-hub/provisioning-packages-for-surface-hub.md
+++ b/devices/surface-hub/provisioning-packages-for-surface-hub.md
@@ -9,7 +9,7 @@ ms.sitesec: library
ms.pagetype: surfacehub
author: jdeckerms
ms.author: jdecker
-ms.date: 06/19/2017
+ms.date: 07/27/2017
ms.localizationpriority: medium
---
diff --git a/devices/surface-hub/remote-surface-hub-management.md b/devices/surface-hub/remote-surface-hub-management.md
index 7511c69e12..e57046e72c 100644
--- a/devices/surface-hub/remote-surface-hub-management.md
+++ b/devices/surface-hub/remote-surface-hub-management.md
@@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: surfacehub
author: jdeckerms
ms.author: jdecker
-ms.date: 06/19/2017
+ms.date: 07/27/2017
ms.localizationpriority: medium
---
diff --git a/devices/surface-hub/save-bitlocker-key-surface-hub.md b/devices/surface-hub/save-bitlocker-key-surface-hub.md
index 7b7a9953bf..a872c380d5 100644
--- a/devices/surface-hub/save-bitlocker-key-surface-hub.md
+++ b/devices/surface-hub/save-bitlocker-key-surface-hub.md
@@ -9,7 +9,7 @@ ms.sitesec: library
ms.pagetype: surfacehub, security
author: jdeckerms
ms.author: jdecker
-ms.date: 06/19/2017
+ms.date: 07/27/2017
ms.localizationpriority: medium
---
diff --git a/devices/surface-hub/set-up-your-surface-hub.md b/devices/surface-hub/set-up-your-surface-hub.md
index 435554c0f4..4a88209a97 100644
--- a/devices/surface-hub/set-up-your-surface-hub.md
+++ b/devices/surface-hub/set-up-your-surface-hub.md
@@ -9,7 +9,7 @@ ms.sitesec: library
ms.pagetype: surfacehub
author: jdeckerms
ms.author: jdecker
-ms.date: 06/19/2017
+ms.date: 07/27/2017
ms.localizationpriority: medium
---
diff --git a/devices/surface-hub/setup-worksheet-surface-hub.md b/devices/surface-hub/setup-worksheet-surface-hub.md
index 804434fe6a..06234fe14a 100644
--- a/devices/surface-hub/setup-worksheet-surface-hub.md
+++ b/devices/surface-hub/setup-worksheet-surface-hub.md
@@ -9,7 +9,7 @@ ms.sitesec: library
ms.pagetype: surfacehub
author: jdeckerms
ms.author: jdecker
-ms.date: 06/19/2017
+ms.date: 07/27/2017
ms.localizationpriority: medium
---
diff --git a/devices/surface-hub/skype-hybrid-voice.md b/devices/surface-hub/skype-hybrid-voice.md
index 569446d7bd..4f3303c2c2 100644
--- a/devices/surface-hub/skype-hybrid-voice.md
+++ b/devices/surface-hub/skype-hybrid-voice.md
@@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: surfacehub
author: jdeckerms
ms.author: jdecker
-ms.date: 06/19/2017
+ms.date: 07/27/2017
ms.localizationpriority: medium
---
diff --git a/devices/surface-hub/surface-hub-authenticator-app.md b/devices/surface-hub/surface-hub-authenticator-app.md
index d859d73c38..c00bb03bbb 100644
--- a/devices/surface-hub/surface-hub-authenticator-app.md
+++ b/devices/surface-hub/surface-hub-authenticator-app.md
@@ -7,7 +7,7 @@ ms.sitesec: library
ms.pagetype: surfacehub
author: jdeckerms
ms.author: jdecker
-ms.date: 07/27/2017
+ms.date: 08/28/2017
localizationpriority: medium
---
diff --git a/devices/surface-hub/surface-hub-downloads.md b/devices/surface-hub/surface-hub-downloads.md
index 10a0151d96..838e8452a9 100644
--- a/devices/surface-hub/surface-hub-downloads.md
+++ b/devices/surface-hub/surface-hub-downloads.md
@@ -7,7 +7,7 @@ ms.sitesec: library
ms.pagetype: surfacehub
author: jdeckerms
ms.author: jdecker
-ms.date: 06/19/2017
+ms.date: 08/22/2017
ms.localizationpriority: medium
---
diff --git a/devices/surface-hub/surface-hub-start-menu.md b/devices/surface-hub/surface-hub-start-menu.md
new file mode 100644
index 0000000000..0f3defa248
--- /dev/null
+++ b/devices/surface-hub/surface-hub-start-menu.md
@@ -0,0 +1,179 @@
+---
+title: Configure Surface Hub Start menu
+description: Use MDM to customize the Start menu on Surface Hub.
+ms.prod: w10
+ms.mktglfcycl: manage
+ms.sitesec: library
+ms.pagetype: surfacehub
+author: jdeckerms
+ms.author: jdecker
+ms.date: 01/17/2018
+ms.localizationpriority: medium
+---
+
+# Configure Surface Hub Start menu
+
+The [January 17, 2018 update to Windows 10](https://support.microsoft.com/help/4057144) (build 15063.877) enables customized Start menus on Surface Hub devices. You apply the customized Start menu layout using mobile device management (MDM).
+
+When you apply a customized Start menu layout to Surface Hub, users cannot pin, unpin, or uninstall apps from Start.
+
+## How to apply a customized Start menu to Surface Hub
+
+The customized Start menu is defined in a Start layout XML file. You have two options for creating your Start layout XML file:
+
+- Edit the [default Surface Hub Start XML](#default)
+
+ -or-
+
+- Configure the desired Start menu on a desktop (pinning only apps that are available on Surface Hub), and then [export the layout](https://docs.microsoft.com/windows/configuration/customize-and-export-start-layout#export-the-start-layout).
+
+>[!TIP]
+>To add a tile with a web link to your desktop start menu, go the the link in Microsoft Edge, select `...` in the top right corner, and select **Pin this page to Start**. See [a Start layout that includes a Microsoft Edge link](#edge) for an example of how links will appear in the XML.
+
+To edit the default XML or the exported layout, familiarize yourself with the [Start layout XML](https://docs.microsoft.com/en-us/windows/configuration/start-layout-xml-desktop). There are a few [differences between Start layout on a deskop and a Surface Hub.](#differences)
+
+When you have your Start menu defined in a Start layout XML, [create an MDM policy to apply the layout.](https://docs.microsoft.com/windows/configuration/customize-windows-10-start-screens-by-using-mobile-device-management#a-href-idbkmk-domaingpodeploymentacreate-a-policy-for-your-customized-start-layout)
+
+
+## Differences between Surface Hub and desktop Start menu
+
+There are a few key differences between Start menu customization for Surface Hub and a Windows 10 desktop:
+
+- You cannot use **DesktopApplicationTile** (https://docs.microsoft.com/en-us/windows/configuration/start-layout-xml-desktop#startdesktopapplicationtile) in your Start layout XML because Windows desktop applications (Win32) are not supported on Surface Hub.
+- You cannot use the Start layout XML to configure the taskbar or the Welcome screen for Surface Hub.
+- Surface Hub supports a maximum of 6 columns (6 1x1 tiles), however, you **must** define `GroupCellWidth=8` even though Surface Hub will only display tiles in columns 0-5, not columns 6 and 7.
+- Surface Hub supports a maximum 6 rows (6 1x1 tiles)
+- `SecondaryTile`, which is used for links, will open the link in Microsoft Edge.
+
+
+
+## Example: Default Surface Hub Start layout
+
+```xml
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+```
+
+
+## Example: Start layout that includes a Microsoft Edge link
+
+This example shows a link to a website and a link to a .pdf file.
+
+```xml
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+```
\ No newline at end of file
diff --git a/devices/surface-hub/surface-hub-wifi-direct.md b/devices/surface-hub/surface-hub-wifi-direct.md
index c351a69bb3..87de677e90 100644
--- a/devices/surface-hub/surface-hub-wifi-direct.md
+++ b/devices/surface-hub/surface-hub-wifi-direct.md
@@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: surfacehub
author: jdeckerms
ms.author: jdecker
-ms.date: 06/19/2017
+ms.date: 07/27/2017
ms.localizationpriority: medium
---
diff --git a/devices/surface-hub/surfacehub-whats-new-1703.md b/devices/surface-hub/surfacehub-whats-new-1703.md
index b7fb78beec..59ced8ff5d 100644
--- a/devices/surface-hub/surfacehub-whats-new-1703.md
+++ b/devices/surface-hub/surfacehub-whats-new-1703.md
@@ -7,7 +7,7 @@ ms.pagetype: devices
ms.sitesec: library
author: jdeckerms
ms.author: jdecker
-ms.date: 06/19/2017
+ms.date: 01/18/2018
ms.localizationpriority: medium
---
@@ -15,11 +15,9 @@ ms.localizationpriority: medium
Watch Surface Hub engineer Jordan Marchese present updates to Microsoft Surface Hub with Windows 10, version 1703 (Creators Update).
-
+
-Windows 10, version 1703 (also called the Creators Update), introduces the following changes for Microsoft Surface Hub:
+Windows 10, version 1703 (also called the Creators Update), introduces the following changes for Microsoft Surface Hub.
## New settings
@@ -40,7 +38,7 @@ Settings have been added to mobile device management (MDM) and configuration ser
Plus settings based on the new [NetworkQoSPolicy CSP](https://msdn.microsoft.com/en-us/windows/hardware/commercialize/customize/mdm/networkqospolicy-csp) and [NetworkProxy CSP](https://msdn.microsoft.com/en-us/windows/hardware/commercialize/customize/mdm/networkproxy-csp).
-## Provizioning wizard
+## Provisioning wizard
An easy-to-use wizard helps you quickly create provisioning packages that you can apply to multiple Surface Hub devices, and includes bulk join to Azure Active Directory. [Learn how to create a provisioning package for Surface Hub.](provisioning-packages-for-certificates-surface-hub.md)
diff --git a/devices/surface-hub/troubleshoot-surface-hub.md b/devices/surface-hub/troubleshoot-surface-hub.md
index 8fb31f0492..9b2ef8764a 100644
--- a/devices/surface-hub/troubleshoot-surface-hub.md
+++ b/devices/surface-hub/troubleshoot-surface-hub.md
@@ -9,7 +9,7 @@ ms.sitesec: library
ms.pagetype: surfacehub
author: jdeckerms
ms.author: jdecker
-ms.date: 06/19/2017
+ms.date: 09/07/2017
ms.localizationpriority: medium
---
@@ -524,7 +524,7 @@ This section lists status codes, mapping, user messages, and actions an admin ca
0x85002004
E_FAIL_ABORT
-
This error is used to interrupt the hanging sync, and will not be exposed to users. It will be shown in the telemetry if you force an interactive sync, delete the account, or update its settings.
+
This error is used to interrupt the hanging sync, and will not be exposed to users. It will be shown in the diagnostic data if you force an interactive sync, delete the account, or update its settings.
Nothing.
@@ -602,7 +602,7 @@ This section lists status codes, mapping, user messages, and actions an admin ca
## Related content
-- [Troubleshooting Miracast connection to the Surface Hub](https://blogs.msdn.microsoft.com/surfacehub/2017/01/30/troubleshooting-miracast-connection-to-the-surface-hub/)
+- [Troubleshooting Miracast connection to the Surface Hub](https://docs.microsoft.com/surface-hub/miracast-troubleshooting)
diff --git a/devices/surface-hub/use-fully-qualified-domain-name-surface-hub.md b/devices/surface-hub/use-fully-qualified-domain-name-surface-hub.md
index 056a710493..b108f07936 100644
--- a/devices/surface-hub/use-fully-qualified-domain-name-surface-hub.md
+++ b/devices/surface-hub/use-fully-qualified-domain-name-surface-hub.md
@@ -4,7 +4,7 @@ description: Troubleshoot common problems, including setup issues, Exchange Acti
keywords: ["Troubleshoot common problems", "setup issues", "Exchange ActiveSync errors"]
author: jdeckerms
ms.author: jdecker
-ms.date: 06/19/2017
+ms.date: 07/27/2017
ms.localizationpriority: medium
ms.prod: w10
ms.mktglfcycl: support
diff --git a/devices/surface-hub/use-room-control-system-with-surface-hub.md b/devices/surface-hub/use-room-control-system-with-surface-hub.md
index 5746904f3f..2ab4e26c88 100644
--- a/devices/surface-hub/use-room-control-system-with-surface-hub.md
+++ b/devices/surface-hub/use-room-control-system-with-surface-hub.md
@@ -9,7 +9,7 @@ ms.sitesec: library
ms.pagetype: surfacehub
author: jdeckerms
ms.author: jdecker
-ms.date: 06/19/2017
+ms.date: 07/27/2017
ms.localizationpriority: medium
---
diff --git a/devices/surface-hub/wireless-network-management-for-surface-hub.md b/devices/surface-hub/wireless-network-management-for-surface-hub.md
index 434cef3e19..b9348bc48d 100644
--- a/devices/surface-hub/wireless-network-management-for-surface-hub.md
+++ b/devices/surface-hub/wireless-network-management-for-surface-hub.md
@@ -9,7 +9,7 @@ ms.sitesec: library
ms.pagetype: surfacehub, networking
author: jdeckerms
ms.author: jdecker
-ms.date: 06/19/2017
+ms.date: 07/27/2017
ms.localizationpriority: medium
---
diff --git a/devices/surface/TOC.md b/devices/surface/TOC.md
index 27d7b79e79..778c88fa47 100644
--- a/devices/surface/TOC.md
+++ b/devices/surface/TOC.md
@@ -1,6 +1,7 @@
# [Surface](index.md)
## [Deploy Surface devices](deploy.md)
-### [Surface device compatibility with Windows 10 Long-Term Servicing Branch](surface-device-compatibility-with-windows-10-ltsb.md)
+### [Windows AutoPilot and Surface devices](windows-autopilot-and-surface-devices.md)
+### [Surface device compatibility with Windows 10 Long-Term Servicing Branch](surface-device-compatibility-with-windows-10-ltsc.md)
#### [Long-Term Servicing Branch for Surface devices](ltsb-for-surface.md)
### [Deploy Windows 10 to Surface devices with MDT](deploy-windows-10-to-surface-devices-with-mdt.md)
### [Upgrade Surface devices to Windows 10 with MDT](upgrade-surface-devices-to-windows-10-with-mdt.md)
diff --git a/devices/surface/advanced-uefi-security-features-for-surface-pro-3.md b/devices/surface/advanced-uefi-security-features-for-surface-pro-3.md
index 1116a30c12..4e5dde8200 100644
--- a/devices/surface/advanced-uefi-security-features-for-surface-pro-3.md
+++ b/devices/surface/advanced-uefi-security-features-for-surface-pro-3.md
@@ -9,6 +9,7 @@ ms.mktglfcycl: manage
ms.pagetype: surface, devices, security
ms.sitesec: library
author: miladCA
+ms.date: 07/27/2017
---
# Advanced UEFI security features for Surface Pro 3
diff --git a/devices/surface/change-history-for-surface.md b/devices/surface/change-history-for-surface.md
index c64127383f..d115d86ecf 100644
--- a/devices/surface/change-history-for-surface.md
+++ b/devices/surface/change-history-for-surface.md
@@ -5,12 +5,28 @@ ms.prod: w10
ms.mktglfcycl: manage
ms.sitesec: library
author: jdeckerms
+ms.date: 01/29/2018
---
# Change history for Surface documentation
This topic lists new and updated topics in the Surface documentation library.
+## January 2018
+
+|New or changed topic | Description |
+| --- | --- |
+|[Windows AutoPilot and Surface devices](windows-autopilot-and-surface-devices.md) | New article |
+|[Microsoft Surface Data Eraser](microsoft-surface-data-eraser.md) | Added version 3.2.45 information |
+|[Surface device compatibility with Windows 10 Long-Term Servicing Channel (LTSC)](surface-device-compatibility-with-windows-10-ltsc.md) | Updated Current Branch (CB) or Current Branch for Business (CBB) servicing options with Semi-Annual Channel (SAC) information |
+|[Wake On LAN for Surface devices](wake-on-lan-for-surface-devices.md) | Added Surface Book 2, Surface Laptop, Surface Pro, Surface Pro with LTE Advanced, and Surface Pro information |
+
+## December 2017
+
+|New or changed topic | Description |
+| --- | --- |
+|[Download the latest firmware and drivers for Surface devices](deploy-the-latest-firmware-and-drivers-for-surface-devices.md) | Added Surface Book 2, Surface Laptop, Surface Pro, and Surface Pro with LTE Advanced information |
+
## November 2017
|New or changed topic | Description |
@@ -42,7 +58,7 @@ New or changed topic | Description
|New or changed topic | Description |
| --- | --- |
-|[Surface device compatibility with Windows 10 Long-Term Servicing Branch](surface-device-compatibility-with-windows-10-ltsb.md) | New (supersedes [Long-Term Servicing Branch for Surface devices](ltsb-for-surface.md))|
+|[Surface device compatibility with Windows 10 Long-Term Servicing Branch](surface-device-compatibility-with-windows-10-ltsc.md) | New (supersedes [Long-Term Servicing Branch for Surface devices](ltsb-for-surface.md))|
## January 2017
diff --git a/devices/surface/considerations-for-surface-and-system-center-configuration-manager.md b/devices/surface/considerations-for-surface-and-system-center-configuration-manager.md
index 542ff44ce7..7f1ca137fd 100644
--- a/devices/surface/considerations-for-surface-and-system-center-configuration-manager.md
+++ b/devices/surface/considerations-for-surface-and-system-center-configuration-manager.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.pagetype: surface, devices
ms.sitesec: library
author: Scottmca
+ms.date: 10/16/2017
---
# Considerations for Surface and System Center Configuration Manager
diff --git a/devices/surface/customize-the-oobe-for-surface-deployments.md b/devices/surface/customize-the-oobe-for-surface-deployments.md
index 1f50da1b95..b05c06e3ef 100644
--- a/devices/surface/customize-the-oobe-for-surface-deployments.md
+++ b/devices/surface/customize-the-oobe-for-surface-deployments.md
@@ -9,6 +9,7 @@ ms.mktglfcycl: deploy
ms.pagetype: surface, devices
ms.sitesec: library
author: jobotto
+ms.date: 07/27/2017
---
# Customize the OOBE for Surface deployments
diff --git a/devices/surface/deploy-surface-app-with-windows-store-for-business.md b/devices/surface/deploy-surface-app-with-windows-store-for-business.md
index a9d29612a7..00d28623aa 100644
--- a/devices/surface/deploy-surface-app-with-windows-store-for-business.md
+++ b/devices/surface/deploy-surface-app-with-windows-store-for-business.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.pagetype: surface, store
ms.sitesec: library
author: miladCA
+ms.date: 09/21/2017
---
#Deploy Surface app with Microsoft Store for Business and Education
diff --git a/devices/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices.md b/devices/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices.md
index 96fa078066..d535905d0d 100644
--- a/devices/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices.md
+++ b/devices/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices.md
@@ -8,7 +8,9 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.pagetype: surface, devices
ms.sitesec: library
-author: jobotto
+author: brecords
+ms.date: 12/07/2017
+ms.author: jdecker
---
# Download the latest firmware and drivers for Surface devices
@@ -40,22 +42,46 @@ Recent additions to the downloads for Surface devices provide you with options t
>A battery charge of 40% or greater is required before you install firmware to a Surface device. See [Microsoft Support article KB2909710](https://go.microsoft.com/fwlink/p/?LinkId=618106) for more information.
+## Surface Book 2
+
+
+Download the following updates for Surface Book 2 from the Microsoft Download Center.
+* SurfaceBook2_Win10_xxxxx_xxxxxx.msi – Cumulative firmware and driver update package for Windows 10
+
+## Surface Laptop
+
+
+Download the following updates for Surface Laptop from the Microsoft Download Center.
+* SurfaceLaptop_Win10_xxxxx_xxxxxx.msi – Cumulative firmware and driver update package for Windows 10
+
+## Surface Pro
+
+
+Download the following updates for Surface Pro (Model 1796) from the Microsoft Download Center.
+
+* SurfacePro_Win10_xxxxx_xxxxxx.msi – Cumulative firmware and driver update package for Windows 10
+
+## Surface Pro with LTE Advanced
+
+
+Download the following updates for Surface Pro with LTE Advanced from the Microsoft Download Center.
+* SurfacePro_LTE_Win10_xxxxx_xxxxxx.msi – Cumulative firmware and driver update package for Windows 10
## Surface Studio
+
Download the following updates for [Surface Studio from the Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=54311).
-* SurfaceStudio_Win10_xxxxxx.msi – Cumulative firmware and driver update package for Windows 10
-
+* SurfaceStudio_Win10_xxxxx_xxxxxx.msi – Cumulative firmware and driver update package for Windows 10
## Surface Book
Download the following updates [for Surface Book from the Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=49497).
-- SurfaceBook_Win10_xxxxxx.msi – Cumulative firmware and driver update package for Windows 10
+- SurfaceBook_Win10_xxxxx_xxxxxx.msi – Cumulative firmware and driver update package for Windows 10
-- SurfaceBook_Win10_xxxxxx.zip – Cumulative firmware and driver update package for Windows 10
+- SurfaceBook_Win10_xxxxx_xxxxxx.zip – Cumulative firmware and driver update package for Windows 10
- Wintab-xxxxx-64-bit.zip – Tablet driver update for all supported x64-based versions of Windows 8.1
@@ -64,9 +90,9 @@ Download the following updates [for Surface Book from the Microsoft Download Cen
Download the following updates for [Surface Pro 4 from the Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=49498).
-- SurfacePro4_Win10_xxxxxx.msi – Cumulative firmware and driver update package for Windows 10
+- SurfacePro4_Win10_xxxxx_xxxxxx.msi – Cumulative firmware and driver update package for Windows 10
-- SurfacePro4_Win10_xxxxxx.zip – Cumulative firmware and driver update package for Windows 10
+- SurfacePro4_Win10_xxxxx_xxxxxx.zip – Cumulative firmware and driver update package for Windows 10
- Wintab-xxxxx-64-bit.zip – Tablet driver update for all supported x64-based versions of Windows 8.1
@@ -75,13 +101,13 @@ Download the following updates for [Surface Pro 4 from the Microsoft Download Ce
Download the following updates [for Surface Pro 3 from the Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=38826).
-- SurfacePro3_Win10_xxxxxx.msi – Cumulative firmware and driver update package for Windows 10
+- SurfacePro3_Win10_xxxxx_xxxxxx.msi – Cumulative firmware and driver update package for Windows 10
-- SurfacePro3_Win10_xxxxxx.zip – Cumulative firmware and driver update package for Windows 10
+- SurfacePro3_Win10_xxxxx_xxxxxx.zip – Cumulative firmware and driver update package for Windows 10
-- SurfacePro3_Win8x_xxxxxx.msi – Cumulative firmware and driver update package for Windows 8.1 Pro
+- SurfacePro3_Win8x_xxxxx_xxxxxx.msi – Cumulative firmware and driver update package for Windows 8.1 Pro
-- SurfacePro3_Win8x_xxxxxx.zip – Cumulative firmware and driver update package for Windows 8.1 Pro
+- SurfacePro3_Win8x_xxxxx_xxxxxx.zip – Cumulative firmware and driver update package for Windows 8.1 Pro
- Surface Firmware Tool.msi – Firmware tools for UEFI management
@@ -98,13 +124,13 @@ Download the following updates [for Surface Pro 3 from the Microsoft Download Ce
Download the following updates [for Surface 3 from the Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=49040).
-- Surface3_WiFi_Win10_xxxxxx.msi – Cumulative firmware and driver update package for Windows 10
+- Surface3_WiFi_Win10_xxxxx_xxxxxx.msi – Cumulative firmware and driver update package for Windows 10
-- Surface3_WiFi_Win10_xxxxxx.zip – Cumulative firmware and driver update package for Windows 10
+- Surface3_WiFi_Win10_xxxxx_xxxxxx.zip – Cumulative firmware and driver update package for Windows 10
-- Surface3_WiFi_Win8x_xxxxxx.msi – Cumulative firmware and driver update package for Windows 8.1 Pro
+- Surface3_WiFi_Win8x_xxxxx_xxxxxx.msi – Cumulative firmware and driver update package for Windows 8.1 Pro
-- Surface3_WiFi_Win8x_xxxxxx.zip – Cumulative firmware and driver update package for Windows 8.1 Pro
+- Surface3_WiFi_Win8x_xxxxx_xxxxxx.zip – Cumulative firmware and driver update package for Windows 8.1 Pro
- Surface 3 AssetTag.zip – UEFI Asset Tag management tool
@@ -115,13 +141,13 @@ Download the following updates [for Surface 3 from the Microsoft Download Center
Download the following updates [for AT&T 4G LTE versions of Surface 3 from the Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=49039).
-- Surface3_4GLTE-ATT_Win10_xxxxxx.msi – Surface 3 LTE AT&T - Cumulative firmware and driver update for locked carrier dependent AT&T devices in the US, running Windows 10
+- Surface3_4GLTE-ATT_Win10_xxxxx_xxxxxx.msi – Surface 3 LTE AT&T - Cumulative firmware and driver update for locked carrier dependent AT&T devices in the US, running Windows 10
-- Surface3_4GLTE-ATT_Win10_xxxxxx.zip – Surface 3 LTE AT&T - Cumulative firmware and driver update for locked carrier dependent AT&T devices in the US, running Windows 10
+- Surface3_4GLTE-ATT_Win10_xxxxx_xxxxxx.zip – Surface 3 LTE AT&T - Cumulative firmware and driver update for locked carrier dependent AT&T devices in the US, running Windows 10
-- Surface3_4GLTE-ATT_Win8x_xxxxxx.msi – Surface 3 LTE AT&T - Cumulative firmware and driver update for locked carrier dependent AT&T devices in the US, running Windows 8.1 Pro
+- Surface3_4GLTE-ATT_Win8x_xxxxx_xxxxxx.msi – Surface 3 LTE AT&T - Cumulative firmware and driver update for locked carrier dependent AT&T devices in the US, running Windows 8.1 Pro
-- Surface3_4GLTE-ATT_Win8x_xxxxxx.zip – Surface 3 LTE AT&T - Cumulative firmware and driver update for locked carrier dependent AT&T devices in the US, running Windows 8.1 Pro
+- Surface3_4GLTE-ATT_Win8x_xxxxx_xxxxxx.zip – Surface 3 LTE AT&T - Cumulative firmware and driver update for locked carrier dependent AT&T devices in the US, running Windows 8.1 Pro
- Surface 3 AssetTag.zip – UEFI Asset Tag management tool
@@ -129,13 +155,13 @@ Download the following updates [for AT&T 4G LTE versions of Surface 3 from the M
Download the following updates [for non-AT&T 4G LTE versions of Surface 3 from the Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=49037).
-- Surface3_4GLTE-NorthAmericaUnlocked_Win10_xxxxxx.msi – Surface 3 LTE North America - Cumulative firmware and driver update for unlocked carrier independent devices in the US, running Windows 10
+- Surface3_4GLTE-NorthAmericaUnlocked_Win10_xxxxx_xxxxxx.msi – Surface 3 LTE North America - Cumulative firmware and driver update for unlocked carrier independent devices in the US, running Windows 10
-- Surface3_4GLTE-NorthAmericaUnlocked_Win10_xxxxxx.zip – Surface 3 LTE North America - Cumulative firmware and driver update for unlocked carrier independent devices in the US, running Windows 10
+- Surface3_4GLTE-NorthAmericaUnlocked_Win10_xxxxx_xxxxxx.zip – Surface 3 LTE North America - Cumulative firmware and driver update for unlocked carrier independent devices in the US, running Windows 10
-- Surface3_4GLTE-NorthAmericaUnlocked_Win8x_xxxxxx.msi – Surface 3 LTE North America - Cumulative firmware and driver update for unlocked carrier independent devices in the US, running Windows 8.1 Pro
+- Surface3_4GLTE-NorthAmericaUnlocked_Win8x_xxxxx_xxxxxx.msi – Surface 3 LTE North America - Cumulative firmware and driver update for unlocked carrier independent devices in the US, running Windows 8.1 Pro
-- Surface3_4GLTE-NorthAmericaUnlocked_Win8x_xxxxxx.zip – Surface 3 LTE North America - Cumulative firmware and driver update for unlocked carrier independent devices in the US, running Windows 8.1 Pro
+- Surface3_4GLTE-NorthAmericaUnlocked_Win8x_xxxxx_xxxxxx.zip – Surface 3 LTE North America - Cumulative firmware and driver update for unlocked carrier independent devices in the US, running Windows 8.1 Pro
- Surface 3 AssetTag.zip – UEFI Asset Tag management tool
@@ -143,13 +169,13 @@ Download the following updates [for non-AT&T 4G LTE versions of Surface 3 from t
Download the following updates [for 4G LTE Surface 3 versions for regions outside North America from the Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=49041).
-- Surface3_4GLTE-RestOfTheWorld_Win10_xxxxxx.msi – Surface 3 LTE rest of the world cumulative - Cumulative firmware and driver update for carrier independent devices outside of the US, as well as for Japan, running Windows 10
+- Surface3_4GLTE-RestOfTheWorld_Win10_xxxxx_xxxxxx.msi – Surface 3 LTE rest of the world cumulative - Cumulative firmware and driver update for carrier independent devices outside of the US, as well as for Japan, running Windows 10
-- Surface3_4GLTE-RestOfTheWorld_Win10_xxxxxx.zip – Surface 3 LTE rest of the world cumulative - Cumulative firmware and driver update for carrier independent devices outside of the US, as well as for Japan, running Windows 10
+- Surface3_4GLTE-RestOfTheWorld_Win10_xxxxx_xxxxxx.zip – Surface 3 LTE rest of the world cumulative - Cumulative firmware and driver update for carrier independent devices outside of the US, as well as for Japan, running Windows 10
-- Surface3_4GLTE-RestOfTheWorld_Win8x_xxxxxx.msi – Surface 3 LTE rest of the world cumulative - Cumulative firmware and driver update for carrier independent devices outside of the US, as well as for Japan, running Windows 8.1 Pro
+- Surface3_4GLTE-RestOfTheWorld_Win8x_xxxxx_xxxxxx.msi – Surface 3 LTE rest of the world cumulative - Cumulative firmware and driver update for carrier independent devices outside of the US, as well as for Japan, running Windows 8.1 Pro
-- Surface3_4GLTE-RestOfTheWorld_Win8x_xxxxxx.zip – Surface 3 LTE rest of the world cumulative - Cumulative firmware and driver update for carrier independent devices outside of the US, as well as for Japan, running Windows 8.1 Pro
+- Surface3_4GLTE-RestOfTheWorld_Win8x_xxxxx_xxxxxx.zip – Surface 3 LTE rest of the world cumulative - Cumulative firmware and driver update for carrier independent devices outside of the US, as well as for Japan, running Windows 8.1 Pro
- Surface 3 AssetTag.zip – UEFI Asset Tag management tool
@@ -173,7 +199,7 @@ Download the following updates [for Surface Pro 2 from the Microsoft Download Ce
## Surface Pro
-Download the following updates [for Surface Pro from the Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=49038).
+Download the following updates [for Surface Pro (Model 1514) from the Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=49038).
- SurfacePro\_Win10\_xxxxxx.zip – Cumulative firmware and driver update package for Windows 10
diff --git a/devices/surface/deploy-windows-10-to-surface-devices-with-mdt.md b/devices/surface/deploy-windows-10-to-surface-devices-with-mdt.md
index f6b63353f6..d0ec9f01fe 100644
--- a/devices/surface/deploy-windows-10-to-surface-devices-with-mdt.md
+++ b/devices/surface/deploy-windows-10-to-surface-devices-with-mdt.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.pagetype: surface
ms.sitesec: library
author: Scottmca
+ms.date: 10/16/2017
---
# Deploy Windows 10 to Surface devices with Microsoft Deployment Toolkit
diff --git a/devices/surface/deploy.md b/devices/surface/deploy.md
index 3753718aef..a52eef5395 100644
--- a/devices/surface/deploy.md
+++ b/devices/surface/deploy.md
@@ -5,7 +5,9 @@ ms.prod: w10
ms.mktglfcycl: manage
ms.pagetype: surface, devices
ms.sitesec: library
-author: heatherpoulsen
+author: brecords
+ms.date: 01/29/2018
+ms.author: jdecker
---
# Deploy Surface devices
@@ -16,7 +18,8 @@ Get deployment guidance for your Surface devices including information about MDT
| Topic | Description |
| --- | --- |
-| [Surface device compatibility with Windows 10 Long-Term Servicing Branch](surface-device-compatibility-with-windows-10-ltsb.md) | Find out about compatibility and limitations of Surface devices running Windows 10 Enterprise LTSB edition. |
+| [Windows AutoPilot and Surface devices](windows-autopilot-and-surface-devices.md) | Find out how to remotely deploy and configure devices with Windows AutoPilot. |
+| [Surface device compatibility with Windows 10 Long-Term Servicing Channel](surface-device-compatibility-with-windows-10-ltsc.md) | Find out about compatibility and limitations of Surface devices running Windows 10 Enterprise LTSC edition. |
| [Deploy Windows 10 to Surface devices with MDT](deploy-windows-10-to-surface-devices-with-mdt.md) | Walk through the recommended process of how to deploy Windows 10 to your Surface devices with the Microsoft Deployment Toolkit.|
| [Upgrade Surface devices to Windows 10 with MDT](upgrade-surface-devices-to-windows-10-with-mdt.md)| Find out how to perform a Windows 10 upgrade deployment to your Surface devices. |
| [Customize the OOBE for Surface deployments](customize-the-oobe-for-surface-deployments.md)| Walk through the process of customizing the Surface out-of-box experience for end users in your organization.|
diff --git a/devices/surface/enable-peap-eap-fast-and-cisco-leap-on-surface-devices.md b/devices/surface/enable-peap-eap-fast-and-cisco-leap-on-surface-devices.md
index 09f3d1463d..e5e7084262 100644
--- a/devices/surface/enable-peap-eap-fast-and-cisco-leap-on-surface-devices.md
+++ b/devices/surface/enable-peap-eap-fast-and-cisco-leap-on-surface-devices.md
@@ -9,6 +9,7 @@ ms.mktglfcycl: deploy
ms.pagetype: surface, devices
ms.sitesec: library
author: miladCA
+ms.date: 07/27/2017
---
# Enable PEAP, EAP-FAST, and Cisco LEAP on Surface devices
diff --git a/devices/surface/enroll-and-configure-surface-devices-with-semm.md b/devices/surface/enroll-and-configure-surface-devices-with-semm.md
index 50ecdc81a9..1b21185ebd 100644
--- a/devices/surface/enroll-and-configure-surface-devices-with-semm.md
+++ b/devices/surface/enroll-and-configure-surface-devices-with-semm.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: manage
ms.pagetype: surface, devices, security
ms.sitesec: library
author: jobotto
+ms.date: 01/06/2017
---
# Enroll and configure Surface devices with SEMM
diff --git a/devices/surface/ethernet-adapters-and-surface-device-deployment.md b/devices/surface/ethernet-adapters-and-surface-device-deployment.md
index 4ebec35606..70a83684af 100644
--- a/devices/surface/ethernet-adapters-and-surface-device-deployment.md
+++ b/devices/surface/ethernet-adapters-and-surface-device-deployment.md
@@ -9,6 +9,7 @@ ms.mktglfcycl: deploy
ms.pagetype: surface, devices
ms.sitesec: library
author: jobotto
+ms.date: 07/27/2017
---
# Ethernet adapters and Surface deployment
diff --git a/devices/surface/index.md b/devices/surface/index.md
index 75d7f71807..e9007ff9b0 100644
--- a/devices/surface/index.md
+++ b/devices/surface/index.md
@@ -8,6 +8,7 @@ ms.mktglfcycl: manage
ms.pagetype: surface, devices
ms.sitesec: library
author: heatherpoulsen
+ms.date: 10/16/2017
---
# Surface
diff --git a/devices/surface/ltsb-for-surface.md b/devices/surface/ltsb-for-surface.md
index a2836613a7..a4c9d85f83 100644
--- a/devices/surface/ltsb-for-surface.md
+++ b/devices/surface/ltsb-for-surface.md
@@ -6,12 +6,13 @@ ms.mktglfcycl: manage
ms.pagetype: surface, devices
ms.sitesec: library
author: jdeckerms
+ms.date: 04/25/2017
---
# Long-Term Servicing Branch (LTSB) for Surface devices
>[!WARNING]
->For updated information on this topic, see [Surface device compatibility with Windows 10 Long-Term Servicing Branch](surface-device-compatibility-with-windows-10-ltsb.md). For additional information on this update, see the [Documentation Updates for Surface and Windows 10 LTSB Compatibility](https://blogs.technet.microsoft.com/surface/2017/04/11/documentation-updates-for-surface-and-windows-10-ltsb-compatibility) post on the Surface Blog for IT Pros.
+>For updated information on this topic, see [Surface device compatibility with Windows 10 Long-Term Servicing Channel](surface-device-compatibility-with-windows-10-ltsc.md). For additional information on this update, see the [Documentation Updates for Surface and Windows 10 LTSB Compatibility](https://blogs.technet.microsoft.com/surface/2017/04/11/documentation-updates-for-surface-and-windows-10-ltsb-compatibility) post on the Surface Blog for IT Pros.
General-purpose Surface devices running Long-Term Servicing Branch (LTSB) are not supported. As a general guideline, if a Surface device runs productivity software, such as Microsoft Office, it is a general-purpose device that does not qualify for LTSB and should instead run Current Branch (CB) or Current Branch for Business (CBB).
diff --git a/devices/surface/manage-surface-dock-firmware-updates.md b/devices/surface/manage-surface-dock-firmware-updates.md
index 02c59dfdbb..e25ba31621 100644
--- a/devices/surface/manage-surface-dock-firmware-updates.md
+++ b/devices/surface/manage-surface-dock-firmware-updates.md
@@ -9,6 +9,7 @@ ms.mktglfcycl: manage
ms.pagetype: surface, devices
ms.sitesec: library
author: jobotto
+ms.date: 07/27/2017
---
# Manage Surface Dock firmware updates
diff --git a/devices/surface/manage-surface-pro-3-firmware-updates.md b/devices/surface/manage-surface-pro-3-firmware-updates.md
index 2a21c48dde..69e97eaf87 100644
--- a/devices/surface/manage-surface-pro-3-firmware-updates.md
+++ b/devices/surface/manage-surface-pro-3-firmware-updates.md
@@ -9,6 +9,7 @@ ms.mktglfcycl: manage
ms.pagetype: surface, devices
ms.sitesec: library
author: jobotto
+ms.date: 07/27/2017
---
# Manage Surface driver and firmware updates
diff --git a/devices/surface/manage-surface-uefi-settings.md b/devices/surface/manage-surface-uefi-settings.md
index 1e675594b7..4b154c0a9a 100644
--- a/devices/surface/manage-surface-uefi-settings.md
+++ b/devices/surface/manage-surface-uefi-settings.md
@@ -8,6 +8,7 @@ ms.mktglfcycl: manage
ms.sitesec: library
ms.pagetype: devices, surface
author: miladCA
+ms.date: 07/27/2017
---
#Manage Surface UEFI settings
diff --git a/devices/surface/microsoft-surface-data-eraser.md b/devices/surface/microsoft-surface-data-eraser.md
index 00d3409f91..fd67224039 100644
--- a/devices/surface/microsoft-surface-data-eraser.md
+++ b/devices/surface/microsoft-surface-data-eraser.md
@@ -8,8 +8,9 @@ ms.prod: w10
ms.mktglfcycl: manage
ms.pagetype: surface, devices, security
ms.sitesec: library
-author: miladCA
-ms.date: 06/29/2017
+author: brecords
+ms.author: jdecker
+ms.date: 01/03/2018
---
# Microsoft Surface Data Eraser
@@ -24,26 +25,17 @@ Find out how the Microsoft Surface Data Eraser tool can help you securely wipe d
Compatible Surface devices include:
-- Surface Studio
-
-- Surface Pro
-
-- Surface Laptop
-
-- Surface Book
-
-- Surface Pro 4
-
-- Surface Pro 3
-
-- Surface 3
-
-- Surface 3 LTE
-
-- Surface Pro 2
-
->[!NOTE]
->Surface Pro devices with 1 TB storage are not currently supported by Microsoft Surface Data Eraser.
+* Surface Book 2
+* Surface Pro with LTE Advanced (Model 1807)
+* Surface Pro (Model 1796)
+* Surface Laptop
+* Surface Studio
+* Surface Book
+* Surface Pro 4
+* Surface 3 LTE
+* Surface 3
+* Surface Pro 3
+* Surface Pro 2
Some scenarios where Microsoft Surface Data Eraser can be helpful include:
@@ -151,6 +143,20 @@ After you create a Microsoft Surface Data Eraser USB stick, you can boot a suppo
Microsoft Surface Data Eraser is periodically updated by Microsoft. For information about the changes provided in each new version, see the following:
+### Version 3.2.45
+
+This version of Microsoft Surface Data Eraser adds support for the following:
+
+- Surface Book 2
+
+- Surface Pro with LTE Advanced
+
+- Surface Pro 1TB
+
+>[!NOTE]
+>Surface Data Eraser v3.2.45 and above can be used to restore Surface Pro or Surface Laptop devices with the 1TB storage option in the scenario that the device shows two separate 512GB volumes or encounters errors when attempting to deploy or install Windows 10. See [Surface Pro Model 1796 and Surface Laptop 1TB display two drives](https://support.microsoft.com/en-us/help/4046105/surface-pro-model-1796-and-surface-laptop-1tb-display-two-drives) for more information.
+
+
### Version 3.2.36
This version of Microsoft Surface Data Eraser adds support for the following:
@@ -161,10 +167,3 @@ This version of Microsoft Surface Data Eraser adds support for the following:
>[!NOTE]
>The Microsoft Surface Data Eraser USB drive creation tool is unable to run on Windows 10 S. To wipe a Surface Laptop running Windows 10 S, you must first create the Microsoft Surface Data Eraser USB drive on another computer with Windows 10 Pro or Windows 10 Enterprise.
-
-
-
-
-
-
-
diff --git a/devices/surface/microsoft-surface-deployment-accelerator.md b/devices/surface/microsoft-surface-deployment-accelerator.md
index 564aadec7a..631198f085 100644
--- a/devices/surface/microsoft-surface-deployment-accelerator.md
+++ b/devices/surface/microsoft-surface-deployment-accelerator.md
@@ -2,7 +2,7 @@
title: Microsoft Surface Deployment Accelerator (Surface)
description: Microsoft Surface Deployment Accelerator provides a quick and simple deployment mechanism for organizations to reimage Surface devices.
ms.assetid: E7991E90-4AAE-44B6-8822-58BFDE3EADE4
-ms.date: 06/29/2017
+ms.date: 07/27/2017
ms.localizationpriority: high
keywords: deploy, install, tool
ms.prod: w10
diff --git a/devices/surface/step-by-step-surface-deployment-accelerator.md b/devices/surface/step-by-step-surface-deployment-accelerator.md
index b9c7a108ed..33683b5d6c 100644
--- a/devices/surface/step-by-step-surface-deployment-accelerator.md
+++ b/devices/surface/step-by-step-surface-deployment-accelerator.md
@@ -9,6 +9,7 @@ ms.mktglfcycl: deploy
ms.pagetype: surface, devices
ms.sitesec: library
author: miladCA
+ms.date: 07/27/2017
---
# Step by step: Surface Deployment Accelerator
diff --git a/devices/surface/support-solutions-surface.md b/devices/surface/support-solutions-surface.md
index 432c5dfe34..3525ce34a9 100644
--- a/devices/surface/support-solutions-surface.md
+++ b/devices/surface/support-solutions-surface.md
@@ -9,7 +9,7 @@ ms.sitesec: library
ms.pagetype: surfacehub
author: kaushika-msft
ms.author: jdecker
-ms.date: 09/07/2017
+ms.date: 09/08/2017
ms.localizationpriority: medium
---
diff --git a/devices/surface/surface-device-compatibility-with-windows-10-ltsb.md b/devices/surface/surface-device-compatibility-with-windows-10-ltsc.md
similarity index 58%
rename from devices/surface/surface-device-compatibility-with-windows-10-ltsb.md
rename to devices/surface/surface-device-compatibility-with-windows-10-ltsc.md
index 0048723f2f..0d4409c657 100644
--- a/devices/surface/surface-device-compatibility-with-windows-10-ltsb.md
+++ b/devices/surface/surface-device-compatibility-with-windows-10-ltsc.md
@@ -1,19 +1,21 @@
---
-title: Surface device compatibility with Windows 10 Long-Term Servicing Branch (Surface)
+title: Surface device compatibility with Windows 10 Long-Term Servicing Channel (Surface)
description: Find out about compatibility and limitations of Surface devices running Windows 10 Enterprise LTSB edition.
keywords: ltsb, update, surface servicing options
ms.prod: w10
ms.mktglfcycl: manage
ms.pagetype: surface, devices
ms.sitesec: library
-author: DavbeaMSFT
+author: brecords
+ms.author: jdecker
+ms.date: 01/03/2018
---
-# Surface device compatibility with Windows 10 Long-Term Servicing Branch (LTSB)
+# Surface device compatibility with Windows 10 Long-Term Servicing Channel (LTSC)
-Surface devices are designed to provide best-in-class experiences in productivity and general-purpose scenarios. Regular updates enable Surface devices to bring to life new innovations and to evolve with the new capabilities delivered by Windows 10 Feature Updates. Feature Updates are available only in Windows 10 Pro or Windows 10 Enterprise editions that receive continuous updates through the Current Branch (CB) or Current Branch for Business (CBB) servicing options.
+Surface devices are designed to provide best-in-class experiences in productivity and general-purpose scenarios. Regular updates enable Surface devices to bring to life new innovations and to evolve with the new capabilities delivered by Windows 10 Feature Updates. Feature Updates are available only in Windows 10 Pro or Windows 10 Enterprise editions that receive continuous updates through the Semi-Annual Channel (SAC).
-In contrast to the CB and CBB servicing options, you cannot select the Long-Term Servicing Branch (LTSB) option in Windows 10 settings. To use the LTSB servicing option, you must install a separate edition of Windows 10 Enterprise, known as *Windows 10 Enterprise LTSB*. In addition to providing an extended servicing model, the Windows 10 Enterprise LTSB edition also provides an environment with several Windows components removed. The core Surface experiences that are impacted by LTSB include:
+In contrast to the SAC servicing option, formerly known as the Current Branch (CB) or Current Branch for Business (CBB) servicing options, you cannot select the Long-Term Servicing Channel (LTSC) option in Windows 10 settings. To use the LTSC servicing option, you must install a separate edition of Windows 10 Enterprise, known as Windows 10 Enterprise LTSC, formerly known as Windows 10 Enterprise LTSB (Long-Term Servicing Branch. In addition to providing an extended servicing model, the Windows 10 Enterprise LTSC edition also provides an environment with several Windows components removed. The core Surface experiences that are impacted by LTSC include:
* Windows Feature Updates, including enhancements such as:
@@ -26,15 +28,15 @@ In contrast to the CB and CBB servicing options, you cannot select the Long-Term
* Key touch-optimized in-box applications including Microsoft Edge, OneNote, Calendar, and Camera
-The use of the Windows 10 Enterprise LTSB environment on Surface devices results in sub-optimal end-user experiences and you should avoid using it in environments where users want and expect a premium, up-to-date user experience.
+The use of the Windows 10 Enterprise LTSC environment on Surface devices results in sub-optimal end-user experiences and you should avoid using it in environments where users want and expect a premium, up-to-date user experience.
-The LTSB servicing option is designed for device types and scenarios where the key attribute is for features or functionality to never change. Examples include systems that power manufacturing or medical equipment, or embedded systems in kiosks, such as ATMs or airport ticketing systems.
+The LTSC servicing option is designed for device types and scenarios where the key attribute is for features or functionality to never change. Examples include systems that power manufacturing or medical equipment, or embedded systems in kiosks, such as ATMs or airport ticketing systems.
>[!NOTE]
->For general information about Windows servicing branches, including LTSB, see [Overview of Windows as a service](https://technet.microsoft.com/itpro/windows/update/waas-overview#long-term-servicing-branch).
+>For general information about Windows servicing branches, including LTSC, see [Overview of Windows as a service](https://technet.microsoft.com/itpro/windows/update/waas-overview#long-term-servicing-branch).
>[!NOTE]
->As a general guideline, devices that fulfill the following criteria are considered general-purpose devices and should be paired with Windows 10 Pro or Windows 10 Enterprise using the CB or CBB servicing option:
+>As a general guideline, devices that fulfill the following criteria are considered general-purpose devices and should be paired with Windows 10 Pro or Windows 10 Enterprise using the Semi-Annual Channel servicing option:
* Devices that run productivity software such as Microsoft Office
@@ -42,17 +44,17 @@ The LTSB servicing option is designed for device types and scenarios where the k
* Devices that are used for general Internet browsing (for example, research or access to social media)
-Before you choose to use Windows 10 Enterprise LTSB edition on Surface devices, consider the following limitations:
+Before you choose to use Windows 10 Enterprise LTSC edition on Surface devices, consider the following limitations:
-* Driver and firmware updates are not explicitly tested against releases of Windows 10 Enterprise LTSB.
+* Driver and firmware updates are not explicitly tested against releases of Windows 10 Enterprise LTSC.
-* If you encounter problems, Microsoft Support will provide troubleshooting assistance. However, due to the servicing nature of the Windows LTSB, issue resolution may require that devices be upgraded to a more recent version of Windows 10 Enterprise LTSB, or to Windows 10 Pro or Enterprise with the CB or CBB servicing option.
+* If you encounter problems, Microsoft Support will provide troubleshooting assistance. However, due to the servicing nature of the Windows LTSC, issue resolution may require that devices be upgraded to a more recent version of Windows 10 Enterprise LTSC, or to Windows 10 Pro or Enterprise with the SAC servicing option.
-* Surface device replacements (for example, devices replaced under warranty) may contain subtle variations in hardware components that require updated device drivers and firmware. Compatibility with these updates may require the installation of a more recent version of Windows 10 Enterprise LTSB or Windows 10 Pro or Enterprise with the CB or CBB servicing option.
+* Surface device replacements (for example, devices replaced under warranty) may contain subtle variations in hardware components that require updated device drivers and firmware. Compatibility with these updates may require the installation of a more recent version of Windows 10 Enterprise LTSC or Windows 10 Pro or Enterprise with the SAC servicing option.
>[!NOTE]
->Organizations that standardize on a specific version of Windows 10 Enterprise LTSB may be unable to adopt new generations of Surface hardware without also updating to a later version of Windows 10 Enterprise LTSB or Windows 10 Pro or Enterprise. For more information, see the **How will Windows 10 LTSBs be supported?** topic in the **Supporting the latest processor and chipsets on Windows** section of [Lifecycle Policy FAQ—Windows products](https://support.microsoft.com/help/18581/lifecycle-policy-faq-windows-products#b4).
+>Organizations that standardize on a specific version of Windows 10 Enterprise LTSC may be unable to adopt new generations of Surface hardware without also updating to a later version of Windows 10 Enterprise LTSC or Windows 10 Pro or Enterprise. For more information, see the **How will Windows 10 LTSBs be supported?** topic in the **Supporting the latest processor and chipsets on Windows** section of [Lifecycle Policy FAQ—Windows products](https://support.microsoft.com/help/18581/lifecycle-policy-faq-windows-products#b4).
-Surface devices running Windows 10 Enterprise LTSB edition will not receive new features. In many cases these features are requested by customers to improve the usability and capabilities of Surface hardware. For example, new improvements for High DPI applications in Windows 10, version 1703. Customers that use Surface devices in the LTSB configuration will not see the improvements until they either update to a new Windows 10 Enterprise LTSB release or upgrade to a version of Windows 10 with support for the CB and CBB servicing options.
+Surface devices running Windows 10 Enterprise LTSC edition will not receive new features. In many cases these features are requested by customers to improve the usability and capabilities of Surface hardware. For example, new improvements for High DPI applications in Windows 10, version 1703. Customers that use Surface devices in the LTSC configuration will not see the improvements until they either update to a new Windows 10 Enterprise LTSC release or upgrade to a version of Windows 10 with support for the SAC servicing option.
-Devices can be changed from Windows 10 Enterprise LTSB to a more recent version of Windows 10 Enterprise, with support for the CB and CBB servicing options, without the loss of user data by performing an upgrade installation. You can also perform an upgrade installation on multiple devices by leveraging the Upgrade Task Sequence Templates available in the Microsoft Deployment Toolkit (MDT) and System Center Configuration Manager. For more information, see [Upgrade Surface devices to Windows 10 with Microsoft Deployment Toolkit](https://technet.microsoft.com/itpro/surface/upgrade-surface-devices-to-windows-10-with-mdt).
+Devices can be changed from Windows 10 Enterprise LTSC to a more recent version of Windows 10 Enterprise, with support for the SAC servicing option, without the loss of user data by performing an upgrade installation. You can also perform an upgrade installation on multiple devices by leveraging the Upgrade Task Sequence Templates available in the Microsoft Deployment Toolkit (MDT) and System Center Configuration Manager. For more information, see [Upgrade Surface devices to Windows 10 with Microsoft Deployment Toolkit](https://technet.microsoft.com/itpro/surface/upgrade-surface-devices-to-windows-10-with-mdt).
diff --git a/devices/surface/surface-dock-updater.md b/devices/surface/surface-dock-updater.md
index d2b9c01167..eff1dae917 100644
--- a/devices/surface/surface-dock-updater.md
+++ b/devices/surface/surface-dock-updater.md
@@ -116,14 +116,13 @@ Microsoft periodically updates Surface Dock Updater. To learn more about the app
>[!Note]
>Each update to Surface Dock firmware is included in a new version of Surface Dock Updater. To update a Surface Dock to the latest firmware, you must use the latest version of Surface Dock Updater.
-### Version 2.7.136.0
+### Version 2.9.136.0
*Release date: November 3, 2017*
This version of Surface Dock Updater adds support for the following:
* Update for Surface Dock DisplayPort Firmware
-* Improved support for passive DisplayPort to DVI or HDMI adapters
-* Improved support for audio over DisplayPort
+* Resolves an issue with audio over passive display port adapters
### Version 2.1.15.0
*Release date: June 19, 2017*
diff --git a/devices/surface/surface-enterprise-management-mode.md b/devices/surface/surface-enterprise-management-mode.md
index 0c040e2593..bcf6b4b60c 100644
--- a/devices/surface/surface-enterprise-management-mode.md
+++ b/devices/surface/surface-enterprise-management-mode.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: manage
ms.pagetype: surface, devices, security
ms.sitesec: library
author: jobotto
+ms.date: 01/06/2017
---
# Microsoft Surface Enterprise Management Mode
diff --git a/devices/surface/unenroll-surface-devices-from-semm.md b/devices/surface/unenroll-surface-devices-from-semm.md
index d801c2e764..4e8cb226f3 100644
--- a/devices/surface/unenroll-surface-devices-from-semm.md
+++ b/devices/surface/unenroll-surface-devices-from-semm.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: manage
ms.pagetype: surface, devices, security
ms.sitesec: library
author: jobotto
+ms.date: 01/06/2017
---
# Unenroll Surface devices from SEMM
diff --git a/devices/surface/update.md b/devices/surface/update.md
index 46d1f3b6bd..7c1b86fbb8 100644
--- a/devices/surface/update.md
+++ b/devices/surface/update.md
@@ -6,6 +6,7 @@ ms.mktglfcycl: manage
ms.pagetype: surface, devices
ms.sitesec: library
author: heatherpoulsen
+ms.date: 12/01/2016
---
# Surface firmware and driver updates
diff --git a/devices/surface/upgrade-surface-devices-to-windows-10-with-mdt.md b/devices/surface/upgrade-surface-devices-to-windows-10-with-mdt.md
index 4e3fcf3fad..20b66668b4 100644
--- a/devices/surface/upgrade-surface-devices-to-windows-10-with-mdt.md
+++ b/devices/surface/upgrade-surface-devices-to-windows-10-with-mdt.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.pagetype: surface
ms.sitesec: library
author: Scottmca
+ms.date: 10/16/2017
---
# Upgrade Surface devices to Windows 10 with Microsoft Deployment Toolkit
diff --git a/devices/surface/use-system-center-configuration-manager-to-manage-devices-with-semm.md b/devices/surface/use-system-center-configuration-manager-to-manage-devices-with-semm.md
index 5e81cad6ce..9234eb04c3 100644
--- a/devices/surface/use-system-center-configuration-manager-to-manage-devices-with-semm.md
+++ b/devices/surface/use-system-center-configuration-manager-to-manage-devices-with-semm.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: manage
ms.pagetype: surface, devices
ms.sitesec: library
author: KiranDavane
+ms.date: 02/01/2017
---
# Use System Center Configuration Manager to manage devices with SEMM
diff --git a/devices/surface/using-the-sda-deployment-share.md b/devices/surface/using-the-sda-deployment-share.md
index 8c118e635e..b65fc91fb5 100644
--- a/devices/surface/using-the-sda-deployment-share.md
+++ b/devices/surface/using-the-sda-deployment-share.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.pagetype: surface, devices
ms.sitesec: library
author: Scottmca
+ms.date: 10/16/2017
---
# Using the Microsoft Surface Deployment Accelerator deployment share
diff --git a/devices/surface/wake-on-lan-for-surface-devices.md b/devices/surface/wake-on-lan-for-surface-devices.md
index c264f50a22..b9d7b5d2e3 100644
--- a/devices/surface/wake-on-lan-for-surface-devices.md
+++ b/devices/surface/wake-on-lan-for-surface-devices.md
@@ -6,24 +6,30 @@ ms.prod: w10
ms.mktglfcycl: manage
ms.pagetype: surface, devices
ms.sitesec: library
-author: jobotto
+author: brecords
+ms.author: jdecker
+ms.date: 01/03/2018
---
# Wake On LAN for Surface devices
-Surface devices that run Windows 10, version 1607 (also known as Windows 10 Anniversary Update) or later and use a Surface Ethernet adapter to connect to a wired network, are capable of Wake On LAN (WOL) from Connected Standby. With WOL, you can remotely wake up devices to perform management or maintenance tasks or enable management solutions (such as System Center Configuration Manager) automatically – even if the devices are powered down. For example, you can deploy applications to Surface devices left docked with a Surface Dock or Surface Pro 3 Docking Station by using System Center Configuration Manager during a window in the middle of the night, when the office is empty.
+Surface devices that run Windows 10, version 1607 (also known as Windows 10 Anniversary Update) or later and use a Surface Ethernet adapter to connect to a wired network, are capable of Wake On LAN (WOL) from Connected Standby. With WOL, you can remotely wake up devices to perform management or maintenance tasks or enable management solutions (such as System Center Configuration Manager) automatically. For example, you can deploy applications to Surface devices left docked with a Surface Dock or Surface Pro 3 Docking Station by using System Center Configuration Manager during a window in the middle of the night, when the office is empty.
>[!NOTE]
->Surface devices must be connected to AC power to support WOL.
+>Surface devices must be connected to AC power and in Connected Standby (Sleep) to support WOL. WOL is not possible from devices that are in hibernation or powered off.
## Supported devices
The following devices are supported for WOL:
+* Surface Book 2
+* Surface Pro with LTE Advanced (Model 1807)
+* Surface Pro (Model 1796)
+* Surface Laptop
* Surface Book
* Surface Pro 4
-* Surface Pro 3
* Surface 3
+* Surface Pro 3
* Surface Ethernet adapter
* Surface Dock
* Surface Docking Station for Surface Pro 3
diff --git a/devices/surface/windows-autopilot-and-surface-devices.md b/devices/surface/windows-autopilot-and-surface-devices.md
new file mode 100644
index 0000000000..d4599d8ffd
--- /dev/null
+++ b/devices/surface/windows-autopilot-and-surface-devices.md
@@ -0,0 +1,51 @@
+---
+title: Windows AutoPilot and Surface Devices (Surface)
+description: Find out about Windows AutoPilot deployment options for Surface devices.
+keywords: autopilot, windows 10, surface, deployment
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.pagetype: surface, devices
+ms.sitesec: library
+author: brecords
+ms.date: 01/31/2018
+ms.author: jdecker
+---
+
+# Windows AutoPilot and Surface devices
+
+Windows AutoPilot is a cloud-based deployment technology available in Windows 10. Using Windows AutoPilot, you can remotely deploy and configure devices in a truly zero-touch process right out of the box. Windows AutoPilot registered devices are identified over the internet at first boot using a unique device signature, known as the hardware hash, and automatically enrolled and configured using modern management solutions such as Azure Active Directory (AAD) and Mobile Device Management (MDM).
+
+With Surface devices, you can choose to register your devices at the time of purchase when purchasing from a Surface partner enabled for Windows AutoPilot. New devices can be shipped directly to your end-users and will be automatically enrolled and configured when the units are unboxed and turned on for the first time. This process can eliminate need to reimage your devices as part of your deployment process, reducing the work required of your deployment staff and opening up new, agile methods for device management and distribution.
+
+In this article learn how to enroll your Surface devices in Windows AutoPilot with a Surface partner and the options and considerations you will need to know along the way. This article focuses specifically on Surface devices, for more information about using Windows AutoPilot with other devices, or to read more about Windows AutoPilot and its capabilities, see [Overview of Windows AutoPilot](https://docs.microsoft.com/en-us/windows/deployment/windows-autopilot/windows-10-autopilot) in the Windows Docs Library.
+
+## Prerequisites
+Enrollment of Surface devices in Windows AutoPilot with a Surface partner enabled for Windows AutoPilot has the following licensing requirements for each enrolled Surface device:
+* **Azure Active Directory Premium** – Required to enroll your devices in your organization and to automatically enroll devices in your organization’s mobile management solution.
+* **Mobile Device Management (such as Microsoft Intune)** – Required to remotely deploy applications, configure, and manage your enrolled devices.
+* **Office 365 ProPlus** – Required to deploy Microsoft Office to your enrolled devices.
+
+These requirements are also met by the following solutions:
+* Microsoft 365 E3 or E5 (includes Azure Active Directory Premium, Microsoft Intune, and Office 365 ProPlus)
+
+Or
+* Enterprise Mobility + Security E3 or E5 (includes Azure Active Directory Premium and Microsoft Intune)
+* Office 365 ProPlus, E3, or E5 (includes Office 365 ProPlus)
+
+>[!NOTE]
+>Deployment of devices using Windows AutoPilot to complete the Out-of-Box Experience (OOBE) is supported without these prerequisites, however will yield deployed devices without applications, configuration, or enrollment in a management solution and is highly discouraged.
+
+### Windows version considerations
+Support for broad deployments of Surface devices using Windows AutoPilot, including enrollment performed by Surface partners at the time of purchase, requires devices manufactured with or otherwise installed with Windows 10 Version 1709 (Fall Creators Update). Windows 10 Version 1709 uses a secure 4096-bit (4k) hash value to uniquely identify devices for Windows AutoPilot that is necessary for deployments at scale.
+
+### Surface device support
+Surface devices with support for out-of-box deployment with Windows AutoPilot, enrolled during the purchase process with a Surface partner, include the following devices, where the devices ship from the factory with Windows 10 Version 1709:
+* Surface Pro (Model 1796)
+* Surface Book 2
+* Surface Laptop
+* Surface Studio
+
+## Surface partners enabled for Windows AutoPilot
+Enrolling Surface devices in Windows AutoPilot at the time of purchase is a capability provided by select Surface partners that are enabled with the capability to identify individual Surface devices during the purchase process and perform enrollment on an organization’s behalf. Devices enrolled by a Surface partner at time of purchase can be shipped directly to users and configured entirely through the zero-touch process of Windows AutoPilot, Azure Active Directory, and Mobile Device Management.
+
+You can find a list of Surface partners enabled for Windows AutoPilot at the [Windows AutoPilot for Surface portal](https://www.microsoft.com/en-us/itpro/surface/windows-autopilot-for-surface).
\ No newline at end of file
diff --git a/education/get-started/change-history-ms-edu-get-started.md b/education/get-started/change-history-ms-edu-get-started.md
index 2e9b13b1a7..0110254868 100644
--- a/education/get-started/change-history-ms-edu-get-started.md
+++ b/education/get-started/change-history-ms-edu-get-started.md
@@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: edu
author: CelesteDG
ms.author: celested
-ms.date: 07/03/2017
+ms.date: 07/07/2017
---
# Change history for Microsoft Education Get Started
diff --git a/education/get-started/configure-microsoft-store-for-education.md b/education/get-started/configure-microsoft-store-for-education.md
index 0de78d8a9c..b57970b3ce 100644
--- a/education/get-started/configure-microsoft-store-for-education.md
+++ b/education/get-started/configure-microsoft-store-for-education.md
@@ -10,7 +10,7 @@ ms.localizationpriority: high
ms.pagetype: edu
author: CelesteDG
ms.author: celested
-ms.date: 07/10/2017
+ms.date: 08/29/2017
---
# Configure Microsoft Store for Education
@@ -23,10 +23,7 @@ You'll need to configure Microsoft Store for Education to accept the services ag
You can watch the video to see how this is done, or follow the step-by-step guide.
-
-
+
You can watch the descriptive audio version here: [Microsoft Education: Configure Microsoft Store for Education (DA)](https://www.youtube.com/watch?v=bStgEpHbEXw)
diff --git a/education/get-started/enable-microsoft-teams.md b/education/get-started/enable-microsoft-teams.md
index 39574448d6..09326b1e2e 100644
--- a/education/get-started/enable-microsoft-teams.md
+++ b/education/get-started/enable-microsoft-teams.md
@@ -10,7 +10,7 @@ ms.localizationpriority: high
ms.pagetype: edu
author: CelesteDG
ms.author: celested
-ms.date: 07/10/2017
+ms.date: 07/28/2017
---
# Enable Microsoft Teams for your school
diff --git a/education/get-started/finish-setup-and-other-tasks.md b/education/get-started/finish-setup-and-other-tasks.md
index 8988624631..7dd5513764 100644
--- a/education/get-started/finish-setup-and-other-tasks.md
+++ b/education/get-started/finish-setup-and-other-tasks.md
@@ -10,7 +10,7 @@ ms.localizationpriority: high
ms.pagetype: edu
author: CelesteDG
ms.author: celested
-ms.date: 07/10/2017
+ms.date: 10/09/2017
---
# Finish Windows 10 device setup and other tasks
@@ -26,10 +26,8 @@ Once you've set up your Windows 10 education device, it's worth checking to veri
You can watch the video to see how this is done, or follow the step-by-step guide.
-
-
+
+
You can watch the descriptive audio version here: [Microsoft Education: Verify Windows 10 education devices are Azure AD joined and managed (DA)](https://www.youtube.com/watch?v=_hVIxaEsu2Y)
## Verify correct device setup
@@ -80,10 +78,8 @@ You can follow the rest of the walkthrough to finish setup and complete other ta
You can watch the following video to see how to update group settings in Intune for Education and configure Azure settings. Or, you can follow the step-by-step guide for these tasks and the other tasks listed above.
-
-
+
+
You can watch the descriptive audio version here: [Microsoft Education: Update settings, apps, and Azure AD settings for your education tenant (DA)](https://www.youtube.com/watch?v=-Rz3VcDXbzs)
## Update group settings in Intune for Education
diff --git a/education/get-started/get-started-with-microsoft-education-fullpage.md b/education/get-started/get-started-with-microsoft-education-fullpage.md
deleted file mode 100644
index 1b41b3b603..0000000000
--- a/education/get-started/get-started-with-microsoft-education-fullpage.md
+++ /dev/null
@@ -1,765 +0,0 @@
----
-title: Deploy and manage a full cloud IT solution with Microsoft Education
-description: Learn how to use the new Microsoft Education system to set up a cloud infrastructure for your school, acquire devices and apps, and configure and deploy policies to your Windows 10 devices.
-keywords: education, Microsoft Education, full cloud IT solution, school, deploy, setup, manage, Windows 10, Intune for Education, Office 365 for Education, School Data Sync, Microsoft Teams, Microsoft Store for Education, Azure AD, Set up School PCs
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.sitesec: library
-ms.topic: hero-article
-ms.localizationpriority: high
-ms.pagetype: edu
-author: CelesteDG
-ms.author: celested
-ms.date: 06/26/2017
----
-
-# Get started: Deploy and manage a full cloud IT solution with Microsoft Education
-
-
-
-**Applies to:**
-
-- Office 365 for Education, School Data Sync, Microsoft Intune for Education, Microsoft Store for Education, Windows 10 Creators Update, Set up School PCs
-
-Hello, IT administrators! In this walkthrough, we'll show you how you can quickly and easily use the new Microsoft Education system, consisting of new and existing cloud services and tools, to implement a full IT cloud solution for your school.
-
-## What is Microsoft Education?
-**Microsoft Education** consists of these new and existing services and tools from Microsoft:
-- **Microsoft Intune for Education** for simple set up, control, and management of the resources for your school including apps, devices, and settings
-- **Office 365 for Education** provides online apps for work from anywhere and desktop apps for advanced functionality, built for working together and available across devices, and it's free for schools, teachers, and students
- - **School Data Sync** to help automate the process for importing and integrating School Information System (SIS) data that you can use with Office 365
- - **OneNote Class Notebook** to organize course content, create and deliver interactive lessons to some or all students, collaborate and provide private feedback to individual students, and connect with major LMS and SIS partners for assignment workflow
-- **Microsoft Teams** to bring conversations, content, and apps together in one place and create collaborate classrooms, connect in professional learning communities, and communicate with school staff
-- **Learning Tools** are moving beyond the OneNote desktop app and is now available in Office Lens, OneNote Online, Word Online, and Word desktop
-- **Whiteboard** to create interactive lessons on the big screen, share and collaborate real-time by connecting to Class Notebook and Classroom
-- **Windows 10, version 1703 (Creators Update)** which brings 3D for everyone and other new and updated Windows features
-- **Minecraft: Education Edition** which provides an open and immersive environment to promote creativity, collaboration, and problem-solving
-
-With Microsoft Education, schools can:
-- **Use affordable devices and simple setup** - Boost creativity and get started instantly with Windows 10 devices that support Windows Ink. Set up devices in minutes and stay in control with the new Intune for Education.
-- **Collaborate in a modern classroom** - Help students become career-ready with Office apps like Word, Excel, PowerPoint, and OneNote. Increase comprehension and outcomes with the most advanced teaching apps like integrated Learning Tools.
-- **Go beyond the browser with inspiring apps for classroom learning** - Inspire with Minecraft: Education Edition and innovative apps from the Microsoft Store for Education.
-
-Go to the Microsoft Education site to learn more. See How to buy to learn about pricing and purchasing options for schools, students, and teachers as well as academic pricing and offers for qualified K-12 and higher education institutions.
-
-## What we're doing
-In this walkthrough, we'll show you the basics on how to:
-> [!div class="checklist"]
-> * Acquire an Office 365 for Education tenant, if you don't already have one
-> * Import school, student, teacher, and class data using School Data Sync (SDS)
-> * Deploy Microsoft Teams to enable groups and teams in your school to communicate and collaborate
-> * Manage apps and settings deployment with Intune for Education
-> * Acquire additional apps in Microsoft Store for Education
-> * Use the Set up School PCs app to quickly set up and provision your Windows 10 education devices
-> * Log in and use the devices
-
-This diagram shows a high-level view of what we cover in this walkthrough. The numbers correspond to the sections in the walkthrough and roughly correspond to the flow of the overall process; but, note that not all sections in this walkthrough are shown in the diagram.
-
-**Figure 1** - Microsoft Education IT administrator workflow
-
-
-
-## Prerequisites
-Complete these tasks before you start the walkthrough:
-- Make sure all the devices that you want to configure, such as student PCs, have the latest Windows 10, version 1703 image installed.
-
- We recommend Windows 10, version 1703 to take advantage of all the new features and functionality that Windows supports. This version of Windows is also compatible with the latest version of the Set up School PCs app and the versions must match in order for Set up School PCs to provision the devices.
-
- If you don't have Windows 10, version 1703 installed on your devices, we recommend upgrading. This process takes a while so start this task before proceeding with this walkthrough.
-
-- Have an education-verified tenant to qualify for an Office 365 for Education subscription. You also need to be education-verified to use School Data Sync and Intune for Education.
-
- If you don't have an education-verified domain, don't worry. We'll show you the steps on how to do this.
-
- > [!NOTE]
- > If you need to get education-verified, it may take up to two weeks for the verification process to be completed.
-
-## Setup options
- To make sure you have a successful experience with deploying and managing a full cloud IT solution with Microsoft Education, select the scenario that best describes your school or how you'd like to get started.
-
-
-| [Get started with Microsoft Education in production environment](#noo365prodenv) | [Try out Microsoft Education in trial environment](#noo365trialenv) | [School uses Office 365, try out Intune for Education now](#schooluseso365tryi4e) |
-| ----------------------------------------- | ------------------------------------------------ | ---------------------------------------------- |
-| * My school doesn't use Office 365 for Education | * My school doesn't use Office 365 for Education | * My school uses Office 365 for Education |
-| * My school is not an education-verified tenant | * My school is not an education-verified tenant | * My school is an education-verified tenant |
-| * I would like to get started with Microsoft Education in a production environment | * I would like to try out Microsoft Education in a trial environment | * I would like to apply the Intune for Education trial code to my school's production environment |
-| * Longest, need to start from scratch | * Simplest, but may take longer to start | * Fastest, Office 365 and SDS already set up |
-
-
-### Option 1: Get started with Microsoft Education in a production environment
-Trying out Microsoft Education in a production environment means you'll be using real school data as you evaluate the features and tools. This requires more time to get fully set up and going.
-
-To get started with Microsoft Education in a production environment:
-
-* Go to https://aka.ms/sdssignup and fill out the form to sign up for School Data Sync and receive a free, one-on-one support from Microsoft.
-
- A team from Microsoft will contact you to help get started with Microsoft Education.
-
-If you want a quicker way to evaluate Microsoft Education, you can [use a trial environment instead](#noo365trialenv).
-
-### Option 2: Try out Microsoft Education in a trial environment
-Once you get an Office 365 education-verified tenant, trying out Microsoft Education in a trial environment is an easy way to evaluate all the features and tools. Here, you'll use promo codes and sample files as you follow the walkthrough.
-
-To get started with Microsoft Education in a trial environment, follow these steps.
-
-1. [Set up a new Office 365 for Education tenant](#1-set-up-a-new-office-365-for-education-tenant).
-
- Wait for your tenant to be education-verified before proceeding with the next step. Verification can take up to a few days.
-
-2. Once you have an education-verified tenant, click https://aka.ms/intuneforedupreviewtrial to apply the Intune for Education trial promo code.
- 1. In the Intune for Education Trial page, on the upper right, click **Sign in** next to **Want to add this to an existing subscription?**.
- 2. Sign in with your global admin credentials.
-
-3. Sign in to Office 365 admin portal and:
- 1. Select **Admin > Users** and then search for your admin account.
- 2. In the user page, select **Product licenses** and expand the **Office 365 Education** license you assigned to yourself.
- 3. Confirm that School Data Sync is turned on.
-
-3. Skip ahead and follow the rest of the instructions in this walkthrough beginning with [2. Use School Data Sync to import student data](#2-use-school-data-sync-to-import-student-data).
-
-### Option 3: Try out Intune for Education
-Already have an Office 365 for Education verified tenant? Just sign in with your global admin credentials to apply the Intune for Education preview trial code to your tenant and follow the rest of the walkthrough.
-
-1. Click https://aka.ms/intuneforedupreviewtrial to get started.
-2. In the **Intune for Education Trial** page, on the upper right, click **Sign in** next to **Want to add this to an existing subscription?**.
-
- **Figure 2** - Intune for Education trial sign in page
-
- 
-
-3. Enter your Office 365 global admin credentials to apply the Intune for Education trial to your tenant.
-4. If you don't already have Microsoft Teams deployed to your tenant, you can start with [3. Enable Microsoft Teams for your school](#3-enable-microsoft-teams-for-your-school) and then follow the rest of the instructions in this walkthrough.
-
-## 1. Set up a new Office 365 for Education tenant
-Schools can use Office 365 to save time and be more productive. Built with powerful tools and accessible from any device, setting it up is the first step in getting your school to the cloud.
-
-Don't have an Office 365 for Education verified tenant or just starting out? Follow these steps to set up an Office 365 for Education tenant. [Learn more about Office 365 for Education plans and pricing](https://products.office.com/en-us/academic/compare-office-365-education-plans).
-
-1. Go to the Office 365 for Education sign up page to sign up for a free subscription for your school.
-2. Create an account and a user ID and password to use to sign into your account.
-
- **Figure 3** - Office 365 account creation
-
- 
-
-3. Save your sign-in info so you can use it to sign in to https://portal.office.com (the sign-in page). Click **You're ready to go...**
-4. In the **Verify eligibility for Microsoft Office 365 for Education** screen:
- 1. Add your domain name and follow the steps to confirm ownership of the domain.
- 2. Choose your DNS hosting provider to see step-by-step instructions on how to confirm that you own the domain.
-
- In some cases, you may need to wait several hours for the DNS verification to complete. You can click **I'll verify later** and come back later and log into the Office 365 portal and then go to the **Admin** center and select **Domains** to check the status entry for your domain.
-
- You may need to fill in other information to provide that you qualify for an education tenant. Provide and submit the info to Microsoft to continue verification for your tenant.
-
-As part of setting up a basic cloud infrastructure, you don't need to complete the rest of the Office 365 for Education setup so we will skip the rest of setup for now and start importing school data. You can pick up where you left off with Office 365 for Education setup once you've completed the rest of the steps in the walkthrough. See [7.3 Complete Office 365 for Education setup](#73-complete-office-365-education-setup) for info.
-
-
-## 2. Use School Data Sync to import student data
-School Data Sync (SDS) helps you import Student Information System (SIS) data into Office 365. It helps automate the process for importing and integrating SIS data that you can use with Office 365 and apps like OneNote Class Notebooks.
-
-Follow all the steps in this section to use SDS and sample CSV files in a trial environment. To use SDS in a production environment, see step 2 in [Try out Microsoft Education in a production environment](#noo365prodenv) instead.
-
-**Download sample school data**
-
-1. Go to the O365-EDU-Tools GitHub site.
-2. Click the green **Clone or download** button to download the SDS sample files.
-
- **Figure 4** - Download the SDS sample files from GitHub
-
- 
-
-3. In the **Clone with HTTPS** pop-up window, choose **Download ZIP** and note the location where you're saving the folder.
-4. Go to the folder where you saved the .zip and unzip the files.
-5. Open the **O365-EDU-Tools-master** folder and then open the **CSV Samples** subfolder. Confirm that you can see the following sample CSV files.
-
- **Figure 5** - Sample CSV files
-
- 
-
- > [!NOTE]
- > - The sample CSV files uses sample accounts and passwords. If you are using the sample files for testing, remember the accounts and their corresponding passwords. You may be asked to change the password during your first sign in.
- > - If you are modifying the sample CSV files to use in your organization, change the accounts and passwords to match the user accounts and passwords in your organization.
- > - If you are using CSV files from your existing production environment, see the detailed instructions in step 5 in the next section.
-
-To learn more about the CSV files that are required and the info you need to include in each file, see CSV files for School Data Sync. If you run into any issues, see School Data Sync errors and troubleshooting.
-
-**Use SDS to import student data**
-
-1. If you haven't done so already, go to the SDS portal, https://sds.microsoft.com.
-2. Click **Sign in**. You will see the **Settings** option for **Manage School Data Sync**.
-
- **Figure 6** - Settings for managing SDS
-
- 
-
-3. Turn on **School Data Sync**. You will get a notification that it is turned on. Click **OK**.
-
- New menu options will appear on the left of the SDS portal.
-
- **Figure 7** - New menu options appear after SDS is turned on
-
- 
-
-4. Click **+ Add Profile** from the sync dashboard or from the menu on the left to start syncing school data.
-
- This opens up the new profile setup wizard within the main page.
-
- **Figure 8** - New SDS profile setup wizard
-
- 
-
-5. For the new profile, in the **How do you want to connect to your school?** screen:
- 1. Enter a name for your profile, such as *Contoso_Elementary_Profile*.
- 2. Select a sync method for your profile. For this walkthrough, select **Upload CSV Files**.
- 3. Select the type of CSV files that you're using. For this walkthrough, select **CSV files: SDS Format**.
- 4. Click **Start**.
-
-6. In the **Sync options** screen:
- 1. In the **Select new or existing users** section, you can select either **Existing users** or **New users** based on the scenaro that applies to you. For this walkthrough, select **New users**.
- 2. In the **Import data** section:
- 1. Click **Upload Files** to bring up the **Select data files to be uploaded** window.
- 2. In the **Select data files to be uploaded** window, click **+ Add Files** and navigate to the directory where you saved the six CSV files required for data import.
- 3. In the File Explorer window, you will see a folder for the sample CSV files for the UK and six sample CSV files for the US. Select the CSV files that match your region/locale, and then click **Open**.
- 4. In the **Select data files to be uploaded** window, confirm that all six CSV files (School.csv, Section.csv, Student.csv, StudentEnrollment.csv, Teacher.csv, and TeacherRoster.csv) are listed and then click **Upload**.
-
- > [!NOTE]
- > After you click **Upload**, the status in the **Select data files to be uploaded** window will indicate that files are being uploaded and verified.
-
- 5. After all the files are successfully uploaded, click **OK**.
-
- 3. Select the domain for the schools/sections. This domain will be used for the Section email addresses created during setup. If you have more than one domain, make sure you select the appropriate domain for the sync profile and subsequent sections being created.
- 4. In the **Select school and section properties** section, ensure the attributes that have been automatically selected for you align to your CSV files. If you select additional properties, or deselect any properties, make sure you have the properties and values contained within the CSV files. For the walkthrough, you don't have to change the default.
- 5. In the **Sync option for Section Group Display Name**, check the box if you want to allow teachers to overwrite the section names. Otherwise, SDS will always reset the display name value for sections to the value contained within the CSV files.
- 6. In the **Student enrollment option** section:
- * If you want to sync your student roster data immediately, leave the box unchecked.
- * If you prefer to sync student enrollment/rostering data at a later date, check this box and then pick a date by clicking the empty box and selecting the appropriate date in the calendar when you would like to begin syncing your student roster data. Some schools prefer to delay syncing student roster data so they don't expose rosters before the start of the new term, semester, or school year.
- 7. In the **License Options** section, check the box for **Intune for Education** to allow students and teachers to receive the Intune for Education license. This will also create the SDS dynamic groups and security groups, which will be used within Intune for Education.
- 8. Click **Next**.
-
- **Figure 9** - Sync options for the new profile
-
- 
-
-7. In the **Teacher options** screen:
- 1. Select the domain for the teachers. SDS appends the selected domain suffix to the teacher's username attribute contained in the CSV file, to build the UserPrincipalName for each user in Office 365/Azure Active Directory during the account creation process. The teacher will log in to Office 365 with the UserPrincipalName once the account is created.
- 2. In the **Select teacher properties** section, make sure the attributes that have been automatically selected for you align to your CSV files. If you select additional properties or deselect any properties, make sure you have the corresponding properties and values contained within the CSV files. For this walkthrough, you don't have to change the default.
- 3. In the **Teacher licenses** section, choose the SKU to assign licenses for teachers. For example, **STANDARDWOFFPACK_FACULTY**.
- 4. Click **Next**.
-
- **Figure 10** - Specify options for teacher mapping
-
- 
-
-8. In the **Student options** screen:
- 1. Select the domain for the students. SDS appends the selected domain suffix to the student's username attribute contained in the CSV file, to build the UserPrincipalName for each user in Office 365/Azure Active Directory during the account creation process. The student will log in to Office 365 with the UserPrincipalName once the account is created.
- 2. In the **Select student properties** section, make sure the attributes that have been automatically selected for you align to your CSV files. If you select additional properties or deselect any properties, make sure you have the corresponding properties and values contained within the CSV files. For this walkthrough, you don't have to change the default.
- 3. In the **Student licenses** section, choose the SKU to assign licenses for students. For example, **STANDARDWOFFPACK_STUDENT**.
- 4. Click **Next**.
-
- **Figure 11** - Specify options for student mapping
-
- 
-
-9. In the profile **Review** page, review the summary and confirm that the options selected are correct.
-10. Click **Create profile**. You will see a notification that your profile is being submitted and then you will see a page for your profile.
-
- **Figure 12** - SDS profile page
-
- 
-
-11. After the profile is created and the status indicates as **Setting up**, refresh the page until you see the status change to **Sync in progress**. Beneath the **Sync in progress** status, you will see which of the 5 sync stages SDS is working on:
- * Stage 1 - Validating data
- * Stage 2 - Processing schools and sections
- * Stage 3 - Processing students and teachers
- * Stage 4 - Adding students and teachers into sections
- * Stage 5 - Setting up security groups
-
- If you don't see a **Sync in progress** status on the sync profile, and receive an error message instead, this indicates that SDS has encountered data issues during the pre-sync validation check and has not started syncing your data. This gives you the opportunity to fix the errors identified by the pre-sync validation checks before continuing. Once you've fixed any errors or if you prefer to continue with the errors and begin syncing your data anyway, click the **Resume sync** button to start the sync process.
-
- Once you've completed all five sync stages, your profile status will update one final time.
- * If you haven't encountered any errors, you will see a green check mark which states **Everything is ok**, and the profile status will change to **Sync complete. Ready for more data.**
- * If SDS encountered sync errors, you will see a red status icon that indicates an error, and a profile status of **Sync complete. Profile contains multiple errors**. Download the available error report to identify and fix your sync errors. Once complete, upload new files as needed and re-sync your data until errors are resolved.
-
- Here are some examples of what the sync status can look like:
-
- **Figure 13** - New profile: Sync in progress
-
- 
-
- **Figure 14** - New profile: Sync complete - no errors
-
- 
-
- **Figure 15** - New profile: Sync complete - with errors
-
- 
-
- Sync times, like file download times, can vary widely depending on when you start the sync, how much data you are syncing, the complexity of your data (such as the number of users, schools, and class enrollments), overall system/network load, and other factors. Two people who start a sync at the same time may not have their syncs complete at the same time.
-
- You can refresh the page to confirm that your profile synced successfully.
-
-That's it for importing sample school data using SDS.
-
-## 3. Enable Microsoft Teams for your school
-Microsoft Teams is a digital hub that brings conversations, content, and apps together in one place. Because it's built on Office 365, schools benefit from integration with their familiar Office apps and services. Your institution can use Microsoft Teams to create collaborative classrooms, connect in professional learning communities, and communicate with school staff all from a single experience in Office 365 for Education.
-
-To get started, IT administrators need to use the Office 365 Admin Center to enable Microsoft Teams for your school.
-
-**Enable Microsoft Teams for your school**
-
-1. Sign in to Office 365 with your work or school account.
-2. Click **Admin** to go to the Office 365 admin center.
-3. Go to **Settings > Services & add-ins**.
-4. On the **Services & add-ins** page, select **Microsoft Teams**.
-
- **Figure 16** - Select Microsoft Teams from the list of services & add-ins
-
- 
-
-5. On the Microsoft Teams settings screen, select the license that you want to configure, **Student** or **Faculty and Staff**. Select **Faculty and Staff**.
-
- **Figure 17** - Select the license that you want to configure
-
- 
-
-6. After you select the license type, set the toggle to turn on Microsoft Teams for your organization.
-
- **Figure 18** - Turn on Microsoft Teams for your organization
-
- 
-
-7. Click **Save**.
-
-You can find more info about how to control which users in your school can use Microsoft Teams, turn off group creation, configure tenant-level settings, and more by reading the *Guide for IT admins* getting started guide in the Meet Microsoft Teams page.
-
-## 4. Configure Microsoft Store for Education
-You'll need to configure Microsoft Store for Education to accept the services agreement and make sure your Microsoft Store account is associated with Intune for Education.
-
-**Associate your Microsoft Store account with Intune for Education**
-
-1. Sign in to Microsoft Store for Education.
-2. Accept the Microsoft Store for Business and Education Services Agreement.
-
- This will take you to the Microsoft Store for Education portal.
-
- **Figure 19** - Microsoft Store for Education portal
-
- 
-
-3. In the Microsoft Store portal, click **Manage** to go to the Microsoft Store **Overview** page.
-4. Find the **Overview** page, find the **Store settings** tile and click **Management tools**.
-
- **Figure 20** - Select management tools from the list of Store settings options
-
- 
-
-4. In the **Management tools** page, find **Microsoft Intune** on the list and click **Activate** to get Intune for Education ready for use with Microsoft Store for Education.
-
- **Figure 21** - Activate Intune for Education as the management tool
-
- 
-
-Your Microsoft Store for Education account is now linked to Intune for Education so let's set that up next.
-
-## 5. Use Intune for Education to manage groups, apps, and settings
-Intune for Education is a streamlined device management solution for educational institutions that can be used to quickly set up and manage Windows 10 devices for your school. It provides a new streamlined UI with the enterprise readiness and resiliency of the Intune service. You can learn more about Intune for Education by reading the Intune for Education documentation.
-
-### Example - Set up Intune for Education, buy apps from the Store, and install the apps
-In this walkthrough, we'll go through a sample scenario and walk you through the steps to:
-- [Use express configuration to quickly set up Intune for Education](#setupintune)
-- [Use Intune for Education to buy apps from the Microsoft Store for Education](#addappsfrommsfe)
-- [Use Intune for Education to install the apps for all users in your tenant](#installappsallusers)
-
-Note that for verified education tenants, Microsoft automatically provisions your app catalog with these apps so you will see them appear on your Intune for Education catalog even before you've bought any apps:
-- Excel
-- Fresh Paint
-- Minecraft: Education Edition
-- OneNote
-- PowerPoint
-- Sway
-- Word
-
- > [!NOTE]
- > Apps that you own in the Microsoft Store for Education are automatically available in Intune for Education. Any changes you make to your purchases get reflected in Intune for Education.
-
-
-**Set up Intune for Education**
-
-Intune for Education provides an **Express configuration** option so you can get going right away. We'll use that option here.
-
-1. Log into the Intune for Education console. You will see the Intune for Education dashboard once you're logged in.
-
- **Figure 22** - Intune for Education dashboard
-
- 
-
-2. On the dashboard, click **Launch Express Configuration**, or select the **Express configuration** option on the menu on the left.
-3. In the **Welcome to Intune for Education** screen, click **Get started**.
-
- **Figure 23** - Click Get started to set up Intune for Education
-
- 
-
-4. In the **Get school information (optional)** screen, it should indicate that SDS is already configured. Click **Next**.
-
- **Figure 24** - SDS is configured
-
- 
-
-5. In the **Choose group** screen, select **All Users**. All apps and settings that we select during express setup will apply to this group.
-
- You can choose another group during this step, but note that your experience may vary from what we show in the walkthrough.
-
-6. The **Next** button will appear at the bottom of the screen after you select **All Users**. Click **Next**.
-
- > [!TIP]
- > At the top of the screen, did you notice the **Choose group** button change to a green check mark? This means we are done with that step. If you change your mind or need to make changes, simply click on the button to go back to that step. Try it!
- >
- > **Figure 25** - Click on the buttons to go back to that step
- >
- > 
-
-7. In the **Choose apps** screen, you will see a selection of Web apps, Microsoft Store apps, and desktop (Win32) apps. You will also see a list of popular apps from each category.
-
- - Add or remove apps by clicking on them. A blue checkmark means the app is added and will be installed for all members of the group selected in the **Choose group** step.
-
- In this walkthrough, it's up to you to select the apps you choose to install. Just remember what they are so that later in the walkthrough you can verify that the apps were installed correctly on the device.
-
- > [!TIP]
- > Web apps are pushed as links in the Windows Start menu under **All apps**. If you want apps to appear in Microsoft Edge browser tabs, use the **Homepages** setting for Microsoft Edge through **Express configuration** or **Manage Users and Devices**.
-
- **Figure 26** - Choose the apps that you want to install for the group
-
- 
-
-8. When you're done choosing apps, click **Next** at the bottom of the screen.
-
- If you select Microsoft Store apps, you will see a notification that Intune for Education is getting these apps.
-
-8. In the **Choose settings** screen, we will set the settings to apply to the group. Click the reverse caret (downward-facing arrow) to expand the settings group and get more information about each setting in that settings group.
-
- **Figure 27** - Expand the settings group to get more details
-
- 
-
-9. For this walkthrough, set the following settings:
- - In the **Microsoft Edge settings** group, change the **Do-Not-Track headers** setting to **Require**.
- - In the **App settings** group, change the **Microsoft Store for Business apps** setting to **Block**, and then set the **Require Microsoft Store for Business apps to be installed from private store** to **Require**.
-
- **Figure 28** - Set some additional settings
-
- 
-
-10. Click **Next**. In the **Review** screen, you will see a summary of the apps and settings you selected to apply.
-
- **Figure 29** - Review the group, apps, and settings you configured
-
- 
-
-11. Click **Save** to end express configuration.
-12. You will see the **You're done!** screen which lets you choose one of two options.
-
- **Figure 30** - All done with Intune for Education express configuration
-
- 
-
-13. Click **All done** or click the **X** on the upper-right corner of the screen to dismiss this screen and go back to the dashboard.
-
-
-**Add apps bought from Microsoft Store for Education**
-
-- **Example 1 - Minecraft: Education Edition**
-
- If you would like to purchase Minecraft: Education Edition or want to learn how to get, distribute, and manage permissions for Minecraft: Education Edition, see For IT administrators - get Minecraft: Education Edition.
-
-- **Example 2 - Free educational/reference apps**
-
- 1. In the Intune for Education console, click **Apps** from the menu on the left.
-
- **Figure 31** - Click on **Apps** to see the list of apps for your tenant
-
- 
-
- 2. In the **Store apps** section, click **+ New app**. This will take you to the Microsoft Store for Education portal and you will already be signed in.
-
- **Figure 32** - Select the option to add a new Store app
-
- 
-
- 3. In the Microsoft Store page, check some of the categories for suggested apps or search the Store for a free educational or reference app. Find ones that you haven't already installed during express setup for Intune for Education.
-
- For example, these apps are free:
- - Duolingo - Learn Languages for Free
- - Flashcards Pro
- - Khan Academy
- - My Study Life
-
- 4. Find or select the app you want to install and click **Get the app**.
- 5. In the app's Store page, click the **...** button and select **Add to private store**.
- 6. Repeat steps 3-5 to install another app or move to the next step.
- 7. In the Microsoft Store for Education portal, select **Manage > Apps & software > Manage apps** to verify that the apps you purchased appear in your inventory.
-
- For example, if you bought Duolingo and Khan Academy, they will show up in your inventory along with the apps that Microsoft automatically provisioned for your education tenant.
-
- **Figure 33** - Apps inventory in Microsoft Store for Education
-
- 
-
- In the **Private store** column of the **Apps & software** page, the status for some apps will indicate that it's "In private store" while others will say "Not in private store". We won't go over this in the walkthrough, but you can learn more about this in Distribute apps using your private store.
-
- > [!NOTE]
- > You'll see in the above screenshot that some apps say that **Add is in progress**. Sync happens automatically, but it may take up to 24 hours for your organization's private store and 12 hours for Intune for Education to sync all your purchased apps.
-
-**Install apps for all users**
-
-Now that you've bought the apps, use Intune for Education to specify the group to install the apps for. Here, we'll show you how to install the apps you bought for all devices used by all users in your tenant.
-
-1. In the Intune for Education console, click the **Groups** option from the menu on the left.
-
- **Figure 34** - Groups page in Intune for Education
-
- 
-
-2. In the **Groups** page, select **All Users** from the list of groups on the left, and then click **Users** in the taskbar at the top of the **All Users** page.
-
- **Figure 35** - List of all users in the tenant
-
- 
-
-3. In the taskbar at the top, select **Apps** and then click **Edit apps** to see a list of available apps.
-
- **Figure 36** - Edit apps to assign them to users
-
- 
-
-4. Select the apps to deploy to the group. A blue checkmark will appear next to the apps you select.
-
- **Figure 37** - Select the apps to deploy to the group
-
- 
-
-5. Once you're done, click **Save** at the bottom of the page to deploy the selected apps to the group.
-6. You'll be notified that app assignments are being updated. The updated **All Users** groups page now include the apps you selected.
-
- **Figure 38** - Updated list of assigned apps
-
- 
-
-You're now done assigning apps to all users in your tenant. It's time to set up your Windows 10 device(s) and check that your cloud infrastructure is correctly set up and your apps are being pushed to your devices from the cloud.
-
-## 6. Set up Windows 10 devices
-
-### 6.1 Set up devices using Set up School PCs or Windows OOBE
-We recommend using the latest build of Windows 10, version 1703 on your education devices. To set up new Windows 10 devices and enroll them to your education tenant, choose from one of these options:
-- **Option 1: [Use the Set up School PCs app](#usesetupschoolpcs)** - You can use the app to create a setup file that you can use to quickly set up one or more Windows 10 devices.
-- **Option 2: [Go through Windows OOBE and join the device to Azure AD](#usewindowsoobandjoinaad)** - You can go through a typical Windows 10 device setup or first-run experience to configure your device.
-
-**Option 1: Set up a device using the Set up School PCs app**
-
-IT administrators and technical teachers can use the Set up School PCs app to quickly set up PCs for students. A student PC set up using the app is tailored to provide students with the tools they need for learning while removing apps and features that they don't need.
-
-
-
-Set up School PCs makes it easy to set up Windows 10 PCs with Microsoft's recommended education settings, using a quick USB setup. This app guides you through the creation of a student PC provisioning package and helps you save it to a USB drive. From there, just plug the USB drive into student PCs running Windows 10 Creators Update (version 1703). It automatically:
-- Joins each student PC to your organization's Office 365 and Azure Active Directory tenant
-- Enrolls each student PC into a mobile device management (MDM) provider, like Intune for Education, if licensed in your tenant. You can manage all the settings Set up School PCs sets later through MDM.
-- Removes OEM preinstalled software from each student PC
-- Auto-configures and saves a wireless network profile on each student PC
-- Gives a friendly and unique name to each student device for future management
-- Sets Microsoft-recommended school PC settings, including shared PC mode which provides faster sign-in and automatic account cleanup
-- Enables optional guest account for younger students, lost passwords, or visitors
-- Enables optional secure testing account
-- Locks down the student PC to prevent mischievous activity:
- * Prevents students from removing the PC from the school's device management system
- * Prevents students from removing the Set up School PCs settings
-- Keeps student PCs up-to-date without interfering with class time using Windows Update and maintenance hours
-- Customizes the Start layout with Office
-- Installs OneDrive for storing cloud-based documents and Sway for creating interactive reports, presentations, and more
-- Uninstalls apps not specific to education, such as Solitaire
-- Prevents students from adding personal Microsoft accounts to the PC
-
-**To set up a device using the Set up School PCs app**
-
-1. Follow the steps in Use the Set up School PCs app to quickly set up one or more student PCs.
-2. Follow the steps in [5.2 Verify correct device setup](#52-verify-correct-device-setup).
-
-
-**Option 2: Set up a device using Windows OOBE**
-
-1. If you don't have a Wi-Fi network configured, make sure you connect the device to the Internet through a wired or Ethernet connection.
-2. Go through the Windows device setup experience. On a new or reset device, this starts with the **Let's start with region. Is this right?** screen.
-
- **Figure 39** - Let's start with region
-
- 
-
-3. Continue with setup. In the **How would you like to set up?** screen, select **Set up for an organization**.
-
- **Figure 40** - Select setup for an organization
-
- 
-
-4. Sign in using the user's account and password. Depending on the user password setting, you may be prompted to update the password.
-5. Choose privacy settings for the device. Location, speech recognition, diagnostics, and other settings are all on by default. Configure the settings based on the school's policies.
-6. Click **Accept** to go through the rest of device setup.
-
-
-### 6.2 Verify correct device setup
-Verify that the device is set up correctly and boots without any issues.
-
-**Verify that the device was set up correctly**
-1. Confirm that the Start menu contains a simple configuration.
-2. Confirm that the Store and built-in apps are installed and working. The apps pushed down from Intune for Education will appear under **Recently added**.
-
- > [!NOTE]
- > It may take some time before some apps are pushed down to your device from Intune for Education. Check again later if you don't see some of the apps you provisioned for the user.
-
- **Figure 41** - Sample list of apps for a user
-
- 
-
-### 6.3 Verify the device is Azure AD joined
-Let's now verify that the device is joined to your organization's Azure AD and shows up as being managed in Microsoft Intune for Education.
-
-**Verify if the device is joined to Azure AD**
-1. Log in to the Intune for Education console.
-2. Select **Groups** and select **All Devices**.
-3. In the **All Devices** page, see the list of devices and verify that the device you're signed into appears on the list.
-
- **Figure 42** - List of all managed devices
-
- 
-
-4. On the Windows 10 education device, click **Start** and go to **Settings**.
-5. Select **Accounts > Access work or school**.
-6. In the **Access work or school** page, confirm that the device is connected to the organization's Azure AD.
-
- **Figure 43** - Confirm that the Windows 10 device is joined to Azure AD
-
- 
-
-**That's it! You're done!** You've completed basic cloud setup, deployment, and management using Microsoft Education. You can continue follow the rest of the walkthrough to finish setup and complete other tasks.
-
-
-## 7. Finish setup and other tasks
-
-### 7.1 Update group settings in Intune for Education
-If you need to make changes or updates to any of the apps or settings for the group(s), follow these steps.
-
-1. Log in to the Intune for Education console.
-2. Click **Groups** and then choose **Settings** in the taskbar at the top of the page.
-3. You will see the same settings groups that you saw in express setup for Intune for Education as well as other settings categories such as **Windows Defender settings**, **Device sharing**, **Edition upgrade**, and so on.
-
- **Figure 44** - See the list of available settings in Intune for Education
-
- 
-
-4. Keep the default settings or configure the settings according to your school's policies.
-
- For example, you can configure the diagnostic data sent to Microsoft in **Basic device settings > Send diagnostic data**.
-
-5. Click **Save** or **Discard changes**.
-
-### 7.2 Configure Azure settings
-After completing the basic setup for your cloud infrastructure and confirming that it is up and running, it's time to prepare for additional devices to be added and enable capabilities for the user to use.
-
-#### Enable many devices to be added by a single person
-When a device is owned by the school, you may need to have a single persion adding many devices to your cloud infrastructure.
-
-Follow the steps in this section to enable a single person to add many devices to your cloud infrastructure.
-
-1. Sign in to the Office 365 admin center.
-2. Configure the device settings for the school's Active Directory. To do this, go to the new Azure portal, https://portal.azure.com.
-3. Select **Azure Active Directory > Users and groups > Device settings**.
-
- **Figure 45** - Device settings in the new Azure portal
-
- 
-
-4. Find the setting **Maximum number of devices per user** and change the value to **Unlimited**.
-5. Click **Save** to update device settings.
-
-#### Enable roaming settings for users
-When students move from using one device to another, they may need to have their settings roam with them and be made available on other devices.
-
-Follow the steps in this section to ensure that settings for the each user follow them when they move from one device to another.
-
-1. Sign in to the Office 365 admin center.
-3. Go to the new Azure portal, https://portal.azure.com.
-3. Select **Azure Active Directory > Users and groups > Device settings**.
-4. Find the setting **Users may sync settings and enterprise app data** and change the value to **All**.
-
- **Figure 46** - Enable settings to roam with users
-
- 
-
-5. Click **Save** to update device settings.
-
-### 7.3 Complete Office 365 for Education setup
-Now that your basic cloud infrastructure is up and running, it's time to complete the rest of the Office 365 for Education setup. You can find detailed information about completing Office 365 setup, services and applications, troubleshooting, and more by reading the Office 365 admin documentation.
-
-### 7.4 Add more users
-After your cloud infrastructure is set up and you have a device management strategy in place, you may need to add more users and you want the same policies to apply to these users. You can add new users to your tenant simply by adding them to the Office 365 groups. Adding new users to Office 365 groups automatically adds them to the corresponding groups in Intune for Education.
-
-See Add users to Office 365 to learn more. Once you're done adding new users, go to the Intune for Education console and verify that the same users were added to the Intune for Education groups as well.
-
-### 7.5 Connect other devices to your cloud infrastructure
-Adding a new device to your cloud-based tenant is easy. For new devices, you can follow the steps in [6. Set up Windows 10 devices](#6-set-up-windows-10-devices). For other devices, such as those personally-owned by teachers who need to connect to the school network to access work or school resources (BYOD), you can follow the steps in this section to get these devices connected.
-
- > [!NOTE]
- > These steps enable users to get access to the organization's resources, but it also gives the organization some control over the device.
-
-**To connect a personal device to your work or school**
-
-1. On your Windows device, go to **Settings > Accounts**.
-2. Select **Access work or school** and then click **Connect** in the **Connect to work or school** page.
-3. In the **Set up a work or school account** window, enter the user's account info.
-
- For example, if a teacher connects their personal device to the school network, they'll see the following screen after typing in their account information.
-
- **Figure 47** - Device is now managed by Intune for Education
-
- 
-
-4. Enter the account password and then click **Sign in** to authenticate the user.
-
- Depending on the organization's policy, the user may be asked to update the password.
-
-5. After the user's credentails are validated, the window will refresh and will now include an entry that shows the device is now connected to the organization's MDM. This means the device is now enrolled in Intune for Education MDM and the account should have access to the organization's resources.
-
- **Figure 48** - Device is connected to organization's MDM
-
- 
-
-6. You can confirm that the new device and user are showing up as Intune for Education-managed by going to the Intune for Education management portal and following the steps in [6.3 Verify the device is Azure AD joined](#63-verify-the-device-is-azure-ad-joined).
-
- It may take several minutes before the new device shows up so check again later.
-
-
-## Get more info
-
-### Microsoft Education documentation and resources hub
-See the Microsoft Education documentation and resources hub for links to more content for IT admins, teachers, students, and education app developers.
-
-### Info related to this walkthrough
-
-**For IT admins**
-
-To learn more about the services and tools mentioned in this walkthrough, and learn what other tasks you can do, follow these links:
-- Working with Microsoft Store for Education
-- *Resources for anyone who uses Office 365* and *Resources for admins* in Get started with Office 365 for Education
-- School Data Sync deployment options
- - Deployment using CSV files: How to deploy School Data Sync by using CSV files and CSV files for School Data Sync
- - Deployment using PowerSchool Sync: How to deploy School Data Sync by using PowerSchool Sync and School Data Sync required attributes for PowerSchool Sync
- - Deployment using Clever Sync: How to deploy School Data Sync by using Clever Sync and School Data Sync required attributes for Clever sync
- - Deployment using OneRoster CSV files: How to deploy School Data Sync by using OneRoster CSV files
-
-**For teachers**
-
-Whether it's in the classroom, getting the most out of your devices, or learning some of the cool things you can do, we've got teachers covered. Follow these links for more info:
-- *Resources for anyone who uses Office 365* in Get started with Office 365 for Education
-- Windows 10 online resources for teachers
-
-
-
-
diff --git a/education/get-started/get-started-with-microsoft-education.md b/education/get-started/get-started-with-microsoft-education.md
index 85d5add1d6..4746bcc249 100644
--- a/education/get-started/get-started-with-microsoft-education.md
+++ b/education/get-started/get-started-with-microsoft-education.md
@@ -10,7 +10,7 @@ ms.localizationpriority: high
ms.pagetype: edu
author: CelesteDG
ms.author: celested
-ms.date: 10/04/2017
+ms.date: 10/09/2017
---
# Get started: Deploy and manage a full cloud IT solution with Microsoft Education
diff --git a/education/get-started/images/03bfe22a-469b-4b73-ab8d-af5aaac8ff89.png b/education/get-started/images/03bfe22a-469b-4b73-ab8d-af5aaac8ff89.png
new file mode 100644
index 0000000000..82aeef7c40
Binary files /dev/null and b/education/get-started/images/03bfe22a-469b-4b73-ab8d-af5aaac8ff89.png differ
diff --git a/education/get-started/images/how-to-deploy-SDS-using-CSV-files-2a.PNG b/education/get-started/images/how-to-deploy-SDS-using-CSV-files-2a.PNG
new file mode 100644
index 0000000000..1dcae48622
Binary files /dev/null and b/education/get-started/images/how-to-deploy-SDS-using-CSV-files-2a.PNG differ
diff --git a/education/get-started/images/how-to-deploy-SDS-using-CSV-files-3.PNG b/education/get-started/images/how-to-deploy-SDS-using-CSV-files-3.PNG
new file mode 100644
index 0000000000..b366d25c4e
Binary files /dev/null and b/education/get-started/images/how-to-deploy-SDS-using-CSV-files-3.PNG differ
diff --git a/education/get-started/images/how-to-deploy-SDS-using-CSV-files-4.PNG b/education/get-started/images/how-to-deploy-SDS-using-CSV-files-4.PNG
new file mode 100644
index 0000000000..60f4857c8e
Binary files /dev/null and b/education/get-started/images/how-to-deploy-SDS-using-CSV-files-4.PNG differ
diff --git a/education/get-started/images/how-to-deploy-SDS-using-CSV-files-5.PNG b/education/get-started/images/how-to-deploy-SDS-using-CSV-files-5.PNG
new file mode 100644
index 0000000000..56cd93787e
Binary files /dev/null and b/education/get-started/images/how-to-deploy-SDS-using-CSV-files-5.PNG differ
diff --git a/education/get-started/set-up-office365-edu-tenant.md b/education/get-started/set-up-office365-edu-tenant.md
index 1b028cb585..3fcbd5064e 100644
--- a/education/get-started/set-up-office365-edu-tenant.md
+++ b/education/get-started/set-up-office365-edu-tenant.md
@@ -10,7 +10,7 @@ ms.localizationpriority: high
ms.pagetype: edu
author: CelesteDG
ms.author: celested
-ms.date: 07/10/2017
+ms.date: 10/09/2017
---
# Set up an Office 365 Education tenant
@@ -23,10 +23,8 @@ Schools can use Office 365 to save time and be more productive. Built with power
Don't have an Office 365 for Education verified tenant or just starting out? Follow these steps to set up an Office 365 for Education tenant. [Learn more about Office 365 for Education plans and pricing](https://products.office.com/academic/compare-office-365-education-plans).
-
-
+
+
You can watch the descriptive audio version here: [Microsoft Education: Set up an Office 365 Education tenant (DA)](https://www.youtube.com/watch?v=d5tQ8KoB3ic)
## To set up a new Office 365 Education tenant
diff --git a/education/get-started/set-up-windows-10-education-devices.md b/education/get-started/set-up-windows-10-education-devices.md
index dc121c18ad..ac9f52c84f 100644
--- a/education/get-started/set-up-windows-10-education-devices.md
+++ b/education/get-started/set-up-windows-10-education-devices.md
@@ -10,7 +10,7 @@ ms.localizationpriority: high
ms.pagetype: edu
author: CelesteDG
ms.author: celested
-ms.date: 07/10/2017
+ms.date: 10/09/2017
---
# Set up Windows 10 education devices
@@ -25,12 +25,6 @@ To set up new Windows 10 devices and enroll them to your education tenant, choos
- **Option 1: [Use the Set up School PCs app](https://docs.microsoft.com/education/windows/use-set-up-school-pcs-app)** - You can use the app to create a setup file that you can use to quickly set up one or more Windows 10 devices.
- **Option 2: [Go through Windows OOBE and join the device to Azure AD](set-up-windows-education-devices.md)** - You can go through a typical Windows 10 device setup or first-run experience to configure your device.
-
-
-
> [!div class="step-by-step"]
[<< Use Intune for Education to manage groups, apps, and settings](use-intune-for-education.md)
[Finish setup and other tasks >>](finish-setup-and-other-tasks.md)
diff --git a/education/get-started/set-up-windows-education-devices.md b/education/get-started/set-up-windows-education-devices.md
index ad79d03cb5..3398db7d3f 100644
--- a/education/get-started/set-up-windows-education-devices.md
+++ b/education/get-started/set-up-windows-education-devices.md
@@ -10,7 +10,7 @@ ms.localizationpriority: high
ms.pagetype: edu
author: CelesteDG
ms.author: celested
-ms.date: 07/10/2017
+ms.date: 07/28/2017
---
# Set up Windows 10 devices using Windows OOBE
@@ -19,7 +19,7 @@ If you are setting up a Windows 10 device invidividually, and network bandwidth
You can watch the video to see how this is done, or follow the step-by-step guide.
-
+
You can watch the descriptive audio version here: [Microsoft Education: Set up a new Windows 10 education devices using the Windows setup experience (DA)](https://www.youtube.com/watch?v=_UtS1Cz2Pno)
diff --git a/education/get-started/use-intune-for-education.md b/education/get-started/use-intune-for-education.md
index 491a309866..5541526c47 100644
--- a/education/get-started/use-intune-for-education.md
+++ b/education/get-started/use-intune-for-education.md
@@ -10,7 +10,7 @@ ms.localizationpriority: high
ms.pagetype: edu
author: CelesteDG
ms.author: celested
-ms.date: 07/10/2017
+ms.date: 08/29/2017
---
# Use Intune for Education to manage groups, apps, and settings
@@ -41,11 +41,8 @@ Note that for verified education tenants, Microsoft automatically provisions you
You can watch the video to see how this is done, or follow the step-by-step guide.
-
+
-
You can watch the descriptive audio version here: [Microsoft Education: Use Intune for Education to manage groups, apps, and settings (DA)](https://youtu.be/Tejxfc4V7cQ)
## Set up Intune for Education
diff --git a/education/get-started/use-school-data-sync.md b/education/get-started/use-school-data-sync.md
index 2a4cd0e57f..a370bb71b8 100644
--- a/education/get-started/use-school-data-sync.md
+++ b/education/get-started/use-school-data-sync.md
@@ -25,14 +25,10 @@ Follow all the steps in this section to use SDS and sample CSV files in a trial
You can watch the video to see how this is done, or follow the step-by-step guide.
-
-
+
You can watch the descriptive audio version here: [Microsoft Education: Use School Data Sync to import student data (DA)](https://www.youtube.com/watch?v=l4b086IMtvc)
-
## Download sample school data
1. Go to the O365-EDU-Tools GitHub site.
@@ -59,89 +55,83 @@ To learn more about the CSV files that are required and the info you need to inc
## Use SDS to import student data
-1. If you haven't done so already, go to the SDS portal, https://sds.microsoft.com.
-2. Click **Sign in**. You will see the **Settings** option for **Manage School Data Sync**.
+1. If you haven't done so already, go to the SDS portal, https://sds.microsoft.com.
+2. Click Sign in. Then enter your O365 Global Admin account credentials.
+3. After logging in, click **+ Add Profile** in the left hand navigation pane to create a Sync Profile.. This opens up the new profile setup wizard within the main page.
- **Figure 3** - Settings for managing SDS
+ **Figure 3** - New SDS profile setup wizard
+
+ 
- 
+4. For the new profile, in the **How do you want to connect to your school?** screen:
+
+ 1. Enter a name for your profile, such as *Contoso_Elementary_Profile*.
+ 2. Select a sync method for your profile. For this walkthrough, select **Upload CSV Files**.
+ 3. Select the type of CSV files that you're using. For this walkthrough, select **CSV files: SDS Format**.
+ 4. Click **Start**.
-3. Turn on **School Data Sync**. You will get a notification that it is turned on. Click **OK**.
+5. In the **Sync options** screen:
- New menu options will appear on the left of the SDS portal.
-
- **Figure 4** - New menu options appear after SDS is turned on
-
- 
-
-4. Click **+ Add Profile** from the sync dashboard or from the menu on the left to start syncing school data.
-
- This opens up the new profile setup wizard within the main page.
-
- **Figure 5** - New SDS profile setup wizard
-
- 
-
-5. For the new profile, in the **How do you want to connect to your school?** screen:
- 1. Enter a name for your profile, such as *Contoso_Elementary_Profile*.
- 2. Select a sync method for your profile. For this walkthrough, select **Upload CSV Files**.
- 3. Select the type of CSV files that you're using. For this walkthrough, select **CSV files: SDS Format**.
- 4. Click **Start**.
-
-6. In the **Sync options** screen:
1. In the **Select new or existing users** section, you can select either **Existing users** or **New users** based on the scenaro that applies to you. For this walkthrough, select **New users**.
- 2. In the **Import data** section:
- 1. Click **Upload Files** to bring up the **Select data files to be uploaded** window.
- 2. In the **Select data files to be uploaded** window, click **+ Add Files** and navigate to the directory where you saved the six CSV files required for data import.
- 3. In the File Explorer window, you will see a folder for the sample CSV files for the UK and six sample CSV files for the US. Select the CSV files that match your region/locale, and then click **Open**.
- 4. In the **Select data files to be uploaded** window, confirm that all six CSV files (School.csv, Section.csv, Student.csv, StudentEnrollment.csv, Teacher.csv, and TeacherRoster.csv) are listed and then click **Upload**.
+ 2. In the **Import data** section, click **Upload Files** to bring up the **Select data files to be uploaded** window.
+ 3. In the **Select data files to be uploaded** window, click **+ Add Files** and navigate to the directory where you saved the six CSV files required for data import.
+ 4. In the File Explorer window, you will see a folder for the sample CSV files for the UK and six sample CSV files for the US. Select the CSV files that match your region/locale, and then click **Open**.
+ 5. In the **Select data files to be uploaded** window, confirm that all six CSV files (School.csv, Section.csv, Student.csv, StudentEnrollment.csv, Teacher.csv, and TeacherRoster.csv) are listed and then click **Upload**.
- > [!NOTE]
- > After you click **Upload**, the status in the **Select data files to be uploaded** window will indicate that files are being uploaded and verified.
+ > [!NOTE]
+ > After you click **Upload**, the status in the **Select data files to be uploaded** window will indicate that files are being uploaded and verified.
- 5. After all the files are successfully uploaded, click **OK**.
-
- 3. Select the domain for the schools/sections. This domain will be used for the Section email addresses created during setup. If you have more than one domain, make sure you select the appropriate domain for the sync profile and subsequent sections being created.
- 4. In the **Select school and section properties** section, ensure the attributes that have been automatically selected for you align to your CSV files. If you select additional properties, or deselect any properties, make sure you have the properties and values contained within the CSV files. For the walkthrough, you don't have to change the default.
- 5. In the **Sync option for Section Group Display Name**, check the box if you want to allow teachers to overwrite the section names. Otherwise, SDS will always reset the display name value for sections to the value contained within the CSV files.
- 6. In the **Student enrollment option** section:
+ 6. After all the files are successfully uploaded, click **OK**.
+ 7. In the **Select school and section properties** section, ensure the attributes that have been automatically selected for you align to your CSV files. If you select additional properties, or deselect any properties, make sure you have the properties and values contained within the CSV files. For the walkthrough, you don't have to change the default.
+ 8. In the Replace Unsupported Special Characters section, checking this box will allow SDS to automatically replace unsupported special characters while the sync is running. Special characters will be replaced with an "_", and no longer result in an error during the sync process for that object.
+ 9. In the **Sync option for Section Group Display Name**, check the box if you want to allow teachers to overwrite the section names. Otherwise, SDS will always reset the display name value for sections to the value contained within the CSV files.
+ 10. In the **Student enrollment option** section:
* If you want to sync your student roster data immediately, leave the box unchecked.
* If you prefer to sync student enrollment/rostering data at a later date, check this box and then pick a date by clicking the empty box and selecting the appropriate date in the calendar when you would like to begin syncing your student roster data. Some schools prefer to delay syncing student roster data so they don't expose rosters before the start of the new term, semester, or school year.
- 7. In the **License Options** section, check the box for **Intune for Education** to allow students and teachers to receive the Intune for Education license. This will also create the SDS dynamic groups and security groups, which will be used within Intune for Education.
- 8. Click **Next**.
+ 11. In the Default Term Dates section, You can set default start and end dates for Section terms. These dates will only be used if you do not provide these dates in your CSV files. If you upload files with Section start and end dates, you will be asked to select the format of the dates provided. If the format that you enter does not match the format of start and end dates in your files, you will receive an error message and need to edit the date format so that it matches the format in your files.
+ 12. In the **License Options** section, check the box for **Intune for Education** to allow students and teachers to receive the Intune for Education license. This will also create the SDS dynamic groups and security groups, which will be used within Intune for Education.
+ 13. Click **Next**.
- **Figure 6** - Sync options for the new profile
+ **Figure 4** - Sync options for the new profile
- 
+ 
+
+6. In the **Teacher options** screen:
-7. In the **Teacher options** screen:
1. Select the domain for the teachers. SDS appends the selected domain suffix to the teacher's username attribute contained in the CSV file, to build the UserPrincipalName for each user in Office 365/Azure Active Directory during the account creation process. The teacher will log in to Office 365 with the UserPrincipalName once the account is created.
+ * Primary Key (Source Directory) - This is the Teacher attribute in the CSV file used for SDS Identity Matching. Watch the Identity Matching video for additional information on how to select the appropriate source directory attribute, and properly configure the identity matching settings for teacher.
+ * Primary Key (Target Directory) - This is the User attribute in Azure AD used for SDS Identity Matching. Watch the Identity Matching video for additional information on how to select the appropriate target directory attribute, and properly configure the identity matching settings for the teacher.
+ * Domain (optional) - This is an optional domain value that you can add to the selected Source Directory attribute to complete your Teacher Identity Matching. If you need to match to a UserPrincipalName or Mail attribute, you must have a domain included in the string. Your source attribute must either include the domain already or you can append the appropriate domain to the source attribute using this dropdown menu.
+
2. In the **Select teacher properties** section, make sure the attributes that have been automatically selected for you align to your CSV files. If you select additional properties or deselect any properties, make sure you have the corresponding properties and values contained within the CSV files. For this walkthrough, you don't have to change the default.
- 3. In the **Teacher licenses** section, choose the SKU to assign licenses for teachers. For example, **STANDARDWOFFPACK_FACULTY**.
+
+ 3. In the **License assignment** section, choose the SKU to assign licenses for teachers.
+
4. Click **Next**.
- **Figure 7** - Specify options for teacher mapping
+ **Figure 5** - Specify options for teacher mapping
- 
+ 
+
+7. In the **Student options** screen:
-8. In the **Student options** screen:
1. Select the domain for the students. SDS appends the selected domain suffix to the student's username attribute contained in the CSV file, to build the UserPrincipalName for each user in Office 365/Azure Active Directory during the account creation process. The student will log in to Office 365 with the UserPrincipalName once the account is created.
2. In the **Select student properties** section, make sure the attributes that have been automatically selected for you align to your CSV files. If you select additional properties or deselect any properties, make sure you have the corresponding properties and values contained within the CSV files. For this walkthrough, you don't have to change the default.
- 3. In the **Student licenses** section, choose the SKU to assign licenses for students. For example, **STANDARDWOFFPACK_STUDENT**.
+ 3. In the **License assignment** section, choose the SKU to assign licenses for students.
4. Click **Next**.
- **Figure 8** - Specify options for student mapping
+ **Figure 6** - Specify options for student mapping
- 
+ 
-9. In the profile **Review** page, review the summary and confirm that the options selected are correct.
-10. Click **Create profile**. You will see a notification that your profile is being submitted and then you will see a page for your profile.
+8. In the profile **Review** page, review the summary and confirm that the options selected are correct.
+9. Click **Create profile**. You will see a notification that your profile is being submitted and then you will see a page for your profile.
- **Figure 9** - SDS profile page
+ **Figure 7** - SDS profile page
+
+ 
- 
-
-11. After the profile is created and the status indicates as **Setting up**, refresh the page until you see the status change to **Sync in progress**. Beneath the **Sync in progress** status, you will see which of the 5 sync stages SDS is working on:
+10. After the profile is created and the status indicates as **Setting up**, refresh the page until you see the status change to **Sync in progress**. Beneath the **Sync in progress** status, you will see which of the 5 sync stages SDS is working on:
* Stage 1 - Validating data
* Stage 2 - Processing schools and sections
* Stage 3 - Processing students and teachers
@@ -156,15 +146,15 @@ To learn more about the CSV files that are required and the info you need to inc
Here are some examples of what the sync status can look like:
- **Figure 10** - New profile: Sync in progress
+ **Figure 8** - New profile: Sync in progress
- **Figure 11** - New profile: Sync complete - no errors
+ **Figure 9** - New profile: Sync complete - no errors
- **Figure 12** - New profile: Sync complete - with errors
+ **Figure 10** - New profile: Sync complete - with errors
@@ -174,14 +164,9 @@ To learn more about the CSV files that are required and the info you need to inc
That's it for importing sample school data using SDS.
-
-
> [!div class="step-by-step"]
[<< Set up an Office 365 education tenant](set-up-office365-edu-tenant.md)
[Configure Microsoft Store for Education >>](configure-microsoft-store-for-education.md)
## Related topic
-[Get started: Deploy and manage a full cloud IT solution with Microsoft Education](get-started-with-microsoft-education.md)
\ No newline at end of file
+[Get started: Deploy and manage a full cloud IT solution with Microsoft Education](get-started-with-microsoft-education.md)
diff --git a/education/index.md b/education/index.md
index ba911a2583..386a59f34f 100644
--- a/education/index.md
+++ b/education/index.md
@@ -5,6 +5,7 @@ title: Microsoft 365 Education documentation and resources | Microsoft Docs
description: Learn about product documentation and resources available for school IT administrators, teachers, students, and education app developers.
author: CelesteDG
ms.author: celested
+ms.date: 10/30/2017
---
diff --git a/education/trial-in-a-box/TOC.md b/education/trial-in-a-box/TOC.md
new file mode 100644
index 0000000000..71ed4cbd0c
--- /dev/null
+++ b/education/trial-in-a-box/TOC.md
@@ -0,0 +1,4 @@
+# [Microsoft Education Trial in a Box](index.md)
+## [Educator Trial in a Box Guide](educator-tib-get-started.md)
+## [IT Admin Trial in a Box Guide](itadmin-tib-get-started.md)
+## [Microsoft Education Trial in a Box Support](support-options.md)
\ No newline at end of file
diff --git a/education/trial-in-a-box/educator-tib-get-started.md b/education/trial-in-a-box/educator-tib-get-started.md
new file mode 100644
index 0000000000..1f647b7dbb
--- /dev/null
+++ b/education/trial-in-a-box/educator-tib-get-started.md
@@ -0,0 +1,199 @@
+---
+title: Educator Trial in a Box Guide
+description: Need help or have a question about using Microsoft Education? Start here.
+keywords: support, troubleshooting, education, Microsoft Education, full cloud IT solution, school, deploy, setup, manage, Windows 10, Intune for Education, Office 365 for Education, Microsoft Store for Education, Set up School PCs
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.topic: article
+ms.localizationpriority: high
+ms.pagetype: edu
+ROBOTS: noindex,nofollow
+author: CelesteDG
+ms.author: celested
+ms.date: 01/12/2017
+---
+
+# Educator Trial in a Box Guide
+
+
+
+This guide shows you how to quickly and easily try a few transformational tools from Microsoft Education in 5 quick steps.
+
+| | |
+| :---: |:--- |
+| [](#edu-task1) | [Log in](#edu-task1) to **Device A** with your Teacher credentials and connect to the school network. |
+| [](#edu-task2) | **Interested in significantly improving your students' reading speed and comprehension?[1](#footnote1)** Try the [Learning Tools Immersive Reader](#edu-task2) to see how kids can learn to read faster, using text read aloud, and highlighting words for syntax. |
+| [](#edu-task3) | **Looking to foster collaboration, communication, and critical thinking in the classroom?** Launch [Microsoft Teams](#edu-task3) and learn how to set up digital classroom discussions, respond to student questions, and organize class content. |
+| [](#edu-task4) | **Trying to expand classroom creativity and interaction between students?** Open [OneNote](#edu-task4) and create an example group project for your class. |
+| [](#edu-task5) | **Want to teach kids to further collaborate and problem solve?** Play with [Minecraft: Education Edition](#edu-task5) to see how it can be used as a collaborative and versatile platform across subjects to encourage 21st century skills. |
+| | |
+
+
+
+
+
+
+## 1. Log in and connect to the school network
+To try out the educator tasks, start by logging in as a teacher.
+
+1. Log in to **Device A** using the **Teacher Username** and **Teacher Password** included in the **Credentials Sheet** located in your kit.
+2. Connect to your school's Wi-Fi network or connect with a local Ethernet connection.
+
+
+
+
+## 2. Significantly improve student reading speed and comprehension
+
+
+
+Learning Tools and the Immersive Reader can be used in the Microsoft Edge browser, Microsoft Word, and Microsoft OneNote to:
+* Increase fluency for English language learners
+* Build confidence for emerging readers
+* Provide text decoding solutions for students with learning differences such as dyslexia
+
+**Try this!**
+
+1. On the **Start** menu, click the Word document titled **Design Think**.
+2. Click **Edit Document** and select **Edit in Browser**.
+3. Select the **View** menu.
+4. Select the **Immersive Reader** button.
+
+ 
+
+5. Press the **Play** button to hear text read aloud.
+6. Select these various settings to see different ways to configure Immersive Reader for your students.
+
+ | Text to Speech | Text Preferences | Grammar Options | Line Focus |
+ | :------------: | :--------------: | :-------------: | :--------: |
+ |  |  |  |  |
+
+
+
+
+## 3. Spark communication, critical thinking, and creativity in the classroom
+
+
+
+Microsoft Teams is a digital hub that brings conversations, content, and apps together in one place. This guided tour walks you through the essential teaching features of the app. Then, through interactive prompts, experience how you can use this tool in your own classroom to spark digital classroom discussions, respond to student questions, organize content, and more!
+
+Take a guided tour of Microsoft Teams and test drive this digital hub.
+
+**Try this!**
+
+1. Take a guided tour of Microsoft Teams and test drive some teaching tasks. Open the Microsoft Edge browser and navigate to https://msteamsdemo.azurewebsites.net.
+2. Use your school credentials provided in the **Credentials Sheet**.
+
+
+
+
+## 4. Expand classroom collaboration and interaction between students
+
+
+
+Microsoft OneNote organizes curriculum and lesson plans for teachers and students to work together and at their own pace. It provides a digital canvas to store text, images, handwritten drawings, attachments, links, voice, and video.
+
+**Try this!**
+See how a group project comes together with opportunities to interact with other students and collaborate with peers. This one works best with the digital pen, included with your Trial in a Box.
+
+1. On the **Start** menu, click the OneNote shortcut named **Imagine Giza** to open the **Reimagine the Great Pyramid of Giza project**.
+2. Take the digital pen out of the box and make notes or draw.
+3. Follow the instructions for the project. Look for the **Try this!** callouts to experiment with these engaging activities.
+ - Discover the power of digital ink by selecting the Draw tab. Choose your pen and get scribbling.
+
+ 
+
+ - Type anywhere on the page! Just click your cursor where you want to place text.
+ - Use the checkmark in the **Home** tab to keep track of completed tasks.
+
+ 
+
+ - The Researcher tool from the Insert tab can help find answers.
+
+ 
+
+
+
+
+## 5. Get kids to further collaborate and problem solve
+
+
+
+Minecraft: Education Edition provides an immersive environment to develop creativity, collaboration, and problem-solving in an immersive environment where the only limit is your imagination.
+
+**Try this!**
+Today, we'll explore a Minecraft world through the eyes of a student.
+
+1. Connect the included mouse to your computer for optimal interaction.
+2. Open Microsoft Edge and visit https://aka.ms/lessonhub.
+3. Scroll down to the **Details** section and select **Download World**.
+
+ 
+
+4. When prompted, save the world.
+5. Enter your same teacher username and password and click **Accept**.
+6. Click **OK** on the **Minecraft: Education Edition Free Trial** box.
+7. Click **Play**.
+8. Click **Lesson Hub Vol 1** to enter the downloaded world.
+9. Explore the world by using the keys on your keyboard.
+ * **W** moves forward.
+ * **A** moves left.
+ * **D** moves right.
+ * **S** moves backward
+
+10. Use your mouse as your "eyes". Just move it to look around.
+11. For a bird's eye view, double-tap the SPACE BAR. Now press the SPACE BAR to fly higher. And then hold the SHIFT key to safely land.
+
+ To try more advanced movements or building within Minecraft, use the Minecraft Controls Diagram.
+
+ 
+
+12. Access and adapt over 300 lesson plans, spanning all grades and subjects, to meet your needs. Enjoy exploring new worlds and happy crafting.
+
+ **Try this!**
+
+ 1. Go to education.minecraft.net/.
+ 2. Click **Class Resources**.
+ 3. Click **Find a Lesson**.
+
+ 
+
+
+
+**Watch what Educators say about Microsoft Education delivering better learning outcomes**
+Bring out the best in students by providing a platform for collaborating, exploring, personalized learning, and getting things done across all devices.
+
+| | |
+|:--- |:--- |
+| See how one school improves reading skills using Learning Tools Immersive Reader | Here's how Microsoft Teams creates more robust classroom experiences at all ages. |
+| Watch teachers elevate the education of students using OneNote. | Here what other teachers say about using Minecraft: Education Edition in their classrooms. |
+| | |
+
+
+## Get more info
+* Learn more at microsoft.com/education
+* Find out if your school is eligible for a device trial at aka.ms/EDUTrialInABox
+* Buy Windows 10 devices
+
+
+
+
+
+
+
+1 OneNote in Education Learning Tools transform the student experience.
\ No newline at end of file
diff --git a/education/trial-in-a-box/images/Thumbs.db b/education/trial-in-a-box/images/Thumbs.db
new file mode 100644
index 0000000000..d36fc0c985
Binary files /dev/null and b/education/trial-in-a-box/images/Thumbs.db differ
diff --git a/education/trial-in-a-box/images/TrialInABox_Header_Map_Graphic-01.png b/education/trial-in-a-box/images/TrialInABox_Header_Map_Graphic-01.png
new file mode 100644
index 0000000000..07dae4fa9a
Binary files /dev/null and b/education/trial-in-a-box/images/TrialInABox_Header_Map_Graphic-01.png differ
diff --git a/education/trial-in-a-box/images/Unlock-Limitless-Learning.png b/education/trial-in-a-box/images/Unlock-Limitless-Learning.png
new file mode 100644
index 0000000000..5697eee7bb
Binary files /dev/null and b/education/trial-in-a-box/images/Unlock-Limitless-Learning.png differ
diff --git a/education/trial-in-a-box/images/Welcome-IT-Admins.png b/education/trial-in-a-box/images/Welcome-IT-Admins.png
new file mode 100644
index 0000000000..e1bc425bb1
Binary files /dev/null and b/education/trial-in-a-box/images/Welcome-IT-Admins.png differ
diff --git a/education/trial-in-a-box/images/Welocme-Educators.png b/education/trial-in-a-box/images/Welocme-Educators.png
new file mode 100644
index 0000000000..5906fd82bb
Binary files /dev/null and b/education/trial-in-a-box/images/Welocme-Educators.png differ
diff --git a/education/trial-in-a-box/images/activate_21st_learning.png b/education/trial-in-a-box/images/activate_21st_learning.png
new file mode 100644
index 0000000000..750846f38e
Binary files /dev/null and b/education/trial-in-a-box/images/activate_21st_learning.png differ
diff --git a/education/trial-in-a-box/images/admin-TIB-setp-1-jump.png b/education/trial-in-a-box/images/admin-TIB-setp-1-jump.png
new file mode 100644
index 0000000000..7a4ae9b645
Binary files /dev/null and b/education/trial-in-a-box/images/admin-TIB-setp-1-jump.png differ
diff --git a/education/trial-in-a-box/images/admin-TIB-setp-1-v3.png b/education/trial-in-a-box/images/admin-TIB-setp-1-v3.png
new file mode 100644
index 0000000000..00dd5bbb40
Binary files /dev/null and b/education/trial-in-a-box/images/admin-TIB-setp-1-v3.png differ
diff --git a/education/trial-in-a-box/images/admin-TIB-setp-2-jump.png b/education/trial-in-a-box/images/admin-TIB-setp-2-jump.png
new file mode 100644
index 0000000000..3bb2096f07
Binary files /dev/null and b/education/trial-in-a-box/images/admin-TIB-setp-2-jump.png differ
diff --git a/education/trial-in-a-box/images/admin-TIB-setp-2-v3.png b/education/trial-in-a-box/images/admin-TIB-setp-2-v3.png
new file mode 100644
index 0000000000..66f0d899df
Binary files /dev/null and b/education/trial-in-a-box/images/admin-TIB-setp-2-v3.png differ
diff --git a/education/trial-in-a-box/images/admin-TIB-setp-3-jump.png b/education/trial-in-a-box/images/admin-TIB-setp-3-jump.png
new file mode 100644
index 0000000000..801a858422
Binary files /dev/null and b/education/trial-in-a-box/images/admin-TIB-setp-3-jump.png differ
diff --git a/education/trial-in-a-box/images/admin-TIB-setp-3-v3.png b/education/trial-in-a-box/images/admin-TIB-setp-3-v3.png
new file mode 100644
index 0000000000..228e0fe52e
Binary files /dev/null and b/education/trial-in-a-box/images/admin-TIB-setp-3-v3.png differ
diff --git a/education/trial-in-a-box/images/admin-TIB-setp-4-jump.png b/education/trial-in-a-box/images/admin-TIB-setp-4-jump.png
new file mode 100644
index 0000000000..291f41f4b3
Binary files /dev/null and b/education/trial-in-a-box/images/admin-TIB-setp-4-jump.png differ
diff --git a/education/trial-in-a-box/images/admin-TIB-setp-4-v3.png b/education/trial-in-a-box/images/admin-TIB-setp-4-v3.png
new file mode 100644
index 0000000000..da700a5321
Binary files /dev/null and b/education/trial-in-a-box/images/admin-TIB-setp-4-v3.png differ
diff --git a/education/trial-in-a-box/images/admin-TIB-setp-5-jump.png b/education/trial-in-a-box/images/admin-TIB-setp-5-jump.png
new file mode 100644
index 0000000000..5b0e1230b2
Binary files /dev/null and b/education/trial-in-a-box/images/admin-TIB-setp-5-jump.png differ
diff --git a/education/trial-in-a-box/images/admin-TIB-setp-5-v3.png b/education/trial-in-a-box/images/admin-TIB-setp-5-v3.png
new file mode 100644
index 0000000000..5a11f7c057
Binary files /dev/null and b/education/trial-in-a-box/images/admin-TIB-setp-5-v3.png differ
diff --git a/education/trial-in-a-box/images/edu-TIB-setp-1-jump.png b/education/trial-in-a-box/images/edu-TIB-setp-1-jump.png
new file mode 100644
index 0000000000..ab75a4c733
Binary files /dev/null and b/education/trial-in-a-box/images/edu-TIB-setp-1-jump.png differ
diff --git a/education/trial-in-a-box/images/edu-TIB-setp-1-v3.png b/education/trial-in-a-box/images/edu-TIB-setp-1-v3.png
new file mode 100644
index 0000000000..3763d04261
Binary files /dev/null and b/education/trial-in-a-box/images/edu-TIB-setp-1-v3.png differ
diff --git a/education/trial-in-a-box/images/edu-TIB-setp-2-jump.png b/education/trial-in-a-box/images/edu-TIB-setp-2-jump.png
new file mode 100644
index 0000000000..1064f06843
Binary files /dev/null and b/education/trial-in-a-box/images/edu-TIB-setp-2-jump.png differ
diff --git a/education/trial-in-a-box/images/edu-TIB-setp-2-v3.png b/education/trial-in-a-box/images/edu-TIB-setp-2-v3.png
new file mode 100644
index 0000000000..a0c6d57d22
Binary files /dev/null and b/education/trial-in-a-box/images/edu-TIB-setp-2-v3.png differ
diff --git a/education/trial-in-a-box/images/edu-TIB-setp-3-jump.png b/education/trial-in-a-box/images/edu-TIB-setp-3-jump.png
new file mode 100644
index 0000000000..8383abf0f7
Binary files /dev/null and b/education/trial-in-a-box/images/edu-TIB-setp-3-jump.png differ
diff --git a/education/trial-in-a-box/images/edu-TIB-setp-3-v3.png b/education/trial-in-a-box/images/edu-TIB-setp-3-v3.png
new file mode 100644
index 0000000000..2ca24538db
Binary files /dev/null and b/education/trial-in-a-box/images/edu-TIB-setp-3-v3.png differ
diff --git a/education/trial-in-a-box/images/edu-TIB-setp-4-jump.png b/education/trial-in-a-box/images/edu-TIB-setp-4-jump.png
new file mode 100644
index 0000000000..5b8b8751a7
Binary files /dev/null and b/education/trial-in-a-box/images/edu-TIB-setp-4-jump.png differ
diff --git a/education/trial-in-a-box/images/edu-TIB-setp-4-v3.png b/education/trial-in-a-box/images/edu-TIB-setp-4-v3.png
new file mode 100644
index 0000000000..7ed0026dd3
Binary files /dev/null and b/education/trial-in-a-box/images/edu-TIB-setp-4-v3.png differ
diff --git a/education/trial-in-a-box/images/edu-TIB-setp-5-jump.png b/education/trial-in-a-box/images/edu-TIB-setp-5-jump.png
new file mode 100644
index 0000000000..3703de260f
Binary files /dev/null and b/education/trial-in-a-box/images/edu-TIB-setp-5-jump.png differ
diff --git a/education/trial-in-a-box/images/edu-TIB-setp-5-v3.png b/education/trial-in-a-box/images/edu-TIB-setp-5-v3.png
new file mode 100644
index 0000000000..e6a165980b
Binary files /dev/null and b/education/trial-in-a-box/images/edu-TIB-setp-5-v3.png differ
diff --git a/education/trial-in-a-box/images/edu-TIB-setp-6-jump.png b/education/trial-in-a-box/images/edu-TIB-setp-6-jump.png
new file mode 100644
index 0000000000..ef787873bf
Binary files /dev/null and b/education/trial-in-a-box/images/edu-TIB-setp-6-jump.png differ
diff --git a/education/trial-in-a-box/images/educator_getstarted_banner.png b/education/trial-in-a-box/images/educator_getstarted_banner.png
new file mode 100644
index 0000000000..6262a6f28e
Binary files /dev/null and b/education/trial-in-a-box/images/educator_getstarted_banner.png differ
diff --git a/education/trial-in-a-box/images/educator_priority.png b/education/trial-in-a-box/images/educator_priority.png
new file mode 100644
index 0000000000..abd0995fff
Binary files /dev/null and b/education/trial-in-a-box/images/educator_priority.png differ
diff --git a/education/trial-in-a-box/images/foster_prof_collab.png b/education/trial-in-a-box/images/foster_prof_collab.png
new file mode 100644
index 0000000000..4e6a86df97
Binary files /dev/null and b/education/trial-in-a-box/images/foster_prof_collab.png differ
diff --git a/education/trial-in-a-box/images/i4e_dashboard.PNG b/education/trial-in-a-box/images/i4e_dashboard.PNG
new file mode 100644
index 0000000000..41304ad303
Binary files /dev/null and b/education/trial-in-a-box/images/i4e_dashboard.PNG differ
diff --git a/education/trial-in-a-box/images/i4e_dashboard_expressconfig.png b/education/trial-in-a-box/images/i4e_dashboard_expressconfig.png
new file mode 100644
index 0000000000..41304ad303
Binary files /dev/null and b/education/trial-in-a-box/images/i4e_dashboard_expressconfig.png differ
diff --git a/education/trial-in-a-box/images/i4e_expressconfig_chooseapps.PNG b/education/trial-in-a-box/images/i4e_expressconfig_chooseapps.PNG
new file mode 100644
index 0000000000..b58d1f0da7
Binary files /dev/null and b/education/trial-in-a-box/images/i4e_expressconfig_chooseapps.PNG differ
diff --git a/education/trial-in-a-box/images/i4e_groups_alldevices_newfolders.PNG b/education/trial-in-a-box/images/i4e_groups_alldevices_newfolders.PNG
new file mode 100644
index 0000000000..6e5a5661a9
Binary files /dev/null and b/education/trial-in-a-box/images/i4e_groups_alldevices_newfolders.PNG differ
diff --git a/education/trial-in-a-box/images/i4e_groups_allusers.PNG b/education/trial-in-a-box/images/i4e_groups_allusers.PNG
new file mode 100644
index 0000000000..925ff9664a
Binary files /dev/null and b/education/trial-in-a-box/images/i4e_groups_allusers.PNG differ
diff --git a/education/trial-in-a-box/images/i4e_groups_allusers_apps.PNG b/education/trial-in-a-box/images/i4e_groups_allusers_apps.PNG
new file mode 100644
index 0000000000..24e4110abc
Binary files /dev/null and b/education/trial-in-a-box/images/i4e_groups_allusers_apps.PNG differ
diff --git a/education/trial-in-a-box/images/i4e_groups_allusers_editapps.PNG b/education/trial-in-a-box/images/i4e_groups_allusers_editapps.PNG
new file mode 100644
index 0000000000..debf56ef03
Binary files /dev/null and b/education/trial-in-a-box/images/i4e_groups_allusers_editapps.PNG differ
diff --git a/education/trial-in-a-box/images/i4e_groups_settings_wincustomizations.PNG b/education/trial-in-a-box/images/i4e_groups_settings_wincustomizations.PNG
new file mode 100644
index 0000000000..bf081dec43
Binary files /dev/null and b/education/trial-in-a-box/images/i4e_groups_settings_wincustomizations.PNG differ
diff --git a/education/trial-in-a-box/images/inspire_innovation.png b/education/trial-in-a-box/images/inspire_innovation.png
new file mode 100644
index 0000000000..0a55e5923a
Binary files /dev/null and b/education/trial-in-a-box/images/inspire_innovation.png differ
diff --git a/education/trial-in-a-box/images/it-admin.png b/education/trial-in-a-box/images/it-admin.png
new file mode 100644
index 0000000000..83a69022cc
Binary files /dev/null and b/education/trial-in-a-box/images/it-admin.png differ
diff --git a/education/trial-in-a-box/images/it-admin1.svg b/education/trial-in-a-box/images/it-admin1.svg
new file mode 100644
index 0000000000..f69dc4d324
--- /dev/null
+++ b/education/trial-in-a-box/images/it-admin1.svg
@@ -0,0 +1,260 @@
+
+
+
+
diff --git a/education/trial-in-a-box/images/itadmin_rotated.png b/education/trial-in-a-box/images/itadmin_rotated.png
new file mode 100644
index 0000000000..2494b2db66
Binary files /dev/null and b/education/trial-in-a-box/images/itadmin_rotated.png differ
diff --git a/education/trial-in-a-box/images/itadmin_rotated_resized.png b/education/trial-in-a-box/images/itadmin_rotated_resized.png
new file mode 100644
index 0000000000..d7e805eadb
Binary files /dev/null and b/education/trial-in-a-box/images/itadmin_rotated_resized.png differ
diff --git a/education/trial-in-a-box/images/m365edu_tib_itadminsteps.PNG b/education/trial-in-a-box/images/m365edu_tib_itadminsteps.PNG
new file mode 100644
index 0000000000..5ab4c44f60
Binary files /dev/null and b/education/trial-in-a-box/images/m365edu_tib_itadminsteps.PNG differ
diff --git a/education/trial-in-a-box/images/m365edu_tib_itadminsteps_2.PNG b/education/trial-in-a-box/images/m365edu_tib_itadminsteps_2.PNG
new file mode 100644
index 0000000000..536d78c8da
Binary files /dev/null and b/education/trial-in-a-box/images/m365edu_tib_itadminsteps_2.PNG differ
diff --git a/education/trial-in-a-box/images/m365edu_trialinabox_adminsteps.PNG b/education/trial-in-a-box/images/m365edu_trialinabox_adminsteps.PNG
new file mode 100644
index 0000000000..f9a565f3c5
Binary files /dev/null and b/education/trial-in-a-box/images/m365edu_trialinabox_adminsteps.PNG differ
diff --git a/education/trial-in-a-box/images/mcee_downloadworld.PNG b/education/trial-in-a-box/images/mcee_downloadworld.PNG
new file mode 100644
index 0000000000..b81d4d94af
Binary files /dev/null and b/education/trial-in-a-box/images/mcee_downloadworld.PNG differ
diff --git a/education/trial-in-a-box/images/mcee_keyboard_controls.png b/education/trial-in-a-box/images/mcee_keyboard_controls.png
new file mode 100644
index 0000000000..86428815a6
Binary files /dev/null and b/education/trial-in-a-box/images/mcee_keyboard_controls.png differ
diff --git a/education/trial-in-a-box/images/mcee_keyboard_mouse_controls.png b/education/trial-in-a-box/images/mcee_keyboard_mouse_controls.png
new file mode 100644
index 0000000000..f76c6951b2
Binary files /dev/null and b/education/trial-in-a-box/images/mcee_keyboard_mouse_controls.png differ
diff --git a/education/trial-in-a-box/images/meet_diverse_needs.png b/education/trial-in-a-box/images/meet_diverse_needs.png
new file mode 100644
index 0000000000..5726b761af
Binary files /dev/null and b/education/trial-in-a-box/images/meet_diverse_needs.png differ
diff --git a/education/trial-in-a-box/images/microsoft_store_suspc_install.PNG b/education/trial-in-a-box/images/microsoft_store_suspc_install.PNG
new file mode 100644
index 0000000000..80a6466b33
Binary files /dev/null and b/education/trial-in-a-box/images/microsoft_store_suspc_install.PNG differ
diff --git a/education/trial-in-a-box/images/minecraft_lesson_plans.png b/education/trial-in-a-box/images/minecraft_lesson_plans.png
new file mode 100644
index 0000000000..69b430f910
Binary files /dev/null and b/education/trial-in-a-box/images/minecraft_lesson_plans.png differ
diff --git a/education/trial-in-a-box/images/msedu_tib_adminsteps.PNG b/education/trial-in-a-box/images/msedu_tib_adminsteps.PNG
new file mode 100644
index 0000000000..512da71d05
Binary files /dev/null and b/education/trial-in-a-box/images/msedu_tib_adminsteps.PNG differ
diff --git a/education/trial-in-a-box/images/msedu_tib_adminsteps_nologo.png b/education/trial-in-a-box/images/msedu_tib_adminsteps_nologo.png
new file mode 100644
index 0000000000..0a16a63350
Binary files /dev/null and b/education/trial-in-a-box/images/msedu_tib_adminsteps_nologo.png differ
diff --git a/education/trial-in-a-box/images/msedu_tib_teachersteps_nologo.png b/education/trial-in-a-box/images/msedu_tib_teachersteps_nologo.png
new file mode 100644
index 0000000000..3b4115374f
Binary files /dev/null and b/education/trial-in-a-box/images/msedu_tib_teachersteps_nologo.png differ
diff --git a/education/trial-in-a-box/images/mses_getstarted_banner.png b/education/trial-in-a-box/images/mses_getstarted_banner.png
new file mode 100644
index 0000000000..48dde0456c
Binary files /dev/null and b/education/trial-in-a-box/images/mses_getstarted_banner.png differ
diff --git a/education/trial-in-a-box/images/msfe_boughtapps.PNG b/education/trial-in-a-box/images/msfe_boughtapps.PNG
new file mode 100644
index 0000000000..72de644cf4
Binary files /dev/null and b/education/trial-in-a-box/images/msfe_boughtapps.PNG differ
diff --git a/education/trial-in-a-box/images/msfe_portal.PNG b/education/trial-in-a-box/images/msfe_portal.PNG
new file mode 100644
index 0000000000..aac1c78f43
Binary files /dev/null and b/education/trial-in-a-box/images/msfe_portal.PNG differ
diff --git a/education/trial-in-a-box/images/o365_adminaccountinfo.PNG b/education/trial-in-a-box/images/o365_adminaccountinfo.PNG
new file mode 100644
index 0000000000..30ab5e5c8e
Binary files /dev/null and b/education/trial-in-a-box/images/o365_adminaccountinfo.PNG differ
diff --git a/education/trial-in-a-box/images/o365_needhelp.PNG b/education/trial-in-a-box/images/o365_needhelp.PNG
new file mode 100644
index 0000000000..72689ee2bf
Binary files /dev/null and b/education/trial-in-a-box/images/o365_needhelp.PNG differ
diff --git a/education/trial-in-a-box/images/o365_needhelp_callingoption.PNG b/education/trial-in-a-box/images/o365_needhelp_callingoption.PNG
new file mode 100644
index 0000000000..beb77f970a
Binary files /dev/null and b/education/trial-in-a-box/images/o365_needhelp_callingoption.PNG differ
diff --git a/education/trial-in-a-box/images/o365_needhelp_questionbutton.png b/education/trial-in-a-box/images/o365_needhelp_questionbutton.png
new file mode 100644
index 0000000000..8c7a6aeeaa
Binary files /dev/null and b/education/trial-in-a-box/images/o365_needhelp_questionbutton.png differ
diff --git a/education/trial-in-a-box/images/o365_needhelp_supporttickets.PNG b/education/trial-in-a-box/images/o365_needhelp_supporttickets.PNG
new file mode 100644
index 0000000000..f9414da09a
Binary files /dev/null and b/education/trial-in-a-box/images/o365_needhelp_supporttickets.PNG differ
diff --git a/education/trial-in-a-box/images/o365_support_options.PNG b/education/trial-in-a-box/images/o365_support_options.PNG
new file mode 100644
index 0000000000..dfb3182c72
Binary files /dev/null and b/education/trial-in-a-box/images/o365_support_options.PNG differ
diff --git a/education/trial-in-a-box/images/o365_users_password.PNG b/education/trial-in-a-box/images/o365_users_password.PNG
new file mode 100644
index 0000000000..4c423e670c
Binary files /dev/null and b/education/trial-in-a-box/images/o365_users_password.PNG differ
diff --git a/education/trial-in-a-box/images/o365_users_password_reset.PNG b/education/trial-in-a-box/images/o365_users_password_reset.PNG
new file mode 100644
index 0000000000..02528706fe
Binary files /dev/null and b/education/trial-in-a-box/images/o365_users_password_reset.PNG differ
diff --git a/education/trial-in-a-box/images/o365_users_resetpassword.PNG b/education/trial-in-a-box/images/o365_users_resetpassword.PNG
new file mode 100644
index 0000000000..e32ff5b6bd
Binary files /dev/null and b/education/trial-in-a-box/images/o365_users_resetpassword.PNG differ
diff --git a/education/trial-in-a-box/images/officeportal_cantaccessaccount.PNG b/education/trial-in-a-box/images/officeportal_cantaccessaccount.PNG
new file mode 100644
index 0000000000..79fcae5d8f
Binary files /dev/null and b/education/trial-in-a-box/images/officeportal_cantaccessaccount.PNG differ
diff --git a/education/trial-in-a-box/images/onenote_checkmark.PNG b/education/trial-in-a-box/images/onenote_checkmark.PNG
new file mode 100644
index 0000000000..fc6cccebc4
Binary files /dev/null and b/education/trial-in-a-box/images/onenote_checkmark.PNG differ
diff --git a/education/trial-in-a-box/images/onenote_draw.PNG b/education/trial-in-a-box/images/onenote_draw.PNG
new file mode 100644
index 0000000000..48c49e6e84
Binary files /dev/null and b/education/trial-in-a-box/images/onenote_draw.PNG differ
diff --git a/education/trial-in-a-box/images/onenote_researcher.png b/education/trial-in-a-box/images/onenote_researcher.png
new file mode 100644
index 0000000000..a03b00c820
Binary files /dev/null and b/education/trial-in-a-box/images/onenote_researcher.png differ
diff --git a/education/trial-in-a-box/images/start_microsoft_store.png b/education/trial-in-a-box/images/start_microsoft_store.png
new file mode 100644
index 0000000000..083bae842a
Binary files /dev/null and b/education/trial-in-a-box/images/start_microsoft_store.png differ
diff --git a/education/trial-in-a-box/images/student.png b/education/trial-in-a-box/images/student.png
new file mode 100644
index 0000000000..8349a0f5dc
Binary files /dev/null and b/education/trial-in-a-box/images/student.png differ
diff --git a/education/trial-in-a-box/images/student1.svg b/education/trial-in-a-box/images/student1.svg
new file mode 100644
index 0000000000..832a1214ae
--- /dev/null
+++ b/education/trial-in-a-box/images/student1.svg
@@ -0,0 +1,168 @@
+
+
+
+
diff --git a/education/trial-in-a-box/images/student2.svg b/education/trial-in-a-box/images/student2.svg
new file mode 100644
index 0000000000..6566eab49b
--- /dev/null
+++ b/education/trial-in-a-box/images/student2.svg
@@ -0,0 +1,176 @@
+
+
+
+
diff --git a/education/trial-in-a-box/images/suspc_configure_pc2.jpg b/education/trial-in-a-box/images/suspc_configure_pc2.jpg
new file mode 100644
index 0000000000..68c0080b22
Binary files /dev/null and b/education/trial-in-a-box/images/suspc_configure_pc2.jpg differ
diff --git a/education/trial-in-a-box/images/suspc_configure_pcsettings.PNG b/education/trial-in-a-box/images/suspc_configure_pcsettings.PNG
new file mode 100644
index 0000000000..9dc6298c43
Binary files /dev/null and b/education/trial-in-a-box/images/suspc_configure_pcsettings.PNG differ
diff --git a/education/trial-in-a-box/images/suspc_configure_pcsettings2.png b/education/trial-in-a-box/images/suspc_configure_pcsettings2.png
new file mode 100644
index 0000000000..2dba596ef9
Binary files /dev/null and b/education/trial-in-a-box/images/suspc_configure_pcsettings2.png differ
diff --git a/education/trial-in-a-box/images/suspc_configure_pcsettings_selected.png b/education/trial-in-a-box/images/suspc_configure_pcsettings_selected.png
new file mode 100644
index 0000000000..b0204e110a
Binary files /dev/null and b/education/trial-in-a-box/images/suspc_configure_pcsettings_selected.png differ
diff --git a/education/trial-in-a-box/images/suspc_configure_recommended_apps.png b/education/trial-in-a-box/images/suspc_configure_recommended_apps.png
new file mode 100644
index 0000000000..4a75409f34
Binary files /dev/null and b/education/trial-in-a-box/images/suspc_configure_recommended_apps.png differ
diff --git a/education/trial-in-a-box/images/suspc_configure_recommendedapps.png b/education/trial-in-a-box/images/suspc_configure_recommendedapps.png
new file mode 100644
index 0000000000..126cf46911
Binary files /dev/null and b/education/trial-in-a-box/images/suspc_configure_recommendedapps.png differ
diff --git a/education/trial-in-a-box/images/suspc_configure_recommendedapps_v2.png b/education/trial-in-a-box/images/suspc_configure_recommendedapps_v2.png
new file mode 100644
index 0000000000..7fa7b7a190
Binary files /dev/null and b/education/trial-in-a-box/images/suspc_configure_recommendedapps_v2.png differ
diff --git a/education/trial-in-a-box/images/suspc_review_summary.PNG b/education/trial-in-a-box/images/suspc_review_summary.PNG
new file mode 100644
index 0000000000..e515809d8f
Binary files /dev/null and b/education/trial-in-a-box/images/suspc_review_summary.PNG differ
diff --git a/education/trial-in-a-box/images/suspc_start.PNG b/education/trial-in-a-box/images/suspc_start.PNG
new file mode 100644
index 0000000000..4fef71992d
Binary files /dev/null and b/education/trial-in-a-box/images/suspc_start.PNG differ
diff --git a/education/trial-in-a-box/images/suspc_takeatest.PNG b/education/trial-in-a-box/images/suspc_takeatest.PNG
new file mode 100644
index 0000000000..282720e66f
Binary files /dev/null and b/education/trial-in-a-box/images/suspc_takeatest.PNG differ
diff --git a/education/trial-in-a-box/images/teacher.png b/education/trial-in-a-box/images/teacher.png
new file mode 100644
index 0000000000..e3b89bb7a7
Binary files /dev/null and b/education/trial-in-a-box/images/teacher.png differ
diff --git a/education/trial-in-a-box/images/teacher1.svg b/education/trial-in-a-box/images/teacher1.svg
new file mode 100644
index 0000000000..7db5c7dd32
--- /dev/null
+++ b/education/trial-in-a-box/images/teacher1.svg
@@ -0,0 +1,155 @@
+
+
+
+
diff --git a/education/trial-in-a-box/images/teacher2.svg b/education/trial-in-a-box/images/teacher2.svg
new file mode 100644
index 0000000000..e4f1cd4b74
--- /dev/null
+++ b/education/trial-in-a-box/images/teacher2.svg
@@ -0,0 +1,163 @@
+
+
+
+
diff --git a/education/trial-in-a-box/images/teacher_rotated.png b/education/trial-in-a-box/images/teacher_rotated.png
new file mode 100644
index 0000000000..ccca16f0e2
Binary files /dev/null and b/education/trial-in-a-box/images/teacher_rotated.png differ
diff --git a/education/trial-in-a-box/images/teacher_rotated_resized.png b/education/trial-in-a-box/images/teacher_rotated_resized.png
new file mode 100644
index 0000000000..4e9f0e03f8
Binary files /dev/null and b/education/trial-in-a-box/images/teacher_rotated_resized.png differ
diff --git a/education/trial-in-a-box/images/trial-in-a-box.png b/education/trial-in-a-box/images/trial-in-a-box.png
new file mode 100644
index 0000000000..ca9b031f24
Binary files /dev/null and b/education/trial-in-a-box/images/trial-in-a-box.png differ
diff --git a/education/trial-in-a-box/images/win10_oobe_firstscreen.png b/education/trial-in-a-box/images/win10_oobe_firstscreen.png
new file mode 100644
index 0000000000..0d5343d0b4
Binary files /dev/null and b/education/trial-in-a-box/images/win10_oobe_firstscreen.png differ
diff --git a/education/trial-in-a-box/images/windows_start.png b/education/trial-in-a-box/images/windows_start.png
new file mode 100644
index 0000000000..08a2568c83
Binary files /dev/null and b/education/trial-in-a-box/images/windows_start.png differ
diff --git a/education/trial-in-a-box/images/word_online_grammar_options.png b/education/trial-in-a-box/images/word_online_grammar_options.png
new file mode 100644
index 0000000000..8d6eec92db
Binary files /dev/null and b/education/trial-in-a-box/images/word_online_grammar_options.png differ
diff --git a/education/trial-in-a-box/images/word_online_immersive_reader.png b/education/trial-in-a-box/images/word_online_immersive_reader.png
new file mode 100644
index 0000000000..74340efca5
Binary files /dev/null and b/education/trial-in-a-box/images/word_online_immersive_reader.png differ
diff --git a/education/trial-in-a-box/images/word_online_line_focus.png b/education/trial-in-a-box/images/word_online_line_focus.png
new file mode 100644
index 0000000000..ee9db0ca08
Binary files /dev/null and b/education/trial-in-a-box/images/word_online_line_focus.png differ
diff --git a/education/trial-in-a-box/images/word_online_text_preferences.png b/education/trial-in-a-box/images/word_online_text_preferences.png
new file mode 100644
index 0000000000..1eec52893f
Binary files /dev/null and b/education/trial-in-a-box/images/word_online_text_preferences.png differ
diff --git a/education/trial-in-a-box/images/word_online_tts.png b/education/trial-in-a-box/images/word_online_tts.png
new file mode 100644
index 0000000000..96e04f35f9
Binary files /dev/null and b/education/trial-in-a-box/images/word_online_tts.png differ
diff --git a/education/trial-in-a-box/images/wordonline_grammar_options.png b/education/trial-in-a-box/images/wordonline_grammar_options.png
new file mode 100644
index 0000000000..aef5976456
Binary files /dev/null and b/education/trial-in-a-box/images/wordonline_grammar_options.png differ
diff --git a/education/trial-in-a-box/images/wordonline_line_focus.png b/education/trial-in-a-box/images/wordonline_line_focus.png
new file mode 100644
index 0000000000..fcb39edd26
Binary files /dev/null and b/education/trial-in-a-box/images/wordonline_line_focus.png differ
diff --git a/education/trial-in-a-box/images/wordonline_text_preferences.png b/education/trial-in-a-box/images/wordonline_text_preferences.png
new file mode 100644
index 0000000000..a336c2356d
Binary files /dev/null and b/education/trial-in-a-box/images/wordonline_text_preferences.png differ
diff --git a/education/trial-in-a-box/images/wordonline_tts.png b/education/trial-in-a-box/images/wordonline_tts.png
new file mode 100644
index 0000000000..973a7dd031
Binary files /dev/null and b/education/trial-in-a-box/images/wordonline_tts.png differ
diff --git a/education/trial-in-a-box/index.md b/education/trial-in-a-box/index.md
new file mode 100644
index 0000000000..2dbb835a36
--- /dev/null
+++ b/education/trial-in-a-box/index.md
@@ -0,0 +1,36 @@
+---
+title: Microsoft Education Trial in a Box
+description: For IT admins, educators, and students, discover what you can do with Microsoft 365 Education. Try it out with our Trial in a Box program.
+keywords: education, Microsoft 365 Education, trial, full cloud IT solution, school, deploy, setup, IT admin, educator, student, explore, Trial in a Box
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.topic: article
+ms.localizationpriority: high
+ms.pagetype: edu
+ROBOTS: noindex,nofollow
+author: CelesteDG
+ms.author: celested
+ms.date: 12/11/2017
+---
+
+# Microsoft Education Trial in a Box
+
+
+
+
+
+
+
+Welcome to Microsoft Education Trial in a Box. We built this trial to make it easy to try our latest classroom technologies. We have two scenarios for you to try: one for educators and one for IT. We recommend starting with Educators. To begin, click **Get started** below.
+
+
+
+|  |  |
+| :---: | :---: |
+| **Educator**Enhance students of all abilities by unleashing their creativity, collaboration, and improving problem-solving skills. [Get started](educator-tib-get-started.md) | **IT Admin**Quickly implement and deploy a full cloud infrastructure that's secure and easy to manage. [Get started](itadmin-tib-get-started.md) |
+
+
+
diff --git a/education/trial-in-a-box/itadmin-tib-get-started.md b/education/trial-in-a-box/itadmin-tib-get-started.md
new file mode 100644
index 0000000000..29f0a0de6c
--- /dev/null
+++ b/education/trial-in-a-box/itadmin-tib-get-started.md
@@ -0,0 +1,266 @@
+---
+title: IT Admin Trial in a Box Guide
+description: Try out Microsoft 365 Education to implement a full cloud infrastructure for your school, manage devices and apps, and configure and deploy policies to your Windows 10 devices.
+keywords: education, Microsoft 365 Education, trial, full cloud IT solution, school, deploy, setup, manage, Windows 10, Intune for Education, Office 365 for Education, Microsoft Store for Education
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.topic: get-started
+ms.localizationpriority: high
+ms.pagetype: edu
+ROBOTS: noindex,nofollow
+author: CelesteDG
+ms.author: celested
+ms.date: 12/11/2017
+---
+
+# IT Admin Trial in a Box Guide
+
+
+
+Learn how to quickly deploy and manage devices for your school in 5 quick steps.
+
+| | |
+| :---: |:--- |
+| [](#it-task1) | [Log in](#it-task1) to **Device A** with your IT Admin credentials and connect to your school's network. |
+| [](#it-task2) | [Configure Device B](#it-task2) with the Set up School PCs app. |
+| [](#it-task3) | [Express configure Intune for Education](#it-task3) to manage devices, users, and policies. |
+| [](#it-task4) | [Find apps from the Microsoft Store for Education](#it-task4) and deploy them to manage devices in your tenant. |
+| [](#it-task5) | [Create custom folders](#it-task5) that will appear on each managed device's **Start** menu. |
+| | |
+
+
+To get the most out of Microsoft Education, we've pre-configured your tenant for you so you don't need to set it up. A tenant is representative of an organization. It is a dedicated instance of the Azure AD service that an organization receives and owns when it signs up for a Microsoft cloud service such as Azure, Microsoft Intune, or Office 365. We've also pre-populated the tenant with fictitious Student Information System (SIS) data so you can work with this as you follow the guide.
+
+If you run into any problems while following the steps in this guide, or you have questions about Trial in a Box or Microsoft Education, see [Microsoft Education Trial in a Box Support](support-options.md).
+
+
+
+
+
+
+
+## 1. Log in to Device A with your IT Admin credentials and connect to the school network
+To try out the IT admin tasks, start by logging in as an IT admin.
+
+1. Log in to **Device A** using the **Administrator Username** and **Administrator Password** included in the **Credentials Sheet** located in your kit.
+2. Connect to your school's Wi-Fi network or connect with a local Ethernet connection.
+3. Note the serial numbers on the Trial in a Box devices and register both devices with the hardware manufacturer to activate the manufacturer's warranty.
+
+
+
+
+## 2. Configure Device B with Set up School PCs
+Now you're ready to learn how to configure a brand new device. You will start on **Device A** by downloading and running the Set up School PCs app. Then, you will configure **Device B**.
+
+If you've previously used Set up School PCs to provision student devices, you can follow the instructions in this section to quickly configure **Device B**. Otherwise, we recommend you follow the instructions in [Use the Set up School PCs app](https://docs.microsoft.com/en-us/education/windows/use-set-up-school-pcs-app) for more detailed information, including tips for successfully running Set up School PCs.
+
+### Download, install, and get ready
+
+1. From the **Start** menu, find and then click **Microsoft Store** to launch the Store.
+
+ 
+
+2. Search for the **Set up School PCs** app.
+
+ 
+
+3. Click **Install**.
+
+### Create the provisioning package
+
+1. On **Device A**, launch the Set up School PCs app.
+
+ 
+
+2. Click **Get started**.
+3. Select **Sign-in**.
+4. In **Let's get you signed in**, choose your Trial in a Box admin account. If you don't see it on the list, follow these steps:
+ 1. Select **Work or school account > Use another account** and then enter your Trial in a Box admin account email and password.
+ 2. Click **Accept**.
+
+5. Add a short name that Set up School PCs will use as a prefix to identify and easily manage the group of devices, apps, and other settings through Intune for Education.
+
+ > [!NOTE]
+ > The name must be five (5) characters or less. Set up School PCs automatically appends `_%SERIAL%` to the prefix that you specify. `_%SERIAL%` ensures that all device names are unique. For example, if you add *Math4* as the prefix, the device names will be *Math4* followed by a random string of letters and numbers.
+
+6. In **Configure student PC settings**, you can specify other settings for the student PC.
+
+ We recommend checking the highlighted settings below:
+
+ 
+
+ - **Remove apps pre-installed by the device manufacturer** - If you select this option, this will reset the machine and the provisioning process will take longer (about 30 minutes).
+ - **Allow local storage (not recommended for shared devices)** lets students save files to the **Desktop** and **Documents** folder on the student PC.
+ - **Optimize device for a single student, instead of a shared cart or lab** optimizes the device for use by a single student (1:1).
+ - Set up School PCs will change some account management logic so that it sets the expiration time for an account to 180 days (without requiring sign-in).
+ - This setting also increases the maximum storage to 100% of the available disk space. This prevents the student's account from being erased if the student stores a lot of files or data or if the student doesn't use the PC over a prolonged period.
+ - **Let guests sign-in to these PCs** allows guests to use student PCs without a school account. If you select this option, a **Guest** account button will be added in the PC's sign-in screen to allow anyone to use the PC.
+ - **Enable Windows 10 Automatic Redeployment** enables IT admins to quickly remove personal files, apps, and settings, and reset Windows 10 devices from the lock screen any time and apply original settings and management enrollment the student PC is returned to a fully configured or known approved state. For more info, see [Windows Automatic Redeployment](https://docs.microsoft.com/en-us/education/windows/windows-automatic-redeployment).
+ - **Lock screen background** shows the default backgroudn used for student PCs provisioned by Set up School PCs. Select **Browse** to change the default.
+
+7. **Set up the Take a Test app** configures the device for taking quizzes and high-stakes assessments by some providers like Smarter Balanced. Windows will lock down the student PC so that students can't access anything else while taking the test.
+
+ 
+
+ 1. Specify if you want to create a Take a Test button on the students' sign-in screens.
+ 2. Select **Advanced settings** to allow keyboard text suggestions to appear and to allow teachers to monitor online tests.
+
+ > [!NOTE]
+ > The Take a Test app doesn't provide monitoring capabilities, but it allows tools like AssistX ClassPolicy to see what is going on in the app.
+
+ 3. Enter the assessment URL.
+
+8. **Add recommended apps** lets you choose from a set of recommended Microsoft Store apps to provision.
+
+ 
+
+ The recommended apps include the following:
+ * **Office 365 for Windows 10 S (Education Preview)** - Optional. This works well for the Trial in a Box PCs running Windows 10 S. However, if you try to install this app on other editions of Windows 10, setup will fail. Also note that if you select **Office 365 for Windows 10 S (Education Preview)**, it will take about 30-45 minutes longer for Set up School PCs to create the provisioning package as the app downloads Office 365 for Windows 10 S (Education Preview) from the Microsoft Store.
+ * **Minecraft: Education Edition** - This is pre-provisioned in your tenant's app catalog, but it's not yet installed on a device. Select this option now to include it in the provisioning package.
+ * **Other apps fit for the classroom** - Optional. You can choose other recommended apps to install on the PC.
+
+9. **Review package summary**.
+
+ To change any of the settings, select the page or section (such as **Sign-in** or **Settings**) to go back to that page and make your changes.
+
+ 
+
+10. Accept the summary and then insert a USB drive in **Device A**. Use the USB drive that came in the Trial in a Box accessories box to save the provisioning package.
+11. Select the drive and then **Save** to create the provisioning package.
+
+ The provisioning package on your USB drive will be named SetUpSchoolPCs_*ABCDE* (Expires *MM-DD-YYYY*).ppkg, where *ABCDE* is the device name you added (if any), and *MM-DD-YYYY* is the month, day, and year when the package will expire.
+
+ > [!NOTE]
+ > If you selected **Office 365 for Windows 10 S (Education Preview)**, this step will take about 30-45 minutes. You can jump ahead to task 3, [Express configure Intune for Education to manage devices, users, and policies](#task3), and then finish the rest of task 2 afterwards.
+
+12. Follow the instructions in the **Get the student PCs ready** page to start setting up **Device B**.
+13. Follow the instructions in the **Install the package** page to apply the provisioning package to **Device B**. For more guidance, you can follow the steps in [Apply the provisioning package](#apply-the-provisioning-package).
+
+ Select **Create new package** if you need to create a new provisioning package. Otherwise, remove the USB drive.
+
+### Apply the provisioning package
+A provisioning package is a method for applying settings to Windows 10 without needing to reimage the device.
+
+**Set up Device B using the Set up School PCs provisioning package**
+
+1. Start with **Device B** turned off or with the PC on the first-run setup screen. In Windows 10 S Fall Creators Update, the first-run setup screen says **Let's start with region. Is this right?**.
+
+ 
+
+ If the PC is past the account setup screen, reset the PC to start over. To reset the PC, go to **Settings > Update & security > Recovery > Reset this PC**.
+
+2. Insert the USB drive into **Device B**. Windows will recognize the drive and automatically install the provisioning package.
+3. When prompted, remove the USB drive. You can then use the USB drive to start provisioning another student PC.
+
+ After provisioning **Device B**, wait 1-2 minutes to allow the device to fully connect to the tenant. You can then select any one of the teacher or student accounts from the **User name and passwords** sheet provided in your Trial in a Box to test **Device B** and the Microsoft Education tools and services that are part of your 1-year trial.
+
+You can complete the rest of the IT admin tasks using **Device A**.
+
+
+
+
+## 3. Express configure Intune for Education to manage devices, users, and policies
+Intune for Education provides an **Express configuration** option so you can get going right away. We'll use that option here.
+
+1. Log into the Intune for Education console.
+2. On the Intune for Education dashboard, click **Launch Express Configuration** or select the **Express configuration**.
+
+ 
+
+3. In the **Welcome to Intune for Education** screen, click **Get started** and follow the prompts until you get to the **Choose group** screen.
+4. In the **Choose group** screen, select **All Users** so that all apps and settings that we select during express setup will apply to this group.
+5. In the **Choose apps** screen, you will see a selection of desktop (Win32) apps, Web apps, and Microsoft Store apps.
+
+ 
+
+6. Add or remove apps by clicking on them. A blue checkmark means the app is added and will be installed for all members of the group selected in step 5.
+
+ > [!TIP]
+ > Web apps are pushed as links in the Windows Start menu under **All apps**. If you want apps to appear in Microsoft Edge browser tabs, use the **Homepages** setting for Microsoft Edge through **Express configuration** or **Manage Users and Devices**.
+
+7. In the **Choose settings** screen, set the settings to apply to the group. Expand each settings group to see all the configurable settings.
+
+ For example, set these settings:
+ - In the **Basic device settings** group, change the **Block changing language settings** and **Block changing device region settings** to **Block**.
+ - In the **Microsoft Edge settings** group, change the **Block pop-ups** setting to **Block**.
+
+8. Click **Next** and review the list of apps and settings you selected to apply.
+9. Click **Save** and then click **All done** to go back to the dashboard.
+
+
+
+
+## 4. Find apps from the Microsoft Store for Education and deploy them to managed devices in your tenant
+The Microsoft Store for Education is where you can shop for more apps for your school.
+
+1. In Intune for Education, select **Apps**.
+2. In the **Store apps** section, select **+ New app** to go to the Microsoft Store for Education.
+3. Select **Sign in** and start shopping for apps for your school.
+
+ 
+
+4. Check some of the categories for suggested apps or search the Store for a free educational or reference app. Find ones that you haven't already installed during express configuration for Intune for Education. For example, these apps are free:
+ - Duolingo - Learn Languages for Free
+ - Khan Academy
+ - My Study Life
+ - Arduino IDE
+
+5. Find or select the app you want to install and click **Get the app**.
+6. In the app's Store page, click the **...** button and select **Add to private store**.
+
+ Repeat steps 3-5 to install another app or go to the next step.
+
+7. Select **Manage > Products & services** to verify that the apps you purchased appear in your inventory.
+
+ The apps will show up in your inventory along with the apps that Microsoft automatically provisioned for your education tenant.
+
+ 
+
+ In the **Private store** column of the **Products & services** page, the status for some apps will indicate that it's "In private store" while others will say "Adding to private store" or "Not applicable". Learn more about this in Distribute apps using your private store.
+
+ > [!NOTE]
+ > Sync happens automatically, but it may take up to 36 hours for your organization's private store and 12 hours for Intune for Education to sync all your purchased apps.
+
+
+
+
+## 5. Create custom folders that will appear on each managed device's Start menu
+Update settings for all devices in your tenant by adding the **Documents** and **Downloads** folders to all devices managed in Intune for Education.
+
+1. Go to the Intune for Education console.
+2. Select **Group > All Devices > Settings** and expand **Windows interface customizations**.
+3. In **Choose folders that appear in the Start menu**, select **Documents** and **Downloads**.
+
+ 
+
+4. **Save** your changes.
+
+## Verify correct device setup and other IT admin tasks
+Follow these instructions to confirm if you configured your tenant correctly and the right apps and settings were applied to all users or devices on your tenant:
+
+* [Verify correct device setup](https://docs.microsoft.com/en-us/education/get-started/finish-setup-and-other-tasks#verify-correct-device-setup)
+
+ 1. Confirm that the apps you bought from the Microsoft Store for Education appear in the Windows Start screen's **Recently added** section.
+
+ > [!NOTE]
+ > It may take some time before the apps appear on your devices. When you select **Start**, some apps may show up under **Recently added** while others may say that **Add is in progress**. Sync happens automatically, but it may take up to 24 hours for your organization's private store and 12 hours for Intune for Education to sync all your purchased apps down to your devices.
+
+ 2. Confirm that the folders you added, if you chose to customize the Windows interface from Intune for Education, appear in the Start menu.
+ 3. If you added **Office 365 for Windows 10 S (Education Preview)** to the package and provisioned **Device B** with it, you need to click on one of the Office apps in the **Start** menu to complete app registration.
+
+* [Verify the device is Azure AD joined](https://docs.microsoft.com/en-us/education/get-started/finish-setup-and-other-tasks#verify-the-device-is-azure-ad-joined) - Confirm that your devices are being managed in Intune for Education.
+* [Add more users](https://docs.microsoft.com/en-us/education/get-started/finish-setup-and-other-tasks#add-more-users) - Go to the Office 365 admin center to add more users.
+* Get app updates (including updates for Office 365 for Windows 10 S)
+ 1. Open the **Start** menu and go to the **Microsoft Store**.
+ 2. From the **Microsoft Store**, click **...** (See more) and select **Downloads and updates**.
+ 3. In the **Downloads and updates** page, click **Get updates**.
+* [Try the BYOD scenario](https://docs.microsoft.com/en-us/education/get-started/finish-setup-and-other-tasks#connect-other-devices-to-your-cloud-infrastructure)
+
+
+## Get more info
+* Learn more at microsoft.com/education
+* Find out if your school is eligible for a device trial at aka.ms/EDUTrialInABox
+* Buy Windows 10 devices
diff --git a/education/trial-in-a-box/support-options.md b/education/trial-in-a-box/support-options.md
new file mode 100644
index 0000000000..bf520efef1
--- /dev/null
+++ b/education/trial-in-a-box/support-options.md
@@ -0,0 +1,66 @@
+---
+title: Microsoft Education Trial in a Box Support
+description: Need help or have a question about using Microsoft Education Trial in a Box? Start here.
+keywords: support, troubleshooting, education, Microsoft 365 Education, full cloud IT solution, school, deploy, setup, manage, Windows 10, Intune for Education, Office 365 for Education, Microsoft Store for Education, Set up School PCs
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.topic: article
+ms.localizationpriority: high
+ms.pagetype: edu
+ROBOTS: noindex,nofollow
+author: CelesteDG
+ms.author: celested
+ms.date: 12/11/2017
+---
+
+# Microsoft Education Trial in a Box Support
+Need help or have a question about using Microsoft Education? Start here.
+
+## 1. Confirm your admin contact information is current
+
+1. Go to the Office 365 admin center and sign in with your Office 365 admin credentials.
+2. In the admin center dashboard, select your profile on the upper righthand corner and select **My account** from the options.
+3. Select **Personal info** and then edit **Contact details** to update your phone, primary email address, and alternate email address.
+
+ > [!NOTE]
+ > For the alternate email address, make sure you use a different address from your Office 365 email address.
+
+ 
+
+4. Click **Save**.
+
+## 2. Request a call back
+
+1. Click the **Need help?** button in the lower right-hand corner of the Office 365 console.
+
+ 
+
+ You will see a sidebar window open up on the right-hand side of the screen.
+
+ 
+
+ If you chose to have a support representative call you, a new support ticket will be opened and you can track these in **Support tickets**.
+
+ 
+
+2. Click the **question button**  in the top navigation of the sidebar window.
+3. In the field below **Need help?**, enter a description of your help request.
+4. Click the **Get help button**.
+5. In the **Let us call you** section, enter a phone number where you can be reached.
+6. Click the **Call me** button.
+7. A Microsoft Education support representative will call you back.
+
+## Forgot your password?
+Forget your password? Follow these steps to recover it.
+
+1. Go to https://portal.office.com
+2. Select **Can't access your account** and follow the prompts to get back into your account.
+
+ 
+
+
+
+
+## Get more info
+[Microsoft Education Trial in a Box](index.md)
\ No newline at end of file
diff --git a/education/windows/change-history-edu.md b/education/windows/change-history-edu.md
index f9bafb5527..ca5709975a 100644
--- a/education/windows/change-history-edu.md
+++ b/education/windows/change-history-edu.md
@@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: edu
author: CelesteDG
ms.author: celested
-ms.date: 08/01/2017
+ms.date: 11/27/2017
---
# Change history for Windows 10 for Education
diff --git a/education/windows/chromebook-migration-guide.md b/education/windows/chromebook-migration-guide.md
index a70112829b..bdc7935944 100644
--- a/education/windows/chromebook-migration-guide.md
+++ b/education/windows/chromebook-migration-guide.md
@@ -10,6 +10,7 @@ ms.pagetype: edu, devices
ms.localizationpriority: high
author: craigash
ms.author: celested
+ms.date: 10/13/2017
---
# Chromebook migration guide
diff --git a/education/windows/configure-windows-for-education.md b/education/windows/configure-windows-for-education.md
index b4457fe264..391f93135b 100644
--- a/education/windows/configure-windows-for-education.md
+++ b/education/windows/configure-windows-for-education.md
@@ -9,7 +9,7 @@ ms.pagetype: edu
ms.localizationpriority: high
author: CelesteDG
ms.author: celested
-ms.date: 06/19/2017
+ms.date: 08/31/2017
---
# Windows 10 configuration recommendations for education customers
diff --git a/education/windows/deploy-windows-10-in-a-school-district.md b/education/windows/deploy-windows-10-in-a-school-district.md
index b5dc716593..af5f429e0c 100644
--- a/education/windows/deploy-windows-10-in-a-school-district.md
+++ b/education/windows/deploy-windows-10-in-a-school-district.md
@@ -9,6 +9,7 @@ ms.sitesec: library
ms.localizationpriority: high
author: craigash
ms.author: celested
+ms.date: 10/30/2017
---
# Deploy Windows 10 in a school district
diff --git a/education/windows/deploy-windows-10-in-a-school.md b/education/windows/deploy-windows-10-in-a-school.md
index a7d1213624..996d28b59a 100644
--- a/education/windows/deploy-windows-10-in-a-school.md
+++ b/education/windows/deploy-windows-10-in-a-school.md
@@ -9,6 +9,7 @@ ms.sitesec: library
ms.localizationpriority: high
author: craigash
ms.author: celested
+ms.date: 10/30/2017
---
# Deploy Windows 10 in a school
diff --git a/education/windows/edu-deployment-recommendations.md b/education/windows/edu-deployment-recommendations.md
index 9d9363576f..b9fe9e4a0e 100644
--- a/education/windows/edu-deployment-recommendations.md
+++ b/education/windows/edu-deployment-recommendations.md
@@ -7,7 +7,7 @@ ms.sitesec: library
ms.localizationpriority: high
author: CelesteDG
ms.author: celested
-ms.date: 06/19/2017
+ms.date: 10/13/2017
ms.prod: W10
---
diff --git a/education/windows/education-scenarios-store-for-business.md b/education/windows/education-scenarios-store-for-business.md
index ffe98a656e..5659364a47 100644
--- a/education/windows/education-scenarios-store-for-business.md
+++ b/education/windows/education-scenarios-store-for-business.md
@@ -10,7 +10,7 @@ searchScope:
- Store
author: trudyha
ms.author: trudyha
-ms.date: 10/27/2017
+ms.date: 11/01/2017
---
# Working with Microsoft Store for Education
diff --git a/education/windows/get-minecraft-device-promotion.md b/education/windows/get-minecraft-device-promotion.md
index 5fe066fdea..5250c1f8df 100644
--- a/education/windows/get-minecraft-device-promotion.md
+++ b/education/windows/get-minecraft-device-promotion.md
@@ -10,7 +10,7 @@ author: trudyha
searchScope:
- Store
ms.author: trudyha
-ms.date: 06/29/2017
+ms.date: 07/27/2017
---
# Get Minecraft: Education Edition with Windows 10 device promotion
diff --git a/education/windows/get-minecraft-for-education.md b/education/windows/get-minecraft-for-education.md
index 172533af8e..1abe2df826 100644
--- a/education/windows/get-minecraft-for-education.md
+++ b/education/windows/get-minecraft-for-education.md
@@ -10,6 +10,7 @@ author: trudyha
searchScope:
- Store
ms.author: trudyha
+ms.date: 07/27/2017
---
# Get Minecraft: Education Edition
diff --git a/education/windows/images/suspc_configure_pc2.jpg b/education/windows/images/suspc_configure_pc2.jpg
new file mode 100644
index 0000000000..68c0080b22
Binary files /dev/null and b/education/windows/images/suspc_configure_pc2.jpg differ
diff --git a/education/windows/images/suspc_createpackage_configurestudentpcsettings_121117.PNG b/education/windows/images/suspc_createpackage_configurestudentpcsettings_121117.PNG
new file mode 100644
index 0000000000..7f8bb1722b
Binary files /dev/null and b/education/windows/images/suspc_createpackage_configurestudentpcsettings_121117.PNG differ
diff --git a/education/windows/index.md b/education/windows/index.md
index 81f54fc144..80955b020d 100644
--- a/education/windows/index.md
+++ b/education/windows/index.md
@@ -9,6 +9,7 @@ ms.pagetype: edu
ms.localizationpriority: high
author: CelesteDG
ms.author: celested
+ms.date: 10/13/2017
---
# Windows 10 for Education
diff --git a/education/windows/school-get-minecraft.md b/education/windows/school-get-minecraft.md
index 5b40562d1e..0e3dfcd0ba 100644
--- a/education/windows/school-get-minecraft.md
+++ b/education/windows/school-get-minecraft.md
@@ -10,6 +10,7 @@ author: trudyha
searchScope:
- Store
ms.author: trudyha
+ms.date: 10/13/2017
---
# For IT administrators - get Minecraft: Education Edition
diff --git a/education/windows/set-up-school-pcs-technical.md b/education/windows/set-up-school-pcs-technical.md
index 1982510bd4..0deb4b8fbc 100644
--- a/education/windows/set-up-school-pcs-technical.md
+++ b/education/windows/set-up-school-pcs-technical.md
@@ -9,6 +9,7 @@ ms.pagetype: edu
ms.localizationpriority: high
author: CelesteDG
ms.author: celested
+ms.date: 12/12/2017
---
# Technical reference for the Set up School PCs app
@@ -189,17 +190,17 @@ The Set up School PCs app produces a specialized provisioning package that makes
Require a password when a computer wakes (on battery)
Enabled
-
Specify the system sleep timeout (plugged in)
1 hour
+
Specify the system sleep timeout (plugged in)
5 minutes
-
Specify the system sleep timeout (on battery)
1 hour
+
Specify the system sleep timeout (on battery)
5 minutes
Turn off hybrid sleep (plugged in)
Enabled
Turn off hybrid sleep (on battery)
Enabled
-
Specify the unattended sleep timeout (plugged in)
1 hour
+
Specify the unattended sleep timeout (plugged in)
5 minutes
-
Specify the unattended sleep timeout (on battery)
1 hour
+
Specify the unattended sleep timeout (on battery)
5 minutes
Allow standby states (S1-S3) when sleeping (plugged in)
Enabled
@@ -210,9 +211,9 @@ The Set up School PCs app produces a specialized provisioning package that makes
Specify the system hibernate timeout (on battery)
Enabled, 0
Admin Templates>System>Power Management>Video and Display Settings
diff --git a/education/windows/set-up-students-pcs-to-join-domain.md b/education/windows/set-up-students-pcs-to-join-domain.md
index b85706e38d..76079be7ff 100644
--- a/education/windows/set-up-students-pcs-to-join-domain.md
+++ b/education/windows/set-up-students-pcs-to-join-domain.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.localizationpriority: high
author: CelesteDG
ms.author: celested
+ms.date: 07/27/2017
---
# Set up student PCs to join domain
diff --git a/education/windows/set-up-students-pcs-with-apps.md b/education/windows/set-up-students-pcs-with-apps.md
index 09099b2501..80bc4c8bfe 100644
--- a/education/windows/set-up-students-pcs-with-apps.md
+++ b/education/windows/set-up-students-pcs-with-apps.md
@@ -9,6 +9,7 @@ ms.sitesec: library
ms.localizationpriority: high
author: CelesteDG
ms.author: celested
+ms.date: 10/13/2017
---
# Provision student PCs with apps
diff --git a/education/windows/set-up-windows-10.md b/education/windows/set-up-windows-10.md
index 1498a9f5a3..6c68f0eee5 100644
--- a/education/windows/set-up-windows-10.md
+++ b/education/windows/set-up-windows-10.md
@@ -9,6 +9,7 @@ ms.pagetype: edu
ms.localizationpriority: high
author: CelesteDG
ms.author: celested
+ms.date: 07/27/2017
---
# Set up Windows devices for education
diff --git a/education/windows/switch-to-pro-education.md b/education/windows/switch-to-pro-education.md
index 45cd776d7d..d9f8e21851 100644
--- a/education/windows/switch-to-pro-education.md
+++ b/education/windows/switch-to-pro-education.md
@@ -9,6 +9,7 @@ ms.pagetype: edu
ms.localizationpriority: high
author: CelesteDG
ms.author: celested
+ms.date: 10/30/2017
---
# Switch to Windows 10 Pro Education from Windows 10 Pro or Windows 10 S
diff --git a/education/windows/take-a-test-multiple-pcs.md b/education/windows/take-a-test-multiple-pcs.md
index 4514676415..f83c1e7773 100644
--- a/education/windows/take-a-test-multiple-pcs.md
+++ b/education/windows/take-a-test-multiple-pcs.md
@@ -9,6 +9,7 @@ ms.pagetype: edu
ms.localizationpriority: high
author: CelesteDG
ms.author: celested
+ms.date: 11/08/2017
---
# Set up Take a Test on multiple PCs
diff --git a/education/windows/take-a-test-single-pc.md b/education/windows/take-a-test-single-pc.md
index b64859a2d9..630e913e2d 100644
--- a/education/windows/take-a-test-single-pc.md
+++ b/education/windows/take-a-test-single-pc.md
@@ -9,6 +9,7 @@ ms.pagetype: edu
ms.localizationpriority: high
author: CelesteDG
ms.author: celested
+ms.date: 11/08/2017
---
# Set up Take a Test on a single PC
diff --git a/education/windows/take-tests-in-windows-10.md b/education/windows/take-tests-in-windows-10.md
index 9f2282eb80..f41a994602 100644
--- a/education/windows/take-tests-in-windows-10.md
+++ b/education/windows/take-tests-in-windows-10.md
@@ -9,6 +9,7 @@ ms.pagetype: edu
ms.localizationpriority: high
author: CelesteDG
ms.author: celested
+ms.date: 10/16/2017
---
# Take tests in Windows 10
diff --git a/education/windows/teacher-get-minecraft.md b/education/windows/teacher-get-minecraft.md
index 2434ed8e9b..7cf6b0d940 100644
--- a/education/windows/teacher-get-minecraft.md
+++ b/education/windows/teacher-get-minecraft.md
@@ -10,6 +10,7 @@ author: trudyha
searchScope:
- Store
ms.author: trudyha
+ms.date: 10/13/2017
---
# For teachers - get Minecraft: Education Edition
diff --git a/education/windows/use-set-up-school-pcs-app.md b/education/windows/use-set-up-school-pcs-app.md
index 8bb431d617..21ac36db3c 100644
--- a/education/windows/use-set-up-school-pcs-app.md
+++ b/education/windows/use-set-up-school-pcs-app.md
@@ -9,7 +9,7 @@ ms.pagetype: edu
ms.localizationpriority: high
author: CelesteDG
ms.author: celested
-ms.date: 09/18/2017
+ms.date: 12/11/2017
---
# Use the Set up School PCs app
@@ -30,6 +30,7 @@ Set up School PCs makes it easy to set up Windows 10 PCs with Microsoft's recomm
- Sets Microsoft-recommended school PC settings, including shared PC mode which provides faster sign-in and automatic account cleanup
- Enables optional guest account for younger students, lost passwords, or visitors
- Enables optional secure testing account
+- Enables optional Windows Automatic Redeployment feature to return devices to a fully configured or known IT-approved state
- Locks down the student PC to prevent mischievous activity:
* Prevents students from removing the PC from the school's device management system
* Prevents students from removing the Set up School PCs settings
@@ -41,7 +42,7 @@ Set up School PCs makes it easy to set up Windows 10 PCs with Microsoft's recomm
You can watch the video to see how to use the Set up School PCs app, or follow the step-by-step guide.
-
[Microsoft 365](https://www.microsoft.com/microsoft-365/default.aspx) is a complete, intelligent solution, including Office 365, Windows 10, and Enterprise Mobility + Security, that empowers everyone to be creative and work together, securely.
-
\ No newline at end of file
diff --git a/smb/cloud-mode-business-setup.md b/smb/cloud-mode-business-setup.md
index 1658370c2e..00362cf711 100644
--- a/smb/cloud-mode-business-setup.md
+++ b/smb/cloud-mode-business-setup.md
@@ -10,6 +10,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: smb
author: CelesteDG
+ms.date: 10/30/2017
---
# Get started: Deploy and manage a full cloud IT solution for your business
diff --git a/smb/index.md b/smb/index.md
index ba888107cb..a74d8f9e0a 100644
--- a/smb/index.md
+++ b/smb/index.md
@@ -10,6 +10,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: smb
author: CelesteDG
+ms.date: 05/01/2017
---
# Windows 10 for SMB
diff --git a/store-for-business/acquire-apps-microsoft-store-for-business.md b/store-for-business/acquire-apps-microsoft-store-for-business.md
index b0f2d72736..181fb19436 100644
--- a/store-for-business/acquire-apps-microsoft-store-for-business.md
+++ b/store-for-business/acquire-apps-microsoft-store-for-business.md
@@ -6,7 +6,7 @@ ms.mktglfcycl: manage
ms.sitesec: library
ms.pagetype: store
author: TrudyHa
-ms.date: 10/01/2017
+ms.date: 11/01/2017
ms.localizationpriority: high
---
diff --git a/store-for-business/add-profile-to-devices.md b/store-for-business/add-profile-to-devices.md
index 3a2daa32e7..cee7f01a25 100644
--- a/store-for-business/add-profile-to-devices.md
+++ b/store-for-business/add-profile-to-devices.md
@@ -7,7 +7,7 @@ ms.sitesec: library
ms.pagetype: store
author: TrudyHa
ms.author: TrudyHa
-ms.date: 10/26/2017
+ms.date: 1/4/2018
ms.localizationpriority: high
---
@@ -16,9 +16,9 @@ ms.localizationpriority: high
**Applies to**
- Windows 10
-Windows AutoPilot Deployment Program simplifies device set up for IT Admins. For an overview of benefits, scenarios, and prerequisites, see [Overview of Windows AutoPilot](https://docs.microsoft.com/windows/deployment/windows-10-auto-pilot).
+Windows AutoPilot Deployment Program simplifies device set up for IT Admins. For an overview of benefits, scenarios, and prerequisites, see [Overview of Windows AutoPilot](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-10-autopilot).
-Watch this video to learn more about Windows AutoPilot in Micrsoft Store for Business.
+Watch this video to learn more about Windows AutoPilot in Micrsoft Store for Business.
diff --git a/store-for-business/add-unsigned-app-to-code-integrity-policy.md b/store-for-business/add-unsigned-app-to-code-integrity-policy.md
index 1deaf59617..74835df001 100644
--- a/store-for-business/add-unsigned-app-to-code-integrity-policy.md
+++ b/store-for-business/add-unsigned-app-to-code-integrity-policy.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: store, security
author: TrudyHa
ms.localizationpriority: high
+ms.date: 10/17/2017
---
# Add unsigned app to code integrity policy
diff --git a/store-for-business/app-inventory-management-microsoft-store-for-business.md b/store-for-business/app-inventory-management-microsoft-store-for-business.md
index 87e45c504e..2471527f23 100644
--- a/store-for-business/app-inventory-management-microsoft-store-for-business.md
+++ b/store-for-business/app-inventory-management-microsoft-store-for-business.md
@@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: store
author: TrudyHa
ms.author: TrudyHa
-ms.date: 06/29/2017
+ms.date: 10/16/2017
---
# App inventory management for Microsoft Store for Business and Education
diff --git a/store-for-business/apps-in-microsoft-store-for-business.md b/store-for-business/apps-in-microsoft-store-for-business.md
index 2f92a85a03..c1dd888a79 100644
--- a/store-for-business/apps-in-microsoft-store-for-business.md
+++ b/store-for-business/apps-in-microsoft-store-for-business.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: store
author: TrudyHa
ms.localizationpriority: high
+ms.date: 10/17/2017
---
# Apps in Microsoft Store for Business and Education
diff --git a/store-for-business/assign-apps-to-employees.md b/store-for-business/assign-apps-to-employees.md
index c15aa18d1c..0b7230b467 100644
--- a/store-for-business/assign-apps-to-employees.md
+++ b/store-for-business/assign-apps-to-employees.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: store
author: TrudyHa
ms.localizationpriority: high
+ms.date: 10/13/2017
---
# Assign apps to employees
diff --git a/store-for-business/configure-mdm-provider-microsoft-store-for-business.md b/store-for-business/configure-mdm-provider-microsoft-store-for-business.md
index c98e43ad4e..9cbc2e2676 100644
--- a/store-for-business/configure-mdm-provider-microsoft-store-for-business.md
+++ b/store-for-business/configure-mdm-provider-microsoft-store-for-business.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: store
author: TrudyHa
ms.localizationpriority: high
+ms.date: 1/6/2018
---
# Configure an MDM provider
@@ -22,17 +23,19 @@ Your management tool needs to be installed and configured with Azure AD, in the
**To configure a management tool in Azure AD**
-1. Sign in to the Azure Portal as an Administrator.
-2. Click **Active Directory**, and then choose your directory.
-3. Click **Applications**, find the application, and add it to your directory.
+1. Sign in to the Azure Portal as an Administrator.
+2. Click **Azure Active Directory**, and then choose your directory.
+4. Click **Mobility (MDM and MAM)**.
+3. Click **+Add Applications**, find the application, and add it to your directory.
After your management tool is added to your Azure AD directory, you can configure it to work with Microsoft Store. You can configure multiple management tools - just repeat the following procedure.
-**To configure a management tool in Store for Business**
+**To configure a management tool in Microsoft Store for Business**
-1. Sign in to the [Store for Business](http://businessstore.microsoft.com) or [Store for Education](https://educationstore.microsoft.com)
-2. Click **Manage**, click **Store settings**, and then click **Management tools**.
-3. From the list of MDM tools, select the one you want to synchronize with Microsoft Store, and then click **Activate.**
+1. Sign in to the [Store for Business](http://businessstore.microsoft.com) or [Store for Education](https://educationstore.microsoft.com)
+2. Click **Manage**, click **Settings**.
+3. Under **Distribute**, click **Management tools**.
+3. From the list of MDM tools, select the one you want to synchronize with Microsoft Store, and then click **Activate.**
Your MDM tool is ready to use with Microsoft Store. To learn how to configure synchronization and deploy apps, see these topics:
- [Manage apps you purchased from Microsoft Store for Business with Microsoft Intune](https://docs.microsoft.com/intune-classic/deploy-use/manage-apps-you-purchased-from-the-windows-store-for-business-with-microsoft-intune)
diff --git a/store-for-business/device-guard-signing-portal.md b/store-for-business/device-guard-signing-portal.md
index 201db11f02..19d5c5bfa6 100644
--- a/store-for-business/device-guard-signing-portal.md
+++ b/store-for-business/device-guard-signing-portal.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: store, security
author: TrudyHa
ms.localizationpriority: high
+ms.date: 10/17/2017
---
# Device Guard signing
diff --git a/store-for-business/distribute-apps-from-your-private-store.md b/store-for-business/distribute-apps-from-your-private-store.md
index 33bfaaae1f..3ce46baf61 100644
--- a/store-for-business/distribute-apps-from-your-private-store.md
+++ b/store-for-business/distribute-apps-from-your-private-store.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: store
author: TrudyHa
ms.localizationpriority: high
+ms.date: 10/17/2017
---
# Distribute apps using your private store
diff --git a/store-for-business/distribute-apps-to-your-employees-microsoft-store-for-business.md b/store-for-business/distribute-apps-to-your-employees-microsoft-store-for-business.md
index dc3de6e6a7..cab6dfb6e3 100644
--- a/store-for-business/distribute-apps-to-your-employees-microsoft-store-for-business.md
+++ b/store-for-business/distribute-apps-to-your-employees-microsoft-store-for-business.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: store
author: TrudyHa
ms.localizationpriority: high
+ms.date: 10/13/2017
---
# Distribute apps to your employees from Microsoft Store for Business and Education
diff --git a/store-for-business/distribute-apps-with-management-tool.md b/store-for-business/distribute-apps-with-management-tool.md
index d85cf9eab4..34e541c6e4 100644
--- a/store-for-business/distribute-apps-with-management-tool.md
+++ b/store-for-business/distribute-apps-with-management-tool.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: store
author: TrudyHa
ms.localizationpriority: high
+ms.date: 10/17/2017
---
# Distribute apps with a management tool
diff --git a/store-for-business/distribute-offline-apps.md b/store-for-business/distribute-offline-apps.md
index 9b66333542..0aacda9288 100644
--- a/store-for-business/distribute-offline-apps.md
+++ b/store-for-business/distribute-offline-apps.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: store
author: TrudyHa
ms.localizationpriority: high
+ms.date: 10/17/2017
---
# Distribute offline apps
diff --git a/store-for-business/education/TOC.md b/store-for-business/education/TOC.md
index 43f7ab7345..63f52ca1ce 100644
--- a/store-for-business/education/TOC.md
+++ b/store-for-business/education/TOC.md
@@ -14,7 +14,7 @@
## [Get Minecraft: Education Edition](/education/windows/get-minecraft-for-education?toc=/microsoft-store/education/toc.json)
### [For teachers: get Minecraft Education Edition](/education/windows/teacher-get-minecraft?toc=/microsoft-store/education/toc.json)
### [For IT administrators: get Minecraft Education Edition](/education/windows/school-get-minecraft?toc=/microsoft-store/education/toc.json)
-### [Get Minecraft: Education Edition with Windows 10 device promotion](/education/windows/get-minecraft-for-education?toc=/microsoft-store/education/toc.json)
+### [Get Minecraft: Education Edition with Windows 10 device promotion](/education/windows/get-minecraft-device-promotion?toc=/microsoft-store/education/toc.json)
## [Distribute apps to your employees from the Microsoft Store for Business and Education](/microsoft-store/distribute-apps-to-your-employees-microsoft-store-for-business?toc=/microsoft-store/education/toc.json)
### [Distribute apps using your private store](/microsoft-store/distribute-apps-from-your-private-store?toc=/microsoft-store/education/toc.json)
### [Assign apps to employees](/microsoft-store/assign-apps-to-employees?toc=/microsoft-store/education/toc.json)
diff --git a/store-for-business/find-and-acquire-apps-overview.md b/store-for-business/find-and-acquire-apps-overview.md
index 4c4d889b3c..99e13fa7c0 100644
--- a/store-for-business/find-and-acquire-apps-overview.md
+++ b/store-for-business/find-and-acquire-apps-overview.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: store
author: TrudyHa
ms.localizationpriority: high
+ms.date: 10/17/2017
---
# Find and acquire apps
diff --git a/store-for-business/index.md b/store-for-business/index.md
index 04c5853b52..5c2990c742 100644
--- a/store-for-business/index.md
+++ b/store-for-business/index.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: store
author: TrudyHa
ms.localizationpriority: high
+ms.date: 10/17/2017
---
# Microsoft Store for Business and Education
diff --git a/store-for-business/manage-access-to-private-store.md b/store-for-business/manage-access-to-private-store.md
index d3d4331cc7..9b10d08550 100644
--- a/store-for-business/manage-access-to-private-store.md
+++ b/store-for-business/manage-access-to-private-store.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: manage
ms.sitesec: library
ms.pagetype: store
author: TrudyHa
+ms.date: 10/17/2017
---
# Manage access to private store
diff --git a/store-for-business/manage-apps-microsoft-store-for-business-overview.md b/store-for-business/manage-apps-microsoft-store-for-business-overview.md
index 35ecff646c..b46f2b5e80 100644
--- a/store-for-business/manage-apps-microsoft-store-for-business-overview.md
+++ b/store-for-business/manage-apps-microsoft-store-for-business-overview.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: store
author: TrudyHa
ms.localizationpriority: high
+ms.date: 10/17/2017
---
# Manage apps in Microsoft Store for Business and Education
diff --git a/store-for-business/manage-orders-microsoft-store-for-business.md b/store-for-business/manage-orders-microsoft-store-for-business.md
index 5ff6a0ebc6..2bc147f08b 100644
--- a/store-for-business/manage-orders-microsoft-store-for-business.md
+++ b/store-for-business/manage-orders-microsoft-store-for-business.md
@@ -7,6 +7,7 @@ ms.sitesec: library
ms.pagetype: store
author: TrudyHa
ms.localizationpriority: high
+ms.date: 11/10/2017
---
# Manage app orders in Microsoft Store for Business and Education
diff --git a/store-for-business/manage-private-store-settings.md b/store-for-business/manage-private-store-settings.md
index e49b08b046..dc2a945599 100644
--- a/store-for-business/manage-private-store-settings.md
+++ b/store-for-business/manage-private-store-settings.md
@@ -7,7 +7,7 @@ ms.mktglfcycl: manage
ms.sitesec: library
ms.pagetype: store
author: TrudyHa
-ms.date: 11/28/2017
+ms.date: 11/30/2017
ms.localizationpriority: high
---
diff --git a/store-for-business/manage-settings-microsoft-store-for-business.md b/store-for-business/manage-settings-microsoft-store-for-business.md
index adac54ffcc..7462859380 100644
--- a/store-for-business/manage-settings-microsoft-store-for-business.md
+++ b/store-for-business/manage-settings-microsoft-store-for-business.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: store
author: TrudyHa
ms.localizationpriority: high
+ms.date: 10/17/2017
---
# Manage settings for Microsoft Store for Business and Education
diff --git a/store-for-business/manage-users-and-groups-microsoft-store-for-business.md b/store-for-business/manage-users-and-groups-microsoft-store-for-business.md
index 0a15cf0049..800ab20f14 100644
--- a/store-for-business/manage-users-and-groups-microsoft-store-for-business.md
+++ b/store-for-business/manage-users-and-groups-microsoft-store-for-business.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: store
author: TrudyHa
ms.localizationpriority: high
+ms.date: 10/17/2017
---
# Manage user accounts in Microsoft Store for Business and Education
diff --git a/store-for-business/microsoft-store-for-business-education-powershell-module.md b/store-for-business/microsoft-store-for-business-education-powershell-module.md
index 0bb6a6d2d6..0f9242807a 100644
--- a/store-for-business/microsoft-store-for-business-education-powershell-module.md
+++ b/store-for-business/microsoft-store-for-business-education-powershell-module.md
@@ -8,7 +8,7 @@ ms.pagetype: store
author: TrudyHa
localizationpriority: high
ms.author:
-ms.date:
+ms.date: 10/22/2017
---
# Microsoft Store for Business and Education PowerShell module - preview
diff --git a/store-for-business/microsoft-store-for-business-overview.md b/store-for-business/microsoft-store-for-business-overview.md
index a7eb6d2051..53ac6bd262 100644
--- a/store-for-business/microsoft-store-for-business-overview.md
+++ b/store-for-business/microsoft-store-for-business-overview.md
@@ -8,6 +8,7 @@ ms.mktglfcycl: manage
ms.sitesec: library
author: TrudyHa
ms.localizationpriority: high
+ms.date: 10/17/2017
---
# Microsoft Store for Business and Microsoft Store for Education overview
@@ -29,7 +30,7 @@ Organizations or schools of any size can benefit from using Microsoft Store for
- **Microsoft Store for Education** – Apps and subscriptions
- **Office 365** – Subscriptions
- **Volume licensing** - Apps purchased with volume licensing
-- **Private store** - Curate a private store for your business that’s easily available from any Windows 10 device. Your private store is available from Microsoft Store on Windows 10, or with a browser on the Web. People in your organization can download apps from your organization's private store on Windows 10 devices.
+- **Private store** - Create a private store for your business that’s easily available from any Windows 10 device. Your private store is available from Microsoft Store on Windows 10, or with a browser on the Web. People in your organization can download apps from your organization's private store on Windows 10 devices.
- **Flexible distribution options** - Flexible options for distributing content and apps to your employee devices:
- Distribute through Microsoft Store services. You can assign apps to individual employees, or make apps available to all employees in your private store.
- Use a management tool from Microsoft, or a 3rd-party tool for advanced distribution and management functions, or for managing images.
diff --git a/store-for-business/notifications-microsoft-store-business.md b/store-for-business/notifications-microsoft-store-business.md
index 0d541ce0d6..57ea2652f3 100644
--- a/store-for-business/notifications-microsoft-store-business.md
+++ b/store-for-business/notifications-microsoft-store-business.md
@@ -9,6 +9,7 @@ ms.sitesec: library
ms.pagetype: store
author: TrudyHa
ms.localizationpriority: high
+ms.date: 07/27/2017
---
# Notifications in Microsoft Store for Business and Education
diff --git a/store-for-business/prerequisites-microsoft-store-for-business.md b/store-for-business/prerequisites-microsoft-store-for-business.md
index 681d4b4a36..48adf681cf 100644
--- a/store-for-business/prerequisites-microsoft-store-for-business.md
+++ b/store-for-business/prerequisites-microsoft-store-for-business.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: store
author: TrudyHa
ms.localizationpriority: high
+ms.date: 10/13/2017
---
# Prerequisites for Microsoft Store for Business and Education
diff --git a/store-for-business/release-history-microsoft-store-business-education.md b/store-for-business/release-history-microsoft-store-business-education.md
index 6f1400e394..4d706c69f6 100644
--- a/store-for-business/release-history-microsoft-store-business-education.md
+++ b/store-for-business/release-history-microsoft-store-business-education.md
@@ -6,7 +6,7 @@ ms.mktglfcycl: manage
ms.sitesec: library
ms.pagetype: store
author: TrudyHa
-ms.date: 11/30/2017
+ms.date: 1/8/2018
---
# Microsoft Store for Business and Education release history
@@ -15,6 +15,10 @@ Microsoft Store for Business and Education regularly releases new and improved f
Looking for info on the latest release? Check out [What's new in Microsoft Store for Business and Education](whats-new-microsoft-store-business-education.md)
+## November 2017
+
+- **Export list of Minecraft: Education Edition users** - Admins and teachers can now export a list of users who have Minecraft: Education Edition licenses assigned to them. Click **Export users**, and Store for Education creates an Excel spreadsheet for you, and saves it as a .csv file.
+
## October 2017
- Bug fixes and permformance improvements.
diff --git a/store-for-business/roles-and-permissions-microsoft-store-for-business.md b/store-for-business/roles-and-permissions-microsoft-store-for-business.md
index 14a0ed1d6f..1d42371897 100644
--- a/store-for-business/roles-and-permissions-microsoft-store-for-business.md
+++ b/store-for-business/roles-and-permissions-microsoft-store-for-business.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: store
author: TrudyHa
ms.localizationpriority: high
+ms.date: 10/17/2017
---
# Roles and permissions in Microsoft Store for Business and Education
diff --git a/store-for-business/settings-reference-microsoft-store-for-business.md b/store-for-business/settings-reference-microsoft-store-for-business.md
index b949eced52..334a1f8ed5 100644
--- a/store-for-business/settings-reference-microsoft-store-for-business.md
+++ b/store-for-business/settings-reference-microsoft-store-for-business.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: store
author: TrudyHa
ms.localizationpriority: high
+ms.date: 11/01/2017
---
# Settings reference: Microsoft Store for Business and Education
diff --git a/store-for-business/sfb-change-history.md b/store-for-business/sfb-change-history.md
index 3fd8e7b79e..457f36b96b 100644
--- a/store-for-business/sfb-change-history.md
+++ b/store-for-business/sfb-change-history.md
@@ -7,7 +7,7 @@ ms.sitesec: library
ms.pagetype: store
author: TrudyHa
ms.author: TrudyHa
-ms.date: 10/31/2107
+ms.date: 10/31/2017
ms.localizationpriority: high
---
diff --git a/store-for-business/sign-code-integrity-policy-with-device-guard-signing.md b/store-for-business/sign-code-integrity-policy-with-device-guard-signing.md
index 3eb56c3155..c042b9fa38 100644
--- a/store-for-business/sign-code-integrity-policy-with-device-guard-signing.md
+++ b/store-for-business/sign-code-integrity-policy-with-device-guard-signing.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: store, security
author: TrudyHa
ms.localizationpriority: high
+ms.date: 10/17/2017
---
# Sign code integrity policy with Device Guard signing
diff --git a/store-for-business/sign-up-microsoft-store-for-business-overview.md b/store-for-business/sign-up-microsoft-store-for-business-overview.md
index 496e92c40e..cf0109c335 100644
--- a/store-for-business/sign-up-microsoft-store-for-business-overview.md
+++ b/store-for-business/sign-up-microsoft-store-for-business-overview.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: store
author: TrudyHa
ms.localizationpriority: high
+ms.date: 10/13/2017
---
# Sign up and get started
diff --git a/store-for-business/sign-up-microsoft-store-for-business.md b/store-for-business/sign-up-microsoft-store-for-business.md
index 22cc99dd2f..2de6dc6f94 100644
--- a/store-for-business/sign-up-microsoft-store-for-business.md
+++ b/store-for-business/sign-up-microsoft-store-for-business.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: store
author: TrudyHa
ms.localizationpriority: high
+ms.date: 10/17/2017
---
# Sign up for Microsoft Store for Business or Microsoft Store for Education
diff --git a/store-for-business/troubleshoot-microsoft-store-for-business.md b/store-for-business/troubleshoot-microsoft-store-for-business.md
index 9e55e0279f..cc5eefa7a5 100644
--- a/store-for-business/troubleshoot-microsoft-store-for-business.md
+++ b/store-for-business/troubleshoot-microsoft-store-for-business.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: store
author: TrudyHa
ms.localizationpriority: high
+ms.date: 10/13/2017
---
# Troubleshoot Microsoft Store for Business
diff --git a/store-for-business/update-microsoft-store-for-business-account-settings.md b/store-for-business/update-microsoft-store-for-business-account-settings.md
index 8e1912c39e..26d293ea41 100644
--- a/store-for-business/update-microsoft-store-for-business-account-settings.md
+++ b/store-for-business/update-microsoft-store-for-business-account-settings.md
@@ -7,6 +7,7 @@ ms.sitesec: library
ms.pagetype: store
author: TrudyHa
ms.localizationpriority: high
+ms.date: 10/17/2017
---
# Update Microsoft Store for Business and Microsoft Store for Education account settings
diff --git a/store-for-business/whats-new-microsoft-store-business-education.md b/store-for-business/whats-new-microsoft-store-business-education.md
index a5f0578801..38af4a8e01 100644
--- a/store-for-business/whats-new-microsoft-store-business-education.md
+++ b/store-for-business/whats-new-microsoft-store-business-education.md
@@ -6,7 +6,7 @@ ms.mktglfcycl: manage
ms.sitesec: library
ms.pagetype: store
author: TrudyHa
-ms.date: 11/30/2017
+ms.date: 1/8/2018
---
# What's new in Microsoft Store for Business and Education
@@ -15,11 +15,9 @@ Microsoft Store for Business and Education regularly releases new and improved f
## Latest updates for Store for Business and Education
-**November 2017**
+**December 2017**
-| | |
-|-----------------------|---------------------------------|
-|  |**Export list of Minecraft: Education Edition users**
Admins and teachers can now export a list of users who have Minecraft: Education Edition licenses assigned to them. Click **Export users**, and Store for Education creates an Excel spreadsheet for you, and saves it as a .csv file.
**Applies to**: Microsoft Store for Education |
+We’ve been working on bug fixes and performance improvements to provide you a better experience. Stay tuned for new features!
## Policies supported by Microsoft Surface Hub
-
-- [ApplicationDefaults/DefaultAssociationsConfiguration](#applicationdefaults-defaultassociationsconfiguration)
+
- [Bluetooth/AllowAdvertising](#bluetooth-allowadvertising)
- [Bluetooth/AllowDiscoverableMode](#bluetooth-allowdiscoverablemode)
- [Bluetooth/AllowPrepairing](#bluetooth-allowprepairing)
@@ -3562,7 +3785,6 @@ The following diagram shows the Policy configuration service provider in tree fo
- [DeliveryOptimization/DOMonthlyUploadDataCap](#deliveryoptimization-domonthlyuploaddatacap)
- [DeliveryOptimization/DOPercentageMaxDownloadBandwidth](#deliveryoptimization-dopercentagemaxdownloadbandwidth)
- [Desktop/PreventUserRedirectionOfProfileFolders](#desktop-preventuserredirectionofprofilefolders)
-- [DeviceGuard/AllowKernelControlFlowGuard](#deviceguard-allowkernelcontrolflowguard)
- [Privacy/EnableActivityFeed](#privacy-enableactivityfeed)
- [Privacy/LetAppsGetDiagnosticInfo](#privacy-letappsgetdiagnosticinfo)
- [Privacy/LetAppsGetDiagnosticInfo_ForceAllowTheseApps](#privacy-letappsgetdiagnosticinfo-forceallowtheseapps)
@@ -3575,6 +3797,7 @@ The following diagram shows the Policy configuration service provider in tree fo
- [Privacy/PublishUserActivities](#privacy-publishuseractivities)
- [Security/RequireProvisioningPackageSignature](#security-requireprovisioningpackagesignature)
- [Security/RequireRetrieveHealthCertificateOnBoot](#security-requireretrievehealthcertificateonboot)
+- [Start/StartLayout](#start-startlayout)
- [System/AllowFontProviders](#system-allowfontproviders)
- [System/AllowLocation](#system-allowlocation)
- [System/AllowTelemetry](#system-allowtelemetry)
@@ -3589,9 +3812,6 @@ The following diagram shows the Policy configuration service provider in tree fo
- [TextInput/ExcludeJapaneseIMEExceptJIS0208](#textinput-excludejapaneseimeexceptjis0208)
- [TextInput/ExcludeJapaneseIMEExceptJIS0208andEUDC](#textinput-excludejapaneseimeexceptjis0208andeudc)
- [TextInput/ExcludeJapaneseIMEExceptShiftJIS](#textinput-excludejapaneseimeexceptshiftjis)
-- [TimeLanguageSettings/Set24HourClock](#timelanguagesettings-set24hourclock)
-- [TimeLanguageSettings/SetCountry](#timelanguagesettings-setcountry)
-- [TimeLanguageSettings/SetLanguage](#timelanguagesettings-setlanguage)
- [Update/AllowAutoUpdate](#update-allowautoupdate)
- [Update/AllowUpdateService](#update-allowupdateservice)
- [Update/AutoRestartNotificationSchedule](#update-autorestartnotificationschedule)
diff --git a/windows/client-management/mdm/policy-csp-abovelock.md b/windows/client-management/mdm/policy-csp-abovelock.md
index 12a7923947..bdcbc5f8c4 100644
--- a/windows/client-management/mdm/policy-csp-abovelock.md
+++ b/windows/client-management/mdm/policy-csp-abovelock.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - AboveLock
@@ -15,7 +15,7 @@ ms.date: 11/01/2017
-
+
## AboveLock policies
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -65,27 +67,31 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
-
Specifies whether to allow Action Center notifications above the device lock screen.
+Specifies whether to allow Action Center notifications above the device lock screen.
-
The following list shows the supported values:
+Most restricted value is 0.
-- 0 – Not allowed.
-- 1 (default) – Allowed.
+
+
+The following list shows the supported values:
-
Most restricted value is 0.
+- 0 - Not allowed.
+- 1 (default) - Allowed.
+
+
+
-
-
Added in Windows 10, version 1607. Specifies whether or not the user can interact with Cortana using speech while the system is locked. If you enable or don’t configure this setting, the user can interact with Cortana using speech while the system is locked. If you disable this setting, the system will need to be unlocked for the user to interact with Cortana using speech.
+
+
+Added in Windows 10, version 1607. Specifies whether or not the user can interact with Cortana using speech while the system is locked. If you enable or don’t configure this setting, the user can interact with Cortana using speech while the system is locked. If you disable this setting, the system will need to be unlocked for the user to interact with Cortana using speech.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
-- 0 – Not allowed.
-- 1 (default) – Allowed.
+- 0 - Not allowed.
+- 1 (default) - Allowed.
+
+
+
-
-
Specifies whether to allow toast notifications above the device lock screen.
+
+
+Specifies whether to allow toast notifications above the device lock screen.
-
The following list shows the supported values:
+Most restricted value is 0.
-- 0 – Not allowed.
-- 1 (default) – Allowed.
+
+
+The following list shows the supported values:
-
Most restricted value is 0.
+- 0 - Not allowed.
+- 1 (default) - Allowed.
-
-
+
+
Footnote:
@@ -183,5 +195,5 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
diff --git a/windows/client-management/mdm/policy-csp-accountpoliciesaccountlockoutpolicy.md b/windows/client-management/mdm/policy-csp-accountpoliciesaccountlockoutpolicy.md
new file mode 100644
index 0000000000..2d0549e77b
--- /dev/null
+++ b/windows/client-management/mdm/policy-csp-accountpoliciesaccountlockoutpolicy.md
@@ -0,0 +1,185 @@
+---
+title: Policy CSP - AccountPoliciesAccountLockoutPolicy
+description: Policy CSP - AccountPoliciesAccountLockoutPolicy
+ms.author: maricia
+ms.topic: article
+ms.prod: w10
+ms.technology: windows
+author: nickbrower
+ms.date: 01/30/2018
+---
+
+# Policy CSP - AccountPoliciesAccountLockoutPolicy
+
+> [!WARNING]
+> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
+
+
+
+
+
+## AccountPoliciesAccountLockoutPolicy policies
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Added in Windows 10, next major release. This security setting determines the number of minutes a locked-out account remains locked out before automatically becoming unlocked. The available range is from 0 minutes through 99,999 minutes. If you set the account lockout duration to 0, the account will be locked out until an administrator explicitly unlocks it.
+
+If an account lockout threshold is defined, the account lockout duration must be greater than or equal to the reset time.
+
+Default: None, because this policy setting only has meaning when an Account lockout threshold is specified.
+
+
+
+
+
+
+
+**AccountPoliciesAccountLockoutPolicy/AccountLockoutThreshold**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Added in Windows 10, next major release. This security setting determines the number of failed logon attempts that causes a user account to be locked out. A locked-out account cannot be used until it is reset by an administrator or until the lockout duration for the account has expired. You can set a value between 0 and 999 failed logon attempts. If you set the value to 0, the account will never be locked out.
+
+Failed password attempts against workstations or member servers that have been locked using either CTRL+ALT+DELETE or password-protected screen savers count as failed logon attempts.
+
+Default: 0.
+
+
+
+
+
+
+
+**AccountPoliciesAccountLockoutPolicy/ResetAccountLockoutCounterAfter**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Added in Windows 10, next major release. This security setting determines the number of minutes that must elapse after a failed logon attempt before the failed logon attempt counter is reset to 0 bad logon attempts. The available range is 1 minute to 99,999 minutes.
+
+If an account lockout threshold is defined, this reset time must be less than or equal to the Account lockout duration.
+
+Default: None, because this policy setting only has meaning when an Account lockout threshold is specified.
+
+
+
+
+
+Footnote:
+
+- 1 - Added in Windows 10, version 1607.
+- 2 - Added in Windows 10, version 1703.
+- 3 - Added in Windows 10, version 1709.
+
+
+
diff --git a/windows/client-management/mdm/policy-csp-accounts.md b/windows/client-management/mdm/policy-csp-accounts.md
index f7c547db72..0fb29f4870 100644
--- a/windows/client-management/mdm/policy-csp-accounts.md
+++ b/windows/client-management/mdm/policy-csp-accounts.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - Accounts
@@ -15,7 +15,7 @@ ms.date: 11/01/2017
-
+
## Accounts policies
Specifies whether user is allowed to add non-MSA email accounts.
+
+
+Specifies whether user is allowed to add non-MSA email accounts.
-
The following list shows the supported values:
-
-- 0 – Not allowed.
-- 1 (default) – Allowed.
-
-
Most restricted value is 0.
+Most restricted value is 0.
> [!NOTE]
> This policy will only block UI/UX-based methods for adding non-Microsoft accounts. Even if this policy is enforced, you can still provision non-MSA accounts using the [EMAIL2 CSP](email2-csp.md).
-
-
+
+
+The following list shows the supported values:
+
+- 0 - Not allowed.
+- 1 (default) - Allowed.
+
+
+
+
Specifies whether the user is allowed to use an MSA account for non-email related connection authentication and services.
+
+
+Specifies whether the user is allowed to use an MSA account for non-email related connection authentication and services.
-
The following list shows the supported values:
+Most restricted value is 0.
-- 0 – Not allowed.
-- 1 (default) – Allowed.
+
+
+The following list shows the supported values:
-
Most restricted value is 0.
+- 0 - Not allowed.
+- 1 (default) - Allowed.
+
+
+
-
-
Added in Windows 10, version 1703. Allows IT Admins the ability to disable the "Microsoft Account Sign-In Assistant" (wlidsvc) NT service.
+
+
+Added in Windows 10, version 1703. Allows IT Admins the ability to disable the "Microsoft Account Sign-In Assistant" (wlidsvc) NT service.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
-- 0 – Disabled.
-- 1 (default) – Manual start.
+- 0 - Disabled.
+- 1 (default) - Manual start.
+
+
+
-
-
Specifies a list of the domains that are allowed to sync email on the device.
+
+
+Specifies a list of the domains that are allowed to sync email on the device.
-
The data type is a string.
+The data type is a string.
-
The default value is an empty string, which allows all email accounts on the device to sync email. Otherwise, the string should contain a pipe-separated list of domains that are allowed to sync email on the device. For example, "contoso.com|fabrikam.net|woodgrove.gov".
+The default value is an empty string, which allows all email accounts on the device to sync email. Otherwise, the string should contain a pipe-separated list of domains that are allowed to sync email on the device. For example, "contoso.com|fabrikam.net|woodgrove.gov".
-
-
+
+
Footnote:
@@ -231,7 +245,7 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
## Accounts policies supported by Windows Holographic for Business
diff --git a/windows/client-management/mdm/policy-csp-activexcontrols.md b/windows/client-management/mdm/policy-csp-activexcontrols.md
index 411a6aa435..4bea893b54 100644
--- a/windows/client-management/mdm/policy-csp-activexcontrols.md
+++ b/windows/client-management/mdm/policy-csp-activexcontrols.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - ActiveXControls
@@ -15,7 +15,7 @@ ms.date: 11/01/2017
-
+
## ActiveXControls policies
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -59,8 +61,8 @@ ms.date: 11/01/2017
-
-
+
+
This policy setting determines which ActiveX installation sites standard users in your organization can use to install ActiveX controls on their computers. When this setting is enabled, the administrator can create a list of approved Activex Install sites specified by host URL.
If you enable this setting, the administrator can create a list of approved ActiveX Install sites specified by host URL.
@@ -69,7 +71,7 @@ If you disable or do not configure this policy setting, ActiveX controls prompt
Note: Wild card characters cannot be used when specifying the host URLs.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -77,15 +79,15 @@ Note: Wild card characters cannot be used when specifying the host URLs.
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Approved Installation Sites for ActiveX Controls*
- GP name: *ApprovedActiveXInstallSites*
- GP path: *Windows Components/ActiveX Installer Service*
- GP ADMX file name: *ActiveXInstallService.admx*
-
-
+
+
Footnote:
@@ -94,5 +96,5 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
diff --git a/windows/client-management/mdm/policy-csp-applicationdefaults.md b/windows/client-management/mdm/policy-csp-applicationdefaults.md
index 440bf514ac..0e45ce047c 100644
--- a/windows/client-management/mdm/policy-csp-applicationdefaults.md
+++ b/windows/client-management/mdm/policy-csp-applicationdefaults.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - ApplicationDefaults
@@ -15,7 +15,7 @@ ms.date: 11/01/2017
-
+
## ApplicationDefaults policies
Added in Windows 10, version 1703. This policy allows an administrator to set default file type and protocol associations. When set, default associations will be applied on sign-in to the PC. The association file can be created using the DISM tool (dism /online /export-defaultappassociations:appassoc.xml), and then needs to be base64 encoded before being added to SyncML.
+
+
+Added in Windows 10, version 1703. This policy allows an administrator to set default file type and protocol associations. When set, default associations will be applied on sign-in to the PC. The association file can be created using the DISM tool (dism /online /export-defaultappassociations:appassoc.xml), and then needs to be base64 encoded before being added to SyncML.
-
If policy is enabled and the client machine is Azure Active Directory joined, the associations assigned in SyncML will be processed and default associations will be applied.
+If policy is enabled and the client machine is Azure Active Directory joined, the associations assigned in SyncML will be processed and default associations will be applied.
-
To create create the SyncML, follow these steps:
+
+
+To create create the SyncML, follow these steps:
Install a few apps and change your defaults.
From an elevated prompt, run "dism /online /export-defaultappassociations:appassoc.xml"
@@ -73,7 +77,7 @@ ms.date: 11/01/2017
Paste the base64 encoded XML into the SyncML
-
Here is an example output from the dism default association export command:
+Here is an example output from the dism default association export command:
``` syntax
@@ -86,13 +90,13 @@ ms.date: 11/01/2017
Here is the base64 encoded result:
+Here is the base64 encoded result:
``` syntax
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz4NCjxEZWZhdWx0QXNzb2NpYXRpb25zPg0KICA8QXNzb2NpYXRpb24gSWRlbnRpZmllcj0iLmh0bSIgUHJvZ0lkPSJBcHBYNGh4dGFkNzdmYmszamtrZWVya3JtMHplOTR3amYzczkiIEFwcGxpY2F0aW9uTmFtZT0iTWljcm9zb2Z0IEVkZ2UiIC8+DQogIDxBc3NvY2lhdGlvbiBJZGVudGlmaWVyPSIuaHRtbCIgUHJvZ0lkPSJBcHBYNGh4dGFkNzdmYmszamtrZWVya3JtMHplOTR3amYzczkiIEFwcGxpY2F0aW9uTmFtZT0iTWljcm9zb2Z0IEVkZ2UiIC8+DQogIDxBc3NvY2lhdGlvbiBJZGVudGlmaWVyPSIucGRmIiBQcm9nSWQ9IkFwcFhkNG5yejhmZjY4c3JuaGY5dDVhOHNianlhcjFjcjcyMyIgQXBwbGljYXRpb25OYW1lPSJNaWNyb3NvZnQgRWRnZSIgLz4NCiAgPEFzc29jaWF0aW9uIElkZW50aWZpZXI9Imh0dHAiIFByb2dJZD0iQXBwWHEwZmV2em1lMnB5czYybjNlMGZicWE3cGVhcHlrcjh2IiBBcHBsaWNhdGlvbk5hbWU9Ik1pY3Jvc29mdCBFZGdlIiAvPg0KICA8QXNzb2NpYXRpb24gSWRlbnRpZmllcj0iaHR0cHMiIFByb2dJZD0iQXBwWDkwbnY2bmhheTVuNmE5OGZuZXR2N3RwazY0cHAzNWVzIiBBcHBsaWNhdGlvbk5hbWU9Ik1pY3Jvc29mdCBFZGdlIiAvPg0KPC9EZWZhdWx0QXNzb2NpYXRpb25zPg0KDQo=
```
-
Here is the SyncMl example:
+Here is the SyncMl example:
``` syntax
@@ -117,8 +121,8 @@ PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz4NCjxEZWZhdWx0QXNzb2NpYXRpb25z
```
-
-
+
+
Footnote:
@@ -127,11 +131,5 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
-
-
-## ApplicationDefaults policies supported by Microsoft Surface Hub
-
-- [ApplicationDefaults/DefaultAssociationsConfiguration](#applicationdefaults-defaultassociationsconfiguration)
-
+
diff --git a/windows/client-management/mdm/policy-csp-applicationmanagement.md b/windows/client-management/mdm/policy-csp-applicationmanagement.md
index b3937a002a..9ee5181bd2 100644
--- a/windows/client-management/mdm/policy-csp-applicationmanagement.md
+++ b/windows/client-management/mdm/policy-csp-applicationmanagement.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - ApplicationManagement
@@ -15,7 +15,7 @@ ms.date: 11/01/2017
-
+
## ApplicationManagement policies
Specifies whether non Microsoft Store apps are allowed.
+
+
+Specifies whether non Microsoft Store apps are allowed.
-
The following list shows the supported values:
+Most restricted value is 0.
-- 0 – Explicit deny.
-- 1 – Explicit allow unlock.
-- 65535 (default) – Not configured.
+
+
+The following list shows the supported values:
-
Most restricted value is 0.
+- 0 - Explicit deny.
+- 1 - Explicit allow unlock.
+- 65535 (default) - Not configured.
+
+
+
-
-
Specifies whether automatic update of apps from Microsoft Store are allowed.
+
+
+Specifies whether automatic update of apps from Microsoft Store are allowed.
-
The following list shows the supported values:
+
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
Specifies whether developer unlock is allowed.
+
+
+Specifies whether developer unlock is allowed.
-
The following list shows the supported values:
+Most restricted value is 0.
-- 0 – Explicit deny.
-- 1 – Explicit allow unlock.
-- 65535 (default) – Not configured.
+
+
+The following list shows the supported values:
-
Most restricted value is 0.
+- 0 - Explicit deny.
+- 1 - Explicit allow unlock.
+- 65535 (default) - Not configured.
+
+
+
-
-
-
+
+
**ApplicationManagement/AllowGameDVR**
-
+
Home
@@ -226,8 +241,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -235,27 +250,31 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> The policy is only enforced in Windows 10 for desktop.
-
Specifies whether DVR and broadcasting is allowed.
+Specifies whether DVR and broadcasting is allowed.
-
The following list shows the supported values:
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
Specifies whether multiple users of the same app can share data.
+
+
+Specifies whether multiple users of the same app can share data.
-
The following list shows the supported values:
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 (default) – Not allowed.
- 1 – Allowed.
-
Specifies whether app store is allowed at the device.
+
+
+Specifies whether app store is allowed at the device.
-
The following list shows the supported values:
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -382,13 +409,13 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop. For desktop devices, use the [AppLocker CSP](applocker-csp.md) instead.
-
An XML blob that specifies the application restrictions company want to put to the device. It could be an app allow list, app disallow list, allowed publisher IDs, and so on. For a list of Windows apps and product IDs, see [inbox apps](applocker-csp.md#inboxappsandcomponents). For more information about the XML, see the [ApplicationRestrictions XSD](applicationrestrictions-xsd.md).
+An XML blob that specifies the application restrictions company want to put to the device. It could be an app allow list, app disallow list, allowed publisher IDs, and so on. For a list of Windows apps and product IDs, see [inbox apps](applocker-csp.md#inboxappsandcomponents). For more information about the XML, see the [ApplicationRestrictions XSD](applicationrestrictions-xsd.md).
> [!NOTE]
> When you upgrade Windows Phone 8.1 devices to Windows 10 Mobile with a list of allowed apps, some Windows inbox apps get blocked causing unexpected behavior. To work around this issue, you must include the [inbox apps](applocker-csp.md#inboxappsandcomponents) that you need to your list of allowed apps.
@@ -402,19 +429,21 @@ ms.date: 11/01/2017
> - You cannot disable or enable **Contact Support** and **Windows Feedback** apps using ApplicationManagement/ApplicationRestrictions policy, although these are listed in the [inbox apps](applocker-csp.md#inboxappsandcomponents).
-
An application that is running may not be immediately terminated.
+An application that is running may not be immediately terminated.
-
Value type is chr.
+Value type is chr.
-
Value evaluation rule - The information for PolicyManager is opaque. There is no most restricted value evaluation. Whenever there is a change to the value, the device parses the node value and enforces specified policies.
+Value evaluation rule - The information for PolicyManager is opaque. There is no most restricted value evaluation. Whenever there is a change to the value, the device parses the node value and enforces specified policies.
+
+
+
-
-
Added in Windows 10, version 1607. Boolean value that disables the launch of all apps from Microsoft Store that came pre-installed or were downloaded.
+
+
+Added in Windows 10, version 1607. Boolean value that disables the launch of all apps from Microsoft Store that came pre-installed or were downloaded.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 (default) – Enable launch of apps.
- 1 – Disable launch of apps.
-
-
+
+
+
Allows disabling of the retail catalog and only enables the Private store.
+
+
+Allows disabling of the retail catalog and only enables the Private store.
-
The following list shows the supported values:
+
+Most restricted value is 1.
+
+
+
+The following list shows the supported values:
- 0 (default) – Allow both public and Private store.
- 1 – Only Private store is enabled.
-
Specifies whether application data is restricted to the system drive.
+
+
+Specifies whether application data is restricted to the system drive.
-
The following list shows the supported values:
+Most restricted value is 1.
+
+
+
+The following list shows the supported values:
- 0 (default) – Not restricted.
- 1 – Restricted.
-
Specifies whether the installation of applications is restricted to the system drive.
+
+
+Specifies whether the installation of applications is restricted to the system drive.
-
The following list shows the supported values:
+Most restricted value is 1.
+
+
+
+The following list shows the supported values:
- 0 (default) – Not restricted.
- 1 – Restricted.
-
Most restricted value is 1.
-
-
-
+
+
Footnote:
@@ -610,7 +652,7 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
## ApplicationManagement policies supported by Windows Holographic for Business
diff --git a/windows/client-management/mdm/policy-csp-appvirtualization.md b/windows/client-management/mdm/policy-csp-appvirtualization.md
index e8d81c05b3..5ec36f8881 100644
--- a/windows/client-management/mdm/policy-csp-appvirtualization.md
+++ b/windows/client-management/mdm/policy-csp-appvirtualization.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - AppVirtualization
@@ -15,7 +15,7 @@ ms.date: 11/01/2017
-
+
## AppVirtualization policies
@@ -105,11 +105,13 @@ ms.date: 11/01/2017
+
-
+
+
**AppVirtualization/AllowAppVClient**
-
+
Home
@@ -131,8 +133,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -140,11 +142,11 @@ ms.date: 11/01/2017
-
-
+
+
This policy setting allows you to enable or disable Microsoft Application Virtualization (App-V) feature. Reboot is needed for disable to take effect.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -152,20 +154,22 @@ This policy setting allows you to enable or disable Microsoft Application Virtua
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Enable App-V Client*
- GP name: *EnableAppV*
- GP path: *System/App-V*
- GP ADMX file name: *appv.admx*
-
-
+
+
+
-
+
+
**AppVirtualization/AllowDynamicVirtualization**
-
+
Home
@@ -187,8 +191,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -196,11 +200,11 @@ ADMX Info:
-
-
+
+
Enables Dynamic Virtualization of supported shell extensions, browser helper objects, and ActiveX controls.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -208,20 +212,22 @@ Enables Dynamic Virtualization of supported shell extensions, browser helper obj
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Enable Dynamic Virtualization*
- GP name: *Virtualization_JITVEnable*
- GP path: *System/App-V/Virtualization*
- GP ADMX file name: *appv.admx*
-
-
+
+
+
-
+
+
**AppVirtualization/AllowPackageCleanup**
-
+
Home
@@ -243,8 +249,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -252,11 +258,11 @@ ADMX Info:
-
-
+
+
Enables automatic cleanup of appv packages that were added after Windows10 anniversary release.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -264,20 +270,22 @@ Enables automatic cleanup of appv packages that were added after Windows10 anniv
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Enable automatic cleanup of unused appv packages*
- GP name: *PackageManagement_AutoCleanupEnable*
- GP path: *System/App-V/PackageManagement*
- GP ADMX file name: *appv.admx*
-
-
+
+
+
-
+
+
**AppVirtualization/AllowPackageScripts**
-
+
Home
@@ -299,8 +307,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -308,11 +316,11 @@ ADMX Info:
-
-
+
+
Enables scripts defined in the package manifest of configuration files that should run.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -320,20 +328,22 @@ Enables scripts defined in the package manifest of configuration files that shou
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Enable Package Scripts*
- GP name: *Scripting_Enable_Package_Scripts*
- GP path: *System/App-V/Scripting*
- GP ADMX file name: *appv.admx*
-
-
+
+
+
-
+
+
**AppVirtualization/AllowPublishingRefreshUX**
-
+
Home
@@ -355,8 +365,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -364,11 +374,11 @@ ADMX Info:
-
-
+
+
Enables a UX to display to the user when a publishing refresh is performed on the client.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -376,20 +386,22 @@ Enables a UX to display to the user when a publishing refresh is performed on th
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Enable Publishing Refresh UX*
- GP name: *Enable_Publishing_Refresh_UX*
- GP path: *System/App-V/Publishing*
- GP ADMX file name: *appv.admx*
-
-
+
+
+
-
+
+
**AppVirtualization/AllowReportingServer**
-
+
Home
@@ -411,8 +423,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -420,8 +432,8 @@ ADMX Info:
-
-
+
+
Reporting Server URL: Displays the URL of reporting server.
Reporting Time: When the client data should be reported to the server. Acceptable range is 0~23, corresponding to the 24 hours in a day. A good practice is, don't set this time to a busy hour, e.g. 9AM.
@@ -434,7 +446,7 @@ Data Cache Limit: This value specifies the maximum size in megabytes (MB) of the
Data Block Size: This value specifies the maximum size in bytes to transmit to the server at once on a reporting upload, to avoid permanent transmission failures when the log has reached a significant size. The default value is 65536. When transmitting report data to the server, one block at a time of application records that is less than or equal to the block size in bytes of XML data will be removed from the cache and sent to the server. Each block will have the general Client data and global package list data prepended, and these will not factor into the block size calculations; the potential exists for an extremely large package list to result in transmission failures over low bandwidth or unreliable connections.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -442,20 +454,22 @@ Data Block Size: This value specifies the maximum size in bytes to transmit to t
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Reporting Server*
- GP name: *Reporting_Server_Policy*
- GP path: *System/App-V/Reporting*
- GP ADMX file name: *appv.admx*
-
-
+
+
+
-
+
+
**AppVirtualization/AllowRoamingFileExclusions**
-
+
Home
@@ -477,8 +491,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -486,11 +500,11 @@ ADMX Info:
-
-
+
+
Specifies the file paths relative to %userprofile% that do not roam with a user's profile. Example usage: /FILEEXCLUSIONLIST='desktop;my pictures'.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -498,20 +512,22 @@ Specifies the file paths relative to %userprofile% that do not roam with a user'
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Roaming File Exclusions*
- GP name: *Integration_Roaming_File_Exclusions*
- GP path: *System/App-V/Integration*
- GP ADMX file name: *appv.admx*
-
-
+
+
+
-
+
+
**AppVirtualization/AllowRoamingRegistryExclusions**
-
+
Home
@@ -533,8 +549,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -542,11 +558,11 @@ ADMX Info:
-
-
+
+
Specifies the registry paths that do not roam with a user profile. Example usage: /REGISTRYEXCLUSIONLIST=software\classes;software\clients.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -554,20 +570,22 @@ Specifies the registry paths that do not roam with a user profile. Example usage
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Roaming Registry Exclusions*
- GP name: *Integration_Roaming_Registry_Exclusions*
- GP path: *System/App-V/Integration*
- GP ADMX file name: *appv.admx*
-
-
+
+
+
-
+
+
**AppVirtualization/AllowStreamingAutoload**
-
+
Home
@@ -589,8 +607,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -598,11 +616,11 @@ ADMX Info:
-
-
+
+
Specifies how new packages should be loaded automatically by App-V on a specific computer.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -610,20 +628,22 @@ Specifies how new packages should be loaded automatically by App-V on a specific
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Specify what to load in background (aka AutoLoad)*
- GP name: *Steaming_Autoload*
- GP path: *System/App-V/Streaming*
- GP ADMX file name: *appv.admx*
-
-
+
+
+
-
+
+
**AppVirtualization/ClientCoexistenceAllowMigrationmode**
-
+
Home
@@ -645,8 +665,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -654,11 +674,11 @@ ADMX Info:
-
-
+
+
Migration mode allows the App-V client to modify shortcuts and FTA's for packages created using a previous version of App-V.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -666,20 +686,22 @@ Migration mode allows the App-V client to modify shortcuts and FTA's for package
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Enable Migration Mode*
- GP name: *Client_Coexistence_Enable_Migration_mode*
- GP path: *System/App-V/Client Coexistence*
- GP ADMX file name: *appv.admx*
-
-
+
+
+
-
+
+
**AppVirtualization/IntegrationAllowRootGlobal**
-
+
Home
@@ -701,8 +723,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -710,11 +732,11 @@ ADMX Info:
-
-
+
+
Specifies the location where symbolic links are created to the current version of a per-user published package. Shortcuts, file type associations, etc. are created pointing to this path. If empty, symbolic links are not used during publishing. Example: %localappdata%\Microsoft\AppV\Client\Integration.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -722,20 +744,22 @@ Specifies the location where symbolic links are created to the current version o
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Integration Root User*
- GP name: *Integration_Root_User*
- GP path: *System/App-V/Integration*
- GP ADMX file name: *appv.admx*
-
-
+
+
+
-
+
+
**AppVirtualization/IntegrationAllowRootUser**
-
+
Home
@@ -757,8 +781,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -766,11 +790,11 @@ ADMX Info:
-
-
+
+
Specifies the location where symbolic links are created to the current version of a globally published package. Shortcuts, file type associations, etc. are created pointing to this path. If empty, symbolic links are not used during publishing. Example: %allusersprofile%\Microsoft\AppV\Client\Integration.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -778,20 +802,22 @@ Specifies the location where symbolic links are created to the current version o
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Integration Root Global*
- GP name: *Integration_Root_Global*
- GP path: *System/App-V/Integration*
- GP ADMX file name: *appv.admx*
-
-
+
+
+
-
+
+
**AppVirtualization/PublishingAllowServer1**
-
+
Home
@@ -813,8 +839,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -822,8 +848,8 @@ ADMX Info:
-
-
+
+
Publishing Server Display Name: Displays the name of publishing server.
Publishing Server URL: Displays the URL of publishing server.
@@ -844,7 +870,7 @@ User Publishing Refresh Interval: Specifies the publishing refresh interval usin
User Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, Day 0-31).
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -852,20 +878,22 @@ User Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, D
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Publishing Server 1 Settings*
- GP name: *Publishing_Server1_Policy*
- GP path: *System/App-V/Publishing*
- GP ADMX file name: *appv.admx*
-
-
+
+
+
-
+
+
**AppVirtualization/PublishingAllowServer2**
-
+
Home
@@ -887,8 +915,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -896,8 +924,8 @@ ADMX Info:
-
-
+
+
Publishing Server Display Name: Displays the name of publishing server.
Publishing Server URL: Displays the URL of publishing server.
@@ -918,7 +946,7 @@ User Publishing Refresh Interval: Specifies the publishing refresh interval usin
User Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, Day 0-31).
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -926,20 +954,22 @@ User Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, D
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Publishing Server 2 Settings*
- GP name: *Publishing_Server2_Policy*
- GP path: *System/App-V/Publishing*
- GP ADMX file name: *appv.admx*
-
-
+
+
+
-
+
+
**AppVirtualization/PublishingAllowServer3**
-
+
Home
@@ -961,8 +991,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -970,8 +1000,8 @@ ADMX Info:
-
-
+
+
Publishing Server Display Name: Displays the name of publishing server.
Publishing Server URL: Displays the URL of publishing server.
@@ -992,7 +1022,7 @@ User Publishing Refresh Interval: Specifies the publishing refresh interval usin
User Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, Day 0-31).
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -1000,20 +1030,22 @@ User Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, D
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Publishing Server 3 Settings*
- GP name: *Publishing_Server3_Policy*
- GP path: *System/App-V/Publishing*
- GP ADMX file name: *appv.admx*
-
-
+
+
+
-
+
+
**AppVirtualization/PublishingAllowServer4**
-
+
Home
@@ -1035,8 +1067,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1044,8 +1076,8 @@ ADMX Info:
-
-
+
+
Publishing Server Display Name: Displays the name of publishing server.
Publishing Server URL: Displays the URL of publishing server.
@@ -1066,7 +1098,7 @@ User Publishing Refresh Interval: Specifies the publishing refresh interval usin
User Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, Day 0-31).
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -1074,20 +1106,22 @@ User Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, D
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Publishing Server 4 Settings*
- GP name: *Publishing_Server4_Policy*
- GP path: *System/App-V/Publishing*
- GP ADMX file name: *appv.admx*
-
-
+
+
+
-
+
+
**AppVirtualization/PublishingAllowServer5**
-
+
Home
@@ -1109,8 +1143,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1118,8 +1152,8 @@ ADMX Info:
-
-
+
+
Publishing Server Display Name: Displays the name of publishing server.
Publishing Server URL: Displays the URL of publishing server.
@@ -1140,7 +1174,7 @@ User Publishing Refresh Interval: Specifies the publishing refresh interval usin
User Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, Day 0-31).
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -1148,20 +1182,22 @@ User Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, D
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Publishing Server 5 Settings*
- GP name: *Publishing_Server5_Policy*
- GP path: *System/App-V/Publishing*
- GP ADMX file name: *appv.admx*
-
-
+
+
+
-
+
+
**AppVirtualization/StreamingAllowCertificateFilterForClient_SSL**
-
+
Home
@@ -1183,8 +1219,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1192,11 +1228,11 @@ ADMX Info:
-
-
+
+
Specifies the path to a valid certificate in the certificate store.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -1204,20 +1240,22 @@ Specifies the path to a valid certificate in the certificate store.
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Certificate Filter For Client SSL*
- GP name: *Streaming_Certificate_Filter_For_Client_SSL*
- GP path: *System/App-V/Streaming*
- GP ADMX file name: *appv.admx*
-
-
+
+
+
-
+
+
**AppVirtualization/StreamingAllowHighCostLaunch**
-
+
Home
@@ -1239,8 +1277,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1248,11 +1286,11 @@ ADMX Info:
-
-
+
+
This setting controls whether virtualized applications are launched on Windows 8 machines connected via a metered network connection (e.g. 4G).
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -1260,20 +1298,22 @@ This setting controls whether virtualized applications are launched on Windows 8
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Allow First Time Application Launches if on a High Cost Windows 8 Metered Connection*
- GP name: *Streaming_Allow_High_Cost_Launch*
- GP path: *System/App-V/Streaming*
- GP ADMX file name: *appv.admx*
-
-
+
+
+
-
+
+
**AppVirtualization/StreamingAllowLocationProvider**
-
+
Home
@@ -1295,8 +1335,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1304,11 +1344,11 @@ ADMX Info:
-
-
+
+
Specifies the CLSID for a compatible implementation of the IAppvPackageLocationProvider interface.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -1316,20 +1356,22 @@ Specifies the CLSID for a compatible implementation of the IAppvPackageLocationP
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Location Provider*
- GP name: *Streaming_Location_Provider*
- GP path: *System/App-V/Streaming*
- GP ADMX file name: *appv.admx*
-
-
+
+
+
-
+
+
**AppVirtualization/StreamingAllowPackageInstallationRoot**
-
+
Home
@@ -1351,8 +1393,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1360,11 +1402,11 @@ ADMX Info:
-
-
+
+
Specifies directory where all new applications and updates will be installed.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -1372,20 +1414,22 @@ Specifies directory where all new applications and updates will be installed.
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Package Installation Root*
- GP name: *Streaming_Package_Installation_Root*
- GP path: *System/App-V/Streaming*
- GP ADMX file name: *appv.admx*
-
-
+
+
+
-
+
+
**AppVirtualization/StreamingAllowPackageSourceRoot**
-
+
Home
@@ -1407,8 +1451,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1416,11 +1460,11 @@ ADMX Info:
-
-
+
+
Overrides source location for downloading package content.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -1428,20 +1472,22 @@ Overrides source location for downloading package content.
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Package Source Root*
- GP name: *Streaming_Package_Source_Root*
- GP path: *System/App-V/Streaming*
- GP ADMX file name: *appv.admx*
-
-
+
+
+
-
+
+
**AppVirtualization/StreamingAllowReestablishmentInterval**
-
+
Home
@@ -1463,8 +1509,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1472,11 +1518,11 @@ ADMX Info:
-
-
+
+
Specifies the number of seconds between attempts to reestablish a dropped session.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -1484,20 +1530,22 @@ Specifies the number of seconds between attempts to reestablish a dropped sessio
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Reestablishment Interval*
- GP name: *Streaming_Reestablishment_Interval*
- GP path: *System/App-V/Streaming*
- GP ADMX file name: *appv.admx*
-
-
+
+
+
-
+
+
**AppVirtualization/StreamingAllowReestablishmentRetries**
-
+
Home
@@ -1519,8 +1567,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1528,11 +1576,11 @@ ADMX Info:
-
-
+
+
Specifies the number of times to retry a dropped session.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -1540,20 +1588,22 @@ Specifies the number of times to retry a dropped session.
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Reestablishment Retries*
- GP name: *Streaming_Reestablishment_Retries*
- GP path: *System/App-V/Streaming*
- GP ADMX file name: *appv.admx*
-
-
+
+
+
-
+
+
**AppVirtualization/StreamingSharedContentStoreMode**
-
+
Home
@@ -1575,8 +1625,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1584,11 +1634,11 @@ ADMX Info:
-
-
+
+
Specifies that streamed package contents will be not be saved to the local hard disk.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -1596,20 +1646,22 @@ Specifies that streamed package contents will be not be saved to the local hard
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Shared Content Store (SCS) mode*
- GP name: *Streaming_Shared_Content_Store_Mode*
- GP path: *System/App-V/Streaming*
- GP ADMX file name: *appv.admx*
-
-
+
+
+
-
+
+
**AppVirtualization/StreamingSupportBranchCache**
-
+
Home
@@ -1631,8 +1683,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1640,11 +1692,11 @@ ADMX Info:
-
-
+
+
If enabled, the App-V client will support BrancheCache compatible HTTP streaming. If BranchCache support is not desired, this should be disabled. The client can then apply HTTP optimizations which are incompatible with BranchCache
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -1652,20 +1704,22 @@ If enabled, the App-V client will support BrancheCache compatible HTTP streaming
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Enable Support for BranchCache*
- GP name: *Streaming_Support_Branch_Cache*
- GP path: *System/App-V/Streaming*
- GP ADMX file name: *appv.admx*
-
-
+
+
+
-
+
+
**AppVirtualization/StreamingVerifyCertificateRevocationList**
-
+
Home
@@ -1687,8 +1741,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1696,11 +1750,11 @@ ADMX Info:
-
-
+
+
Verifies Server certificate revocation status before streaming using HTTPS.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -1708,20 +1762,22 @@ Verifies Server certificate revocation status before streaming using HTTPS.
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Verify certificate revocation list*
- GP name: *Streaming_Verify_Certificate_Revocation_List*
- GP path: *System/App-V/Streaming*
- GP ADMX file name: *appv.admx*
-
-
+
+
+
-
+
+
**AppVirtualization/VirtualComponentsAllowList**
-
+
Home
@@ -1743,8 +1799,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1752,11 +1808,11 @@ ADMX Info:
-
-
+
+
Specifies a list of process paths (may contain wildcards) which are candidates for using virtual components (shell extensions, browser helper objects, etc). Only processes whose full path matches one of these items can use virtual components.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -1764,15 +1820,15 @@ Specifies a list of process paths (may contain wildcards) which are candidates f
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Virtual Component Process Allow List*
- GP name: *Virtualization_JITVAllowList*
- GP path: *System/App-V/Virtualization*
- GP ADMX file name: *appv.admx*
-
-
+
+
Footnote:
@@ -1781,5 +1837,5 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
diff --git a/windows/client-management/mdm/policy-csp-attachmentmanager.md b/windows/client-management/mdm/policy-csp-attachmentmanager.md
index 71012e8237..3cd9a8202d 100644
--- a/windows/client-management/mdm/policy-csp-attachmentmanager.md
+++ b/windows/client-management/mdm/policy-csp-attachmentmanager.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - AttachmentManager
@@ -15,7 +15,7 @@ ms.date: 11/01/2017
-
+
## AttachmentManager policies
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -65,8 +67,8 @@ ms.date: 11/01/2017
-
-
+
+
This policy setting allows you to manage whether Windows marks file attachments with information about their zone of origin (such as restricted, Internet, intranet, local). This requires NTFS in order to function correctly, and will fail without notice on FAT32. By not preserving the zone information, Windows cannot make proper risk assessments.
If you enable this policy setting, Windows does not mark file attachments with their zone information.
@@ -75,7 +77,7 @@ If you disable this policy setting, Windows marks file attachments with their zo
If you do not configure this policy setting, Windows marks file attachments with their zone information.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -83,20 +85,22 @@ If you do not configure this policy setting, Windows marks file attachments with
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Do not preserve zone information in file attachments*
- GP name: *AM_MarkZoneOnSavedAtttachments*
- GP path: *Windows Components/Attachment Manager*
- GP ADMX file name: *AttachmentManager.admx*
-
-
+
+
+
-
+
+
**AttachmentManager/HideZoneInfoMechanism**
-
+
Home
@@ -118,8 +122,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -127,8 +131,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage whether users can manually remove the zone information from saved file attachments by clicking the Unblock button in the file's property sheet or by using a check box in the security warning dialog. Removing the zone information allows users to open potentially dangerous file attachments that Windows has blocked users from opening.
If you enable this policy setting, Windows hides the check box and Unblock button.
@@ -137,7 +141,7 @@ If you disable this policy setting, Windows shows the check box and Unblock butt
If you do not configure this policy setting, Windows hides the check box and Unblock button.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -145,20 +149,22 @@ If you do not configure this policy setting, Windows hides the check box and Unb
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Hide mechanisms to remove zone information*
- GP name: *AM_RemoveZoneInfo*
- GP path: *Windows Components/Attachment Manager*
- GP ADMX file name: *AttachmentManager.admx*
-
-
+
+
+
-
+
+
**AttachmentManager/NotifyAntivirusPrograms**
-
+
Home
@@ -180,8 +186,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -189,8 +195,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage the behavior for notifying registered antivirus programs. If multiple programs are registered, they will all be notified. If the registered antivirus program already performs on-access checks or scans files as they arrive on the computer's email server, additional calls would be redundant.
If you enable this policy setting, Windows tells the registered antivirus program to scan the file when a user opens a file attachment. If the antivirus program fails, the attachment is blocked from being opened.
@@ -199,7 +205,7 @@ If you disable this policy setting, Windows does not call the registered antivir
If you do not configure this policy setting, Windows does not call the registered antivirus programs when file attachments are opened.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -207,15 +213,15 @@ If you do not configure this policy setting, Windows does not call the registere
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Notify antivirus programs when opening attachments*
- GP name: *AM_CallIOfficeAntiVirus*
- GP path: *Windows Components/Attachment Manager*
- GP ADMX file name: *AttachmentManager.admx*
-
-
+
+
Footnote:
@@ -224,5 +230,5 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
diff --git a/windows/client-management/mdm/policy-csp-authentication.md b/windows/client-management/mdm/policy-csp-authentication.md
index 6a21929f0c..881ae7ff19 100644
--- a/windows/client-management/mdm/policy-csp-authentication.md
+++ b/windows/client-management/mdm/policy-csp-authentication.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/16/2017
+ms.date: 01/30/2018
---
# Policy CSP - Authentication
@@ -15,7 +15,7 @@ ms.date: 11/16/2017
-
+
## Authentication policies
Added in Windows 10, version 1709. Specifies whether password reset is enabled for Azure Active Directory accounts. This policy allows the Azure AD tenant administrators to enable self service password reset feature on the windows logon screen.
+
+
+Added in Windows 10, version 1709. Specifies whether password reset is enabled for Azure Active Directory accounts. This policy allows the Azure AD tenant administrators to enable self service password reset feature on the windows logon screen.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 (default) – Not allowed.
- 1 – Allowed.
-
-
+
+
+
Allows an EAP cert-based authentication for a single sign on (SSO) to access internal resources.
+
+
+Allows an EAP cert-based authentication for a single sign on (SSO) to access internal resources.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
-
+
+
+
Allows EAP Fast Reconnect from being attempted for EAP Method TLS.
+
+
+Allows EAP Fast Reconnect from being attempted for EAP Method TLS.
-
The following list shows the supported values:
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
Preview release in Windows 10, version 1709. Supported in the next release. Specifies whether Fast Identity Online (FIDO) device can be used to sign on. This policy enables the Windows logon credential provider for FIDO 2.0
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
-
Value type is integer.
+> [!div class = "checklist"]
+> * Device
-
Here is an example scenario: At Contoso, there are a lot of shared devices and kiosks that employees throughout the day using as many as 20 different devices. To minimize the loss in productivity when employees have to login with username and password everytime they pick up a device, the IT admin deploys SharePC CSP and Authentication/AllowFidoDeviceSignon policy to shared devices. The IT admin provisions and distributes FIDO 2.0 devices to employees, which allows them to authenticate to various shared devices and PCs.
+
-
The following list shows the supported values:
+
+
+Preview release in Windows 10, version 1709. Supported in the next release. Specifies whether Fast Identity Online (FIDO) device can be used to sign on. This policy enables the Windows logon credential provider for FIDO 2.0
+
+Value type is integer.
+
+Here is an example scenario: At Contoso, there are a lot of shared devices and kiosks that employees throughout the day using as many as 20 different devices. To minimize the loss in productivity when employees have to login with username and password everytime they pick up a device, the IT admin deploys SharePC CSP and Authentication/AllowFidoDeviceSignon policy to shared devices. The IT admin provisions and distributes FIDO 2.0 devices to employees, which allows them to authenticate to various shared devices and PCs.
+
+
+
+The following list shows the supported values:
- 0 - Do not allow. The FIDO device credential provider disabled.
- 1 - Allow. The FIDO device credential provider is enabled and allows usage of FIDO devices to sign into an Windows.
-
-
+
+
+
Added in Windows 10, version 1607. Allows secondary authentication devices to work with Windows.
+
+
+Added in Windows 10, version 1607. Allows secondary authentication devices to work with Windows.
-
The following list shows the supported values:
+The default for this policy must be on for consumer devices (defined as local or Microsoft account connected device) and off for enterprise devices (such as cloud domain-joined, cloud domain-joined in an on-premise only environment, cloud domain-joined in a hybrid environment, and BYOD).
+
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 – Allowed.
-
The default for this policy must be on for consumer devices (defined as local or Microsoft account connected device) and off for enterprise devices (such as cloud domain-joined, cloud domain-joined in an on-premise only environment, cloud domain-joined in a hybrid environment, and BYOD).
-
-
-
+
+
Footnote:
@@ -273,7 +302,7 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
## Authentication policies supported by Windows Holographic for Business
diff --git a/windows/client-management/mdm/policy-csp-autoplay.md b/windows/client-management/mdm/policy-csp-autoplay.md
index 0eeac9b230..ea02a39c19 100644
--- a/windows/client-management/mdm/policy-csp-autoplay.md
+++ b/windows/client-management/mdm/policy-csp-autoplay.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - Autoplay
@@ -15,7 +15,7 @@ ms.date: 11/01/2017
-
+
## Autoplay policies
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -66,15 +68,15 @@ ms.date: 11/01/2017
-
-
+
+
This policy setting disallows AutoPlay for MTP devices like cameras or phones.
If you enable this policy setting, AutoPlay is not allowed for MTP devices like cameras or phones.
If you disable or do not configure this policy setting, AutoPlay is enabled for non-volume devices.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -82,20 +84,22 @@ If you disable or do not configure this policy setting, AutoPlay is enabled for
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Disallow Autoplay for non-volume devices*
- GP name: *NoAutoplayfornonVolume*
- GP path: *Windows Components/AutoPlay Policies*
- GP ADMX file name: *AutoPlay.admx*
-
-
+
+
+
-
+
+
**Autoplay/SetDefaultAutoRunBehavior**
-
+
Home
@@ -117,8 +121,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -127,8 +131,8 @@ ADMX Info:
-
-
+
+
This policy setting sets the default behavior for Autorun commands.
Autorun commands are generally stored in autorun.inf files. They often launch the installation program or other routines.
@@ -144,7 +148,7 @@ b) Revert back to pre-Windows Vista behavior of automatically executing the auto
If you disable or not configure this policy setting, Windows Vista or later will prompt the user whether autorun command is to be run.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -152,20 +156,22 @@ If you disable or not configure this policy setting, Windows Vista or later will
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Set the default behavior for AutoRun*
- GP name: *NoAutorun*
- GP path: *Windows Components/AutoPlay Policies*
- GP ADMX file name: *AutoPlay.admx*
-
-
+
+
+
-
+
+
**Autoplay/TurnOffAutoPlay**
-
+
Home
@@ -187,8 +193,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -197,8 +203,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to turn off the Autoplay feature.
Autoplay begins reading from a drive as soon as you insert media in the drive. As a result, the setup file of programs and the music on audio media start immediately.
@@ -215,7 +221,7 @@ If you disable or do not configure this policy setting, AutoPlay is enabled.
Note: This policy setting appears in both the Computer Configuration and User Configuration folders. If the policy settings conflict, the policy setting in Computer Configuration takes precedence over the policy setting in User Configuration.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -223,15 +229,15 @@ Note: This policy setting appears in both the Computer Configuration and User Co
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Turn off Autoplay*
- GP name: *Autorun*
- GP path: *Windows Components/AutoPlay Policies*
- GP ADMX file name: *AutoPlay.admx*
-
-
+
+
Footnote:
@@ -240,5 +246,5 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
diff --git a/windows/client-management/mdm/policy-csp-bitlocker.md b/windows/client-management/mdm/policy-csp-bitlocker.md
index 9eb085531d..852a915bac 100644
--- a/windows/client-management/mdm/policy-csp-bitlocker.md
+++ b/windows/client-management/mdm/policy-csp-bitlocker.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - Bitlocker
@@ -15,7 +15,7 @@ ms.date: 11/01/2017
-
+
## Bitlocker policies
Specifies the BitLocker Drive Encryption method and cipher strength.
+
+
+Specifies the BitLocker Drive Encryption method and cipher strength.
> [!NOTE]
> XTS-AES 128-bit and XTS-AES 256-bit values are only supported on Windows 10 for desktop.
-
The following list shows the supported values:
-
-- 3 - AES-CBC 128-bit
-- 4 - AES-CBC 256-bit
-- 6 - XTS-AES 128-bit (Desktop only)
-- 7 - XTS-AES 256-bit (Desktop only)
-
-
You can find the following policies in BitLocker CSP:
+You can find the following policies in BitLocker CSP:
Specifies whether the device can send out Bluetooth advertisements.
+
+
+Specifies whether the device can send out Bluetooth advertisements.
-
The following list shows the supported values:
+If this is not set or it is deleted, the default value of 1 (Allow) is used.
+
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 – Not allowed. When set to 0, the device will not send out advertisements. To verify, use any Bluetooth LE app and enable it to do advertising. Then, verify that the advertisement is not received by the peripheral.
- 1 (default) – Allowed. When set to 1, the device will send out advertisements. To verify, use any Bluetooth LE app and enable it to do advertising. Then, verify that the advertisement is received by the peripheral.
-
If this is not set or it is deleted, the default value of 1 (Allow) is used.
+
+
-
Specifies whether other Bluetooth-enabled devices can discover the device.
+
+
+Specifies whether other Bluetooth-enabled devices can discover the device.
-
The following list shows the supported values:
+If this is not set or it is deleted, the default value of 1 (Allow) is used.
+
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 – Not allowed. When set to 0, other devices will not be able to detect the device. To verify, open the Bluetooth control panel on the device. Then, go to another Bluetooth-enabled device, open the Bluetooth control panel, and verify that you cannot see the name of the device.
- 1 (default) – Allowed. When set to 1, other devices will be able to detect the device. To verify, open the Bluetooth control panel on the device. Then, go to another Bluetooth-enabled device, open the Bluetooth control panel and verify that you can discover it.
-
If this is not set or it is deleted, the default value of 1 (Allow) is used.
+
+
-
Specifies whether to allow specific bundled Bluetooth peripherals to automatically pair with the host device.
+
+
+Specifies whether to allow specific bundled Bluetooth peripherals to automatically pair with the host device.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default)– Allowed.
-
-
+
+
+
Sets the local Bluetooth device name.
+
+
+Sets the local Bluetooth device name.
-
If this is set, the value that it is set to will be used as the Bluetooth device name. To verify the policy is set, open the Bluetooth control panel on the device. Then, go to another Bluetooth-enabled device, open the Bluetooth control panel, and verify that the value that was specified.
+If this is set, the value that it is set to will be used as the Bluetooth device name. To verify the policy is set, open the Bluetooth control panel on the device. Then, go to another Bluetooth-enabled device, open the Bluetooth control panel, and verify that the value that was specified.
-
If this policy is not set or it is deleted, the default local radio name is used.
+If this policy is not set or it is deleted, the default local radio name is used.
+
+
+
-
-
Set a list of allowable services and profiles. String hex formatted array of Bluetooth service UUIDs in canonical format, delimited by semicolons. For example, {782AFCFC-7CAA-436C-8BF0-78CD0FFBD4AF}.
+
+
+Set a list of allowable services and profiles. String hex formatted array of Bluetooth service UUIDs in canonical format, delimited by semicolons. For example, {782AFCFC-7CAA-436C-8BF0-78CD0FFBD4AF}.
-
The default value is an empty string.
+The default value is an empty string.
-
-
+
+
Footnote:
@@ -278,7 +294,7 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
## Bluetooth policies supported by Windows Holographic for Business
diff --git a/windows/client-management/mdm/policy-csp-browser.md b/windows/client-management/mdm/policy-csp-browser.md
index 190229dc56..9ffaf7854f 100644
--- a/windows/client-management/mdm/policy-csp-browser.md
+++ b/windows/client-management/mdm/policy-csp-browser.md
@@ -6,16 +6,18 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - Browser
+> [!WARNING]
+> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
+
## Browser policies
Added in Windows 10, version 1703. Specifies whether to allow the address bar drop-down functionality in Microsoft Edge. If you want to minimize network connections from Microsoft Edge to Microsoft services, we recommend disabling this functionality.
+
+
+Added in Windows 10, version 1703. Specifies whether to allow the address bar drop-down functionality in Microsoft Edge. If you want to minimize network connections from Microsoft Edge to Microsoft services, we recommend disabling this functionality.
> [!NOTE]
> Disabling this setting turns off the address bar drop-down functionality. Because search suggestions are shown in the drop-down list, this setting takes precedence over the Browser/AllowSearchSuggestionsinAddressBar setting.
-
The following list shows the supported values:
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 – Not allowed. Address bar drop-down is disabled, which also disables the user-defined setting, "Show search and site suggestions as I type."
- 1 (default) – Allowed. Address bar drop-down is enabled.
-
Specifies whether autofill on websites is allowed.
+
+
+Specifies whether autofill on websites is allowed.
-
The following list shows the supported values:
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
Most restricted value is 0.
-
-
To verify AllowAutofill is set to 0 (not allowed):
+
+
+To verify AllowAutofill is set to 0 (not allowed):
1. Open Microsoft Edge.
2. In the upper-right corner of the browser, click **…**.
3. Click **Settings** in the drop down list, and select **View Advanced Settings**.
4. Verify the setting **Save form entries** is greyed out.
-
-
+
+
+
-
+
+
**Browser/AllowBrowser**
-
+
Home
@@ -263,8 +283,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -273,30 +293,34 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop. For desktop devices, use the [AppLocker CSP](applocker-csp.md) instead.
-
Specifies whether the browser is allowed on the device.
+Specifies whether the browser is allowed on the device.
-
The following list shows the supported values:
+Most restricted value is 0.
+
+When this policy is set to 0 (not allowed), the Microsoft Edge for Windows 10 Mobile tile will appear greyed out, and clicking on the tile will display a message indicating theat Internet browsing has been disabled by your administrator.
+
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
Most restricted value is 0.
+
+
-
When this policy is set to 0 (not allowed), the Microsoft Edge for Windows 10 Mobile tile will appear greyed out, and clicking on the tile will display a message indicating theat Internet browsing has been disabled by your administrator.
-
-
-
Specifies whether cookies are allowed.
+
+
+Specifies whether cookies are allowed.
-
The following list shows the supported values:
+
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
Most restricted value is 0.
-
-
To verify AllowCookies is set to 0 (not allowed):
+
+
+To verify AllowCookies is set to 0 (not allowed):
1. Open Microsoft Edge or Microsoft Edge for Windows 10 Mobile.
2. In the upper-right corner of the browser, click **…**.
3. Click **Settings** in the drop down list, and select **View Advanced Settings**.
4. Verify the setting **Cookies** is greyed out.
-
-
+
+
+
-
+
+
**Browser/AllowDeveloperTools**
-
+
Home
@@ -374,8 +405,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -384,28 +415,32 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop and not supported in Windows 10 Mobile.
-
Specifies whether employees can use F12 Developer Tools on Microsoft Edge. Turning this setting on, or not configuring it, lets employees use F12 Developer Tools. Turning this setting off stops employees from using F12 Developer Tools.
+Specifies whether employees can use F12 Developer Tools on Microsoft Edge. Turning this setting on, or not configuring it, lets employees use F12 Developer Tools. Turning this setting off stops employees from using F12 Developer Tools.
-
The following list shows the supported values:
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
Specifies whether Do Not Track headers are allowed.
+
+
+Specifies whether Do Not Track headers are allowed.
-
The following list shows the supported values:
+Most restricted value is 1.
+
+
+
+The following list shows the supported values:
- 0 (default) – Not allowed.
- 1 – Allowed.
-
Most restricted value is 1.
-
-
To verify AllowDoNotTrack is set to 0 (not allowed):
+
+
+To verify AllowDoNotTrack is set to 0 (not allowed):
1. Open Microsoft Edge or Microsoft Edge for Windows 10 Mobile.
2. In the upper-right corner of the browser, click **…**.
3. Click **Settings** in the drop down list, and select **View Advanced Settings**.
4. Verify the setting **Send Do Not Track requests** is greyed out.
-
-
+
+
+
Added in Windows 10, version 1607. Specifies whether Microsoft Edge extensions are allowed.
+
+
+Added in Windows 10, version 1607. Specifies whether Microsoft Edge extensions are allowed.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
-
+
+
+
Added in Windows 10. Specifies whether Adobe Flash can run in Microsoft Edge.
+
+
+Added in Windows 10. Specifies whether Adobe Flash can run in Microsoft Edge.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
-
+
+
+
Added in Windows 10, version 1703. Specifies whether users must take an action, such as clicking the content or a Click-to-Run button, before seeing content in Adobe Flash.
+
+
+Added in Windows 10, version 1703. Specifies whether users must take an action, such as clicking the content or a Click-to-Run button, before seeing content in Adobe Flash.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – Adobe Flash content is automatically loaded and run by Microsoft Edge.
- 1 (default) – Users must click the content, click a Click-to-Run button, or have the site appear on an auto-allow list before Microsoft Edge loads and runs Adobe Flash content.
-
-
+
+
+
Specifies whether InPrivate browsing is allowed on corporate networks.
+
+
+Specifies whether InPrivate browsing is allowed on corporate networks.
-
The following list shows the supported values:
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
Added in Windows 10, version 1703. Specifies whether to use the Microsoft compatibility list in Microsoft Edge. The Microsoft compatibility list is a Microsoft-provided list that enables sites with known compatibility issues to display properly.
+
+
+Added in Windows 10, version 1703. Specifies whether to use the Microsoft compatibility list in Microsoft Edge. The Microsoft compatibility list is a Microsoft-provided list that enables sites with known compatibility issues to display properly.
By default, the Microsoft compatibility list is enabled and can be viewed by visiting "about:compat".
-
If you enable or don’t configure this setting, Microsoft Edge periodically downloads the latest version of the compatibility list from Microsoft, applying the updates during browser navigation. Visiting any site on the compatibility list prompts the employee to use Internet Explorer 11 (or enables/disables certain browser features on mobile), where the site is automatically rendered as though it’s run in the version of Internet Explorer necessary for it to display properly. If you disable this setting, the compatibility list isn’t used during browser navigation.
+If you enable or don’t configure this setting, Microsoft Edge periodically downloads the latest version of the compatibility list from Microsoft, applying the updates during browser navigation. Visiting any site on the compatibility list prompts the employee to use Internet Explorer 11 (or enables/disables certain browser features on mobile), where the site is automatically rendered as though it’s run in the version of Internet Explorer necessary for it to display properly. If you disable this setting, the compatibility list isn’t used during browser navigation.
-
The following list shows the supported values:
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 – Not enabled.
- 1 (default) – Enabled.
-
Most restricted value is 0.
+
+
-
-
-
+
+
**Browser/AllowPasswordManager**
-
+
Home
@@ -725,8 +786,8 @@ By default, the Microsoft compatibility list is enabled and can be viewed by vis
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -735,31 +796,37 @@ By default, the Microsoft compatibility list is enabled and can be viewed by vis
-
-
-
Specifies whether saving and managing passwords locally on the device is allowed.
+
+
+Specifies whether saving and managing passwords locally on the device is allowed.
-
The following list shows the supported values:
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
Most restricted value is 0.
-
-
To verify AllowPasswordManager is set to 0 (not allowed):
+
+
+To verify AllowPasswordManager is set to 0 (not allowed):
1. Open Microsoft Edge or Microsoft Edge for Windows 10 Mobile.
2. In the upper-right corner of the browser, click **…**.
3. Click **Settings** in the drop down list, and select **View Advanced Settings**.
4. Verify the settings **Offer to save password** and **Manage my saved passwords** are greyed out.
-
-
+
+
+
-
+
+
**Browser/AllowPopups**
-
+
Home
@@ -781,8 +848,8 @@ By default, the Microsoft compatibility list is enabled and can be viewed by vis
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -791,31 +858,37 @@ By default, the Microsoft compatibility list is enabled and can be viewed by vis
-
-
-
Specifies whether pop-up blocker is allowed or enabled.
+
+
+Specifies whether pop-up blocker is allowed or enabled.
-
The following list shows the supported values:
+Most restricted value is 1.
+
+
+
+The following list shows the supported values:
- 0 (default) – Pop-up blocker is not allowed. It means that pop-up browser windows are allowed.
- 1 – Pop-up blocker is allowed or enabled. It means that pop-up browser windows are blocked.
-
Most restricted value is 1.
-
-
To verify AllowPopups is set to 0 (not allowed):
+
+
+To verify AllowPopups is set to 0 (not allowed):
1. Open Microsoft Edge.
2. In the upper-right corner of the browser, click **…**.
3. Click **Settings** in the drop down list, and select **View Advanced Settings**.
4. Verify the setting **Block pop-ups** is greyed out.
-
-
+
+
+
@@ -837,8 +910,8 @@ By default, the Microsoft compatibility list is enabled and can be viewed by vis
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -847,26 +920,30 @@ By default, the Microsoft compatibility list is enabled and can be viewed by vis
-
-
-
Added in Windows 10, version 1703. Allows search engine customization for MDM-enrolled devices. Users can change their default search engine.
+
+
+Added in Windows 10, version 1703. Allows search engine customization for MDM-enrolled devices. Users can change their default search engine.
-
If this setting is turned on or not configured, users can add new search engines and change the default used in the address bar from within Microsoft Edge settings. If this setting is disabled, users will be unable to add search engines or change the default used in the address bar. This policy applies only on domain-joined machines or when the device is MDM-enrolled. For more information, see Microsoft browser extension policy (aka.ms/browserpolicy).
+If this setting is turned on or not configured, users can add new search engines and change the default used in the address bar from within Microsoft Edge settings. If this setting is disabled, users will be unable to add search engines or change the default used in the address bar. This policy applies only on domain-joined machines or when the device is MDM-enrolled. For more information, see Microsoft browser extension policy (aka.ms/browserpolicy).
-
The following list shows the supported values:
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
@@ -888,8 +965,8 @@ By default, the Microsoft compatibility list is enabled and can be viewed by vis
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -898,24 +975,28 @@ By default, the Microsoft compatibility list is enabled and can be viewed by vis
-
-
-
Specifies whether search suggestions are allowed in the address bar.
+
+
+Specifies whether search suggestions are allowed in the address bar.
-
The following list shows the supported values:
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
Most restricted value is 0.
+
+
-
-
-
+
+
**Browser/AllowSmartScreen**
-
+
Home
@@ -937,8 +1018,8 @@ By default, the Microsoft compatibility list is enabled and can be viewed by vis
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -947,31 +1028,60 @@ By default, the Microsoft compatibility list is enabled and can be viewed by vis
-
-
-
Specifies whether Windows Defender SmartScreen is allowed.
+
+
+Specifies whether Windows Defender SmartScreen is allowed.
-
The following list shows the supported values:
+Most restricted value is 1.
+
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
Most restricted value is 1.
-
-
To verify AllowSmartScreen is set to 0 (not allowed):
+
+
+To verify AllowSmartScreen is set to 0 (not allowed):
1. Open Microsoft Edge or Microsoft Edge for Windows 10 Mobile.
2. In the upper-right corner of the browser, click **…**.
3. Click **Settings** in the drop down list, and select **View Advanced Settings**.
4. Verify the setting **Help protect me from malicious sites and download with SmartScreen Filter** is greyed out.
-
-
+
+
+
-
+
+
**Browser/AlwaysEnableBooksLibrary**
-
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -980,19 +1090,26 @@ By default, the Microsoft compatibility list is enabled and can be viewed by vis
-
-
-
+
+
+Added in Windows 10, next majot update. Always show the Books Library in Microsoft Edge
-
This is only a placeholder.
+
+
+The following list shows the supported values:
+
+- 0 (default) - Disable. Use default visibility of the Books Library. The Library will be only visible in countries or regions where it’s available.
+- 1 - Enable. Always show the Books Library, regardless of countries or region of activation.
+
+
+
-
-
-
+
+
**Browser/ClearBrowsingDataOnExit**
-
+
Home
@@ -1014,8 +1131,8 @@ By default, the Microsoft compatibility list is enabled and can be viewed by vis
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1024,30 +1141,36 @@ By default, the Microsoft compatibility list is enabled and can be viewed by vis
-
-
-
Added in Windows 10, version 1703. Specifies whether to clear browsing data on exiting Microsoft Edge.
+
+
+Added in Windows 10, version 1703. Specifies whether to clear browsing data on exiting Microsoft Edge.
-
The following list shows the supported values:
+Most restricted value is 1.
+
+
+
+The following list shows the supported values:
- 0 – (default) Browsing data is not cleared on exit. The type of browsing data to clear can be configured by the employee in the Clear browsing data options under Settings.
- 1 – Browsing data is cleared on exit.
-
Most restricted value is 1.
-
-
To verify that browsing data is cleared on exit (ClearBrowsingDataOnExit is set to 1):
+
+
+To verify that browsing data is cleared on exit (ClearBrowsingDataOnExit is set to 1):
1. Open Microsoft Edge and browse to websites.
2. Close the Microsoft Edge window.
3. Open Microsoft Edge and start typing the same URL in address bar. Verify that it does not auto-complete from history.
-
-
+
+
+
@@ -1069,8 +1192,8 @@ By default, the Microsoft compatibility list is enabled and can be viewed by vis
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1079,32 +1202,37 @@ By default, the Microsoft compatibility list is enabled and can be viewed by vis
-
-
-
Added in Windows 10, version 1703. Allows you to add up to 5 additional search engines for MDM-enrolled devices.
+
+
+Added in Windows 10, version 1703. Allows you to add up to 5 additional search engines for MDM-enrolled devices.
-
If this policy is enabled, you can add up to 5 additional search engines for your employees. For each additional search engine you want to add, specify a link to the OpenSearch XML file that contains, at a minimum, the short name and the URL template (HTTPS) of the search engine. For more information about creating the OpenSearch XML file, see [Search provider discovery](https://developer.microsoft.com/en-us/microsoft-edge/platform/documentation/dev-guide/browser/search-provider-discovery/).
+If this policy is enabled, you can add up to 5 additional search engines for your employees. For each additional search engine you want to add, specify a link to the OpenSearch XML file that contains, at a minimum, the short name and the URL template (HTTPS) of the search engine. For more information about creating the OpenSearch XML file, see [Search provider discovery](https://developer.microsoft.com/en-us/microsoft-edge/platform/documentation/dev-guide/browser/search-provider-discovery/).
Employees cannot remove these search engines, but they can set any one as the default. This setting does not affect the default search engine.
-
If this setting is not configured, the search engines used are the ones that are specified in the App settings. If this setting is disabled, the search engines you added will be deleted from your employee's machine.
+If this setting is not configured, the search engines used are the ones that are specified in the App settings. If this setting is disabled, the search engines you added will be deleted from your employee's machine.
> [!IMPORTANT]
> Due to Protected Settings (aka.ms/browserpolicy), this setting will apply only on domain-joined machines or when the device is MDM-enrolled.
-
The following list shows the supported values:
+
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 (default) – Additional search engines are not allowed.
- 1 – Additional search engines are allowed.
-
Most restricted value is 0.
+
+
-
-
-
+
+
**Browser/DisableLockdownOfStartPages**
-
+
Home
@@ -1126,8 +1254,8 @@ Employees cannot remove these search engines, but they can set any one as the de
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1136,9 +1264,9 @@ Employees cannot remove these search engines, but they can set any one as the de
-
-
-
Added in Windows 10, version 1703. Boolean value that specifies whether the lockdown on the Start pages is disabled. This policy works with the Browser/HomePages policy, which locks down the Start pages that the users cannot modify. You can use the DisableLockdownOfStartPages policy to allow users to modify the Start pages when the Browser/HomePages policy is in effect.
+
+
+Added in Windows 10, version 1703. Boolean value that specifies whether the lockdown on the Start pages is disabled. This policy works with the Browser/HomePages policy, which locks down the Start pages that the users cannot modify. You can use the DisableLockdownOfStartPages policy to allow users to modify the Start pages when the Browser/HomePages policy is in effect.
> [!NOTE]
> This policy has no effect when the Browser/HomePages policy is not configured.
@@ -1146,20 +1274,77 @@ Employees cannot remove these search engines, but they can set any one as the de
> [!IMPORTANT]
> This setting can be used only with domain-joined or MDM-enrolled devices. For more information, see the Microsoft browser extension policy (aka.ms/browserpolicy).
-
The following list shows the supported values:
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 (default) – Enable lockdown of the Start pages according to the settings specified in the Browser/HomePages policy. Users cannot change the Start pages.
-- 1 – Disable lockdown of the Start pages and allow users to modify them.
+- 1 – Disable lockdown of the Start pages and allow users to modify them.
-
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
+
+This policy setting lets you decide how much data to send to Microsoft about the book you're reading from the Books tab in Microsoft Edge.
+
+If you enable this setting, Microsoft Edge sends additional diagnostic data, on top of the basic diagnostic data, from the Books tab. If you disable or don't configure this setting, Microsoft Edge only sends basic diagnostic data, depending on your device configuration.
+
+
+
+The following list shows the supported values:
+
+- 0 (default) - Disable. No additional diagnostic data.
+- 1 - Enable. Additional diagnostic data for schools.
+
+
+
+
+
+
+
**Browser/EnterpriseModeSiteList**
-
+
Home
@@ -1181,8 +1366,8 @@ Employees cannot remove these search engines, but they can set any one as the de
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1191,26 +1376,30 @@ Employees cannot remove these search engines, but they can set any one as the de
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop and not supported in Windows 10 Mobile.
-
Allows the user to specify an URL of an enterprise site list.
+Allows the user to specify an URL of an enterprise site list.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- Not configured. The device checks for updates from Microsoft Update.
- Set to a URL location of the enterprise site list.
-
-
+
+
+
@@ -1232,8 +1421,8 @@ Employees cannot remove these search engines, but they can set any one as the de
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1242,18 +1431,20 @@ Employees cannot remove these search engines, but they can set any one as the de
-
-
+
+
> [!IMPORTANT]
> This policy (introduced in Windows 10, version 1507) was deprecated in Windows 10, version 1511 by [Browser/EnterpriseModeSiteList](#browser-enterprisemodesitelist).
-
-
+
+
+
-
+
+
**Browser/FirstRunURL**
-
+
Home
@@ -1275,8 +1466,8 @@ Employees cannot remove these search engines, but they can set any one as the de
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1285,25 +1476,27 @@ Employees cannot remove these search engines, but they can set any one as the de
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
-
Specifies the URL that Microsoft Edge for Windows 10 Mobile. will use when it is opened the first time.
+Specifies the URL that Microsoft Edge for Windows 10 Mobile. will use when it is opened the first time.
-
The data type is a string.
+The data type is a string.
-
The default value is an empty string. Otherwise, the string should contain the URL of the webpage users will see the first time Microsoft Edge is run. For example, “contoso.com”.
+The default value is an empty string. Otherwise, the string should contain the URL of the webpage users will see the first time Microsoft Edge is run. For example, “contoso.com”.
+
+
+
-
-
-
+
+
**Browser/HomePages**
-
+
Home
@@ -1325,8 +1518,8 @@ Employees cannot remove these search engines, but they can set any one as the de
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1335,27 +1528,29 @@ Employees cannot remove these search engines, but they can set any one as the de
-
-
+
+
> [!NOTE]
> This policy is only available for Windows 10 for desktop and not supported in Windows 10 Mobile.
-
Specifies your Start pages for MDM-enrolled devices. Turning this setting on lets you configure one or more corporate Start pages. If this setting is turned on, you must also include URLs to the pages, separating multiple pages by using the XML-escaped characters **<** and **>**. For example, "<support.contoso.com><support.microsoft.com>"
+Specifies your Start pages for MDM-enrolled devices. Turning this setting on lets you configure one or more corporate Start pages. If this setting is turned on, you must also include URLs to the pages, separating multiple pages by using the XML-escaped characters **<** and **>**. For example, "<support.contoso.com><support.microsoft.com>"
-
Starting in Windows 10, version 1607, this policy will be enforced so that the Start pages specified by this policy cannot be changed by the users.
+Starting in Windows 10, version 1607, this policy will be enforced so that the Start pages specified by this policy cannot be changed by the users.
-
Starting in Windows 10, version 1703, if you don’t want to send traffic to Microsoft, you can use the "<about:blank>" value, which is honored for both domain- and non-domain-joined machines, when it’s the only configured URL.
+Starting in Windows 10, version 1703, if you don’t want to send traffic to Microsoft, you can use the "<about:blank>" value, which is honored for both domain- and non-domain-joined machines, when it’s the only configured URL.
> [!NOTE]
> Turning this setting off, or not configuring it, sets your default Start pages to the webpages specified in App settings.
-
-
+
+
+
-
+
+
**Browser/LockdownFavorites**
-
+
Home
@@ -1377,8 +1572,8 @@ Employees cannot remove these search engines, but they can set any one as the de
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1387,31 +1582,35 @@ Employees cannot remove these search engines, but they can set any one as the de
-
-
-
Added in Windows 10, version 1709. This policy setting lets you decide whether employees can add, import, sort, or edit the Favorites list on Microsoft Edge.
+
+
+Added in Windows 10, version 1709. This policy setting lets you decide whether employees can add, import, sort, or edit the Favorites list on Microsoft Edge.
-
If you enable this setting, employees won't be able to add, import, or change anything in the Favorites list. Also as part of this, Save a Favorite, Import settings, and the context menu items (such as, Create a new folder) are all turned off.
+If you enable this setting, employees won't be able to add, import, or change anything in the Favorites list. Also as part of this, Save a Favorite, Import settings, and the context menu items (such as, Create a new folder) are all turned off.
> [!Important]
> Don't enable both this setting and the Keep favorites in sync between Internet Explorer and Microsoft Edge setting. Enabling both settings stops employees from syncing their favorites between Internet Explorer and Microsoft Edge.
-
-
0 - Disabled. Do not lockdown Favorites.
-
1 - Enabled. Lockdown Favorites.
-
+If you disable or don't configure this setting (default), employees can add, import and make changes to the Favorites list.
-
If you disable or don't configure this setting (default), employees can add, import and make changes to the Favorites list.
+Data type is integer.
-
Data type is integer.
+
+
+The following list shows the supported values:
+
+- 0 - Disabled. Do not lockdown Favorites.
+- 1 - Enabled. Lockdown Favorites.
+
+
+
-
-
@@ -1433,8 +1632,8 @@ Employees cannot remove these search engines, but they can set any one as the de
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1443,22 +1642,26 @@ Employees cannot remove these search engines, but they can set any one as the de
-
-
-
Specifies whether users can access the about:flags page, which is used to change developer settings and to enable experimental features.
+
+
+Specifies whether users can access the about:flags page, which is used to change developer settings and to enable experimental features.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 (default) – Users can access the about:flags page in Microsoft Edge.
- 1 – Users can't access the about:flags page in Microsoft Edge.
-
-
+
+
+
-
+
+
**Browser/PreventFirstRunPage**
-
+
Home
@@ -1480,8 +1683,8 @@ Employees cannot remove these search engines, but they can set any one as the de
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1490,24 +1693,28 @@ Employees cannot remove these search engines, but they can set any one as the de
-
-
-
Added in Windows 10, version 1703. Specifies whether to enable or disable the First Run webpage. On the first explicit user-launch of Microsoft Edge, a First Run webpage hosted on Microsoft.com opens automatically via a FWLINK. This policy allows enterprises (such as those enrolled in a zero-emissions configuration) to prevent this page from opening.
+
+
+Added in Windows 10, version 1703. Specifies whether to enable or disable the First Run webpage. On the first explicit user-launch of Microsoft Edge, a First Run webpage hosted on Microsoft.com opens automatically via a FWLINK. This policy allows enterprises (such as those enrolled in a zero-emissions configuration) to prevent this page from opening.
-
The following list shows the supported values:
+Most restricted value is 1.
+
+
+
+The following list shows the supported values:
- 0 (default) – Employees see the First Run webpage.
- 1 – Employees don't see the First Run webpage.
-
@@ -1529,8 +1736,8 @@ Employees cannot remove these search engines, but they can set any one as the de
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1539,24 +1746,28 @@ Employees cannot remove these search engines, but they can set any one as the de
-
-
-
Added in Windows 10, version 1703. Specifies whether Microsoft can collect information to create a Live Tile when pinning a site to Start from Microsoft Edge.
+
+
+Added in Windows 10, version 1703. Specifies whether Microsoft can collect information to create a Live Tile when pinning a site to Start from Microsoft Edge.
-
The following list shows the supported values:
+Most restricted value is 1.
+
+
+
+The following list shows the supported values:
- 0 (default) – Microsoft servers will be contacted if a site is pinned to Start from Microsoft Edge.
- 1 – Microsoft servers will not be contacted if a site is pinned to Start from Microsoft Edge.
-
@@ -1578,8 +1789,8 @@ Employees cannot remove these search engines, but they can set any one as the de
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1588,24 +1799,28 @@ Employees cannot remove these search engines, but they can set any one as the de
-
-
-
Specifies whether users can override the Windows Defender SmartScreen Filter warnings about potentially malicious websites.
+
+
+Specifies whether users can override the Windows Defender SmartScreen Filter warnings about potentially malicious websites.
-
The following list shows the supported values:
+Turning this setting on stops users from ignoring the Windows Defender SmartScreen Filter warnings and blocks them from going to the site. Turning this setting off, or not configuring it, lets users ignore the Windows Defender SmartScreen Filter warnings about potentially malicious websites and to continue to the site.
+
+
+
+The following list shows the supported values:
- 0 (default) – Off.
- 1 – On.
-
Turning this setting on stops users from ignoring the Windows Defender SmartScreen Filter warnings and blocks them from going to the site. Turning this setting off, or not configuring it, lets users ignore the Windows Defender SmartScreen Filter warnings about potentially malicious websites and to continue to the site.
+
+
-
-
@@ -1627,8 +1842,8 @@ Employees cannot remove these search engines, but they can set any one as the de
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1637,22 +1852,26 @@ Employees cannot remove these search engines, but they can set any one as the de
-
-
-
Specifies whether users can override the Windows Defender SmartScreen Filter warnings about downloading unverified files. Turning this setting on stops users from ignoring the Windows Defender SmartScreen Filter warnings and blocks them from downloading unverified files. Turning this setting off, or not configuring it, lets users ignore the Windows Defender SmartScreen Filter warnings about unverified files and lets them continue the download process.
+
+
+Specifies whether users can override the Windows Defender SmartScreen Filter warnings about downloading unverified files. Turning this setting on stops users from ignoring the Windows Defender SmartScreen Filter warnings and blocks them from downloading unverified files. Turning this setting off, or not configuring it, lets users ignore the Windows Defender SmartScreen Filter warnings about unverified files and lets them continue the download process.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 (default) – Off.
- 1 – On.
-
-
+
+
+
@@ -1674,8 +1893,8 @@ Employees cannot remove these search engines, but they can set any one as the de
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1684,26 +1903,30 @@ Employees cannot remove these search engines, but they can set any one as the de
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop and not supported in Windows 10 Mobile.
-
Specifies whether a user's localhost IP address is displayed while making phone calls using the WebRTC protocol. Turning this setting on hides an user’s localhost IP address while making phone calls using WebRTC. Turning this setting off, or not configuring it, shows an
user’s localhost IP address while making phone calls using WebRTC.
+Specifies whether a user's localhost IP address is displayed while making phone calls using the WebRTC protocol. Turning this setting on hides an user’s localhost IP address while making phone calls using WebRTC. Turning this setting off, or not configuring it, shows an user’s localhost IP address while making phone calls using WebRTC.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 (default) – The localhost IP address is shown.
- 1 – The localhost IP address is hidden.
-
-
+
+
+
-
+
+
**Browser/ProvisionFavorites**
-
+
Home
@@ -1725,8 +1948,8 @@ Employees cannot remove these search engines, but they can set any one as the de
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1735,11 +1958,11 @@ Employees cannot remove these search engines, but they can set any one as the de
-
-
-
Added in Windows 10, version 1709. This policy setting allows you to configure a default set of favorites, which will appear for employees. Employees cannot modify, sort, move, export or delete these provisioned favorites. Specify the URL which points to the file that has all the data for provisioning favorites (in html format). You can export a set of favorites from Edge and use that html file for provisioning user machines.
+
+
+Added in Windows 10, version 1709. This policy setting allows you to configure a default set of favorites, which will appear for employees. Employees cannot modify, sort, move, export or delete these provisioned favorites. Specify the URL which points to the file that has all the data for provisioning favorites (in html format). You can export a set of favorites from Edge and use that html file for provisioning user machines.
-
URL can be specified as:
+URL can be specified as:
- HTTP location: "SiteList"="http://localhost:8080/URLs.html"
- Local network: "SiteList"="\\network\shares\URLs.html"
@@ -1748,17 +1971,19 @@ Employees cannot remove these search engines, but they can set any one as the de
> [!Important]
> Don't enable both this setting and the Keep favorites in sync between Internet Explorer and Microsoft Edge setting. Enabling both settings stops employees from syncing their favorites between Internet Explorer and Microsoft Edge.
-
If you disable or don't configure this setting, employees will see the favorites they set in the Hub and Favorites Bar.
+If you disable or don't configure this setting, employees will see the favorites they set in the Hub and Favorites Bar.
-
Data type is string.
+Data type is string.
+
+
+
-
-
@@ -1780,8 +2005,8 @@ Employees cannot remove these search engines, but they can set any one as the de
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1790,28 +2015,32 @@ Employees cannot remove these search engines, but they can set any one as the de
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop and not supported in Windows 10 Mobile.
-
Specifies whether to send intranet traffic over to Internet Explorer.
+Specifies whether to send intranet traffic over to Internet Explorer.
-
The following list shows the supported values:
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 (default) – Intranet traffic is sent to Internet Explorer.
- 1 – Intranet traffic is sent to Microsoft Edge.
-
Most restricted value is 0.
+
+
-
-
-
+
+
**Browser/SetDefaultSearchEngine**
-
+
Home
@@ -1833,8 +2062,8 @@ Employees cannot remove these search engines, but they can set any one as the de
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1843,31 +2072,36 @@ Employees cannot remove these search engines, but they can set any one as the de
-
-
-
Added in Windows 10, version 1703. Allows you configure the default search engine for your employees. By default, your employees can change the default search engine at any time. If you want to prevent your employees from changing the default search engine that you set, you can do so by configuring the AllowSearchEngineCustomization policy.
+
+
+Added in Windows 10, version 1703. Allows you configure the default search engine for your employees. By default, your employees can change the default search engine at any time. If you want to prevent your employees from changing the default search engine that you set, you can do so by configuring the AllowSearchEngineCustomization policy.
-
You must specify a link to the OpenSearch XML file that contains, at a minimum, the short name and the URL template (HTTPS) of the search engine. For more information about creating the OpenSearch XML file, see [Search provider discovery](https://developer.microsoft.com/en-us/microsoft-edge/platform/documentation/dev-guide/browser/search-provider-discovery/). If you want your employees to use the Microsoft Edge factory settings for the default search engine for their market, set the string EDGEDEFAULT; otherwise, if you want your employees to use Bing as the default search engine, set the string EDGEBING.
+You must specify a link to the OpenSearch XML file that contains, at a minimum, the short name and the URL template (HTTPS) of the search engine. For more information about creating the OpenSearch XML file, see [Search provider discovery](https://developer.microsoft.com/en-us/microsoft-edge/platform/documentation/dev-guide/browser/search-provider-discovery/). If you want your employees to use the Microsoft Edge factory settings for the default search engine for their market, set the string EDGEDEFAULT; otherwise, if you want your employees to use Bing as the default search engine, set the string EDGEBING.
-
If this setting is not configured, the default search engine is set to the one specified in App settings and can be changed by your employees. If this setting is disabled, the policy-set search engine will be removed, and, if it is the current default, the default will be set back to the factory Microsoft Edge search engine for the market.
+If this setting is not configured, the default search engine is set to the one specified in App settings and can be changed by your employees. If this setting is disabled, the policy-set search engine will be removed, and, if it is the current default, the default will be set back to the factory Microsoft Edge search engine for the market.
> [!IMPORTANT]
> This setting can be used only with domain-joined or MDM-enrolled devices. For more information, see the Microsoft browser extension policy (aka.ms/browserpolicy).
-
The following list shows the supported values:
+
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 (default) - The default search engine is set to the one specified in App settings.
- 1 - Allows you to configure the default search engine for your employees.
-
@@ -1889,8 +2123,8 @@ Employees cannot remove these search engines, but they can set any one as the de
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1899,28 +2133,32 @@ Employees cannot remove these search engines, but they can set any one as the de
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop and not supported in Windows 10 Mobile.
-
Added in Windows 10, version 1607. Specifies whether users should see a full interstitial page in Microsoft Edge when opening sites that are configured to open in Internet Explorer using the Enterprise Site List.
+Added in Windows 10, version 1607. Specifies whether users should see a full interstitial page in Microsoft Edge when opening sites that are configured to open in Internet Explorer using the Enterprise Site List.
-
The following list shows the supported values:
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 (default) – Interstitial pages are not shown.
- 1 – Interstitial pages are shown.
-
@@ -1942,8 +2180,8 @@ Employees cannot remove these search engines, but they can set any one as the de
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1952,21 +2190,25 @@ Employees cannot remove these search engines, but they can set any one as the de
-
-
-
Added in Windows 10, version 1703. Specifies whether favorites are kept in sync between Internet Explorer and Microsoft Edge. Changes to favorites in one browser are reflected in the other, including: additions, deletions, modifications, and ordering.
+
+
+Added in Windows 10, version 1703. Specifies whether favorites are kept in sync between Internet Explorer and Microsoft Edge. Changes to favorites in one browser are reflected in the other, including: additions, deletions, modifications, and ordering.
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop and not supported in Windows 10 Mobile.
>
> Enabling this setting stops Microsoft Edge favorites from syncing between connected Windows 10 devices.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 (default) – Synchronization is off.
- 1 – Synchronization is on.
-
To verify that favorites are in synchronized between Internet Explorer and Microsoft Edge:
+
+
+To verify that favorites are in synchronized between Internet Explorer and Microsoft Edge:
Open Internet Explorer and add some favorites.
@@ -1974,8 +2216,59 @@ Employees cannot remove these search engines, but they can set any one as the de
Verify that the favorites added to Internet Explorer show up in the favorites list in Microsoft Edge.
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
+
+This setting specifies whether organizations should use a folder shared across users to store books from the Books Library.
+
+
+
+The following list shows the supported values:
+
+- 0 - No shared folder.
+- 1 - Use a shared folder.
+
+
+
Footnote:
@@ -1984,7 +2277,7 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
## Browser policies that can be set using Exchange Active Sync (EAS)
diff --git a/windows/client-management/mdm/policy-csp-camera.md b/windows/client-management/mdm/policy-csp-camera.md
index bade8a1989..635f9d4118 100644
--- a/windows/client-management/mdm/policy-csp-camera.md
+++ b/windows/client-management/mdm/policy-csp-camera.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - Camera
@@ -15,7 +15,7 @@ ms.date: 11/01/2017
-
+
## Camera policies
Disables or enables the camera.
+
+
+Disables or enables the camera.
-
The following list shows the supported values:
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
Most restricted value is 0.
-
-
-
+
+
Footnote:
@@ -80,7 +84,7 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
## Camera policies that can be set using Exchange Active Sync (EAS)
diff --git a/windows/client-management/mdm/policy-csp-cellular.md b/windows/client-management/mdm/policy-csp-cellular.md
index b070a9305e..33931f6aa7 100644
--- a/windows/client-management/mdm/policy-csp-cellular.md
+++ b/windows/client-management/mdm/policy-csp-cellular.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/16/2017
+ms.date: 01/30/2018
---
# Policy CSP - Cellular
@@ -15,7 +15,7 @@ ms.date: 11/16/2017
-
+
## Cellular policies
-
-
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
Added in Windows 10, version 1709. This policy setting specifies whether Windows apps can access cellular data.
You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
@@ -78,19 +89,23 @@ If you disable or do not configure this policy setting, employees in your organi
If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.”
-Suported values:
+
+
+The following list shows the supported values:
- 0 - User is in control
- 1 - Force Allow
- 2 - Force Deny
-
-
-
+
+
+
+
-
+
+
**Cellular/LetAppsAccessCellularData_ForceAllowTheseApps**
-
+
Home
@@ -112,101 +127,8 @@ Suported values:
-
-
-Added in Windows 10, version 1709. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to cellular data. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. Value type is string.
-
-
-
-
-**Cellular/LetAppsAccessCellularData_ForceDenyTheseApps**
-
-
-
-
-
Home
-
Pro
-
Business
-
Enterprise
-
Education
-
Mobile
-
Mobile Enterprise
-
-
-
3
-
3
-
3
-
3
-
3
-
-
-
-
-
-
-
-Added in Windows 10, version 1709. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to cellular data. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. Value type is string.
-
-
-
-
-**Cellular/LetAppsAccessCellularData_UserInControlOfTheseApps**
-
-
-
-
-
Home
-
Pro
-
Business
-
Enterprise
-
Education
-
Mobile
-
Mobile Enterprise
-
-
-
3
-
3
-
3
-
3
-
3
-
-
-
-
-
-
-
-Added in Windows 10, version 1709. List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the cellular data access setting for the listed apps. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. Value type is string.
-
-
-
-
-**Cellular/ShowAppCellularAccessUI**
-
-
-
-
-
Home
-
Pro
-
Business
-
Enterprise
-
Education
-
Mobile
-
Mobile Enterprise
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -214,8 +136,137 @@ Added in Windows 10, version 1709. List of semi-colon delimited Package Family N
-
-
+
+
+Added in Windows 10, version 1709. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to cellular data. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. Value type is string.
+
+
+
+
+
+
+
+**Cellular/LetAppsAccessCellularData_ForceDenyTheseApps**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
3
+
3
+
3
+
3
+
3
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Added in Windows 10, version 1709. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to cellular data. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. Value type is string.
+
+
+
+
+
+
+
+**Cellular/LetAppsAccessCellularData_UserInControlOfTheseApps**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
3
+
3
+
3
+
3
+
3
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Added in Windows 10, version 1709. List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the cellular data access setting for the listed apps. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. Value type is string.
+
+
+
+
+
+
+
+**Cellular/ShowAppCellularAccessUI**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
This policy setting configures the visibility of the link to the per-application cellular access control page in the cellular setting UX.
If this policy setting is enabled, a drop-down list box presenting possible values will be active. Select "Hide" or "Show" to hide or show the link to the per-application cellular access control page.
@@ -226,7 +277,8 @@ Supported values:
- 0 - Hide
- 1 - Show
-
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -234,15 +286,15 @@ Supported values:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Set Per-App Cellular Access UI Visibility*
- GP name: *ShowAppCellularAccessUI*
- GP path: *Network/WWAN Service/WWAN UI Settings*
- GP ADMX file name: *wwansvc.admx*
-
-
+
+
Footnote:
@@ -251,7 +303,7 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
## Cellular policies that can be set using Exchange Active Sync (EAS)
diff --git a/windows/client-management/mdm/policy-csp-connectivity.md b/windows/client-management/mdm/policy-csp-connectivity.md
index b2e38b8a0c..df9e662f31 100644
--- a/windows/client-management/mdm/policy-csp-connectivity.md
+++ b/windows/client-management/mdm/policy-csp-connectivity.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - Connectivity
@@ -15,7 +15,7 @@ ms.date: 11/01/2017
-
+
## Connectivity policies
Allows the user to enable Bluetooth or restrict access.
-
-
The following list shows the supported values:
-
-- 0 – Disallow Bluetooth. If this is set to 0, the radio in the Bluetooth control panel will be greyed out and the user will not be able to turn Bluetooth on.
-- 1 – Reserved. If this is set to 1, the radio in the Bluetooth control panel will be functional and the user will be able to turn Bluetooth on.
+
+
+Allows the user to enable Bluetooth or restrict access.
> [!NOTE]
> This value is not supported in Windows Phone 8.1 MDM and EAS, Windows 10 for desktop, or Windows 10 Mobile.
+If this is not set or it is deleted, the default value of 2 (Allow) is used.
+
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
+
+- 0 – Disallow Bluetooth. If this is set to 0, the radio in the Bluetooth control panel will be greyed out and the user will not be able to turn Bluetooth on.
+- 1 – Reserved. If this is set to 1, the radio in the Bluetooth control panel will be functional and the user will be able to turn Bluetooth on.
- 2 (default) – Allow Bluetooth. If this is set to 2, the radio in the Bluetooth control panel will be functional and the user will be able to turn Bluetooth on.
-
If this is not set or it is deleted, the default value of 2 (Allow) is used.
+
+
-
Allows the cellular data channel on the device. Device reboot is not required to enforce the policy.
+
+
+Allows the cellular data channel on the device. Device reboot is not required to enforce the policy.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – Do not allow the cellular data channel. The user cannot turn it on. This value is not supported in Windows 10, version 1511.
- 1 (default) – Allow the cellular data channel. The user can turn it off.
- 2 - Allow the cellular data channel. The user cannot turn it off.
-
-
+
+
+
Allows or disallows cellular data roaming on the device. Device reboot is not required to enforce the policy.
+
+
+Allows or disallows cellular data roaming on the device. Device reboot is not required to enforce the policy.
-
The following list shows the supported values:
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 – Do not allow cellular data roaming. The user cannot turn it on. This value is not supported in Windows 10, version 1511.
- 1 (default) – Allow cellular data roaming.
- 2 - Allow cellular data roaming on. The user cannot turn it off.
-
Most restricted value is 0.
+
+
+To validate, the enterprise can confirm by observing the roaming enable switch in the UX. It will be inactive if the roaming policy is being enforced by the enterprise policy.
-
To validate, the enterprise can confirm by observing the roaming enable switch in the UX. It will be inactive if the roaming policy is being enforced by the enterprise policy.
-
-
To validate on mobile devices, do the following:
+To validate on mobile devices, do the following:
1. Go to Cellular & SIM.
2. Click on the SIM (next to the signal strength icon) and select **Properties**.
3. On the Properties page, select **Data roaming options**.
-
-
+
+
+
-
+
+
**Connectivity/AllowConnectedDevices**
-
+
Home
@@ -248,8 +263,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -257,25 +272,29 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy requires reboot to take effect.
-
Added in Windows 10, version 1703. Allows IT Admins the ability to disable the Connected Devices Platform (CDP) component. CDP enables discovery and connection to other devices (either proximally with BT/LAN or through the cloud) to support remote app launching, remote messaging, remote app sessions, and other cross-device experiences.
+Added in Windows 10, version 1703. Allows IT Admins the ability to disable the Connected Devices Platform (CDP) component. CDP enables discovery and connection to other devices (either proximally with BT/LAN or through the cloud) to support remote app launching, remote messaging, remote app sessions, and other cross-device experiences.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 1 (default) - Allow (CDP service available).
- 0 - Disable (CDP service not available).
-
-
+
+
+
-
+
+
**Connectivity/AllowNFC**
-
+
Home
@@ -297,8 +316,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -306,28 +325,32 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
-
Allows or disallows near field communication (NFC) on the device.
+Allows or disallows near field communication (NFC) on the device.
-
The following list shows the supported values:
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 – Do not allow NFC capabilities.
- 1 (default) – Allow NFC capabilities.
-
Most restricted value is 0.
+
+
-
-
-
+
+
**Connectivity/AllowUSBConnection**
-
+
Home
@@ -349,8 +372,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -358,30 +381,34 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
-
Enables USB connection between the device and a computer to sync files with the device or to use developer tools to deploy or debug applications. Changing this policy does not affect USB charging.
+Enables USB connection between the device and a computer to sync files with the device or to use developer tools to deploy or debug applications. Changing this policy does not affect USB charging.
-
Both Media Transfer Protocol (MTP) and IP over USB are disabled when this policy is enforced.
+Both Media Transfer Protocol (MTP) and IP over USB are disabled when this policy is enforced.
-
The following list shows the supported values:
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
Specifies what type of underlying connections VPN is allowed to use.
+
+
+Specifies what type of underlying connections VPN is allowed to use.
-
The following list shows the supported values:
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 – VPN is not allowed over cellular.
- 1 (default) – VPN can use any connection, including cellular.
-
Prevents the device from connecting to VPN when the device roams over cellular networks.
+
+
+Prevents the device from connecting to VPN when the device roams over cellular networks.
-
The following list shows the supported values:
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
Most restricted value is 0.
+
+
-
-
-
+
+
**Connectivity/DiablePrintingOverHTTP**
-
+
Home
@@ -499,8 +534,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -508,9 +543,10 @@ ms.date: 11/01/2017
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -518,20 +554,22 @@ ms.date: 11/01/2017
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Turn off printing over HTTP*
- GP name: *DisableHTTPPrinting_2*
- GP path: *Internet Communication settings*
- GP ADMX file name: *ICM.admx*
-
-
+
+
+
-
+
+
**Connectivity/DisableDownloadingOfPrintDriversOverHTTP**
-
+
Home
@@ -553,8 +591,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -562,9 +600,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -572,20 +611,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Turn off downloading of print drivers over HTTP*
- GP name: *DisableWebPnPDownload_2*
- GP path: *Internet Communication settings*
- GP ADMX file name: *ICM.admx*
-
-
+
+
+
-
+
+
**Connectivity/DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards**
-
+
Home
@@ -607,8 +648,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -616,9 +657,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -626,20 +668,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Turn off Internet download for Web publishing and online ordering wizards*
- GP name: *ShellPreventWPWDownload_2*
- GP path: *Internet Communication settings*
- GP ADMX file name: *ICM.admx*
-
-
+
+
+
-
+
+
**Connectivity/DisallowNetworkConnectivityActiveTests**
-
+
Home
@@ -661,43 +705,8 @@ ADMX Info:
-
-
-
-Added in Windows 10, version 1703. Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to http://www.msftconnecttest.com/connecttest.txt to determine if the device can communicate with the Internet. This policy disables the NCSI active probe, preventing network connectivity to www.msftconnecttest.com.
-
-Value type is integer.
-
-
-
-
-
-**Connectivity/HardenedUNCPaths**
-
-
-
-
-
Home
-
Pro
-
Business
-
Enterprise
-
Education
-
Mobile
-
Mobile Enterprise
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -705,13 +714,58 @@ Value type is integer.
-
-
+
+
+Added in Windows 10, version 1703. Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to http://www.msftconnecttest.com/connecttest.txt to determine if the device can communicate with the Internet. This policy disables the NCSI active probe, preventing network connectivity to www.msftconnecttest.com.
+
+Value type is integer.
+
+
+
+
+
+
+
+**Connectivity/HardenedUNCPaths**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
This policy setting configures secure access to UNC paths.
If you enable this policy, Windows only allows access to the specified UNC paths after fulfilling additional security requirements.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -719,20 +773,22 @@ If you enable this policy, Windows only allows access to the specified UNC paths
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Hardened UNC Paths*
- GP name: *Pol_HardenedPaths*
- GP path: *Network/Network Provider*
- GP ADMX file name: *networkprovider.admx*
-
-
+
+
+
-
+
+
**Connectivity/ProhibitInstallationAndConfigurationOfNetworkBridge**
-
+
Home
@@ -754,8 +810,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -763,9 +819,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -773,15 +830,15 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Prohibit installation and configuration of Network Bridge on your DNS domain network*
- GP name: *NC_AllowNetBridge_NLA*
- GP path: *Network/Network Connections*
- GP ADMX file name: *NetworkConnections.admx*
-
-
+
+
Footnote:
@@ -790,7 +847,7 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
## Connectivity policies that can be set using Exchange Active Sync (EAS)
diff --git a/windows/client-management/mdm/policy-csp-controlpolicyconflict.md b/windows/client-management/mdm/policy-csp-controlpolicyconflict.md
new file mode 100644
index 0000000000..d4124e950a
--- /dev/null
+++ b/windows/client-management/mdm/policy-csp-controlpolicyconflict.md
@@ -0,0 +1,96 @@
+---
+title: Policy CSP - ControlPolicyConflict
+description: Policy CSP - ControlPolicyConflict
+ms.author: maricia
+ms.topic: article
+ms.prod: w10
+ms.technology: windows
+author: nickbrower
+ms.date: 01/30/2018
+---
+
+# Policy CSP - ControlPolicyConflict
+
+> [!WARNING]
+> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
+
+
+
+
+
+## ControlPolicyConflict policies
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Added in Windows 10, next major update. This policy allows the IT admin to control which policy will be used whenever both the MDM policy and its equivalent Group Policy are set on the device.
+
+This policy is used to ensure that MDM policy wins over GP when same setting is set by both GP and MDM channel. This policy doesn’t support Delete command. This policy doesn’t support setting the value to be 0 again after it was previously set 1. The default value is 0. In next major update, the MDM policies in Policy CSP will behave as described if this policy value is set 1.
+
+The policy should be set at every sync to ensure the device removes any settings that conflict with MDM just as it does on the very first set of the policy. This ensures that:
+
+- GP settings that correspond to MDM applied settings are not conflicting
+- The current Policy Manager policies are refreshed from what MDM has set
+- Any values set by scripts/user outside of GP that conflict with MDM are removed
+
+
+
+The following list shows the supported values:
+
+- 0 (default)
+- 1 - The MDM policy is used and the GP policy is blocked.
+
+
+
+
+
+Footnote:
+
+- 1 - Added in Windows 10, version 1607.
+- 2 - Added in Windows 10, version 1703.
+- 3 - Added in Windows 10, version 1709.
+
+
+
diff --git a/windows/client-management/mdm/policy-csp-credentialproviders.md b/windows/client-management/mdm/policy-csp-credentialproviders.md
index 06c155dfec..8994842055 100644
--- a/windows/client-management/mdm/policy-csp-credentialproviders.md
+++ b/windows/client-management/mdm/policy-csp-credentialproviders.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - CredentialProviders
@@ -15,7 +15,7 @@ ms.date: 11/01/2017
-
+
## CredentialProviders policies
@@ -30,11 +30,13 @@ ms.date: 11/01/2017
+
-
+
+
**CredentialProviders/AllowPINLogon**
-
+
Home
@@ -56,8 +58,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -65,8 +67,8 @@ ms.date: 11/01/2017
-
-
+
+
This policy setting allows you to control whether a domain user can sign in using a convenience PIN.
If you enable this policy setting, a domain user can set up and sign in with a convenience PIN.
@@ -77,7 +79,7 @@ Note: The user's domain password will be cached in the system vault when using t
To configure Windows Hello for Business, use the Administrative Template policies under Windows Hello for Business.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -85,20 +87,22 @@ To configure Windows Hello for Business, use the Administrative Template policie
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Turn on convenience PIN sign-in*
- GP name: *AllowDomainPINLogon*
- GP path: *System/Logon*
- GP ADMX file name: *credentialproviders.admx*
-
-
+
+
+
-
+
+
**CredentialProviders/BlockPicturePassword**
-
+
Home
@@ -120,8 +124,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -129,8 +133,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to control whether a domain user can sign in using a picture password.
If you enable this policy setting, a domain user can't set up or sign in with a picture password.
@@ -139,7 +143,7 @@ If you disable or don't configure this policy setting, a domain user can set up
Note that the user's domain password will be cached in the system vault when using this feature.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -147,20 +151,22 @@ Note that the user's domain password will be cached in the system vault when usi
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Turn off picture password sign-in*
- GP name: *BlockDomainPicturePassword*
- GP path: *System/Logon*
- GP ADMX file name: *credentialproviders.admx*
-
-
+
+
+
-
+
+
**CredentialProviders/DisableAutomaticReDeploymentCredentials**
-
+
Home
@@ -182,8 +188,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -191,17 +197,21 @@ ADMX Info:
-
-
+
+
Added in Windows 10, version 1709. Boolean policy to disable the visibility of the credential provider that triggers the PC refresh on a device. This policy does not actually trigger the refresh. The admin user is required to authenticate to trigger the refresh on the target device.
The Windows 10 Automatic ReDeployment feature allows admin to reset devices to a known good managed state while preserving the management enrollment. After the automatic redeployment is triggered the devices are for ready for use by information workers or students.
+
+
+The following list shows the supported values:
+
- 0 - Enable the visibility of the credentials for Windows 10 Automatic ReDeployment
- 1 - Disable visibility of the credentials for Windows 10 Automatic ReDeployment
-
-
+
+
Footnote:
@@ -210,7 +220,7 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
## CredentialProviders policies supported by IoT Core
diff --git a/windows/client-management/mdm/policy-csp-credentialsui.md b/windows/client-management/mdm/policy-csp-credentialsui.md
index 6a2a7950a3..869f016e13 100644
--- a/windows/client-management/mdm/policy-csp-credentialsui.md
+++ b/windows/client-management/mdm/policy-csp-credentialsui.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - CredentialsUI
@@ -15,7 +15,7 @@ ms.date: 11/01/2017
-
+
## CredentialsUI policies
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -63,8 +65,8 @@ ms.date: 11/01/2017
-
-
+
+
This policy setting allows you to configure the display of the password reveal button in password entry user experiences.
If you enable this policy setting, the password reveal button will not be displayed after a user types a password in the password entry text box.
@@ -75,7 +77,7 @@ By default, the password reveal button is displayed after a user types a passwor
The policy applies to all Windows components and applications that use the Windows system controls, including Internet Explorer.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -83,20 +85,22 @@ The policy applies to all Windows components and applications that use the Windo
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Do not display the password reveal button*
- GP name: *DisablePasswordReveal*
- GP path: *Windows Components/Credential User Interface*
- GP ADMX file name: *credui.admx*
-
-
+
+
+
-
+
+
**CredentialsUI/EnumerateAdministrators**
-
+
Home
@@ -118,8 +122,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -127,15 +131,15 @@ ADMX Info:
-
-
+
+
This policy setting controls whether administrator accounts are displayed when a user attempts to elevate a running application. By default, administrator accounts are not displayed when the user attempts to elevate a running application.
If you enable this policy setting, all local administrator accounts on the PC will be displayed so the user can choose one and enter the correct password.
If you disable this policy setting, users will always be required to type a user name and password to elevate.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -143,15 +147,15 @@ If you disable this policy setting, users will always be required to type a user
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Enumerate administrator accounts on elevation*
- GP name: *EnumerateAdministrators*
- GP path: *Windows Components/Credential User Interface*
- GP ADMX file name: *credui.admx*
-
-
+
+
Footnote:
@@ -160,5 +164,5 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
diff --git a/windows/client-management/mdm/policy-csp-cryptography.md b/windows/client-management/mdm/policy-csp-cryptography.md
index e65cf59e9f..81023d5fdd 100644
--- a/windows/client-management/mdm/policy-csp-cryptography.md
+++ b/windows/client-management/mdm/policy-csp-cryptography.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - Cryptography
@@ -15,7 +15,7 @@ ms.date: 11/01/2017
-
+
## Cryptography policies
Allows or disallows the Federal Information Processing Standard (FIPS) policy.
+
+
+Allows or disallows the Federal Information Processing Standard (FIPS) policy.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 (default) – Not allowed.
- 1– Allowed.
-
-
+
+
+
Lists the Cryptographic Cipher Algorithms allowed for SSL connections. Format is a semicolon delimited list. Last write win.
+
+
+Lists the Cryptographic Cipher Algorithms allowed for SSL connections. Format is a semicolon delimited list. Last write win.
-
-
+
+
Footnote:
@@ -122,7 +128,7 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
## Cryptography policies supported by Microsoft Surface Hub
diff --git a/windows/client-management/mdm/policy-csp-dataprotection.md b/windows/client-management/mdm/policy-csp-dataprotection.md
index b2d87567b0..1563402e93 100644
--- a/windows/client-management/mdm/policy-csp-dataprotection.md
+++ b/windows/client-management/mdm/policy-csp-dataprotection.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - DataProtection
@@ -15,7 +15,7 @@ ms.date: 11/01/2017
-
+
## DataProtection policies
This policy setting allows you to block direct memory access (DMA) for all hot pluggable PCI downstream ports until a user logs into Windows. Once a user logs in, Windows will enumerate the PCI devices connected to the host plug PCI ports. Every time the user locks the machine, DMA will be blocked on hot plug PCI ports with no children devices until the user logs in again. Devices which were already enumerated when the machine was unlocked will continue to function until unplugged. This policy setting is only enforced when BitLocker or device encryption is enabled.
+
+
+This policy setting allows you to block direct memory access (DMA) for all hot pluggable PCI downstream ports until a user logs into Windows. Once a user logs in, Windows will enumerate the PCI devices connected to the host plug PCI ports. Every time the user locks the machine, DMA will be blocked on hot plug PCI ports with no children devices until the user logs in again. Devices which were already enumerated when the machine was unlocked will continue to function until unplugged. This policy setting is only enforced when BitLocker or device encryption is enabled.
-
The following list shows the supported values:
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -110,19 +116,19 @@ ms.date: 11/01/2017
-
-
+
+
> [!IMPORTANT]
> This policy may change in a future release. It may be used for testing purposes, but should not be used in a production environment at this time.
-
Setting used by Windows 8.1 Selective Wipe.
+Setting used by Windows 8.1 Selective Wipe.
> [!NOTE]
> This policy is not recommended for use in Windows 10.
-
-
+
+
Footnote:
@@ -131,7 +137,7 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
## DataProtection policies supported by IoT Core
diff --git a/windows/client-management/mdm/policy-csp-datausage.md b/windows/client-management/mdm/policy-csp-datausage.md
index b9d3a22ccc..9d64360b36 100644
--- a/windows/client-management/mdm/policy-csp-datausage.md
+++ b/windows/client-management/mdm/policy-csp-datausage.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - DataUsage
@@ -15,7 +15,7 @@ ms.date: 11/01/2017
-
+
## DataUsage policies
@@ -27,11 +27,13 @@ ms.date: 11/01/2017
+
-
+
+
**DataUsage/SetCost3G**
-
+
Home
@@ -53,8 +55,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -62,8 +64,8 @@ ms.date: 11/01/2017
-
-
+
+
This policy setting configures the cost of 3G connections on the local machine.
If this policy setting is enabled, a drop-down list box presenting possible cost values will be active. Selecting one of the following values from the list will set the cost of all 3G connections on the local machine:
@@ -76,7 +78,7 @@ If this policy setting is enabled, a drop-down list box presenting possible cost
If this policy setting is disabled or is not configured, the cost of 3G connections is Fixed by default.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -84,20 +86,22 @@ If this policy setting is disabled or is not configured, the cost of 3G connecti
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Set 3G Cost*
- GP name: *SetCost3G*
- GP path: *Network/WWAN Service/WWAN Media Cost*
- GP ADMX file name: *wwansvc.admx*
-
-
+
+
+
-
+
+
**DataUsage/SetCost4G**
-
+
Home
@@ -119,8 +123,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -128,8 +132,8 @@ ADMX Info:
-
-
+
+
This policy setting configures the cost of 4G connections on the local machine.
If this policy setting is enabled, a drop-down list box presenting possible cost values will be active. Selecting one of the following values from the list will set the cost of all 4G connections on the local machine:
@@ -142,7 +146,7 @@ If this policy setting is enabled, a drop-down list box presenting possible cost
If this policy setting is disabled or is not configured, the cost of 4G connections is Fixed by default.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -150,15 +154,15 @@ If this policy setting is disabled or is not configured, the cost of 4G connecti
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Set 4G Cost*
- GP name: *SetCost4G*
- GP path: *Network/WWAN Service/WWAN Media Cost*
- GP ADMX file name: *wwansvc.admx*
-
-
+
+
Footnote:
@@ -167,5 +171,5 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
diff --git a/windows/client-management/mdm/policy-csp-defender.md b/windows/client-management/mdm/policy-csp-defender.md
index 030df27006..6dcfb31902 100644
--- a/windows/client-management/mdm/policy-csp-defender.md
+++ b/windows/client-management/mdm/policy-csp-defender.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - Defender
@@ -15,7 +15,7 @@ ms.date: 11/01/2017
-
+
## Defender policies
@@ -126,11 +126,13 @@ ms.date: 11/01/2017
+
-
+
+
**Defender/AllowArchiveScanning**
-
+
Home
@@ -152,8 +154,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -161,26 +163,30 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop.
-
Allows or disallows scanning of archives.
+Allows or disallows scanning of archives.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
-
+
+
+
-
+
+
**Defender/AllowBehaviorMonitoring**
-
+
Home
@@ -202,8 +208,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -211,26 +217,30 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop.
-
Allows or disallows Windows Defender Behavior Monitoring functionality.
+Allows or disallows Windows Defender Behavior Monitoring functionality.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
-
+
+
+
-
+
+
**Defender/AllowCloudProtection**
-
+
Home
@@ -252,8 +262,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -261,26 +271,30 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop.
-
To best protect your PC, Windows Defender will send information to Microsoft about any problems it finds. Microsoft will analyze that information, learn more about problems affecting you and other customers, and offer improved solutions.
+To best protect your PC, Windows Defender will send information to Microsoft about any problems it finds. Microsoft will analyze that information, learn more about problems affecting you and other customers, and offer improved solutions.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
-
+
+
+
-
+
+
**Defender/AllowEmailScanning**
-
+
Home
@@ -302,8 +316,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -311,26 +325,30 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop.
-
Allows or disallows scanning of email.
+Allows or disallows scanning of email.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 (default) – Not allowed.
- 1 – Allowed.
-
-
+
+
+
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -361,26 +379,30 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop.
-
Allows or disallows a full scan of mapped network drives.
+Allows or disallows a full scan of mapped network drives.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 (default) – Not allowed.
- 1 – Allowed.
-
-
+
+
+
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -411,26 +433,30 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop.
-
Allows or disallows a full scan of removable drives.
+Allows or disallows a full scan of removable drives.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
-
+
+
+
-
+
+
**Defender/AllowIOAVProtection**
-
+
Home
@@ -452,8 +478,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -461,26 +487,30 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop.
-
Allows or disallows Windows Defender IOAVP Protection functionality.
+Allows or disallows Windows Defender IOAVP Protection functionality.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
-
+
+
+
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -511,26 +541,30 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop.
-
Allows or disallows Windows Defender Intrusion Prevention functionality.
+Allows or disallows Windows Defender Intrusion Prevention functionality.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
-
+
+
+
-
+
+
**Defender/AllowOnAccessProtection**
-
+
Home
@@ -552,8 +586,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -561,26 +595,30 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop.
-
Allows or disallows Windows Defender On Access Protection functionality.
+Allows or disallows Windows Defender On Access Protection functionality.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
-
+
+
+
-
+
+
**Defender/AllowRealtimeMonitoring**
-
+
Home
@@ -602,8 +640,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -611,26 +649,30 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop.
-
Allows or disallows Windows Defender Realtime Monitoring functionality.
+Allows or disallows Windows Defender Realtime Monitoring functionality.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
-
+
+
+
-
+
+
**Defender/AllowScanningNetworkFiles**
-
+
Home
@@ -652,8 +694,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -661,26 +703,30 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop.
-
Allows or disallows a scanning of network files.
+Allows or disallows a scanning of network files.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
-
+
+
+
-
+
+
**Defender/AllowScriptScanning**
-
+
Home
@@ -702,8 +748,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -711,26 +757,30 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop.
-
Allows or disallows Windows Defender Script Scanning functionality.
+Allows or disallows Windows Defender Script Scanning functionality.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
-
+
+
+
-
+
+
**Defender/AllowUserUIAccess**
-
+
Home
@@ -752,8 +802,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -761,26 +811,30 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop.
-
Allows or disallows user access to the Windows Defender UI. If disallowed, all Windows Defender notifications will also be suppressed.
+Allows or disallows user access to the Windows Defender UI. If disallowed, all Windows Defender notifications will also be suppressed.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
-
+
+
+
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -811,23 +865,25 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop.
-
Added in Windows 10, version 1709. This policy setting allows you to prevent Attack Surface reduction rules from matching on files under the paths specified or for the fully qualified resources specified. Paths should be added under the Options for this setting. Each entry must be listed as a name value pair, where the name should be a string representation of a path or a fully qualified resource name. As an example, a path might be defined as: "c:\Windows" to exclude all files in this directory. A fully qualified resource name might be defined as: "C:\Windows\App.exe"..
+Added in Windows 10, version 1709. This policy setting allows you to prevent Attack Surface reduction rules from matching on files under the paths specified or for the fully qualified resources specified. Paths should be added under the Options for this setting. Each entry must be listed as a name value pair, where the name should be a string representation of a path or a fully qualified resource name. As an example, a path might be defined as: "c:\Windows" to exclude all files in this directory. A fully qualified resource name might be defined as: "C:\Windows\App.exe"..
-
Value type is string.
+Value type is string.
+
+
+
-
-
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -858,25 +914,27 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop.
-
Added in Windows 10, version 1709. This policy setting enables setting the state (Block/Audit/Off) for each Attack surface reduction (ASR) rule. Each ASR rule listed can be set to one of the following states (Block/Audit/Off). The ASR rule ID and state should be added under the Options for this setting. Each entry must be listed as a name value pair. The name defines a valid ASR rule ID, while the value contains the status ID indicating the status of the rule.
+Added in Windows 10, version 1709. This policy setting enables setting the state (Block/Audit/Off) for each Attack surface reduction (ASR) rule. Each ASR rule listed can be set to one of the following states (Block/Audit/Off). The ASR rule ID and state should be added under the Options for this setting. Each entry must be listed as a name value pair. The name defines a valid ASR rule ID, while the value contains the status ID indicating the status of the rule.
-
For more information about ASR rule ID and status ID, see [Enable Attack Surface Reduction](https://docs.microsoft.com/en-us/windows/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction).
+For more information about ASR rule ID and status ID, see [Enable Attack Surface Reduction](https://docs.microsoft.com/en-us/windows/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction).
-
Value type is string.
+Value type is string.
+
+
+
-
-
-
+
+
**Defender/AvgCPULoadFactor**
-
+
Home
@@ -898,8 +956,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -907,25 +965,30 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop.
-
Represents the average CPU load factor for the Windows Defender scan (in percent).
+Represents the average CPU load factor for the Windows Defender scan (in percent).
-
Valid values: 0–100
-
The default value is 50.
+The default value is 50.
+
+
+
+Valid values: 0–100
+
+
+
-
-
-
+
+
**Defender/CloudBlockLevel**
-
+
Home
@@ -947,8 +1010,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -956,35 +1019,39 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop.
-
Added in Windows 10, version 1709. This policy setting determines how aggressive Windows Defender Antivirus will be in blocking and scanning suspicious files. Value type is integer.
+Added in Windows 10, version 1709. This policy setting determines how aggressive Windows Defender Antivirus will be in blocking and scanning suspicious files. Value type is integer.
-
If this setting is on, Windows Defender Antivirus will be more aggressive when identifying suspicious files to block and scan; otherwise, it will be less aggressive and therefore block and scan with less frequency.
+If this setting is on, Windows Defender Antivirus will be more aggressive when identifying suspicious files to block and scan; otherwise, it will be less aggressive and therefore block and scan with less frequency.
-
For more information about specific values that are supported, see the Windows Defender Antivirus documentation site.
+For more information about specific values that are supported, see the Windows Defender Antivirus documentation site.
> [!Note]
-> This feature requires the "Join Microsoft MAPS" setting enabled in order to function.
+> This feature requires the "Join Microsoft MAPS" setting enabled in order to function.
-
Possible options are:
+
+
+The following list shows the supported values:
-- (0x0) Default windows defender blocking level
-- (0x2) High blocking level - aggressively block unknowns while optimizing client performance (greater chance of false positives)
-- (0x4) High+ blocking level – aggressively block unknowns and apply additional protection measures (may impact client performance)
-- (0x6) Zero tolerance blocking level – block all unknown executables
+- 0x0 - Default windows defender blocking level
+- 0x2 - High blocking level - aggressively block unknowns while optimizing client performance (greater chance of false positives)
+- 0x4 - High+ blocking level – aggressively block unknowns and apply additional protection measures (may impact client performance)
+- 0x6 - Zero tolerance blocking level – block all unknown executables
+
+
+
-
-
-
+
+
**Defender/CloudExtendedTimeout**
-
+
Home
@@ -1006,8 +1073,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1015,27 +1082,29 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop.
-
Added in Windows 10, version 1709. This feature allows Windows Defender Antivirus to block a suspicious file for up to 60 seconds, and scan it in the cloud to make sure it's safe. Value type is integer, range is 0 - 50.
+Added in Windows 10, version 1709. This feature allows Windows Defender Antivirus to block a suspicious file for up to 60 seconds, and scan it in the cloud to make sure it's safe. Value type is integer, range is 0 - 50.
-
The typical cloud check timeout is 10 seconds. To enable the extended cloud check feature, specify the extended time in seconds, up to an additional 50 seconds.
+The typical cloud check timeout is 10 seconds. To enable the extended cloud check feature, specify the extended time in seconds, up to an additional 50 seconds.
-
For example, if the desired timeout is 60 seconds, specify 50 seconds in this setting, which will enable the extended cloud check feature, and will raise the total time to 60 seconds.
+For example, if the desired timeout is 60 seconds, specify 50 seconds in this setting, which will enable the extended cloud check feature, and will raise the total time to 60 seconds.
> [!Note]
> This feature depends on three other MAPS settings the must all be enabled- "Configure the 'Block at First Sight' feature; "Join Microsoft MAPS"; "Send file samples when further analysis is required".
-
-
+
+
+
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1066,20 +1135,22 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop. The previous name was GuardedFoldersAllowedApplications and changed to ControlledFolderAccessAllowedApplications.
-
Added in Windows 10, version 1709. This policy setting allows user-specified applications to the guard my folders feature. Adding an allowed application means the guard my folders feature will allow the application to modify or delete content in certain folders such as My Documents. In most cases it will not be necessary to add entries. Windows Defender Antivirus will automatically detect and dynamically add applications that are friendly. Value type is string. Use the | as the substring separator.
+Added in Windows 10, version 1709. This policy setting allows user-specified applications to the guard my folders feature. Adding an allowed application means the guard my folders feature will allow the application to modify or delete content in certain folders such as My Documents. In most cases it will not be necessary to add entries. Windows Defender Antivirus will automatically detect and dynamically add applications that are friendly. Value type is string. Use the | as the substring separator.
+
+
+
-
-
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1110,20 +1181,22 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop. The previous name was GuardedFoldersList and changed to ControlledFolderAccessProtectedFolders.
-
Added in Windows 10, version 1709. This policy settings allows adding user-specified folder locations to the guard my folders feature. These folders will complement the system defined folders such as My Documents and My Pictures. The list of system folders will be displayed in the user interface and can not be changed. Value type is string. Use the | as the substring separator.
+Added in Windows 10, version 1709. This policy settings allows adding user-specified folder locations to the guard my folders feature. These folders will complement the system defined folders such as My Documents and My Pictures. The list of system folders will be displayed in the user interface and can not be changed. Value type is string. Use the | as the substring separator.
+
+
+
-
-
-
+
+
**Defender/DaysToRetainCleanedMalware**
-
+
Home
@@ -1145,8 +1218,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1154,25 +1227,30 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop.
-
Time period (in days) that quarantine items will be stored on the system.
+Time period (in days) that quarantine items will be stored on the system.
-
Valid values: 0–90
-
The default value is 0, which keeps items in quarantine, and does not automatically remove them.
+The default value is 0, which keeps items in quarantine, and does not automatically remove them.
+
+
+
+Valid values: 0–90
+
+
+
-
-
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1203,24 +1281,30 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop. The previous name was EnableGuardMyFolders and changed to EnableControlledFolderAccess.
-
Added in Windows 10, version 1709. This policy enables setting the state (On/Off/Audit) for the guard my folders feature. The guard my folders feature removes modify and delete permissions from untrusted applications to certain folders such as My Documents. Value type is integer and the range is 0 - 2.
+Added in Windows 10, version 1709. This policy enables setting the state (On/Off/Audit) for the guard my folders feature. The guard my folders feature removes modify and delete permissions from untrusted applications to certain folders such as My Documents. Value type is integer and the range is 0 - 2.
+
+
+
+The following list shows the supported values:
- 0 (default) - Disabled
- 1 - Enabled
- 2 - Audit Mode
-
-
+
+
+
-
+
+
**Defender/EnableNetworkProtection**
-
+
Home
@@ -1242,8 +1326,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1251,32 +1335,36 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop.
-
Added in Windows 10, version 1709. This policy allows you to turn network protection on (block/audit) or off in Windows Defender Exploit Guard. Network protection is a feature of Windows Defender Exploit Guard that protects employees using any app from accessing phishing scams, exploit-hosting sites, and malicious content on the Internet. This includes preventing third-party browsers from connecting to dangerous sites. Value type is integer.
+Added in Windows 10, version 1709. This policy allows you to turn network protection on (block/audit) or off in Windows Defender Exploit Guard. Network protection is a feature of Windows Defender Exploit Guard that protects employees using any app from accessing phishing scams, exploit-hosting sites, and malicious content on the Internet. This includes preventing third-party browsers from connecting to dangerous sites. Value type is integer.
-
If you enable this setting, network protection is turned on and employees can't turn it off. Its behavior can be controlled by the following options: Block and Audit.
-
If you enable this policy with the ""Block"" option, users/apps will be blocked from connecting to dangerous domains. You will be able to see this activity in Windows Defender Security Center.
-
If you enable this policy with the ""Audit"" option, users/apps will not be blocked from connecting to dangerous domains. However, you will still see this activity in Windows Defender Security Center.
-
If you disable this policy, users/apps will not be blocked from connecting to dangerous domains. You will not see any network activity in Windows Defender Security Center.
-
If you do not configure this policy, network blocking will be disabled by default.
+If you enable this setting, network protection is turned on and employees can't turn it off. Its behavior can be controlled by the following options: Block and Audit.
+If you enable this policy with the ""Block"" option, users/apps will be blocked from connecting to dangerous domains. You will be able to see this activity in Windows Defender Security Center.
+If you enable this policy with the ""Audit"" option, users/apps will not be blocked from connecting to dangerous domains. However, you will still see this activity in Windows Defender Security Center.
+If you disable this policy, users/apps will not be blocked from connecting to dangerous domains. You will not see any network activity in Windows Defender Security Center.
+If you do not configure this policy, network blocking will be disabled by default.
-
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1307,21 +1395,23 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop.
-
Allows an administrator to specify a list of file type extensions to ignore during a scan. Each file type in the list must be separated by a **|**. For example, "lib|obj".
+Allows an administrator to specify a list of file type extensions to ignore during a scan. Each file type in the list must be separated by a **|**. For example, "lib|obj".
+
+
+
-
-
-
+
+
**Defender/ExcludedPaths**
-
+
Home
@@ -1343,8 +1433,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1352,21 +1442,23 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop.
-
Allows an administrator to specify a list of directory paths to ignore during a scan. Each path in the list must be separated by a **|**. For example, "C:\\Example|C:\\Example1".
+Allows an administrator to specify a list of directory paths to ignore during a scan. Each path in the list must be separated by a **|**. For example, "C:\\Example|C:\\Example1".
+
+
+
-
-
-
+
+
**Defender/ExcludedProcesses**
-
+
Home
@@ -1388,8 +1480,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1397,27 +1489,29 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop.
-
Allows an administrator to specify a list of files opened by processes to ignore during a scan.
+Allows an administrator to specify a list of files opened by processes to ignore during a scan.
> [!IMPORTANT]
> The process itself is not excluded from the scan, but can be by using the **Defender/ExcludedPaths** policy to exclude its path.
-
Each file type must be separated by a **|**. For example, "C:\\Example.exe|C:\\Example1.exe".
+Each file type must be separated by a **|**. For example, "C:\\Example.exe|C:\\Example1.exe".
+
+
+
-
-
-
+
+
**Defender/PUAProtection**
-
+
Home
@@ -1439,8 +1533,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1448,27 +1542,31 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop.
-
Added in Windows 10, version 1607. Specifies the level of detection for potentially unwanted applications (PUAs). Windows Defender alerts you when potentially unwanted software is being downloaded or attempts to install itself on your computer.
+Added in Windows 10, version 1607. Specifies the level of detection for potentially unwanted applications (PUAs). Windows Defender alerts you when potentially unwanted software is being downloaded or attempts to install itself on your computer.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 (default) – PUA Protection off. Windows Defender will not protect against potentially unwanted applications.
- 1 – PUA Protection on. Detected items are blocked. They will show in history along with other threats.
- 2 – Audit mode. Windows Defender will detect potentially unwanted applications, but take no action. You can review information about the applications Windows Defender would have taken action against by searching for events created by Windows Defender in the Event Viewer.
-
-
+
+
+
-
+
+
**Defender/RealTimeScanDirection**
-
+
Home
@@ -1490,8 +1588,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1499,31 +1597,34 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop.
-
Controls which sets of files should be monitored.
+Controls which sets of files should be monitored.
> [!NOTE]
> If **AllowOnAccessProtection** is not allowed, then this configuration can be used to monitor specific files.
-
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 (default) – Monitor all files (bi-directional).
- 1 – Monitor incoming files.
- 2 – Monitor outgoing files.
-
-
+
+
+
-
+
+
**Defender/ScanParameter**
-
+
Home
@@ -1545,8 +1646,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1554,26 +1655,30 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop.
-
Selects whether to perform a quick scan or full scan.
+Selects whether to perform a quick scan or full scan.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 1 (default) – Quick scan
- 2 – Full scan
-
-
+
+
+
-
+
+
**Defender/ScheduleQuickScanTime**
-
+
Home
@@ -1595,8 +1700,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1604,31 +1709,36 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop.
-
Selects the time of day that the Windows Defender quick scan should run.
+Selects the time of day that the Windows Defender quick scan should run.
> [!NOTE]
> The scan type will depends on what scan type is selected in the **Defender/ScanParameter** setting.
-
Valid values: 0–1380
-
For example, a value of 0=12:00AM, a value of 60=1:00AM, a value of 120=2:00, and so on, up to a value of 1380=11:00PM.
+For example, a value of 0=12:00AM, a value of 60=1:00AM, a value of 120=2:00, and so on, up to a value of 1380=11:00PM.
-
The default value is 120
+The default value is 120
+
+
+
+Valid values: 0–1380
+
+
+
-
-
-
+
+
**Defender/ScheduleScanDay**
-
+
Home
@@ -1650,8 +1760,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1659,19 +1769,20 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop.
-
Selects the day that the Windows Defender scan should run.
+Selects the day that the Windows Defender scan should run.
> [!NOTE]
> The scan type will depends on what scan type is selected in the **Defender/ScanParameter** setting.
-
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 (default) – Every day
- 1 – Monday
@@ -1683,13 +1794,15 @@ ms.date: 11/01/2017
- 7 – Sunday
- 8 – No scheduled scan
-
-
+
+
+
-
+
+
**Defender/ScheduleScanTime**
-
+
Home
@@ -1711,8 +1824,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1720,31 +1833,36 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop.
-
Selects the time of day that the Windows Defender scan should run.
+Selects the time of day that the Windows Defender scan should run.
> [!NOTE]
> The scan type will depends on what scan type is selected in the **Defender/ScanParameter** setting.
-
Valid values: 0–1380.
-
For example, a value of 0=12:00AM, a value of 60=1:00AM, a value of 120=2:00, and so on, up to a value of 1380=11:00PM.
+For example, a value of 0=12:00AM, a value of 60=1:00AM, a value of 120=2:00, and so on, up to a value of 1380=11:00PM.
-
The default value is 120.
+The default value is 120.
+
+
+
+Valid values: 0–1380.
+
+
+
-
-
-
+
+
**Defender/SignatureUpdateInterval**
-
+
Home
@@ -1766,8 +1884,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1775,27 +1893,32 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop.
-
Specifies the interval (in hours) that will be used to check for signatures, so instead of using the ScheduleDay and ScheduleTime the check for new signatures will be set according to the interval.
+Specifies the interval (in hours) that will be used to check for signatures, so instead of using the ScheduleDay and ScheduleTime the check for new signatures will be set according to the interval.
-
Valid values: 0–24.
-
A value of 0 means no check for new signatures, a value of 1 means to check every hour, a value of 2 means to check every two hours, and so on, up to a value of 24, which means to check every day.
+A value of 0 means no check for new signatures, a value of 1 means to check every hour, a value of 2 means to check every two hours, and so on, up to a value of 24, which means to check every day.
-
The default value is 8.
+The default value is 8.
+
+
+
+Valid values: 0–24.
+
+
+
-
-
-
+
+
**Defender/SubmitSamplesConsent**
-
+
Home
@@ -1817,8 +1940,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1826,28 +1949,32 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop.
-
Checks for the user consent level in Windows Defender to send data. If the required consent has already been granted, Windows Defender submits them. If not, (and if the user has specified never to ask), the UI is launched to ask for user consent (when **Defender/AllowCloudProtection** is allowed) before sending data.
+Checks for the user consent level in Windows Defender to send data. If the required consent has already been granted, Windows Defender submits them. If not, (and if the user has specified never to ask), the UI is launched to ask for user consent (when **Defender/AllowCloudProtection** is allowed) before sending data.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – Always prompt.
- 1 (default) – Send safe samples automatically.
- 2 – Never send.
- 3 – Send all samples automatically.
-
-
+
+
+
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1878,24 +2005,24 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop.
-
Allows an administrator to specify any valid threat severity levels and the corresponding default action ID to take.
+Allows an administrator to specify any valid threat severity levels and the corresponding default action ID to take.
-
This value is a list of threat severity level IDs and corresponding actions, separated by a**|** using the format "*threat level*=*action*|*threat level*=*action*". For example "1=6|2=2|4=10|5=3
+This value is a list of threat severity level IDs and corresponding actions, separated by a**|** using the format "*threat level*=*action*|*threat level*=*action*". For example "1=6|2=2|4=10|5=3
-
The following list shows the supported values for threat severity levels:
+The following list shows the supported values for threat severity levels:
- 1 – Low severity threats
- 2 – Moderate severity threats
- 4 – High severity threats
- 5 – Severe threats
-
The following list shows the supported values for possible actions:
+The following list shows the supported values for possible actions:
- 1 – Clean
- 2 – Quarantine
@@ -1904,8 +2031,8 @@ ms.date: 11/01/2017
- 8 – User defined
- 10 – Block
-
-
+
+
Footnote:
@@ -1914,7 +2041,7 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
## Defender policies supported by Microsoft Surface Hub
diff --git a/windows/client-management/mdm/policy-csp-deliveryoptimization.md b/windows/client-management/mdm/policy-csp-deliveryoptimization.md
index 1476d9a06b..d05d2cedb0 100644
--- a/windows/client-management/mdm/policy-csp-deliveryoptimization.md
+++ b/windows/client-management/mdm/policy-csp-deliveryoptimization.md
@@ -6,16 +6,18 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - DeliveryOptimization
+> [!WARNING]
+> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
+
## DeliveryOptimization policies
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -104,23 +132,25 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 Pro, Enterprise, and Education editions and not supported in Windows 10 Mobile.
-
Added in Windows 10, version 1607. Specifies the maximum size in GB of Delivery Optimization cache. This policy overrides the DOMaxCacheSize policy. The value 0 (zero) means "unlimited" cache. Delivery Optimization will clear the cache when the device is running low on disk space.
+Added in Windows 10, version 1607. Specifies the maximum size in GB of Delivery Optimization cache. This policy overrides the DOMaxCacheSize policy. The value 0 (zero) means "unlimited" cache. Delivery Optimization will clear the cache when the device is running low on disk space.
-
The default value is 10.
+The default value is 10.
+
+
+
-
-
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -151,23 +181,132 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 Pro, Enterprise, and Education editions and not supported in Windows 10 Mobile.
-
Added in Windows 10, version 1703. Specifies whether the device is allowed to participate in Peer Caching while connected via VPN to the domain network. This means the device can download from or upload to other domain network devices, either on VPN or on the corporate domain network.
+Added in Windows 10, version 1703. Specifies whether the device is allowed to participate in Peer Caching while connected via VPN to the domain network. This means the device can download from or upload to other domain network devices, either on VPN or on the corporate domain network.
-
The default value is 0 (FALSE).
+
+
+The following list shows the supported values:
+
+- 0 (default) - Not allowed.
+- 1 - Allowed.
+
+
+
-
-
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Added in Windows 10, next major update. This policy allows you to delay the use of an HTTP source in a background download that is allowed to use peer-to-peer.
+
+After the max delay is reached, the download will resume using HTTP, either downloading the entire payload or complementing the bytes that could not be downloaded from peers. Note that a download that is waiting for peer sources, will appear to be stuck for the end user. The recommended value is 1 hour (3600).
+
+
+
+
+
+
+
+**DeliveryOptimization/DODelayForegroundDownloadFromHttp**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Added in Windows 10, next major update. This policy allows you to delay the use of an HTTP source in a foreground (interactive) download that is allowed to use peer-to-peer.
+
+After the max delay has reached, the download will resume using HTTP, either downloading the entire payload or complementing the bytes that could not be downloaded from Peers.
+
+Note that a download that is waiting for peer sources, will appear to be stuck for the end user.
+
+The recommended value is 1 minute (60).
+
+
+
+The following list shows the supported values as number of seconds:
+
+- 0 to 86400 (1 day)
+- 0 - managed by the cloud service
+- Default is not configured.
+
+
+
+
+
+
+
**DeliveryOptimization/DODownloadMode**
-
+
Home
@@ -189,8 +328,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -198,30 +337,34 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 Pro, Enterprise, and Education editions and not supported in Windows 10 Mobile.
-
Specifies the download method that Delivery Optimization can use in downloads of Windows Updates, Apps and App updates.
+Specifies the download method that Delivery Optimization can use in downloads of Windows Updates, Apps and App updates.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
-- 0 –HTTP only, no peering.
+- 0 – HTTP only, no peering.
- 1 (default) – HTTP blended with peering behind the same NAT.
- 2 – HTTP blended with peering across a private group. Peering occurs on devices in the same Active Directory Site (if it exists) or the same domain by default. When this option is selected, peering will cross NATs. To create a custom group use Group ID in combination with Mode 2.
- 3 – HTTP blended with Internet peering.
- 99 - Simple download mode with no peering. Delivery Optimization downloads using HTTP only and does not attempt to contact the Delivery Optimization cloud services. Added in Windows 10, version 1607.
- 100 - Bypass mode. Do not use Delivery Optimization and use BITS instead. Added in Windows 10, version 1607.
-
-
+
+
+
-
+
+
**DeliveryOptimization/DOGroupId**
-
+
Home
@@ -243,8 +386,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -252,24 +395,86 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 Pro, Enterprise, and Education editions and not supported in Windows 10 Mobile.
-
This Policy specifies an arbitrary group ID that the device belongs to. Use this if you need to create a single group for Local Network Peering for branches that are on different domains or are not on the same LAN. Note that this is a best effort optimization and should not be relied on for an authentication of identity.
+This Policy specifies an arbitrary group ID that the device belongs to. Use this if you need to create a single group for Local Network Peering for branches that are on different domains or are not on the same LAN. Note that this is a best effort optimization and should not be relied on for an authentication of identity.
> [!NOTE]
> You must use a GUID as the group ID.
-
-
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Added in Windows 10, next major update. Set this policy to restrict peer selection to a specific source. Options available are: 1 = AD Site, 2 = Authenticated domain SID, 3 = DHCP Option ID, 4 = DNS Suffix
+
+When set, the Group ID will be assigned automatically from the selected source.
+
+If you set this policy, the GroupID policy will be ignored.
+
+The options set in this policy only apply to Group (2) download mode. If Group (2) isn't set as Download mode, this policy will be ignored.
+
+For option 4 - DHCP Option ID, the client will query DHCP Option ID 234 and use the returned GUID value as the Group ID.
+
+
+
+The following list shows the supported values:
+
+- 1 - AD site
+- 2 - Authenticated domain SID
+- 3 - DHCP user option
+- 4 - DNS suffix
+
+
+
+
+
+
+
**DeliveryOptimization/DOMaxCacheAge**
-
+
Home
@@ -291,8 +496,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -300,23 +505,25 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 Pro, Enterprise, and Education editions and not supported in Windows 10 Mobile.
-
Specifies the maximum time in seconds that each file is held in the Delivery Optimization cache after downloading successfully. The value 0 (zero) means "unlimited"; Delivery Optimization will hold the files in the cache longer and make the files available for uploads to other devices, as long as the cache size has not exceeded. The value 0 is new in Windows 10, version 1607.
+Specifies the maximum time in seconds that each file is held in the Delivery Optimization cache after downloading successfully. The value 0 (zero) means "unlimited"; Delivery Optimization will hold the files in the cache longer and make the files available for uploads to other devices, as long as the cache size has not exceeded. The value 0 is new in Windows 10, version 1607.
-
The default value is 259200 seconds (3 days).
+The default value is 259200 seconds (3 days).
+
+
+
-
-
-
+
+
**DeliveryOptimization/DOMaxCacheSize**
-
+
Home
@@ -338,8 +545,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -347,23 +554,25 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 Pro, Enterprise, and Education editions and not supported in Windows 10 Mobile.
-
Specifies the maximum cache size that Delivery Optimization can utilize, as a percentage of disk size (1-100).
+Specifies the maximum cache size that Delivery Optimization can utilize, as a percentage of disk size (1-100).
-
The default value is 20.
+The default value is 20.
+
+
+
-
-
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -394,23 +603,25 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 Pro, Enterprise, and Education editions and not supported in Windows 10 Mobile.
-
Added in Windows 10, version 1607. Specifies the maximum download bandwidth in KiloBytes/second that the device can use across all concurrent download activities using Delivery Optimization.
+Added in Windows 10, version 1607. Specifies the maximum download bandwidth in KiloBytes/second that the device can use across all concurrent download activities using Delivery Optimization.
-
The default value 0 (zero) means that Delivery Optimization dynamically adjusts to use the available bandwidth for downloads.
+The default value 0 (zero) means that Delivery Optimization dynamically adjusts to use the available bandwidth for downloads.
+
+
+
-
-
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -441,23 +652,25 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 Pro, Enterprise, and Education editions and not supported in Windows 10 Mobile.
-
Specifies the maximum upload bandwidth in KiloBytes/second that a device will use across all concurrent upload activity using Delivery Optimization.
+Specifies the maximum upload bandwidth in KiloBytes/second that a device will use across all concurrent upload activity using Delivery Optimization.
-
The default value is 0, which permits unlimited possible bandwidth (optimized for minimal usage of upload bandwidth).
+The default value is 0, which permits unlimited possible bandwidth (optimized for minimal usage of upload bandwidth).
+
+
+
-
-
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -488,23 +701,25 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 Pro, Enterprise, and Education editions and not supported in Windows 10 Mobile.
-
Added in Windows 10, version 1607. Specifies the minimum download QoS (Quality of Service or speed) in KiloBytes/sec for background downloads. This policy affects the blending of peer and HTTP sources. Delivery Optimization complements the download from the HTTP source to achieve the minimum QoS value set.
+Added in Windows 10, version 1607. Specifies the minimum download QoS (Quality of Service or speed) in KiloBytes/sec for background downloads. This policy affects the blending of peer and HTTP sources. Delivery Optimization complements the download from the HTTP source to achieve the minimum QoS value set.
-
The default value is 500.
+The default value is 500.
+
+
+
-
-
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -535,22 +750,24 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 Pro, Business, Enterprise, and Education editions and not supported in Windows 10 Mobile.
-
Added in Windows 10, version 1703. Specifies any value between 1 and 100 (in percentage) to allow the device to upload data to LAN and Group peers while on battery power. Uploads will automatically pause when the battery level drops below the set minimum battery level. The recommended value to set is 40 (for 40%) if you allow uploads on battery.
+Added in Windows 10, version 1703. Specifies any value between 1 and 100 (in percentage) to allow the device to upload data to LAN and Group peers while on battery power. Uploads will automatically pause when the battery level drops below the set minimum battery level. The recommended value to set is 40 (for 40%) if you allow uploads on battery.
-
The default value is 0. The value 0 (zero) means "not limited" and the cloud service default value will be used.
+The default value is 0. The value 0 (zero) means "not limited" and the cloud service default value will be used.
+
+
+
-
-
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -581,26 +798,28 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 Pro, Business, Enterprise, and Education editions and not supported in Windows 10 Mobile.
-
Added in Windows 10, version 1703. Specifies the required minimum disk size (capacity in GB) for the device to use Peer Caching. The value 0 means "not-limited" which means the cloud service set default value will be used. Recommended values: 64 GB to 256 GB.
+Added in Windows 10, version 1703. Specifies the required minimum disk size (capacity in GB) for the device to use Peer Caching. The value 0 means "not-limited" which means the cloud service set default value will be used. Recommended values: 64 GB to 256 GB.
> [!NOTE]
> If the DOMofidyCacheDrive policy is set, the disk size check will apply to the new working directory specified by this policy.
-
The default value is 32 GB.
+The default value is 32 GB.
+
+
+
-
-
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -631,23 +850,25 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 Pro, Business, Enterprise, and Education editions and not supported in Windows 10 Mobile.
-
Added in Windows 10, version 1703. Specifies the minimum content file size in MB enabled to use Peer Caching. The value 0 means "unlimited" which means the cloud service set default value will be used. Recommended values: 1 MB to 100,000 MB.
+Added in Windows 10, version 1703. Specifies the minimum content file size in MB enabled to use Peer Caching. The value 0 means "unlimited" which means the cloud service set default value will be used. Recommended values: 1 MB to 100,000 MB.
-
The default value is 100 MB.
+The default value is 100 MB.
+
+
+
-
-
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -678,23 +899,25 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 Pro, Business, Enterprise, and Education editions and not supported in Windows 10 Mobile.
-
Added in Windows 10, version 1703. Specifies the minimum RAM size in GB required to use Peer Caching. The value 0 means "not-limited" which means the cloud service set default value will be used. For example if the minimum set is 1 GB, then devices with 1 GB or higher available RAM will be allowed to use Peer caching. Recommended values: 1 GB to 4 GB.
+Added in Windows 10, version 1703. Specifies the minimum RAM size in GB required to use Peer Caching. The value 0 means "not-limited" which means the cloud service set default value will be used. For example if the minimum set is 1 GB, then devices with 1 GB or higher available RAM will be allowed to use Peer caching. Recommended values: 1 GB to 4 GB.
-
The default value is 4 GB.
+The default value is 4 GB.
+
+
+
-
-
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -725,23 +948,25 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 Pro, Enterprise, and Education editions and not supported in Windows 10 Mobile.
-
Added in Windows 10, version 1607. Specifies the drive that Delivery Optimization should use for its cache. The drive location can be specified using environment variables, drive letter or using a full path.
+Added in Windows 10, version 1607. Specifies the drive that Delivery Optimization should use for its cache. The drive location can be specified using environment variables, drive letter or using a full path.
-
By default, %SystemDrive% is used to store the cache.
+By default, %SystemDrive% is used to store the cache.
+
+
+
-
-
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -772,25 +997,83 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 Pro, Enterprise, and Education editions and not supported in Windows 10 Mobile.
-
Added in Windows 10, version 1607. Specifies the maximum total bytes in GB that Delivery Optimization is allowed to upload to Internet peers in each calendar month.
+Added in Windows 10, version 1607. Specifies the maximum total bytes in GB that Delivery Optimization is allowed to upload to Internet peers in each calendar month.
-
The value 0 (zero) means "unlimited"; No monthly upload limit is applied if 0 is set.
+The value 0 (zero) means "unlimited"; No monthly upload limit is applied if 0 is set.
-
The default value is 20.
+The default value is 20.
+
+
+
-
-
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Added in Windows 10, next major update. Specifies the maximum background download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth. The default value 0 (zero) means that Delivery Optimization dynamically adjusts to use the available bandwidth for background downloads.
+
+Note that downloads from LAN peers will not be throttled even when this policy is set.
+
+
+
+
+
+
+
**DeliveryOptimization/DOPercentageMaxDownloadBandwidth**
-
+
+This policy is deprecated. Use [DOPercentageMaxForeDownloadBandwidth](#deliveryoptimization-dopercentagemaxforedownloadbandwidth) and [DOPercentageMaxBackDownloadBandwidth](#deliveryoptimization-dopercentagemaxbackdownloadbandwidth) policies instead.
+
+
+
+
+
+
+
+**DeliveryOptimization/DOPercentageMaxForeDownloadBandwidth**
+
+
Home
@@ -803,17 +1086,17 @@ ms.date: 11/01/2017
-
1
-
-
1
-
1
+
4
+
4
+
4
+
4
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -821,18 +1104,172 @@ ms.date: 11/01/2017
-
-
-> [!NOTE]
-> This policy is only enforced in Windows 10 Pro, Enterprise, and Education editions and not supported in Windows 10 Mobile.
+
+
+Added in Windows 10, next major update. Specifies the maximum foreground download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth. The default value 0 (zero) means that Delivery Optimization dynamically adjusts to use the available bandwidth for foreground downloads.
-
-
Added in Windows 10, version 1607. Specifies the maximum download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth.
+Note that downloads from LAN peers will not be throttled even when this policy is set.
-
The default value 0 (zero) means that Delivery Optimization dynamically adjusts to use the available bandwidth for downloads.
+
+
-
-
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Added in Windows 10, next major update. Set this policy to restrict peer selection via selected option.
+Options available are: 1=Subnet mask (more options will be added in a future release).
+
+Option 1 (Subnet mask) applies to both Download Mode LAN (1) and Group (2).
+
+
+
+The following list shows the supported values:
+
+- 1 - Subnet mask.
+
+
+
+
+
+
+
+**DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Added in Windows 10, next major update. Specifies the maximum background download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth.
+
+Note that downloads from LAN peers will not be throttled even when this policy is set.
+
+
+
+This policy allows an IT Admin to define the following:
+
+- Business hours range (for example 06:00 to 18:00)
+- % of throttle for foreground traffic during business hours
+- % of throttle for foreground traffic outside of business hours
+
+
+
+
+
+
+
+**DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Added in Windows 10, next major update. Specifies the maximum foreground download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth.
+
+Note that downloads from LAN peers will not be throttled even when this policy is set.
+
+
+
+This policy allows an IT Admin to define the following:
+
+- Business hours range (for example 06:00 to 18:00)
+- % of throttle for foreground traffic during business hours
+- % of throttle for foreground traffic outside of business hours
+
+
+
Footnote:
@@ -841,7 +1278,7 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
## DeliveryOptimization policies supported by Microsoft Surface Hub
diff --git a/windows/client-management/mdm/policy-csp-desktop.md b/windows/client-management/mdm/policy-csp-desktop.md
index 048304c12e..56fcae51f5 100644
--- a/windows/client-management/mdm/policy-csp-desktop.md
+++ b/windows/client-management/mdm/policy-csp-desktop.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - Desktop
@@ -15,7 +15,7 @@ ms.date: 11/01/2017
-
+
## Desktop policies
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -59,15 +61,15 @@ ms.date: 11/01/2017
-
-
+
+
Prevents users from changing the path to their profile folders.
By default, a user can change the location of their individual profile folders like Documents, Music etc. by typing a new path in the Locations tab of the folder's Properties dialog box.
If you enable this setting, users are unable to type a new location in the Target box.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -75,15 +77,15 @@ If you enable this setting, users are unable to type a new location in the Targe
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Prohibit User from manually redirecting Profile Folders*
- GP name: *DisablePersonalDirChange*
- GP path: *Desktop*
- GP ADMX file name: *desktop.admx*
-
-
+
+
Footnote:
@@ -92,7 +94,7 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
## Desktop policies supported by Microsoft Surface Hub
diff --git a/windows/client-management/mdm/policy-csp-deviceguard.md b/windows/client-management/mdm/policy-csp-deviceguard.md
index 7570724110..bde8f4dc65 100644
--- a/windows/client-management/mdm/policy-csp-deviceguard.md
+++ b/windows/client-management/mdm/policy-csp-deviceguard.md
@@ -6,15 +6,16 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - DeviceGuard
+
-
+
## DeviceGuard policies
Added in Windows 10, version 1709. Turns on virtualization based security(VBS) at the next reboot. virtualization based security uses the Windows Hypervisor to provide support for security services. Value type is integer. Supported values:
-
-
0 (default) - disable virtualization based security
-
1 - enable virtualization based security
-
+
+
+Added in Windows 10, version 1709. Turns on virtualization based security(VBS) at the next reboot. virtualization based security uses the Windows Hypervisor to provide support for security services. Value type is integer.
+
+
+
+The following list shows the supported values:
+
+- 0 (default) - disable virtualization based security.
+- 1 - enable virtualization based security.
+
+
+
-
-
-
+
+
**DeviceGuard/LsaCfgFlags**
-
+
Added in Windows 10, version 1709. This setting lets users turn on Credential Guard with virtualization-based security to help protect credentials at next reboot. Value type is integer. Supported values:
-
-
0 (default) - (Disabled) Turns off Credential Guard remotely if configured previously without UEFI Lock
-
1 - (Enabled with UEFI lock) Turns on Credential Guard with UEFI lock
-
2 - (Enabled without lock) Turns on Credential Guard without UEFI lock
+
+
+Added in Windows 10, version 1709. This setting lets users turn on Credential Guard with virtualization-based security to help protect credentials at next reboot. Value type is integer.
-
+
+
+The following list shows the supported values:
+
+- 0 (default) - (Disabled) Turns off Credential Guard remotely if configured previously without UEFI Lock.
+- 1 - (Enabled with UEFI lock) Turns on Credential Guard with UEFI lock.
+- 2 - (Enabled without lock) Turns on Credential Guard without UEFI lock.
+
+
+
-
-
-
+
+
**DeviceGuard/RequirePlatformSecurityFeatures**
-
+
Home
@@ -149,8 +159,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -158,18 +168,19 @@ ms.date: 11/01/2017
-
-
-Added in Windows 10, version 1709. Specifies the platform security level at the next reboot. Value type is integer. Supported values:
-
-
1 (default) - Turns on VBS with Secure Boot.
-
3 - Turns on VBS with Secure Boot and direct memory access (DMA). DMA requires hardware support.
-
-
-
+
+
+Added in Windows 10, version 1709. Specifies the platform security level at the next reboot. Value type is integer.
-
-
+
+
+The following list shows the supported values:
+
+- 1 (default) - Turns on VBS with Secure Boot.
+- 3 - Turns on VBS with Secure Boot and direct memory access (DMA). DMA requires hardware support.
+
+
+
Footnote:
@@ -178,11 +189,5 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
-
-
-## DeviceGuard policies supported by Microsoft Surface Hub
-
-- [DeviceGuard/AllowKernelControlFlowGuard](#deviceguard-allowkernelcontrolflowguard)
-
+
diff --git a/windows/client-management/mdm/policy-csp-deviceinstallation.md b/windows/client-management/mdm/policy-csp-deviceinstallation.md
index 7e7740810a..5813ea9ecb 100644
--- a/windows/client-management/mdm/policy-csp-deviceinstallation.md
+++ b/windows/client-management/mdm/policy-csp-deviceinstallation.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - DeviceInstallation
@@ -15,7 +15,7 @@ ms.date: 11/01/2017
-
+
## DeviceInstallation policies
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -62,15 +64,15 @@ ms.date: 11/01/2017
-
-
+
+
This policy setting allows you to specify a list of Plug and Play hardware IDs and compatible IDs for devices that Windows is prevented from installing. This policy setting takes precedence over any other policy setting that allows Windows to install a device.
If you enable this policy setting, Windows is prevented from installing a device whose hardware ID or compatible ID appears in the list you create. If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server.
If you disable or do not configure this policy setting, devices can be installed and updated as allowed or prevented by other policy settings.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -78,20 +80,22 @@ If you disable or do not configure this policy setting, devices can be installed
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Prevent installation of devices that match any of these device IDs*
- GP name: *DeviceInstall_IDs_Deny*
- GP path: *System/Device Installation/Device Installation Restrictions*
- GP ADMX file name: *deviceinstallation.admx*
-
-
+
+
+
-
+
+
**DeviceInstallation/PreventInstallationOfMatchingDeviceSetupClasses**
-
+
Home
@@ -113,8 +117,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -122,15 +126,15 @@ ADMX Info:
-
-
+
+
This policy setting allows you to specify a list of device setup class globally unique identifiers (GUIDs) for device drivers that Windows is prevented from installing. This policy setting takes precedence over any other policy setting that allows Windows to install a device.
If you enable this policy setting, Windows is prevented from installing or updating device drivers whose device setup class GUIDs appear in the list you create. If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server.
If you disable or do not configure this policy setting, Windows can install and update devices as allowed or prevented by other policy settings.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -138,15 +142,15 @@ If you disable or do not configure this policy setting, Windows can install and
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Prevent installation of devices using drivers that match these device setup classes*
- GP name: *DeviceInstall_Classes_Deny*
- GP path: *System/Device Installation/Device Installation Restrictions*
- GP ADMX file name: *deviceinstallation.admx*
-
-
+
+
Footnote:
@@ -155,5 +159,5 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
diff --git a/windows/client-management/mdm/policy-csp-devicelock.md b/windows/client-management/mdm/policy-csp-devicelock.md
index f4face45fd..2555067447 100644
--- a/windows/client-management/mdm/policy-csp-devicelock.md
+++ b/windows/client-management/mdm/policy-csp-devicelock.md
@@ -6,16 +6,18 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - DeviceLock
+> [!WARNING]
+> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
+
## DeviceLock policies
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -104,30 +111,33 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
-
Specifies whether the user must input a PIN or password when the device resumes from an idle state.
+Specifies whether the user must input a PIN or password when the device resumes from an idle state.
> [!NOTE]
> This policy must be wrapped in an Atomic command.
-
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
-
+
+
+
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -158,33 +168,38 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
-
Specifies whether to show a user-configurable setting to control the screen timeout while on the lock screen of Windows 10 Mobile devices.
+Specifies whether to show a user-configurable setting to control the screen timeout while on the lock screen of Windows 10 Mobile devices.
> [!NOTE]
> This policy must be wrapped in an Atomic command.
-
The following list shows the supported values:
-
-- 0 (default) – Not allowed.
-- 1 – Allowed.
> [!IMPORTANT]
> If this policy is set to 1 (Allowed), the value set by **DeviceLock/ScreenTimeOutWhileLocked** is ignored. To ensure enterprise control over the screen timeout, set this policy to 0 (Not allowed) and use **DeviceLock/ScreenTimeOutWhileLocked** to set the screen timeout period.
-
-
+
+
+The following list shows the supported values:
+
+- 0 (default) – Not allowed.
+- 1 – Allowed.
+
+
+
+
Specifies whether PINs or passwords such as "1111" or "1234" are allowed. For the desktop, it also controls the use of picture passwords.
+
+
+Specifies whether PINs or passwords such as "1111" or "1234" are allowed. For the desktop, it also controls the use of picture passwords.
> [!NOTE]
> This policy must be wrapped in an Atomic command.
-
The following list shows the supported values:
+
+For additional information about this policy, see [Exchange ActiveSync Policy Engine Overview](https://technet.microsoft.com/library/dn282287.aspx).
+
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
For additional information about this policy, see [Exchange ActiveSync Policy Engine Overview](https://technet.microsoft.com/library/dn282287.aspx).
+
+
-
-
Determines the type of PIN or password required. This policy only applies if the **DeviceLock/DevicePasswordEnabled** policy is set to 0 (required).
+
+
+Determines the type of PIN or password required. This policy only applies if the **DeviceLock/DevicePasswordEnabled** policy is set to 0 (required).
> [!NOTE]
> This policy must be wrapped in an Atomic command.
@@ -277,26 +297,29 @@ ms.date: 11/01/2017
> Always use the Replace command instead of Add for this policy in Windows 10 for desktop editions (Home, Pro, Enterprise, and Education).
-
The following list shows the supported values:
-
-- 0 – Alphanumeric PIN or password required.
-- 1 – Numeric PIN or password required.
-- 2 (default) – Users can choose: Numeric PIN or password, or Alphanumeric PIN or password.
> [!NOTE]
> If **AlphanumericDevicePasswordRequired** is set to 1 or 2, then MinDevicePasswordLength = 0 and MinDevicePasswordComplexCharacters = 1.
>
> If **AlphanumericDevicePasswordRequired** is set to 0, then MinDevicePasswordLength = 4 and MinDevicePasswordComplexCharacters = 2.
-
+
+
+The following list shows the supported values:
+
+- 0 – Alphanumeric PIN or password required.
+- 1 – Numeric PIN or password required.
+- 2 (default) – Users can choose: Numeric PIN or password, or Alphanumeric PIN or password.
+
+
+
-
-
Specifies whether device lock is enabled.
+
+
+Specifies whether device lock is enabled.
> [!NOTE]
> This policy must be wrapped in an Atomic command.
@@ -337,10 +360,6 @@ ms.date: 11/01/2017
> Always use the Replace command instead of Add for this policy in Windows 10 for desktop editions.
-
The following list shows the supported values:
-
-- 0 (default) – Enabled
-- 1 – Disabled
> [!IMPORTANT]
> The **DevicePasswordEnabled** setting must be set to 0 (device password is enabled) for the following policy settings to take effect:
@@ -376,13 +395,22 @@ ms.date: 11/01/2017
> - MaxDevicePasswordFailedAttempts
> - MaxInactivityTimeDeviceLock
-
-
+
+
+The following list shows the supported values:
+
+- 0 (default) – Enabled
+- 1 – Disabled
+
+
+
+
Specifies when the password expires (in days).
+
+
+Specifies when the password expires (in days).
> [!NOTE]
> This policy must be wrapped in an Atomic command.
-
The following list shows the supported values:
+
+If all policy values = 0 then 0; otherwise, Min policy value is the most secure value.
+
+For additional information about this policy, see [Exchange ActiveSync Policy Engine Overview](https://technet.microsoft.com/library/dn282287.aspx).
+
+
+
+The following list shows the supported values:
- An integer X where 0 <= X <= 730.
- 0 (default) - Passwords do not expire.
-
If all policy values = 0 then 0; otherwise, Min policy value is the most secure value.
+
+
-
For additional information about this policy, see [Exchange ActiveSync Policy Engine Overview](https://technet.microsoft.com/library/dn282287.aspx).
-
-
-
Specifies how many passwords can be stored in the history that can’t be used.
+
+
+Specifies how many passwords can be stored in the history that can’t be used.
> [!NOTE]
> This policy must be wrapped in an Atomic command.
-
The following list shows the supported values:
+
+The value includes the user's current password. This means that with a setting of 1 the user cannot reuse their current password when choosing a new password, while a setting of 5 means that a user cannot set their new password to their current password or any of their previous four passwords.
+
+Max policy value is the most restricted.
+
+For additional information about this policy, see [Exchange ActiveSync Policy Engine Overview](https://technet.microsoft.com/library/dn282287.aspx).
+
+
+
+The following list shows the supported values:
- An integer X where 0 <= X <= 50.
- 0 (default)
-
The value includes the user's current password. This means that with a setting of 1 the user cannot reuse their current password when choosing a new password, while a setting of 5 means that a user cannot set their new password to their current password or any of their previous four passwords.
+
+
-
Max policy value is the most restricted.
-
-
For additional information about this policy, see [Exchange ActiveSync Policy Engine Overview](https://technet.microsoft.com/library/dn282287.aspx).
-
-
-
Added in Windows 10, version 1607. Specifies the default lock screen and logon image shown when no user is signed in. It also sets the specified image for all users, which replaces the default image. The same image is used for both the lock and logon screens. Users will not be able to change this image.
+
+
+Added in Windows 10, version 1607. Specifies the default lock screen and logon image shown when no user is signed in. It also sets the specified image for all users, which replaces the default image. The same image is used for both the lock and logon screens. Users will not be able to change this image.
> [!NOTE]
> This policy is only enforced in Windows 10 Enterprise and Education editions and not supported in Windows 10 Home and Pro.
-
Value type is a string, which is the full image filepath and filename.
+Value type is a string, which is the full image filepath and filename.
+
+
+
-
-
Added in Windows 10, version 1607. Restricts lock screen image to a specific lock screen provider. Users will not be able change this provider.
+
+
+Added in Windows 10, version 1607. Restricts lock screen image to a specific lock screen provider. Users will not be able change this provider.
> [!NOTE]
> This policy is only enforced in Windows 10 for mobile devices.
-
Value type is a string, which is the AppID.
+Value type is a string, which is the AppID.
+
+
+
-
-
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -617,37 +659,42 @@ ms.date: 11/01/2017
-
-
+
+
The number of authentication failures allowed before the device will be wiped. A value of 0 disables device wipe functionality.
> [!NOTE]
> This policy must be wrapped in an Atomic command.
-
This policy has different behaviors on the mobile device and desktop.
+This policy has different behaviors on the mobile device and desktop.
- On a mobile device, when the user reaches the value set by this policy, then the device is wiped.
- On a desktop, when the user reaches the value set by this policy, it is not wiped. Instead, the desktop is put on BitLocker recovery mode, which makes the data inaccessible but recoverable. If BitLocker is not enabled, then the policy cannot be enforced.
Prior to reaching the failed attempts limit, the user is sent to the lock screen and warned that more failed attempts will lock their computer. When the user reaches the limit, the device automatically reboots and shows the BitLocker recovery page. This page prompts the user for the BitLocker recovery key.
-
The following list shows the supported values:
+
+Most secure value is 0 if all policy values = 0; otherwise, Min policy value is the most secure value.
+
+For additional information about this policy, see [Exchange ActiveSync Policy Engine Overview](https://technet.microsoft.com/library/dn282287.aspx).
+
+
+
+The following list shows the supported values:
- An integer X where 4 <= X <= 16 for desktop and 0 <= X <= 999 for mobile devices.
- 0 (default) - The device is never wiped after an incorrect PIN or password is entered.
-
Most secure value is 0 if all policy values = 0; otherwise, Min policy value is the most secure value.
+
+
-
For additional information about this policy, see [Exchange ActiveSync Policy Engine Overview](https://technet.microsoft.com/library/dn282287.aspx).
-
-
-
@@ -669,8 +716,8 @@ The number of authentication failures allowed before the device will be wiped. A
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -678,28 +725,33 @@ The number of authentication failures allowed before the device will be wiped. A
-
-
-
Specifies the maximum amount of time (in minutes) allowed after the device is idle that will cause the device to become PIN or password locked. Users can select any existing timeout value less than the specified maximum time in the Settings app. Note the Lumia 950 and 950XL have a maximum timeout value of 5 minutes, regardless of the value set by this policy.
+
+
+Specifies the maximum amount of time (in minutes) allowed after the device is idle that will cause the device to become PIN or password locked. Users can select any existing timeout value less than the specified maximum time in the Settings app. Note the Lumia 950 and 950XL have a maximum timeout value of 5 minutes, regardless of the value set by this policy.
> [!NOTE]
> This policy must be wrapped in an Atomic command.
-
The following list shows the supported values:
+
+For additional information about this policy, see [Exchange ActiveSync Policy Engine Overview](https://technet.microsoft.com/library/dn282287.aspx).
+
+
+
+The following list shows the supported values:
- An integer X where 0 <= X <= 999.
- 0 (default) - No timeout is defined. The default of "0" is Windows Phone 7.5 parity and is interpreted by as "No timeout is defined."
-
For additional information about this policy, see [Exchange ActiveSync Policy Engine Overview](https://technet.microsoft.com/library/dn282287.aspx).
+
+
-
-
@@ -721,8 +773,8 @@ The number of authentication failures allowed before the device will be wiped. A
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -730,26 +782,29 @@ The number of authentication failures allowed before the device will be wiped. A
-
-
-
Specifies the maximum amount of time (in minutes) allowed after the device is idle that will cause the device to become PIN or password locked while connected to an external display.
+
+
+Specifies the maximum amount of time (in minutes) allowed after the device is idle that will cause the device to become PIN or password locked while connected to an external display.
> [!NOTE]
> This policy must be wrapped in an Atomic command.
-
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- An integer X where 0 <= X <= 999.
- 0 (default) - No timeout is defined. The default of "0" is Windows Phone 7.5 parity and is interpreted by as "No timeout is defined."
-
-
+
+
+
@@ -771,8 +826,8 @@ The number of authentication failures allowed before the device will be wiped. A
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -780,23 +835,23 @@ The number of authentication failures allowed before the device will be wiped. A
-
-
-
The number of complex element types (uppercase and lowercase letters, numbers, and punctuation) required for a strong PIN or password.
+
+
+The number of complex element types (uppercase and lowercase letters, numbers, and punctuation) required for a strong PIN or password.
> [!NOTE]
> This policy must be wrapped in an Atomic command.
>
> Always use the Replace command instead of Add for this policy in Windows 10 for desktop editions.
-
PIN enforces the following behavior for desktop and mobile devices:
+PIN enforces the following behavior for desktop and mobile devices:
- 1 - Digits only
- 2 - Digits and lowercase letters are required
- 3 - Digits, lowercase letters, and uppercase letters are required. Not supported in desktop Microsoft accounts and domain accounts.
- 4 - Digits, lowercase letters, uppercase letters, and special characters are required. Not supported in desktop.
-
The default value is 1. The following list shows the supported values and actual enforced values:
+The default value is 1. The following list shows the supported values and actual enforced values:
@@ -837,7 +892,7 @@ The number of authentication failures allowed before the device will be wiped. A
-
Enforced values for Local and Microsoft Accounts:
+Enforced values for Local and Microsoft Accounts:
- Local accounts support values of 1, 2, and 3, however they always enforce a value of 3.
- Passwords for local accounts must meet the following minimum requirements:
@@ -851,17 +906,19 @@ The number of authentication failures allowed before the device will be wiped. A
- Base 10 digits (0 through 9)
- Special characters (!, $, \#, %, etc.)
-
The enforcement of policies for Microsoft accounts happen on the server, and the server requires a password length of 8 and a complexity of 2. A complexity value of 3 or 4 is unsupported and setting this value on the server makes Microsoft accounts non-compliant.
+The enforcement of policies for Microsoft accounts happen on the server, and the server requires a password length of 8 and a complexity of 2. A complexity value of 3 or 4 is unsupported and setting this value on the server makes Microsoft accounts non-compliant.
-
For additional information about this policy, see [Exchange ActiveSync Policy Engine Overview](https://technet.microsoft.com/library/dn282287.aspx) and [KB article](https://support.office.com/article/This-device-doesn-t-meet-the-security-requirements-set-by-your-email-administrator-87132fc7-2c7f-4a71-9de0-779ff81c86ca).
+For additional information about this policy, see [Exchange ActiveSync Policy Engine Overview](https://technet.microsoft.com/library/dn282287.aspx) and [KB article](https://support.office.com/article/This-device-doesn-t-meet-the-security-requirements-set-by-your-email-administrator-87132fc7-2c7f-4a71-9de0-779ff81c86ca).
+
+
+
-
-
-
+
+
**DeviceLock/MinDevicePasswordLength**
-
+
Home
@@ -883,8 +940,8 @@ The number of authentication failures allowed before the device will be wiped. A
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -892,9 +949,9 @@ The number of authentication failures allowed before the device will be wiped. A
-
-
-
Specifies the minimum number or characters required in the PIN or password.
+
+
+Specifies the minimum number or characters required in the PIN or password.
> [!NOTE]
> This policy must be wrapped in an Atomic command.
@@ -902,23 +959,75 @@ The number of authentication failures allowed before the device will be wiped. A
> Always use the Replace command instead of Add for this policy in Windows 10 for desktop editions.
-
The following list shows the supported values:
+
+Max policy value is the most restricted.
+
+For additional information about this policy, see [Exchange ActiveSync Policy Engine Overview](https://technet.microsoft.com/library/dn282287.aspx) and [KB article](https://support.office.com/article/This-device-doesn-t-meet-the-security-requirements-set-by-your-email-administrator-87132fc7-2c7f-4a71-9de0-779ff81c86ca).
+
+
+
+The following list shows the supported values:
- An integer X where 4 <= X <= 16 for mobile devices and desktop. However, local accounts will always enforce a minimum password length of 6.
- Not enforced.
- The default value is 4 for mobile devices and desktop devices.
-
Max policy value is the most restricted.
+
+
-
For additional information about this policy, see [Exchange ActiveSync Policy Engine Overview](https://technet.microsoft.com/library/dn282287.aspx) and [KB article](https://support.office.com/article/This-device-doesn-t-meet-the-security-requirements-set-by-your-email-administrator-87132fc7-2c7f-4a71-9de0-779ff81c86ca).
-
-
-
-
+
+
+**DeviceLock/MinimumPasswordAge**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
3
+
3
+
3
+
3
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+This security setting determines the period of time (in days) that a password must be used before the user can change it. You can set a value between 1 and 998 days, or you can allow changes immediately by setting the number of days to 0.
+
+The minimum password age must be less than the Maximum password age, unless the maximum password age is set to 0, indicating that passwords will never expire. If the maximum password age is set to 0, the minimum password age can be set to any value between 0 and 998.
+
+Configure the minimum password age to be more than 0 if you want Enforce password history to be effective. Without a minimum password age, users can cycle through passwords repeatedly until they get to an old favorite. The default setting does not follow this recommendation, so that an administrator can specify a password for a user and then require the user to change the administrator-defined password when the user logs on. If the password history is set to 0, the user does not have to choose a new password. For this reason, Enforce password history is set to 1 by default.
+
+
+
+
+
+
+
**DeviceLock/PreventLockScreenSlideShow**
-
+
Home
@@ -940,8 +1049,8 @@ The number of authentication failures allowed before the device will be wiped. A
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -949,15 +1058,15 @@ The number of authentication failures allowed before the device will be wiped. A
-
-
+
+
Disables the lock screen slide show settings in PC Settings and prevents a slide show from playing on the lock screen.
By default, users can enable a slide show that will run after they lock the machine.
If you enable this setting, users will no longer be able to modify slide show settings in PC Settings, and no slide show will ever start.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -965,20 +1074,22 @@ If you enable this setting, users will no longer be able to modify slide show se
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Prevent enabling lock screen slide show*
- GP name: *CPL_Personalization_NoLockScreenSlideshow*
- GP path: *Control Panel/Personalization*
- GP ADMX file name: *ControlPanelDisplay.admx*
-
-
+
+
+
-
+
+
**DeviceLock/ScreenTimeoutWhileLocked**
-
+
Home
@@ -1000,8 +1111,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1009,23 +1120,23 @@ ADMX Info:
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
-
Allows an enterprise to set the duration in seconds for the screen timeout while on the lock screen of Windows 10 Mobile devices.
+Allows an enterprise to set the duration in seconds for the screen timeout while on the lock screen of Windows 10 Mobile devices.
-
Minimum supported value is 10.
+Minimum supported value is 10.
-
Maximum supported value is 1800.
+Maximum supported value is 1800.
-
The default value is 10.
+The default value is 10.
-
Most restricted value is 0.
+Most restricted value is 0.
-
-
+
+
Footnote:
@@ -1034,7 +1145,7 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
## DeviceLock policies that can be set using Exchange Active Sync (EAS)
diff --git a/windows/client-management/mdm/policy-csp-display.md b/windows/client-management/mdm/policy-csp-display.md
index b23977c0bc..fbfc7878d5 100644
--- a/windows/client-management/mdm/policy-csp-display.md
+++ b/windows/client-management/mdm/policy-csp-display.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - Display
@@ -15,7 +15,7 @@ ms.date: 11/01/2017
-
+
## Display policies
GDI DPI Scaling enables applications that are not DPI aware to become per monitor DPI aware.
+
+
+GDI DPI Scaling enables applications that are not DPI aware to become per monitor DPI aware.
-
This policy setting lets you specify legacy applications that have GDI DPI Scaling turned off.
+This policy setting lets you specify legacy applications that have GDI DPI Scaling turned off.
-
If you enable this policy setting, GDI DPI Scaling is turned off for all applications in the list, even if they are enabled by using ApplicationCompatibility database, ApplicationCompatibility UI System (Enhanced) setting, or an application manifest.
+If you enable this policy setting, GDI DPI Scaling is turned off for all applications in the list, even if they are enabled by using ApplicationCompatibility database, ApplicationCompatibility UI System (Enhanced) setting, or an application manifest.
-
If you disable or do not configure this policy setting, GDI DPI Scaling might still be turned on for legacy applications.
+If you disable or do not configure this policy setting, GDI DPI Scaling might still be turned on for legacy applications.
-
If GDI DPI Scaling is configured to both turn off and turn on an application, the application will be turned off.
+If GDI DPI Scaling is configured to both turn off and turn on an application, the application will be turned off.
-
To validate on Desktop, do the following:
+
+
+To validate on Desktop, do the following:
1. Configure the setting for an app which has GDI DPI scaling enabled via MDM or any other supported mechanisms.
2. Run the app and observe blurry text.
-
-
+
+
+
GDI DPI Scaling enables applications that are not DPI aware to become per monitor DPI aware.
+
+
+GDI DPI Scaling enables applications that are not DPI aware to become per monitor DPI aware.
-
This policy setting lets you specify legacy applications that have GDI DPI Scaling turned on.
+This policy setting lets you specify legacy applications that have GDI DPI Scaling turned on.
-
If you enable this policy setting, GDI DPI Scaling is turned on for all legacy applications in the list.
+If you enable this policy setting, GDI DPI Scaling is turned on for all legacy applications in the list.
-
If you disable or do not configure this policy setting, GDI DPI Scaling will not be enabled for an application except when an application is enabled by using ApplicationCompatibility database, ApplicationCompatibility UI System (Enhanced) setting, or an application manifest.
+If you disable or do not configure this policy setting, GDI DPI Scaling will not be enabled for an application except when an application is enabled by using ApplicationCompatibility database, ApplicationCompatibility UI System (Enhanced) setting, or an application manifest.
-
If GDI DPI Scaling is configured to both turn off and turn on an application, the application will be turned off.
+If GDI DPI Scaling is configured to both turn off and turn on an application, the application will be turned off.
-
To validate on Desktop, do the following:
+
+
+To validate on Desktop, do the following:
1. Configure the setting for an app which uses GDI.
2. Run the app and observe crisp text.
-
-
+
+
Footnote:
@@ -143,5 +151,5 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
diff --git a/windows/client-management/mdm/policy-csp-education.md b/windows/client-management/mdm/policy-csp-education.md
index fb7ee74e89..3583549ed4 100644
--- a/windows/client-management/mdm/policy-csp-education.md
+++ b/windows/client-management/mdm/policy-csp-education.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - Education
@@ -15,7 +15,7 @@ ms.date: 11/01/2017
-
+
## Education policies
@@ -30,11 +30,13 @@ ms.date: 11/01/2017
+
-
+
+
**Education/DefaultPrinterName**
-
+
Home
@@ -56,8 +58,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -65,19 +67,21 @@ ms.date: 11/01/2017
-
-
+
+
Added in Windows 10, version 1709. This policy allows IT Admins to set the user's default printer.
The policy value is expected to be the name (network host name) of an installed printer.
-
-
+
+
+
-
+
+
**Education/PreventAddingNewPrinters**
-
+
Home
@@ -99,8 +103,8 @@ The policy value is expected to be the name (network host name) of an installed
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -108,22 +112,26 @@ The policy value is expected to be the name (network host name) of an installed
-
-
+
+
Added in Windows 10, version 1709. Allows IT Admins to prevent user installation of additional printers from the printers settings.
+
+
The following list shows the supported values:
- 0 (default) – Allow user installation.
- 1 – Prevent user installation.
-
-
+
+
+
-
+
+
**Education/PrinterNames**
-
+
Home
@@ -145,8 +153,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -154,14 +162,14 @@ The following list shows the supported values:
-
-
+
+
Added in Windows 10, version 1709. Allows IT Admins to automatically provision printers based on their names (network host names).
The policy value is expected to be a `````` seperated list of printer names. The OS will attempt to search and install the matching printer driver for each listed printer.
-
-
+
+
Footnote:
@@ -170,5 +178,5 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
diff --git a/windows/client-management/mdm/policy-csp-enterprisecloudprint.md b/windows/client-management/mdm/policy-csp-enterprisecloudprint.md
index 3506a2c3f1..63d4b5f3b2 100644
--- a/windows/client-management/mdm/policy-csp-enterprisecloudprint.md
+++ b/windows/client-management/mdm/policy-csp-enterprisecloudprint.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - EnterpriseCloudPrint
@@ -15,7 +15,7 @@ ms.date: 11/01/2017
-
+
## EnterpriseCloudPrint policies
Added in Windows 10, version 1703. Specifies the authentication endpoint for acquiring OAuth tokens. This policy must target ./User, otherwise it fails.
+
+
+Added in Windows 10, version 1703. Specifies the authentication endpoint for acquiring OAuth tokens. This policy must target ./User, otherwise it fails.
-
The datatype is a string.
+The datatype is a string.
-
The default value is an empty string. Otherwise, the value should contain the URL of an endpoint. For example, "https://azuretenant.contoso.com/adfs".
+The default value is an empty string. Otherwise, the value should contain the URL of an endpoint. For example, "https://azuretenant.contoso.com/adfs".
+
+
+
-
-
Added in Windows 10, version 1703. Specifies the GUID of a client application authorized to retrieve OAuth tokens from the OAuthAuthority. This policy must target ./User, otherwise it fails.
+
+
+Added in Windows 10, version 1703. Specifies the GUID of a client application authorized to retrieve OAuth tokens from the OAuthAuthority. This policy must target ./User, otherwise it fails.
-
The datatype is a string.
+The datatype is a string.
-
The default value is an empty string. Otherwise, the value should contain a GUID. For example, "E1CF1107-FF90-4228-93BF-26052DD2C714".
+The default value is an empty string. Otherwise, the value should contain a GUID. For example, "E1CF1107-FF90-4228-93BF-26052DD2C714".
+
+
+
-
-
Added in Windows 10, version 1703. Specifies the per-user resource URL for which access is requested by the enterprise cloud print client during OAuth authentication. This policy must target ./User, otherwise it fails.
+
+
+Added in Windows 10, version 1703. Specifies the per-user resource URL for which access is requested by the enterprise cloud print client during OAuth authentication. This policy must target ./User, otherwise it fails.
-
The datatype is a string.
+The datatype is a string.
-
The default value is an empty string. Otherwise, the value should contain a URL. For example, "http://MicrosoftEnterpriseCloudPrint/CloudPrint".
+The default value is an empty string. Otherwise, the value should contain a URL. For example, "http://MicrosoftEnterpriseCloudPrint/CloudPrint".
+
+
+
-
-
Added in Windows 10, version 1703. Specifies the per-user end point for discovering cloud printers. This policy must target ./User, otherwise it fails.
+
+
+Added in Windows 10, version 1703. Specifies the per-user end point for discovering cloud printers. This policy must target ./User, otherwise it fails.
-
The datatype is a string.
+The datatype is a string.
-
The default value is an empty string. Otherwise, the value should contain the URL of an endpoint. For example, "https://cloudprinterdiscovery.contoso.com".
+The default value is an empty string. Otherwise, the value should contain the URL of an endpoint. For example, "https://cloudprinterdiscovery.contoso.com".
+
+
+
-
-
Added in Windows 10, version 1703. Defines the maximum number of printers that should be queried from a discovery end point. This policy must target ./User, otherwise it fails.
+
+
+Added in Windows 10, version 1703. Defines the maximum number of printers that should be queried from a discovery end point. This policy must target ./User, otherwise it fails.
-
The datatype is an integer.
+The datatype is an integer.
-
For Windows Mobile, the default value is 20.
+For Windows Mobile, the default value is 20.
+
+
+
-
-
Added in Windows 10, version 1703. Specifies the per-user resource URL for which access is requested by the Mopria discovery client during OAuth authentication. This policy must target ./User, otherwise it fails.
+
+
+Added in Windows 10, version 1703. Specifies the per-user resource URL for which access is requested by the Mopria discovery client during OAuth authentication. This policy must target ./User, otherwise it fails.
-
The datatype is a string.
+The datatype is a string.
-
The default value is an empty string. Otherwise, the value should contain a URL. For example, "http://MopriaDiscoveryService/CloudPrint".
+The default value is an empty string. Otherwise, the value should contain a URL. For example, "http://MopriaDiscoveryService/CloudPrint".
-
-
+
+
Footnote:
@@ -317,5 +329,5 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
diff --git a/windows/client-management/mdm/policy-csp-errorreporting.md b/windows/client-management/mdm/policy-csp-errorreporting.md
index 67f7bd2d6a..e33bbb0431 100644
--- a/windows/client-management/mdm/policy-csp-errorreporting.md
+++ b/windows/client-management/mdm/policy-csp-errorreporting.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - ErrorReporting
@@ -15,7 +15,7 @@ ms.date: 11/01/2017
-
+
## ErrorReporting policies
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -71,8 +73,8 @@ ms.date: 11/01/2017
-
-
+
+
This policy setting determines the consent behavior of Windows Error Reporting for specific event types.
If you enable this policy setting, you can add specific event types to a list by clicking Show, and typing event types in the Value Name column of the Show Contents dialog box. Event types are those for generic, non-fatal errors: crash, no response, and kernel fault errors. For each specified event type, you can set a consent level of 0, 1, 2, 3, or 4.
@@ -89,7 +91,7 @@ If you enable this policy setting, you can add specific event types to a list by
If you disable or do not configure this policy setting, then the default consent settings that are applied are those specified by the user in Control Panel, or in the Configure Default Consent policy setting.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -97,20 +99,22 @@ If you disable or do not configure this policy setting, then the default consent
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Customize consent settings*
- GP name: *WerConsentCustomize_2*
- GP path: *Windows Components/Windows Error Reporting/Consent*
- GP ADMX file name: *ErrorReporting.admx*
-
-
+
+
+
-
+
+
**ErrorReporting/DisableWindowsErrorReporting**
-
+
Home
@@ -132,8 +136,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -141,15 +145,15 @@ ADMX Info:
-
-
+
+
This policy setting turns off Windows Error Reporting, so that reports are not collected or sent to either Microsoft or internal servers within your organization when software unexpectedly stops working or fails.
If you enable this policy setting, Windows Error Reporting does not send any problem information to Microsoft. Additionally, solution information is not available in Security and Maintenance in Control Panel.
If you disable or do not configure this policy setting, the Turn off Windows Error Reporting policy setting in Computer Configuration/Administrative Templates/System/Internet Communication Management/Internet Communication settings takes precedence. If Turn off Windows Error Reporting is also either disabled or not configured, user settings in Control Panel for Windows Error Reporting are applied.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -157,20 +161,22 @@ If you disable or do not configure this policy setting, the Turn off Windows Err
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Disable Windows Error Reporting*
- GP name: *WerDisable_2*
- GP path: *Windows Components/Windows Error Reporting*
- GP ADMX file name: *ErrorReporting.admx*
-
-
+
+
+
-
+
+
**ErrorReporting/DisplayErrorNotification**
-
+
Home
@@ -192,8 +198,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -201,8 +207,8 @@ ADMX Info:
-
-
+
+
This policy setting controls whether users are shown an error dialog box that lets them report an error.
If you enable this policy setting, users are notified in a dialog box that an error has occurred, and can display more details about the error. If the Configure Error Reporting policy setting is also enabled, the user can also report the error.
@@ -213,7 +219,7 @@ If you do not configure this policy setting, users can change this setting in Co
See also the Configure Error Reporting policy setting.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -221,20 +227,22 @@ See also the Configure Error Reporting policy setting.
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Display Error Notification*
- GP name: *PCH_ShowUI*
- GP path: *Windows Components/Windows Error Reporting*
- GP ADMX file name: *ErrorReporting.admx*
-
-
+
+
+
-
+
+
**ErrorReporting/DoNotSendAdditionalData**
-
+
Home
@@ -256,8 +264,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -265,15 +273,15 @@ ADMX Info:
-
-
+
+
This policy setting controls whether additional data in support of error reports can be sent to Microsoft automatically.
If you enable this policy setting, any additional data requests from Microsoft in response to a Windows Error Reporting report are automatically declined, without notification to the user.
If you disable or do not configure this policy setting, then consent policy settings in Computer Configuration/Administrative Templates/Windows Components/Windows Error Reporting/Consent take precedence.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -281,20 +289,22 @@ If you disable or do not configure this policy setting, then consent policy sett
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Do not send additional data*
- GP name: *WerNoSecondLevelData_2*
- GP path: *Windows Components/Windows Error Reporting*
- GP ADMX file name: *ErrorReporting.admx*
-
-
+
+
+
-
+
+
**ErrorReporting/PreventCriticalErrorDisplay**
-
+
Home
@@ -316,8 +326,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -325,15 +335,15 @@ ADMX Info:
-
-
+
+
This policy setting prevents the display of the user interface for critical errors.
If you enable this policy setting, Windows Error Reporting does not display any GUI-based error messages or dialog boxes for critical errors.
If you disable or do not configure this policy setting, Windows Error Reporting displays the user interface for critical errors.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -341,15 +351,15 @@ If you disable or do not configure this policy setting, Windows Error Reporting
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Prevent display of the user interface for critical errors*
- GP name: *WerDoNotShowUI*
- GP path: *Windows Components/Windows Error Reporting*
- GP ADMX file name: *ErrorReporting.admx*
-
-
+
+
Footnote:
@@ -358,5 +368,5 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
diff --git a/windows/client-management/mdm/policy-csp-eventlogservice.md b/windows/client-management/mdm/policy-csp-eventlogservice.md
index ea5746021f..10a8c1e6f4 100644
--- a/windows/client-management/mdm/policy-csp-eventlogservice.md
+++ b/windows/client-management/mdm/policy-csp-eventlogservice.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - EventLogService
@@ -15,7 +15,7 @@ ms.date: 11/01/2017
-
+
## EventLogService policies
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -68,8 +70,8 @@ ms.date: 11/01/2017
-
-
+
+
This policy setting controls Event Log behavior when the log file reaches its maximum size.
If you enable this policy setting and a log file reaches its maximum size, new events are not written to the log and are lost.
@@ -78,7 +80,7 @@ If you disable or do not configure this policy setting and a log file reaches it
Note: Old events may or may not be retained according to the "Backup log automatically when full" policy setting.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -86,20 +88,22 @@ Note: Old events may or may not be retained according to the "Backup log automat
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Control Event Log behavior when the log file reaches its maximum size*
- GP name: *Channel_Log_Retention_1*
- GP path: *Windows Components/Event Log Service/Application*
- GP ADMX file name: *eventlog.admx*
-
-
+
+
+
-
+
+
**EventLogService/SpecifyMaximumFileSizeApplicationLog**
-
+
Home
@@ -121,8 +125,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -130,15 +134,15 @@ ADMX Info:
-
-
+
+
This policy setting specifies the maximum size of the log file in kilobytes.
If you enable this policy setting, you can configure the maximum log file size to be between 1 megabyte (1024 kilobytes) and 2 terabytes (2147483647 kilobytes) in kilobyte increments.
If you disable or do not configure this policy setting, the maximum size of the log file will be set to the locally configured value. This value can be changed by the local administrator using the Log Properties dialog and it defaults to 20 megabytes.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -146,20 +150,22 @@ If you disable or do not configure this policy setting, the maximum size of the
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Specify the maximum log file size (KB)*
- GP name: *Channel_LogMaxSize_1*
- GP path: *Windows Components/Event Log Service/Application*
- GP ADMX file name: *eventlog.admx*
-
-
+
+
+
-
+
+
**EventLogService/SpecifyMaximumFileSizeSecurityLog**
-
+
Home
@@ -181,8 +187,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -190,15 +196,15 @@ ADMX Info:
-
-
+
+
This policy setting specifies the maximum size of the log file in kilobytes.
If you enable this policy setting, you can configure the maximum log file size to be between 1 megabyte (1024 kilobytes) and 2 terabytes (2147483647 kilobytes) in kilobyte increments.
If you disable or do not configure this policy setting, the maximum size of the log file will be set to the locally configured value. This value can be changed by the local administrator using the Log Properties dialog and it defaults to 20 megabytes.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -206,20 +212,22 @@ If you disable or do not configure this policy setting, the maximum size of the
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Specify the maximum log file size (KB)*
- GP name: *Channel_LogMaxSize_2*
- GP path: *Windows Components/Event Log Service/Security*
- GP ADMX file name: *eventlog.admx*
-
-
+
+
+
-
+
+
**EventLogService/SpecifyMaximumFileSizeSystemLog**
-
+
Home
@@ -241,8 +249,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -250,15 +258,15 @@ ADMX Info:
-
-
+
+
This policy setting specifies the maximum size of the log file in kilobytes.
If you enable this policy setting, you can configure the maximum log file size to be between 1 megabyte (1024 kilobytes) and 2 terabytes (2147483647 kilobytes) in kilobyte increments.
If you disable or do not configure this policy setting, the maximum size of the log file will be set to the locally configured value. This value can be changed by the local administrator using the Log Properties dialog and it defaults to 20 megabytes.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -266,15 +274,15 @@ If you disable or do not configure this policy setting, the maximum size of the
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Specify the maximum log file size (KB)*
- GP name: *Channel_LogMaxSize_4*
- GP path: *Windows Components/Event Log Service/System*
- GP ADMX file name: *eventlog.admx*
-
-
+
+
Footnote:
@@ -283,5 +291,5 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
diff --git a/windows/client-management/mdm/policy-csp-experience.md b/windows/client-management/mdm/policy-csp-experience.md
index df796d96ca..162e0d9065 100644
--- a/windows/client-management/mdm/policy-csp-experience.md
+++ b/windows/client-management/mdm/policy-csp-experience.md
@@ -6,16 +6,18 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - Experience
+> [!WARNING]
+> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
+
## Experience policies
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -113,27 +123,31 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
-
Specifies whether copy and paste is allowed.
+Specifies whether copy and paste is allowed.
-
The following list shows the supported values:
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
Specifies whether Cortana is allowed on the device. If you enable or don’t configure this setting, Cortana is allowed on the device. If you disable this setting, Cortana is turned off. When Cortana is off, users will still be able to use search to find items on the device.
+
+
+Specifies whether Cortana is allowed on the device. If you enable or don’t configure this setting, Cortana is allowed on the device. If you disable this setting, Cortana is turned off. When Cortana is off, users will still be able to use search to find items on the device.
-
The following list shows the supported values:
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
Allows users to turn on/off device discovery UX.
+
+
+Allows users to turn on/off device discovery UX.
-
The following list shows the supported values:
+When set to 0 , the projection pane is disabled. The Win+P and Win+K shortcut keys will not work on.
+
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
When set to 0 , the projection pane is disabled. The Win+P and Win+K shortcut keys will not work on.
+
+
-
Added in Windows 10, version 1703. This policy turns on Find My Device.
+
+
+Added in Windows 10, version 1703. This policy turns on Find My Device.
-
When Find My Device is on, the device and its location are registered in the cloud so that the device can be located when the user initiates a Find command from account.microsoft.com. In Windows 10, version 1709 devices that are compatible with active digitizers, enabling Find My Device will also allow the user to view the last location of use of their active digitizer on their device; this location is stored locally on the user's device after each use of their active digitizer.
+When Find My Device is on, the device and its location are registered in the cloud so that the device can be located when the user initiates a Find command from account.microsoft.com. In Windows 10, version 1709 devices that are compatible with active digitizers, enabling Find My Device will also allow the user to view the last location of use of their active digitizer on their device; this location is stored locally on the user's device after each use of their active digitizer.
-
When Find My Device is off, the device and its location are not registered and the Find My Device feature will not work. In Windows 10, version 1709 the user will not be able to view the location of the last use of their active digitizer on their device.
+When Find My Device is off, the device and its location are not registered and the Find My Device feature will not work. In Windows 10, version 1709 the user will not be able to view the location of the last use of their active digitizer on their device.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
-
+
+
+
Specifies whether to allow the user to delete the workplace account using the workplace control panel. If the device is Azure Active Directory joined and MDM enrolled (e.g. auto-enrolled), which is majority of the case for Intune, then disabling the MDM unenrollment has no effect.
+
+
+Specifies whether to allow the user to delete the workplace account using the workplace control panel. If the device is Azure Active Directory joined and MDM enrolled (e.g. auto-enrolled), which is majority of the case for Intune, then disabling the MDM unenrollment has no effect.
> [!NOTE]
> The MDM server can always remotely delete the account.
-
The following list shows the supported values:
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -364,26 +394,41 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
-
Specifies whether to display dialog prompt when no SIM card is detected.
+Specifies whether to display dialog prompt when no SIM card is detected.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – SIM card dialog prompt is not displayed.
- 1 (default) – SIM card dialog prompt is displayed.
-
-
+
+
+
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -414,28 +459,43 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
-
Specifies whether screen capture is allowed.
+Specifies whether screen capture is allowed.
-
The following list shows the supported values:
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
Allows or disallows all Windows sync settings on the device. For information about what settings are sync'ed, see [About sync setting on Windows 10 devices](http://windows.microsoft.com/windows-10/about-sync-settings-on-windows-10-devices).
+
+
+Allows or disallows all Windows sync settings on the device. For information about what settings are sync'ed, see [About sync setting on Windows 10 devices](http://windows.microsoft.com/windows-10/about-sync-settings-on-windows-10-devices).
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – Sync settings is not allowed.
- 1 (default) – Sync settings allowed.
-
-
+
+
+
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -512,31 +576,35 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop and not supported in Windows 10 Mobile.
-
Added in Windows 10, version 1703. This policy allows you to prevent Windows from using diagnostic data to provide customized experiences to the user. If you enable this policy setting, Windows will not use diagnostic data from this device to customize content shown on the lock screen, Windows tips, Microsoft consumer features, or other related features. If these features are enabled, users will still see recommendations, tips and offers, but they may be less relevant. If you disable or do not configure this policy setting, Microsoft will use diagnostic data to provide personalized recommendations, tips, and offers to tailor Windows for the user's needs and make it work better for them.
+Added in Windows 10, version 1703. This policy allows you to prevent Windows from using diagnostic data to provide customized experiences to the user. If you enable this policy setting, Windows will not use diagnostic data from this device to customize content shown on the lock screen, Windows tips, Microsoft consumer features, or other related features. If these features are enabled, users will still see recommendations, tips and offers, but they may be less relevant. If you disable or do not configure this policy setting, Microsoft will use diagnostic data to provide personalized recommendations, tips, and offers to tailor Windows for the user's needs and make it work better for them.
-
Diagnostic data can include browser, app and feature usage, depending on the "Diagnostic and usage data" setting value.
+Diagnostic data can include browser, app and feature usage, depending on the "Diagnostic and usage data" setting value.
> **Note** This setting does not control Cortana cutomized experiences because there are separate policies to configure it.
-
The following list shows the supported values:
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
Most restricted value is 0.
+
+
-
-
-
+
+
**Experience/AllowTaskSwitcher**
-
+
Home
@@ -558,8 +626,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -567,26 +635,30 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
-
Allows or disallows task switching on the device.
+Allows or disallows task switching on the device.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – Task switching not allowed.
- 1 (default) – Task switching allowed.
-
-
+
+
+
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -617,26 +689,30 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only available for Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education.
-
Specifies whether to allow app and content suggestions from third-party software publishers in Windows spotlight features like lock screen spotlight, suggested apps in the Start menu, and Windows tips. Users may still see suggestions for Microsoft features, apps, and services.
+Specifies whether to allow app and content suggestions from third-party software publishers in Windows spotlight features like lock screen spotlight, suggested apps in the Start menu, and Windows tips. Users may still see suggestions for Microsoft features, apps, and services.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – Third-party suggestions not allowed.
- 1 (default) – Third-party suggestions allowed.
-
-
+
+
+
-
+
+
**Experience/AllowVoiceRecording**
-
+
Home
@@ -658,8 +734,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -667,28 +743,32 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
-
Specifies whether voice recording is allowed for apps.
+Specifies whether voice recording is allowed for apps.
-
The following list shows the supported values:
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -719,28 +799,32 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop and not supported in Windows 10 Mobile.
-
This policy allows IT admins to turn on experiences that are typically for consumers only, such as Start suggestions, Membership notifications, Post-OOBE app install and redirect tiles.
+This policy allows IT admins to turn on experiences that are typically for consumers only, such as Start suggestions, Membership notifications, Post-OOBE app install and redirect tiles.
-
The following list shows the supported values:
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 – Allowed.
-
Most restricted value is 0.
+
+
-
-
-
+
+
**Experience/AllowWindowsSpotlight**
-
+
Home
@@ -762,8 +846,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -771,28 +855,32 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only available for Windows 10 Enterprise and Windows 10 Education.
-
Specifies whether to turn off all Windows spotlight features at once. If you enable this policy setting, Windows spotlight on lock screen, Windows Tips, Microsoft consumer features and other related features will be turned off. You should enable this policy setting if your goal is to minimize network traffic from target devices. If you disable or do not configure this policy setting, Windows spotlight features are allowed and may be controlled individually using their corresponding policy settings.
+Specifies whether to turn off all Windows spotlight features at once. If you enable this policy setting, Windows spotlight on lock screen, Windows Tips, Microsoft consumer features and other related features will be turned off. You should enable this policy setting if your goal is to minimize network traffic from target devices. If you disable or do not configure this policy setting, Windows spotlight features are allowed and may be controlled individually using their corresponding policy settings.
-
The following list shows the supported values:
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -823,27 +911,31 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop and not supported in Windows 10 Mobile.
-
Added in Windows 10, version 1703. This policy allows administrators to prevent Windows spotlight notifications from being displayed in the Action Center. If you enable this policy, Windows spotlight notifications will no longer be displayed in the Action Center. If you disable or do not configure this policy, Microsoft may display notifications in the Action Center that will suggest apps or features to help users be more productive on Windows.
+Added in Windows 10, version 1703. This policy allows administrators to prevent Windows spotlight notifications from being displayed in the Action Center. If you enable this policy, Windows spotlight notifications will no longer be displayed in the Action Center. If you disable or do not configure this policy, Microsoft may display notifications in the Action Center that will suggest apps or features to help users be more productive on Windows.
-
The following list shows the supported values:
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -874,28 +966,32 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop and not supported in Windows 10 Mobile.
-
Added in Windows 10, version 1703. This policy setting lets you turn off the Windows spotlight Windows welcome experience feature.
+Added in Windows 10, version 1703. This policy setting lets you turn off the Windows spotlight Windows welcome experience feature.
The Windows welcome experience feature introduces onboard users to Windows; for example, launching Microsoft Edge with a webpage that highlights new features. If you enable this policy, the Windows welcome experience will no longer be displayed when there are updates and changes to Windows and its apps. If you disable or do not configure this policy, the Windows welcome experience will be launched to inform onboard users about what's new, changed, and suggested.
-
The following list shows the supported values:
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
Most restricted value is 0.
+
+
-
-
-
+
+
**Experience/AllowWindowsTips**
-
+
Home
@@ -917,8 +1013,8 @@ The Windows welcome experience feature introduces onboard users to Windows; for
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -926,22 +1022,26 @@ The Windows welcome experience feature introduces onboard users to Windows; for
-
-
+
+
Enables or disables Windows Tips / soft landing.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – Disabled.
- 1 (default) – Enabled.
-
-
+
+
+
@@ -963,8 +1063,8 @@ Enables or disables Windows Tips / soft landing.
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -972,27 +1072,31 @@ Enables or disables Windows Tips / soft landing.
-
-
+
+
> [!NOTE]
> This policy is only available for Windows 10 Enterprise and Windows 10 Education.
-
Allows IT admins to specify whether spotlight should be used on the user's lock screen. If your organization does not have an Enterprise spotlight content service, then this policy will behave the same as a setting of 1.
+Allows IT admins to specify whether spotlight should be used on the user's lock screen. If your organization does not have an Enterprise spotlight content service, then this policy will behave the same as a setting of 1.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – None.
- 1 (default) – Windows spotlight enabled.
- 2 – placeholder only for future extension. Using this value has no effect.
-
-
+
+
+
@@ -1014,8 +1118,8 @@ Enables or disables Windows Tips / soft landing.
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1023,21 +1127,23 @@ Enables or disables Windows Tips / soft landing.
-
-
-
Prevents devices from showing feedback questions from Microsoft.
+
+
+Prevents devices from showing feedback questions from Microsoft.
-
If you enable this policy setting, users will no longer see feedback notifications through the Feedback hub app. If you disable or do not configure this policy setting, users may see notifications through the Feedback hub app asking users for feedback.
+If you enable this policy setting, users will no longer see feedback notifications through the Feedback hub app. If you disable or do not configure this policy setting, users may see notifications through the Feedback hub app asking users for feedback.
-
If you disable or do not configure this policy setting, users can control how often they receive feedback questions.
+If you disable or do not configure this policy setting, users can control how often they receive feedback questions.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 (default) – Feedback notifications are not disabled. The actual state of feedback notifications on the device will then depend on what GP has configured or what the user has configured locally.
- 1 – Feedback notifications are disabled.
-
-
+
+
Footnote:
@@ -1046,7 +1152,7 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
## Experience policies supported by Windows Holographic for Business
diff --git a/windows/client-management/mdm/policy-csp-exploitguard.md b/windows/client-management/mdm/policy-csp-exploitguard.md
index e165e843f7..f52eb4c227 100644
--- a/windows/client-management/mdm/policy-csp-exploitguard.md
+++ b/windows/client-management/mdm/policy-csp-exploitguard.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - ExploitGuard
@@ -15,7 +15,7 @@ ms.date: 11/01/2017
-
+
## ExploitGuard policies
Enables the IT admin to push out a configuration representing the desired system and application mitigation options to all the devices in the organization. The configuration is represented by an XML. For more information Exploit Protection, see [Protect devices from exploits with Windows Defender Exploit Guard](https://docs.microsoft.com/en-us/windows/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard) and [Import, export, and deploy Exploit Protection configurations](https://docs.microsoft.com/en-us/windows/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml).
+
+
+Enables the IT admin to push out a configuration representing the desired system and application mitigation options to all the devices in the organization. The configuration is represented by an XML. For more information Exploit Protection, see [Protect devices from exploits with Windows Defender Exploit Guard](https://docs.microsoft.com/en-us/windows/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard) and [Import, export, and deploy Exploit Protection configurations](https://docs.microsoft.com/en-us/windows/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml).
-
The system settings require a reboot; the application settings do not require a reboot.
+The system settings require a reboot; the application settings do not require a reboot.
-
Here is an example:
+
+
+Here is an example:
``` syntax
@@ -90,8 +94,8 @@ ms.date: 11/01/2017
```
-
-
+
+
Footnote:
@@ -100,5 +104,5 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
diff --git a/windows/client-management/mdm/policy-csp-games.md b/windows/client-management/mdm/policy-csp-games.md
index c5edf225b8..2a651204e1 100644
--- a/windows/client-management/mdm/policy-csp-games.md
+++ b/windows/client-management/mdm/policy-csp-games.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - Games
@@ -15,7 +15,7 @@ ms.date: 11/01/2017
-
+
## Games policies
Added in Windows 10, version 1709. Specifies whether advanced gaming services can be used. These services may send data to Microsoft or publishers of games that use these services. Value type is integer.
+
+
+Added in Windows 10, version 1709. Specifies whether advanced gaming services can be used. These services may send data to Microsoft or publishers of games that use these services. Value type is integer.
+
+
+
+The following list shows the supported values:
- 0 - Not Allowed
- 1 (default) - Allowed
-
This policy can only be turned off in Windows 10 Education and Enterprise editions.
-
-
-
+
+
Footnote:
@@ -78,5 +82,5 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
diff --git a/windows/client-management/mdm/policy-csp-handwriting.md b/windows/client-management/mdm/policy-csp-handwriting.md
index ed2e1ec38d..c03012e8f2 100644
--- a/windows/client-management/mdm/policy-csp-handwriting.md
+++ b/windows/client-management/mdm/policy-csp-handwriting.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - Handwriting
@@ -15,7 +15,7 @@ ms.date: 11/01/2017
-
+
## Handwriting policies
Added in Windows 10. version 1709. This policy allows an enterprise to configure the default mode for the handwriting panel.
+
+
+Added in Windows 10. version 1709. This policy allows an enterprise to configure the default mode for the handwriting panel.
-
The handwriting panel has 2 modes - floats near the text box, or docked to the bottom of the screen. The default configuration to is floating near text box. If you want the panel to be fixed or docked, use this policy to fix it to the bottom of the screen.
+The handwriting panel has 2 modes - floats near the text box, or docked to the bottom of the screen. The default configuration to is floating near text box. If you want the panel to be fixed or docked, use this policy to fix it to the bottom of the screen.
-
In floating mode, the content is hidden behind a flying-in panel and results in end-user dissatisfaction. The end-user will need to drag the flying-in panel to see the rest of the content. In the fixed mode, the flying-in panel is fixed to the bottom of the screen and does not require any user interaction.
+In floating mode, the content is hidden behind a flying-in panel and results in end-user dissatisfaction. The end-user will need to drag the flying-in panel to see the rest of the content. In the fixed mode, the flying-in panel is fixed to the bottom of the screen and does not require any user interaction.
-
The docked mode is especially useful in Kiosk mode where you do not expect the end-user to drag the flying-in panel out of the way.
+The docked mode is especially useful in Kiosk mode where you do not expect the end-user to drag the flying-in panel out of the way.
-
-
0 - Disabled (default)
-
1 - Enabled
-
+
+
+The following list shows the supported values:
-
-
+- 0 (default) - Disabled.
+- 1 - Enabled.
+
+
+
Footnote:
@@ -84,5 +88,5 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
diff --git a/windows/client-management/mdm/policy-csp-internetexplorer.md b/windows/client-management/mdm/policy-csp-internetexplorer.md
index 88e6a352f7..4e2042350f 100644
--- a/windows/client-management/mdm/policy-csp-internetexplorer.md
+++ b/windows/client-management/mdm/policy-csp-internetexplorer.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - InternetExplorer
@@ -15,7 +15,7 @@ ms.date: 11/01/2017
-
+
## InternetExplorer policies
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -786,15 +788,15 @@ ms.date: 11/01/2017
-
-
+
+
This policy setting allows you to add a specific list of search providers to the user's default list of search providers. Normally, search providers can be added from third-party toolbars or in Setup. The user can also add a search provider from the provider's website.
If you enable this policy setting, the user can add and remove search providers, but only from the set of search providers specified in the list of policy keys for search providers (found under [HKCU or HKLM\Software\policies\Microsoft\Internet Explorer\SearchScopes]). Note: This list can be created from a custom administrative template file. For information about creating this custom administrative template file, see the Internet Explorer documentation on search providers.
If you disable or do not configure this policy setting, the user can configure their list of search providers unless another policy setting restricts such configuration.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -802,20 +804,22 @@ If you disable or do not configure this policy setting, the user can configure t
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Add a specific list of search providers to the user's list of search providers*
- GP name: *AddSearchProvider*
- GP path: *Windows Components/Internet Explorer*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/AllowActiveXFiltering**
-
+
Home
@@ -837,8 +841,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -847,15 +851,15 @@ ADMX Info:
-
-
+
+
This policy setting controls the ActiveX Filtering feature for websites that are running ActiveX controls. The user can choose to turn off ActiveX Filtering for specific websites so that ActiveX controls can run properly.
If you enable this policy setting, ActiveX Filtering is enabled by default for the user. The user cannot turn off ActiveX Filtering, although they may add per-site exceptions.
If you disable or do not configure this policy setting, ActiveX Filtering is not enabled by default for the user. The user can turn ActiveX Filtering on or off.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -863,20 +867,22 @@ If you disable or do not configure this policy setting, ActiveX Filtering is not
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Turn on ActiveX Filtering*
- GP name: *TurnOnActiveXFiltering*
- GP path: *Windows Components/Internet Explorer*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/AllowAddOnList**
-
+
Home
@@ -898,8 +904,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -908,8 +914,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage a list of add-ons to be allowed or denied by Internet Explorer. Add-ons in this case are controls like ActiveX Controls, Toolbars, and Browser Helper Objects (BHOs) which are specifically written to extend or enhance the functionality of the browser or web pages.
This list can be used with the 'Deny all add-ons unless specifically allowed in the Add-on List' policy setting, which defines whether add-ons not listed here are assumed to be denied.
@@ -922,7 +928,7 @@ Value - A number indicating whether Internet Explorer should deny or allow the a
If you disable this policy setting, the list is deleted. The 'Deny all add-ons unless specifically allowed in the Add-on List' policy setting will still determine whether add-ons not in this list are assumed to be denied.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -930,20 +936,22 @@ If you disable this policy setting, the list is deleted. The 'Deny all add-ons u
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Add-on List*
- GP name: *AddonManagement_AddOnList*
- GP path: *Windows Components/Internet Explorer/Security Features/Add-on Management*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/AllowAutoComplete**
-
+
Home
@@ -965,8 +973,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -974,9 +982,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -984,20 +993,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Turn on the auto-complete feature for user names and passwords on forms*
- GP name: *RestrictFormSuggestPW*
- GP path: *Windows Components/Internet Explorer*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/AllowCertificateAddressMismatchWarning**
-
+
Home
@@ -1019,8 +1030,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1029,9 +1040,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -1039,20 +1051,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Turn on certificate address mismatch warning*
- GP name: *IZ_PolicyWarnCertMismatch*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/AllowDeletingBrowsingHistoryOnExit**
-
+
Home
@@ -1074,8 +1088,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1084,9 +1098,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -1094,20 +1109,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Allow deleting browsing history on exit*
- GP name: *DBHDisableDeleteOnExit*
- GP path: *Windows Components/Internet Explorer/Delete Browsing History*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/AllowEnhancedProtectedMode**
-
+
Home
@@ -1129,8 +1146,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1139,8 +1156,8 @@ ADMX Info:
-
-
+
+
Enhanced Protected Mode provides additional protection against malicious websites by using 64-bit processes on 64-bit versions of Windows. For computers running at least Windows 8, Enhanced Protected Mode also limits the locations Internet Explorer can read from in the registry and the file system.
If you enable this policy setting, Enhanced Protected Mode will be turned on. Any zone that has Protected Mode enabled will use Enhanced Protected Mode. Users will not be able to disable Enhanced Protected Mode.
@@ -1149,7 +1166,7 @@ If you disable this policy setting, Enhanced Protected Mode will be turned off.
If you do not configure this policy, users will be able to turn on or turn off Enhanced Protected Mode on the Advanced tab of the Internet Options dialog.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -1157,20 +1174,22 @@ If you do not configure this policy, users will be able to turn on or turn off E
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Turn on Enhanced Protected Mode*
- GP name: *Advanced_EnableEnhancedProtectedMode*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Advanced Page*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/AllowEnterpriseModeFromToolsMenu**
-
+
Home
@@ -1192,8 +1211,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1202,15 +1221,15 @@ ADMX Info:
-
-
+
+
This policy setting lets you decide whether users can turn on Enterprise Mode for websites with compatibility issues. Optionally, this policy also lets you specify where to get reports (through post messages) about the websites for which users turn on Enterprise Mode using the Tools menu.
If you turn this setting on, users can see and use the Enterprise Mode option from the Tools menu. If you turn this setting on, but don't specify a report location, Enterprise Mode will still be available to your users, but you won't get any reports.
If you disable or don't configure this policy setting, the menu option won't appear and users won't be able to run websites in Enterprise Mode.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -1218,20 +1237,22 @@ If you disable or don't configure this policy setting, the menu option won't app
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Let users turn on and use Enterprise Mode from the Tools menu*
- GP name: *EnterpriseModeEnable*
- GP path: *Windows Components/Internet Explorer*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/AllowEnterpriseModeSiteList**
-
+
Home
@@ -1253,8 +1274,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1263,15 +1284,15 @@ ADMX Info:
-
-
+
+
This policy setting lets you specify where to find the list of websites you want opened using Enterprise Mode IE, instead of Standard mode, because of compatibility issues. Users can't edit this list.
If you enable this policy setting, Internet Explorer downloads the website list from your location (HKCU or HKLM\Software\policies\Microsoft\Internet Explorer\Main\EnterpriseMode), opening all listed websites using Enterprise Mode IE.
If you disable or don't configure this policy setting, Internet Explorer opens all websites using Standards mode.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -1279,20 +1300,22 @@ If you disable or don't configure this policy setting, Internet Explorer opens a
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Use the Enterprise Mode IE website list*
- GP name: *EnterpriseModeSiteList*
- GP path: *Windows Components/Internet Explorer*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/AllowFallbackToSSL3**
-
+
Home
@@ -1314,8 +1337,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1323,9 +1346,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -1333,20 +1357,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Allow fallback to SSL 3.0 (Internet Explorer)*
- GP name: *Advanced_EnableSSL3Fallback*
- GP path: *Windows Components/Internet Explorer/Security Features*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/AllowInternetExplorer7PolicyList**
-
+
Home
@@ -1368,8 +1394,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1378,15 +1404,15 @@ ADMX Info:
-
-
+
+
This policy setting allows you to add specific sites that must be viewed in Internet Explorer 7 Compatibility View.
If you enable this policy setting, the user can add and remove sites from the list, but the user cannot remove the entries that you specify.
If you disable or do not configure this policy setting, the user can add and remove sites from the list.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -1394,20 +1420,22 @@ If you disable or do not configure this policy setting, the user can add and rem
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Use Policy List of Internet Explorer 7 sites*
- GP name: *CompatView_UsePolicyList*
- GP path: *Windows Components/Internet Explorer/Compatibility View*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/AllowInternetExplorerStandardsMode**
-
+
Home
@@ -1429,8 +1457,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1439,8 +1467,8 @@ ADMX Info:
-
-
+
+
This policy setting controls how Internet Explorer displays local intranet content. Intranet content is defined as any webpage that belongs to the local intranet security zone.
If you enable this policy setting, Internet Explorer uses the current user agent string for local intranet content. Additionally, all local intranet Standards Mode pages appear in the Standards Mode available with the latest version of Internet Explorer. The user cannot change this behavior through the Compatibility View Settings dialog box.
@@ -1449,7 +1477,7 @@ If you disable this policy setting, Internet Explorer uses an Internet Explorer
If you do not configure this policy setting, Internet Explorer uses an Internet Explorer 7 user agent string (with an additional string appended) for local intranet content. Additionally, all local intranet Standards Mode pages appear in Internet Explorer 7 Standards Mode. This option results in the greatest compatibility with existing webpages, but newer content written to common Internet standards may be displayed incorrectly. This option matches the default behavior of Internet Explorer.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -1457,20 +1485,22 @@ If you do not configure this policy setting, Internet Explorer uses an Internet
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Turn on Internet Explorer Standards Mode for local intranet*
- GP name: *CompatView_IntranetSites*
- GP path: *Windows Components/Internet Explorer/Compatibility View*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/AllowInternetZoneTemplate**
-
+
Home
@@ -1492,8 +1522,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1502,8 +1532,8 @@ ADMX Info:
-
-
+
+
This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.
If you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.
@@ -1516,7 +1546,7 @@ Note. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate
Note. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -1524,20 +1554,22 @@ Note. It is recommended to configure template policy settings in one Group Polic
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Internet Zone Template*
- GP name: *IZ_PolicyInternetZoneTemplate*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/AllowIntranetZoneTemplate**
-
+
Home
@@ -1559,8 +1591,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1569,8 +1601,8 @@ ADMX Info:
-
-
+
+
This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.
If you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.
@@ -1583,7 +1615,7 @@ Note. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate
Note. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -1591,20 +1623,22 @@ Note. It is recommended to configure template policy settings in one Group Polic
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Intranet Zone Template*
- GP name: *IZ_PolicyIntranetZoneTemplate*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/AllowLocalMachineZoneTemplate**
-
+
Home
@@ -1626,8 +1660,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1636,8 +1670,8 @@ ADMX Info:
-
-
+
+
This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.
If you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.
@@ -1650,7 +1684,7 @@ Note. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate
Note. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -1658,20 +1692,22 @@ Note. It is recommended to configure template policy settings in one Group Polic
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Local Machine Zone Template*
- GP name: *IZ_PolicyLocalMachineZoneTemplate*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/AllowLockedDownInternetZoneTemplate**
-
+
Home
@@ -1693,8 +1729,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1703,8 +1739,8 @@ ADMX Info:
-
-
+
+
This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.
If you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.
@@ -1717,7 +1753,7 @@ Note. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate
Note. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -1725,20 +1761,22 @@ Note. It is recommended to configure template policy settings in one Group Polic
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Locked-Down Internet Zone Template*
- GP name: *IZ_PolicyInternetZoneLockdownTemplate*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/AllowLockedDownIntranetZoneTemplate**
-
+
Home
@@ -1760,8 +1798,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1770,8 +1808,8 @@ ADMX Info:
-
-
+
+
This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.
If you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.
@@ -1784,7 +1822,7 @@ Note. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate
Note. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -1792,20 +1830,22 @@ Note. It is recommended to configure template policy settings in one Group Polic
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Locked-Down Intranet Zone Template*
- GP name: *IZ_PolicyIntranetZoneLockdownTemplate*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/AllowLockedDownLocalMachineZoneTemplate**
-
+
Home
@@ -1827,8 +1867,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1837,8 +1877,8 @@ ADMX Info:
-
-
+
+
This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.
If you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.
@@ -1851,7 +1891,7 @@ Note. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate
Note. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -1859,20 +1899,22 @@ Note. It is recommended to configure template policy settings in one Group Polic
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Locked-Down Local Machine Zone Template*
- GP name: *IZ_PolicyLocalMachineZoneLockdownTemplate*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/AllowLockedDownRestrictedSitesZoneTemplate**
-
+
Home
@@ -1894,8 +1936,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1904,8 +1946,8 @@ ADMX Info:
-
-
+
+
This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.
If you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.
@@ -1918,7 +1960,7 @@ Note. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate
Note. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -1926,20 +1968,22 @@ Note. It is recommended to configure template policy settings in one Group Polic
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Locked-Down Restricted Sites Zone Template*
- GP name: *IZ_PolicyRestrictedSitesZoneLockdownTemplate*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/AllowOneWordEntry**
-
+
Home
@@ -1961,8 +2005,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1971,15 +2015,15 @@ ADMX Info:
-
-
+
+
This policy allows the user to go directly to an intranet site for a one-word entry in the Address bar.
If you enable this policy setting, Internet Explorer goes directly to an intranet site for a one-word entry in the Address bar, if it is available.
If you disable or do not configure this policy setting, Internet Explorer does not go directly to an intranet site for a one-word entry in the Address bar.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -1987,20 +2031,22 @@ If you disable or do not configure this policy setting, Internet Explorer does n
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Go to an intranet site for a one-word entry in the Address bar*
- GP name: *UseIntranetSiteForOneWordEntry*
- GP path: *Windows Components/Internet Explorer/Internet Settings/Advanced settings/Browsing*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/AllowSiteToZoneAssignmentList**
-
+
Home
@@ -2022,8 +2068,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -2032,8 +2078,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage a list of sites that you want to associate with a particular security zone. These zone numbers have associated security settings that apply to all of the sites in the zone.
Internet Explorer has 4 security zones, numbered 1-4, and these are used by this policy setting to associate sites to zones. They are: (1) Intranet zone, (2) Trusted Sites zone, (3) Internet zone, and (4) Restricted Sites zone. Security settings can be set for each of these zones through other policy settings, and their default settings are: Trusted Sites zone (Low template), Intranet zone (Medium-Low template), Internet zone (Medium template), and Restricted Sites zone (High template). (The Local Machine zone and its locked down equivalent have special security settings that protect your local computer.)
@@ -2046,7 +2092,7 @@ Value - A number indicating the zone with which this site should be associated f
If you disable or do not configure this policy, users may choose their own site-to-zone assignments.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -2054,20 +2100,22 @@ If you disable or do not configure this policy, users may choose their own site-
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Site to Zone Assignment List*
- GP name: *IZ_Zonemaps*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/AllowSoftwareWhenSignatureIsInvalid**
-
+
Home
@@ -2089,8 +2137,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -2099,9 +2147,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -2109,20 +2158,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Allow software to run or install even if the signature is invalid*
- GP name: *Advanced_InvalidSignatureBlock*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Advanced Page*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/AllowSuggestedSites**
-
+
Home
@@ -2144,8 +2195,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -2154,8 +2205,8 @@ ADMX Info:
-
-
+
+
This policy setting controls the Suggested Sites feature, which recommends websites based on the users browsing activity. Suggested Sites reports a users browsing history to Microsoft to suggest sites that the user might want to visit.
If you enable this policy setting, the user is not prompted to enable Suggested Sites. The users browsing history is sent to Microsoft to produce suggestions.
@@ -2164,7 +2215,7 @@ If you disable this policy setting, the entry points and functionality associate
If you do not configure this policy setting, the user can turn on and turn off the Suggested Sites feature.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -2172,20 +2223,22 @@ If you do not configure this policy setting, the user can turn on and turn off t
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Turn on Suggested Sites*
- GP name: *EnableSuggestedSites*
- GP path: *Windows Components/Internet Explorer*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/AllowTrustedSitesZoneTemplate**
-
+
Home
@@ -2207,8 +2260,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -2217,8 +2270,8 @@ ADMX Info:
-
-
+
+
This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.
If you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.
@@ -2231,7 +2284,7 @@ Note. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate
Note. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -2239,20 +2292,22 @@ Note. It is recommended to configure template policy settings in one Group Polic
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Trusted Sites Zone Template*
- GP name: *IZ_PolicyTrustedSitesZoneTemplate*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/AllowsLockedDownTrustedSitesZoneTemplate**
-
+
Home
@@ -2274,8 +2329,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -2284,8 +2339,8 @@ ADMX Info:
-
-
+
+
This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.
If you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.
@@ -2298,7 +2353,7 @@ Note. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate
Note. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -2306,20 +2361,22 @@ Note. It is recommended to configure template policy settings in one Group Polic
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Locked-Down Trusted Sites Zone Template*
- GP name: *IZ_PolicyTrustedSitesZoneLockdownTemplate*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/AllowsRestrictedSitesZoneTemplate**
-
+
Home
@@ -2341,8 +2398,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -2351,8 +2408,8 @@ ADMX Info:
-
-
+
+
This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.
If you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.
@@ -2365,7 +2422,7 @@ Note. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate
Note. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -2373,20 +2430,22 @@ Note. It is recommended to configure template policy settings in one Group Polic
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Restricted Sites Zone Template*
- GP name: *IZ_PolicyRestrictedSitesZoneTemplate*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/CheckServerCertificateRevocation**
-
+
Home
@@ -2408,8 +2467,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -2418,9 +2477,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -2428,20 +2488,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Check for server certificate revocation*
- GP name: *Advanced_CertificateRevocation*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Advanced Page*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/CheckSignaturesOnDownloadedPrograms**
-
+
Home
@@ -2463,8 +2525,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -2473,9 +2535,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -2483,20 +2546,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Check for signatures on downloaded programs*
- GP name: *Advanced_DownloadSignatures*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Advanced Page*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/ConsistentMimeHandlingInternetExplorerProcesses**
-
+
Home
@@ -2518,8 +2583,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -2528,9 +2593,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -2538,20 +2604,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Internet Explorer Processes*
- GP name: *IESF_PolicyExplorerProcesses_2*
- GP path: *Windows Components/Internet Explorer/Security Features/Binary Behavior Security Restriction*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/DisableAdobeFlash**
-
+
Home
@@ -2573,8 +2641,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -2583,8 +2651,8 @@ ADMX Info:
-
-
+
+
This policy setting turns off Adobe Flash in Internet Explorer and prevents applications from using Internet Explorer technology to instantiate Flash objects.
If you enable this policy setting, Flash is turned off for Internet Explorer, and applications cannot use Internet Explorer technology to instantiate Flash objects. In the Manage Add-ons dialog box, the Flash status will be 'Disabled', and users cannot enable Flash. If you enable this policy setting, Internet Explorer will ignore settings made for Adobe Flash through the "Add-on List" and "Deny all add-ons unless specifically allowed in the Add-on List" policy settings.
@@ -2593,7 +2661,7 @@ If you disable, or do not configure this policy setting, Flash is turned on for
Note that Adobe Flash can still be disabled through the "Add-on List" and "Deny all add-ons unless specifically allowed in the Add-on List" policy settings, even if this policy setting is disabled, or not configured. However, if Adobe Flash is disabled through the "Add-on List" and "Deny all add-ons unless specifically allowed in the Add-on List" policy settings and not through this policy setting, all applications that use Internet Explorer technology to instantiate Flash object can still do so. For more information, see "Group Policy Settings in Internet Explorer 10" in the Internet Explorer TechNet library.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -2601,20 +2669,22 @@ Note that Adobe Flash can still be disabled through the "Add-on List" and "Deny
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Turn off Adobe Flash in Internet Explorer and prevent applications from using Internet Explorer technology to instantiate Flash objects*
- GP name: *DisableFlashInIE*
- GP path: *Windows Components/Internet Explorer/Security Features/Add-on Management*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/DisableBypassOfSmartScreenWarnings**
-
+
Home
@@ -2636,8 +2706,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -2646,15 +2716,15 @@ ADMX Info:
-
-
+
+
This policy setting determines whether the user can bypass warnings from SmartScreen Filter. SmartScreen Filter prevents the user from browsing to or downloading from sites that are known to host malicious content. SmartScreen Filter also prevents the execution of files that are known to be malicious.
If you enable this policy setting, SmartScreen Filter warnings block the user.
If you disable or do not configure this policy setting, the user can bypass SmartScreen Filter warnings.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -2662,20 +2732,22 @@ If you disable or do not configure this policy setting, the user can bypass Smar
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Prevent bypassing SmartScreen Filter warnings*
- GP name: *DisableSafetyFilterOverride*
- GP path: *Windows Components/Internet Explorer*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/DisableBypassOfSmartScreenWarningsAboutUncommonFiles**
-
+
Home
@@ -2697,8 +2769,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -2707,15 +2779,15 @@ ADMX Info:
-
-
+
+
This policy setting determines whether the user can bypass warnings from SmartScreen Filter. SmartScreen Filter warns the user about executable files that Internet Explorer users do not commonly download from the Internet.
If you enable this policy setting, SmartScreen Filter warnings block the user.
If you disable or do not configure this policy setting, the user can bypass SmartScreen Filter warnings.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -2723,20 +2795,22 @@ If you disable or do not configure this policy setting, the user can bypass Smar
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Prevent bypassing SmartScreen Filter warnings about files that are not commonly downloaded from the Internet*
- GP name: *DisableSafetyFilterOverrideForAppRepUnknown*
- GP path: *Windows Components/Internet Explorer*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/DisableConfiguringHistory**
-
+
Home
@@ -2758,8 +2832,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -2768,9 +2842,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -2778,20 +2853,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Disable "Configuring History"*
- GP name: *RestrictHistory*
- GP path: *Windows Components/Internet Explorer/Delete Browsing History*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/DisableCrashDetection**
-
+
Home
@@ -2813,8 +2890,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -2823,9 +2900,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -2833,20 +2911,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Turn off Crash Detection*
- GP name: *AddonManagement_RestrictCrashDetection*
- GP path: *Windows Components/Internet Explorer*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/DisableCustomerExperienceImprovementProgramParticipation**
-
+
Home
@@ -2868,8 +2948,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -2878,8 +2958,8 @@ ADMX Info:
-
-
+
+
This policy setting prevents the user from participating in the Customer Experience Improvement Program (CEIP).
If you enable this policy setting, the user cannot participate in the CEIP, and the Customer Feedback Options command does not appear on the Help menu.
@@ -2888,7 +2968,7 @@ If you disable this policy setting, the user must participate in the CEIP, and t
If you do not configure this policy setting, the user can choose to participate in the CEIP.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -2896,20 +2976,22 @@ If you do not configure this policy setting, the user can choose to participate
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Prevent participation in the Customer Experience Improvement Program*
- GP name: *SQM_DisableCEIP*
- GP path: *Windows Components/Internet Explorer*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/DisableDeletingUserVisitedWebsites**
-
+
Home
@@ -2931,8 +3013,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -2941,9 +3023,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -2951,20 +3034,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Prevent deleting websites that the user has visited*
- GP name: *DBHDisableDeleteHistory*
- GP path: *Windows Components/Internet Explorer/Delete Browsing History*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/DisableEnclosureDownloading**
-
+
Home
@@ -2986,8 +3071,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -2996,15 +3081,15 @@ ADMX Info:
-
-
+
+
This policy setting prevents the user from having enclosures (file attachments) downloaded from a feed to the user's computer.
If you enable this policy setting, the user cannot set the Feed Sync Engine to download an enclosure through the Feed property page. A developer cannot change the download setting through the Feed APIs.
If you disable or do not configure this policy setting, the user can set the Feed Sync Engine to download an enclosure through the Feed property page. A developer can change the download setting through the Feed APIs.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -3012,20 +3097,22 @@ If you disable or do not configure this policy setting, the user can set the Fee
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Prevent downloading of enclosures*
- GP name: *Disable_Downloading_of_Enclosures*
- GP path: *Windows Components/RSS Feeds*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/DisableEncryptionSupport**
-
+
Home
@@ -3047,8 +3134,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -3057,8 +3144,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to turn off support for Transport Layer Security (TLS) 1.0, TLS 1.1, TLS 1.2, Secure Sockets Layer (SSL) 2.0, or SSL 3.0 in the browser. TLS and SSL are protocols that help protect communication between the browser and the target server. When the browser attempts to set up a protected communication with the target server, the browser and server negotiate which protocol and version to use. The browser and server attempt to match each others list of supported protocols and versions, and they select the most preferred match.
If you enable this policy setting, the browser negotiates or does not negotiate an encryption tunnel by using the encryption methods that you select from the drop-down list.
@@ -3067,7 +3154,7 @@ If you disable or do not configure this policy setting, the user can select whic
Note: SSL 2.0 is off by default and is no longer supported starting with Windows 10 Version 1607. SSL 2.0 is an outdated security protocol, and enabling SSL 2.0 impairs the performance and functionality of TLS 1.0.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -3075,20 +3162,22 @@ Note: SSL 2.0 is off by default and is no longer supported starting with Windows
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Turn off encryption support*
- GP name: *Advanced_SetWinInetProtocols*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Advanced Page*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/DisableFirstRunWizard**
-
+
Home
@@ -3110,8 +3199,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -3120,8 +3209,8 @@ ADMX Info:
-
-
+
+
This policy setting prevents Internet Explorer from running the First Run wizard the first time a user starts the browser after installing Internet Explorer or Windows.
If you enable this policy setting, you must make one of the following choices:
@@ -3132,7 +3221,7 @@ Starting with Windows 8, the "Welcome to Internet Explorer" webpage is not avail
If you disable or do not configure this policy setting, Internet Explorer may run the First Run wizard the first time the browser is started after installation.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -3140,20 +3229,22 @@ If you disable or do not configure this policy setting, Internet Explorer may ru
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Prevent running First Run wizard*
- GP name: *NoFirstRunCustomise*
- GP path: *Windows Components/Internet Explorer*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/DisableFlipAheadFeature**
-
+
Home
@@ -3175,8 +3266,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -3185,8 +3276,8 @@ ADMX Info:
-
-
+
+
This policy setting determines whether a user can swipe across a screen or click Forward to go to the next pre-loaded page of a website.
Microsoft collects your browsing history to improve how flip ahead with page prediction works. This feature isn't available for Internet Explorer for the desktop.
@@ -3197,7 +3288,7 @@ If you disable this policy setting, flip ahead with page prediction is turned on
If you don't configure this setting, users can turn this behavior on or off, using the Settings charm.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -3205,20 +3296,22 @@ If you don't configure this setting, users can turn this behavior on or off, usi
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Turn off the flip ahead with page prediction feature*
- GP name: *Advanced_DisableFlipAhead*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Advanced Page*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/DisableHomePageChange**
-
+
Home
@@ -3240,8 +3333,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -3249,15 +3342,15 @@ ADMX Info:
-
-
+
+
The Home page specified on the General tab of the Internet Options dialog box is the default Web page that Internet Explorer loads whenever it is run.
If you enable this policy setting, a user cannot set a custom default home page. You must specify which default home page should load on the user machine. For machines with at least Internet Explorer 7, the home page can be set within this policy to override other home page policies.
If you disable or do not configure this policy setting, the Home page box is enabled and users can choose their own home page.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -3265,20 +3358,22 @@ If you disable or do not configure this policy setting, the Home page box is ena
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Disable changing home page settings*
- GP name: *RestrictHomePage*
- GP path: *Windows Components/Internet Explorer*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/DisableIgnoringCertificateErrors**
-
+
Home
@@ -3300,8 +3395,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -3310,9 +3405,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -3320,20 +3416,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Prevent ignoring certificate errors*
- GP name: *NoCertError*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/DisableInPrivateBrowsing**
-
+
Home
@@ -3355,8 +3453,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -3365,9 +3463,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -3375,20 +3474,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Turn off InPrivate Browsing*
- GP name: *DisableInPrivateBrowsing*
- GP path: *Windows Components/Internet Explorer/Privacy*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/DisableProcessesInEnhancedProtectedMode**
-
+
Home
@@ -3410,8 +3511,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -3420,9 +3521,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -3430,20 +3532,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Turn on 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows*
- GP name: *Advanced_EnableEnhancedProtectedMode64Bit*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Advanced Page*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/DisableProxyChange**
-
+
Home
@@ -3465,8 +3569,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -3475,15 +3579,15 @@ ADMX Info:
-
-
+
+
This policy setting specifies if a user can change proxy settings.
If you enable this policy setting, the user will not be able to configure proxy settings.
If you disable or do not configure this policy setting, the user can configure proxy settings.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -3491,20 +3595,22 @@ If you disable or do not configure this policy setting, the user can configure p
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Prevent changing proxy settings*
- GP name: *RestrictProxy*
- GP path: *Windows Components/Internet Explorer*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/DisableSearchProviderChange**
-
+
Home
@@ -3526,8 +3632,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -3536,15 +3642,15 @@ ADMX Info:
-
-
+
+
This policy setting prevents the user from changing the default search provider for the Address bar and the toolbar Search box.
If you enable this policy setting, the user cannot change the default search provider.
If you disable or do not configure this policy setting, the user can change the default search provider.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -3552,20 +3658,22 @@ If you disable or do not configure this policy setting, the user can change the
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Prevent changing the default search provider*
- GP name: *NoSearchProvider*
- GP path: *Windows Components/Internet Explorer*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/DisableSecondaryHomePageChange**
-
+
Home
@@ -3587,8 +3695,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -3597,8 +3705,8 @@ ADMX Info:
-
-
+
+
Secondary home pages are the default Web pages that Internet Explorer loads in separate tabs from the home page whenever the browser is run. This policy setting allows you to set default secondary home pages.
If you enable this policy setting, you can specify which default home pages should load as secondary home pages. The user cannot set custom default secondary home pages.
@@ -3607,7 +3715,7 @@ If you disable or do not configure this policy setting, the user can add seconda
Note: If the Disable Changing Home Page Settings policy is enabled, the user cannot add secondary home pages.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -3615,20 +3723,22 @@ Note: If the Disable Changing Home Page Settings policy is enabled, the user can
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Disable changing secondary home page settings*
- GP name: *SecondaryHomePages*
- GP path: *Windows Components/Internet Explorer*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/DisableSecuritySettingsCheck**
-
+
Home
@@ -3650,8 +3760,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -3660,9 +3770,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -3670,20 +3781,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Turn off the Security Settings Check feature*
- GP name: *Disable_Security_Settings_Check*
- GP path: *Windows Components/Internet Explorer*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/DisableUpdateCheck**
-
+
Home
@@ -3705,8 +3818,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -3714,8 +3827,8 @@ ADMX Info:
-
-
+
+
Prevents Internet Explorer from checking whether a new version of the browser is available.
If you enable this policy, it prevents Internet Explorer from checking to see whether it is the latest available browser version and notifying users if a new version is available.
@@ -3724,7 +3837,7 @@ If you disable this policy or do not configure it, Internet Explorer checks ever
This policy is intended to help the administrator maintain version control for Internet Explorer by preventing users from being notified about new versions of the browser.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -3732,20 +3845,22 @@ This policy is intended to help the administrator maintain version control for I
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Disable Periodic Check for Internet Explorer software updates*
- GP name: *NoUpdateCheck*
- GP path: *Windows Components/Internet Explorer*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/DoNotAllowActiveXControlsInProtectedMode**
-
+
Home
@@ -3767,8 +3882,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -3777,9 +3892,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -3787,20 +3903,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Do not allow ActiveX controls to run in Protected Mode when Enhanced Protected Mode is enabled*
- GP name: *Advanced_DisableEPMCompat*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Advanced Page*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/DoNotAllowUsersToAddSites**
-
+
Home
@@ -3822,8 +3940,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -3831,8 +3949,8 @@ ADMX Info:
-
-
+
+
Prevents users from adding or removing sites from security zones. A security zone is a group of Web sites with the same security level.
If you enable this policy, the site management settings for security zones are disabled. (To see the site management settings for security zones, in the Internet Options dialog box, click the Security tab, and then click the Sites button.)
@@ -3845,7 +3963,7 @@ Note: The "Disable the Security page" policy (located in \User Configuration\Ad
Also, see the "Security zones: Use only machine settings" policy.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -3853,20 +3971,22 @@ Also, see the "Security zones: Use only machine settings" policy.
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Security Zones: Do not allow users to add/delete sites*
- GP name: *Security_zones_map_edit*
- GP path: *Windows Components/Internet Explorer*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/DoNotAllowUsersToChangePolicies**
-
+
Home
@@ -3888,8 +4008,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -3897,8 +4017,8 @@ ADMX Info:
-
-
+
+
Prevents users from changing security zone settings. A security zone is a group of Web sites with the same security level.
If you enable this policy, the Custom Level button and security-level slider on the Security tab in the Internet Options dialog box are disabled.
@@ -3911,7 +4031,7 @@ Note: The "Disable the Security page" policy (located in \User Configuration\Adm
Also, see the "Security zones: Use only machine settings" policy.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -3919,20 +4039,22 @@ Also, see the "Security zones: Use only machine settings" policy.
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Security Zones: Do not allow users to change policies*
- GP name: *Security_options_edit*
- GP path: *Windows Components/Internet Explorer*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/DoNotBlockOutdatedActiveXControls**
-
+
Home
@@ -3954,8 +4076,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -3964,8 +4086,8 @@ ADMX Info:
-
-
+
+
This policy setting determines whether Internet Explorer blocks specific outdated ActiveX controls. Outdated ActiveX controls are never blocked in the Intranet Zone.
If you enable this policy setting, Internet Explorer stops blocking outdated ActiveX controls.
@@ -3974,7 +4096,7 @@ If you disable or don't configure this policy setting, Internet Explorer continu
For more information, see "Outdated ActiveX Controls" in the Internet Explorer TechNet library.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -3982,20 +4104,22 @@ For more information, see "Outdated ActiveX Controls" in the Internet Explorer T
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Turn off blocking of outdated ActiveX controls for Internet Explorer*
- GP name: *VerMgmtDisable*
- GP path: *Windows Components/Internet Explorer/Security Features/Add-on Management*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/DoNotBlockOutdatedActiveXControlsOnSpecificDomains**
-
+
Home
@@ -4017,8 +4141,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -4027,8 +4151,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage a list of domains on which Internet Explorer will stop blocking outdated ActiveX controls. Outdated ActiveX controls are never blocked in the Intranet Zone.
If you enable this policy setting, you can enter a custom list of domains for which outdated ActiveX controls won't be blocked in Internet Explorer. Each domain entry must be formatted like one of the following:
@@ -4041,7 +4165,7 @@ If you disable or don't configure this policy setting, the list is deleted and I
For more information, see "Outdated ActiveX Controls" in the Internet Explorer TechNet library.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -4049,20 +4173,22 @@ For more information, see "Outdated ActiveX Controls" in the Internet Explorer T
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Turn off blocking of outdated ActiveX controls for Internet Explorer on specific domains*
- GP name: *VerMgmtDomainAllowlist*
- GP path: *Windows Components/Internet Explorer/Security Features/Add-on Management*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/IncludeAllLocalSites**
-
+
Home
@@ -4084,8 +4210,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -4094,8 +4220,8 @@ ADMX Info:
-
-
+
+
This policy setting controls whether local sites which are not explicitly mapped into any Security Zone are forced into the local Intranet security zone.
If you enable this policy setting, local sites which are not explicitly mapped into a zone are considered to be in the Intranet Zone.
@@ -4104,7 +4230,7 @@ If you disable this policy setting, local sites which are not explicitly mapped
If you do not configure this policy setting, users choose whether to force local sites into the Intranet Zone.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -4112,20 +4238,22 @@ If you do not configure this policy setting, users choose whether to force local
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Intranet Sites: Include all local (intranet) sites not listed in other zones*
- GP name: *IZ_IncludeUnspecifiedLocalSites*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/IncludeAllNetworkPaths**
-
+
Home
@@ -4147,8 +4275,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -4157,8 +4285,8 @@ ADMX Info:
-
-
+
+
This policy setting controls whether URLs representing UNCs are mapped into the local Intranet security zone.
If you enable this policy setting, all network paths are mapped into the Intranet Zone.
@@ -4167,7 +4295,7 @@ If you disable this policy setting, network paths are not necessarily mapped int
If you do not configure this policy setting, users choose whether network paths are mapped into the Intranet Zone.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -4175,20 +4303,22 @@ If you do not configure this policy setting, users choose whether network paths
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Intranet Sites: Include all network paths (UNCs)*
- GP name: *IZ_UNCAsIntranet*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/InternetZoneAllowAccessToDataSources**
-
+
Home
@@ -4210,8 +4340,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -4220,8 +4350,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).
If you enable this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you select Prompt in the drop-down box, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.
@@ -4230,7 +4360,7 @@ If you disable this policy setting, users cannot load a page in the zone that us
If you do not configure this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -4238,20 +4368,22 @@ If you do not configure this policy setting, users cannot load a page in the zon
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Access data sources across domains*
- GP name: *IZ_PolicyAccessDataSourcesAcrossDomains_1*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/InternetZoneAllowAutomaticPromptingForActiveXControls**
-
+
Home
@@ -4273,8 +4405,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -4283,8 +4415,8 @@ ADMX Info:
-
-
+
+
This policy setting manages whether users will be automatically prompted for ActiveX control installations.
If you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.
@@ -4293,7 +4425,7 @@ If you disable this policy setting, ActiveX control installations will be blocke
If you do not configure this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -4301,20 +4433,22 @@ If you do not configure this policy setting, ActiveX control installations will
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Automatic prompting for ActiveX controls*
- GP name: *IZ_PolicyNotificationBarActiveXURLaction_1*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/InternetZoneAllowAutomaticPromptingForFileDownloads**
-
+
Home
@@ -4336,8 +4470,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -4346,15 +4480,15 @@ ADMX Info:
-
-
+
+
This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.
If you enable this setting, users will receive a file download dialog for automatic download attempts.
If you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the Notification bar instead of the file download dialog. Users can then click the Notification bar to allow the file download prompt.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -4362,20 +4496,22 @@ If you disable or do not configure this setting, file downloads that are not use
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Automatic prompting for file downloads*
- GP name: *IZ_PolicyNotificationBarDownloadURLaction_1*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/InternetZoneAllowCopyPasteViaScript**
-
+
Home
@@ -4397,8 +4533,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -4407,9 +4543,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -4417,20 +4554,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Allow cut, copy or paste operations from the clipboard via script*
- GP name: *IZ_PolicyAllowPasteViaScript_1*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/InternetZoneAllowDragAndDropCopyAndPasteFiles**
-
+
Home
@@ -4452,8 +4591,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -4462,9 +4601,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -4472,20 +4612,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Allow drag and drop or copy and paste files*
- GP name: *IZ_PolicyDropOrPasteFiles_1*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/InternetZoneAllowFontDownloads**
-
+
Home
@@ -4507,8 +4649,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -4517,8 +4659,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage whether pages of the zone may download HTML fonts.
If you enable this policy setting, HTML fonts can be downloaded automatically. If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.
@@ -4527,7 +4669,7 @@ If you disable this policy setting, HTML fonts are prevented from downloading.
If you do not configure this policy setting, HTML fonts can be downloaded automatically.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -4535,20 +4677,22 @@ If you do not configure this policy setting, HTML fonts can be downloaded automa
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Allow font downloads*
- GP name: *IZ_PolicyFontDownload_1*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/InternetZoneAllowLessPrivilegedSites**
-
+
Home
@@ -4570,8 +4714,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -4580,8 +4724,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage whether Web sites from less privileged zones, such as Restricted Sites, can navigate into this zone.
If you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur.
@@ -4590,7 +4734,7 @@ If you disable this policy setting, the possibly harmful navigations are prevent
If you do not configure this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -4598,20 +4742,22 @@ If you do not configure this policy setting, Web sites from less privileged zone
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Web sites in less privileged Web content zones can navigate into this zone*
- GP name: *IZ_PolicyZoneElevationURLaction_1*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/InternetZoneAllowLoadingOfXAMLFiles**
-
+
Home
@@ -4633,8 +4779,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -4643,9 +4789,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -4653,20 +4800,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Allow loading of XAML files*
- GP name: *IZ_Policy_XAML_1*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/InternetZoneAllowNETFrameworkReliantComponents**
-
+
Home
@@ -4688,8 +4837,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -4698,8 +4847,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.
If you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components.
@@ -4708,7 +4857,7 @@ If you disable this policy setting, Internet Explorer will not execute unsigned
If you do not configure this policy setting, Internet Explorer will execute unsigned managed components.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -4716,20 +4865,22 @@ If you do not configure this policy setting, Internet Explorer will execute unsi
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Run .NET Framework-reliant components not signed with Authenticode*
- GP name: *IZ_PolicyUnsignedFrameworkComponentsURLaction_1*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/InternetZoneAllowOnlyApprovedDomainsToUseActiveXControls**
-
+
Home
@@ -4751,8 +4902,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -4761,9 +4912,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -4771,20 +4923,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Allow only approved domains to use ActiveX controls without prompt*
- GP name: *IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Internet*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/InternetZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl**
-
+
Home
@@ -4806,8 +4960,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -4816,9 +4970,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -4826,20 +4981,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Allow only approved domains to use the TDC ActiveX control*
- GP name: *IZ_PolicyAllowTDCControl_Both_Internet*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/InternetZoneAllowScriptInitiatedWindows**
-
+
Home
@@ -4861,8 +5018,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -4871,9 +5028,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -4881,20 +5039,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Allow script-initiated windows without size or position constraints*
- GP name: *IZ_PolicyWindowsRestrictionsURLaction_1*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/InternetZoneAllowScriptingOfInternetExplorerWebBrowserControls**
-
+
Home
@@ -4916,8 +5076,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -4926,9 +5086,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -4936,20 +5097,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Allow scripting of Internet Explorer WebBrowser controls*
- GP name: *IZ_Policy_WebBrowserControl_1*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/InternetZoneAllowScriptlets**
-
+
Home
@@ -4971,8 +5134,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -4981,8 +5144,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage whether the user can run scriptlets.
If you enable this policy setting, the user can run scriptlets.
@@ -4991,7 +5154,7 @@ If you disable this policy setting, the user cannot run scriptlets.
If you do not configure this policy setting, the user can enable or disable scriptlets.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -4999,20 +5162,22 @@ If you do not configure this policy setting, the user can enable or disable scri
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Allow scriptlets*
- GP name: *IZ_Policy_AllowScriptlets_1*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/InternetZoneAllowSmartScreenIE**
-
+
Home
@@ -5034,8 +5199,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -5044,8 +5209,8 @@ ADMX Info:
-
-
+
+
This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.
If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content.
@@ -5056,7 +5221,7 @@ If you do not configure this policy setting, the user can choose whether SmartSc
Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -5064,20 +5229,22 @@ Note: In Internet Explorer 7, this policy setting controls whether Phishing Filt
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Turn on SmartScreen Filter scan*
- GP name: *IZ_Policy_Phishing_1*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/InternetZoneAllowUpdatesToStatusBarViaScript**
-
+
Home
@@ -5099,8 +5266,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -5109,9 +5276,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -5119,20 +5287,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Allow updates to status bar via script*
- GP name: *IZ_Policy_ScriptStatusBar_1*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/InternetZoneAllowUserDataPersistence**
-
+
Home
@@ -5154,8 +5324,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -5164,8 +5334,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.
If you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.
@@ -5174,7 +5344,7 @@ If you disable this policy setting, users cannot preserve information in the bro
If you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -5182,20 +5352,22 @@ If you do not configure this policy setting, users can preserve information in t
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Userdata persistence*
- GP name: *IZ_PolicyUserdataPersistence_1*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/InternetZoneDoNotRunAntimalwareAgainstActiveXControls**
-
+
Home
@@ -5217,8 +5389,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -5227,9 +5399,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -5237,20 +5410,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Don't run antimalware programs against ActiveX controls*
- GP name: *IZ_PolicyAntiMalwareCheckingOfActiveXControls_1*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/InternetZoneDownloadSignedActiveXControls**
-
+
Home
@@ -5272,8 +5447,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -5282,9 +5457,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -5292,20 +5468,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Download signed ActiveX controls*
- GP name: *IZ_PolicyDownloadSignedActiveX_1*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/InternetZoneDownloadUnsignedActiveXControls**
-
+
Home
@@ -5327,8 +5505,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -5337,9 +5515,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -5347,20 +5526,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Download unsigned ActiveX controls*
- GP name: *IZ_PolicyDownloadUnsignedActiveX_1*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/InternetZoneEnableCrossSiteScriptingFilter**
-
+
Home
@@ -5382,8 +5563,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -5392,9 +5573,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -5402,20 +5584,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Turn on Cross-Site Scripting Filter*
- GP name: *IZ_PolicyTurnOnXSSFilter_Both_Internet*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/InternetZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows**
-
+
Home
@@ -5437,8 +5621,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -5447,9 +5631,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -5457,20 +5642,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Enable dragging of content from different domains across windows*
- GP name: *IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Internet*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/InternetZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows**
-
+
Home
@@ -5492,8 +5679,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -5502,9 +5689,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -5512,20 +5700,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Enable dragging of content from different domains within a window*
- GP name: *IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Internet*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/InternetZoneEnableMIMESniffing**
-
+
Home
@@ -5547,8 +5737,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -5557,9 +5747,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -5567,20 +5758,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Enable MIME Sniffing*
- GP name: *IZ_PolicyMimeSniffingURLaction_1*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/InternetZoneEnableProtectedMode**
-
+
Home
@@ -5602,8 +5795,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -5612,9 +5805,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -5622,20 +5816,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Turn on Protected Mode*
- GP name: *IZ_Policy_TurnOnProtectedMode_1*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/InternetZoneIncludeLocalPathWhenUploadingFilesToServer**
-
+
Home
@@ -5657,8 +5853,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -5667,9 +5863,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -5677,20 +5874,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Include local path when user is uploading files to a server*
- GP name: *IZ_Policy_LocalPathForUpload_1*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/InternetZoneInitializeAndScriptActiveXControls**
-
+
Home
@@ -5712,8 +5911,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -5722,8 +5921,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage ActiveX controls not marked as safe.
If you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. This setting is not recommended, except for secure and administered zones. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option.
@@ -5734,7 +5933,7 @@ If you disable this policy setting, ActiveX controls that cannot be made safe ar
If you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -5742,20 +5941,22 @@ If you do not configure this policy setting, ActiveX controls that cannot be mad
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Initialize and script ActiveX controls not marked as safe*
- GP name: *IZ_PolicyScriptActiveXNotMarkedSafe_1*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/InternetZoneInitializeAndScriptActiveXControlsNotMarkedSafe**
-
+
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -5817,9 +6021,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -5827,20 +6032,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Java permissions*
- GP name: *IZ_PolicyJavaPermissions_1*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/InternetZoneLaunchingApplicationsAndFilesInIFRAME**
-
+
Home
@@ -5862,8 +6069,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -5872,9 +6079,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -5882,20 +6090,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Launching applications and files in an IFRAME*
- GP name: *IZ_PolicyLaunchAppsAndFilesInIFRAME_1*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/InternetZoneLogonOptions**
-
+
Home
@@ -5917,8 +6127,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -5927,9 +6137,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -5937,20 +6148,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Logon options*
- GP name: *IZ_PolicyLogon_1*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/InternetZoneNavigateWindowsAndFrames**
-
+
Home
@@ -5972,8 +6185,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -5982,8 +6195,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.
If you enable this policy setting, users can open windows and frames from othe domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains.
@@ -5992,7 +6205,7 @@ If you disable this policy setting, users cannot open windows and frames to acce
If you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -6000,20 +6213,22 @@ If you do not configure this policy setting, users can open windows and frames f
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Navigate windows and frames across different domains*
- GP name: *IZ_PolicyNavigateSubframesAcrossDomains_1*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/InternetZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode**
-
+
Home
@@ -6035,8 +6250,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -6045,9 +6260,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -6055,20 +6271,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Run .NET Framework-reliant components signed with Authenticode*
- GP name: *IZ_PolicySignedFrameworkComponentsURLaction_1*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/InternetZoneShowSecurityWarningForPotentiallyUnsafeFiles**
-
+
Home
@@ -6090,8 +6308,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -6100,9 +6318,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -6110,20 +6329,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Show security warning for potentially unsafe files*
- GP name: *IZ_Policy_UnsafeFiles_1*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/InternetZoneUsePopupBlocker**
-
+
Home
@@ -6145,8 +6366,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -6155,9 +6376,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -6165,20 +6387,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Use Pop-up Blocker*
- GP name: *IZ_PolicyBlockPopupWindows_1*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/IntranetZoneAllowAccessToDataSources**
-
+
Home
@@ -6200,8 +6424,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -6210,8 +6434,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).
If you enable this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you select Prompt in the drop-down box, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.
@@ -6220,7 +6444,7 @@ If you disable this policy setting, users cannot load a page in the zone that us
If you do not configure this policy setting, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -6228,20 +6452,22 @@ If you do not configure this policy setting, users are queried to choose whether
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Access data sources across domains*
- GP name: *IZ_PolicyAccessDataSourcesAcrossDomains_3*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/IntranetZoneAllowAutomaticPromptingForActiveXControls**
-
+
Home
@@ -6263,8 +6489,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -6273,8 +6499,8 @@ ADMX Info:
-
-
+
+
This policy setting manages whether users will be automatically prompted for ActiveX control installations.
If you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.
@@ -6283,7 +6509,7 @@ If you disable this policy setting, ActiveX control installations will be blocke
If you do not configure this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -6291,20 +6517,22 @@ If you do not configure this policy setting, users will receive a prompt when a
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Automatic prompting for ActiveX controls*
- GP name: *IZ_PolicyNotificationBarActiveXURLaction_3*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/IntranetZoneAllowAutomaticPromptingForFileDownloads**
-
+
Home
@@ -6326,8 +6554,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -6336,15 +6564,15 @@ ADMX Info:
-
-
+
+
This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.
If you enable this setting, users will receive a file download dialog for automatic download attempts.
If you disable or do not configure this setting, users will receive a file download dialog for automatic download attempts.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -6352,20 +6580,22 @@ If you disable or do not configure this setting, users will receive a file downl
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Automatic prompting for file downloads*
- GP name: *IZ_PolicyNotificationBarDownloadURLaction_3*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/IntranetZoneAllowFontDownloads**
-
+
Home
@@ -6387,8 +6617,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -6397,8 +6627,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage whether pages of the zone may download HTML fonts.
If you enable this policy setting, HTML fonts can be downloaded automatically. If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.
@@ -6407,7 +6637,7 @@ If you disable this policy setting, HTML fonts are prevented from downloading.
If you do not configure this policy setting, HTML fonts can be downloaded automatically.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -6415,20 +6645,22 @@ If you do not configure this policy setting, HTML fonts can be downloaded automa
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Allow font downloads*
- GP name: *IZ_PolicyFontDownload_3*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/IntranetZoneAllowLessPrivilegedSites**
-
+
Home
@@ -6450,8 +6682,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -6460,8 +6692,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage whether Web sites from less privileged zones, such as Restricted Sites, can navigate into this zone.
If you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur.
@@ -6470,7 +6702,7 @@ If you disable this policy setting, the possibly harmful navigations are prevent
If you do not configure this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -6478,20 +6710,22 @@ If you do not configure this policy setting, Web sites from less privileged zone
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Web sites in less privileged Web content zones can navigate into this zone*
- GP name: *IZ_PolicyZoneElevationURLaction_3*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/IntranetZoneAllowNETFrameworkReliantComponents**
-
+
Home
@@ -6513,8 +6747,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -6523,8 +6757,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.
If you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components.
@@ -6533,7 +6767,7 @@ If you disable this policy setting, Internet Explorer will not execute unsigned
If you do not configure this policy setting, Internet Explorer will execute unsigned managed components.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -6541,20 +6775,22 @@ If you do not configure this policy setting, Internet Explorer will execute unsi
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Run .NET Framework-reliant components not signed with Authenticode*
- GP name: *IZ_PolicyUnsignedFrameworkComponentsURLaction_3*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/IntranetZoneAllowScriptlets**
-
+
Home
@@ -6576,8 +6812,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -6586,8 +6822,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage whether the user can run scriptlets.
If you enable this policy setting, the user can run scriptlets.
@@ -6596,7 +6832,7 @@ If you disable this policy setting, the user cannot run scriptlets.
If you do not configure this policy setting, the user can enable or disable scriptlets.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -6604,20 +6840,22 @@ If you do not configure this policy setting, the user can enable or disable scri
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Allow scriptlets*
- GP name: *IZ_Policy_AllowScriptlets_3*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/IntranetZoneAllowSmartScreenIE**
-
+
Home
@@ -6639,8 +6877,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -6649,8 +6887,8 @@ ADMX Info:
-
-
+
+
This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.
If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content.
@@ -6661,7 +6899,7 @@ If you do not configure this policy setting, the user can choose whether SmartSc
Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -6669,20 +6907,22 @@ Note: In Internet Explorer 7, this policy setting controls whether Phishing Filt
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Turn on SmartScreen Filter scan*
- GP name: *IZ_Policy_Phishing_3*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/IntranetZoneAllowUserDataPersistence**
-
+
Home
@@ -6704,8 +6944,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -6714,8 +6954,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.
If you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.
@@ -6724,7 +6964,7 @@ If you disable this policy setting, users cannot preserve information in the bro
If you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -6732,20 +6972,22 @@ If you do not configure this policy setting, users can preserve information in t
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Userdata persistence*
- GP name: *IZ_PolicyUserdataPersistence_3*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/IntranetZoneDoNotRunAntimalwareAgainstActiveXControls**
-
+
Home
@@ -6767,8 +7009,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -6777,9 +7019,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -6787,20 +7030,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Don't run antimalware programs against ActiveX controls*
- GP name: *IZ_PolicyAntiMalwareCheckingOfActiveXControls_3*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/IntranetZoneInitializeAndScriptActiveXControls**
-
+
Home
@@ -6822,8 +7067,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -6832,8 +7077,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage ActiveX controls not marked as safe.
If you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. This setting is not recommended, except for secure and administered zones. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option.
@@ -6844,7 +7089,7 @@ If you disable this policy setting, ActiveX controls that cannot be made safe ar
If you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -6852,20 +7097,22 @@ If you do not configure this policy setting, ActiveX controls that cannot be mad
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Initialize and script ActiveX controls not marked as safe*
- GP name: *IZ_PolicyScriptActiveXNotMarkedSafe_3*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/IntranetZoneJavaPermissions**
-
+
Home
@@ -6887,8 +7134,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -6897,9 +7144,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -6907,20 +7155,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Java permissions*
- GP name: *IZ_PolicyJavaPermissions_3*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/IntranetZoneNavigateWindowsAndFrames**
-
+
Home
@@ -6942,8 +7192,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -6952,8 +7202,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.
If you enable this policy setting, users can open windows and frames from othe domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains.
@@ -6962,7 +7212,7 @@ If you disable this policy setting, users cannot open windows and frames to acce
If you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -6970,20 +7220,22 @@ If you do not configure this policy setting, users can open windows and frames f
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Navigate windows and frames across different domains*
- GP name: *IZ_PolicyNavigateSubframesAcrossDomains_3*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LocalMachineZoneAllowAccessToDataSources**
-
+
Home
@@ -7005,8 +7257,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -7015,8 +7267,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).
If you enable this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you select Prompt in the drop-down box, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.
@@ -7025,7 +7277,7 @@ If you disable this policy setting, users cannot load a page in the zone that us
If you do not configure this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -7033,20 +7285,22 @@ If you do not configure this policy setting, users can load a page in the zone t
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Access data sources across domains*
- GP name: *IZ_PolicyAccessDataSourcesAcrossDomains_9*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LocalMachineZoneAllowAutomaticPromptingForActiveXControls**
-
+
Home
@@ -7068,8 +7322,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -7078,8 +7332,8 @@ ADMX Info:
-
-
+
+
This policy setting manages whether users will be automatically prompted for ActiveX control installations.
If you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.
@@ -7088,7 +7342,7 @@ If you disable this policy setting, ActiveX control installations will be blocke
If you do not configure this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -7096,20 +7350,22 @@ If you do not configure this policy setting, users will receive a prompt when a
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Automatic prompting for ActiveX controls*
- GP name: *IZ_PolicyNotificationBarActiveXURLaction_9*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LocalMachineZoneAllowAutomaticPromptingForFileDownloads**
-
+
Home
@@ -7131,8 +7387,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -7141,15 +7397,15 @@ ADMX Info:
-
-
+
+
This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.
If you enable this setting, users will receive a file download dialog for automatic download attempts.
If you disable or do not configure this setting, users will receive a file download dialog for automatic download attempts.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -7157,20 +7413,22 @@ If you disable or do not configure this setting, users will receive a file downl
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Automatic prompting for file downloads*
- GP name: *IZ_PolicyNotificationBarDownloadURLaction_9*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LocalMachineZoneAllowFontDownloads**
-
+
Home
@@ -7192,8 +7450,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -7202,8 +7460,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage whether pages of the zone may download HTML fonts.
If you enable this policy setting, HTML fonts can be downloaded automatically. If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.
@@ -7212,7 +7470,7 @@ If you disable this policy setting, HTML fonts are prevented from downloading.
If you do not configure this policy setting, HTML fonts can be downloaded automatically.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -7220,20 +7478,22 @@ If you do not configure this policy setting, HTML fonts can be downloaded automa
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Allow font downloads*
- GP name: *IZ_PolicyFontDownload_9*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LocalMachineZoneAllowLessPrivilegedSites**
-
+
Home
@@ -7255,8 +7515,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -7265,8 +7525,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage whether Web sites from less privileged zones, such as Internet sites, can navigate into this zone.
If you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur.
@@ -7275,7 +7535,7 @@ If you disable this policy setting, the possibly harmful navigations are prevent
If you do not configure this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -7283,20 +7543,22 @@ If you do not configure this policy setting, the possibly harmful navigations ar
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Web sites in less privileged Web content zones can navigate into this zone*
- GP name: *IZ_PolicyZoneElevationURLaction_9*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LocalMachineZoneAllowNETFrameworkReliantComponents**
-
+
Home
@@ -7318,8 +7580,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -7328,8 +7590,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.
If you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components.
@@ -7338,7 +7600,7 @@ If you disable this policy setting, Internet Explorer will not execute unsigned
If you do not configure this policy setting, Internet Explorer will not execute unsigned managed components.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -7346,20 +7608,22 @@ If you do not configure this policy setting, Internet Explorer will not execute
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Run .NET Framework-reliant components not signed with Authenticode*
- GP name: *IZ_PolicyUnsignedFrameworkComponentsURLaction_9*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LocalMachineZoneAllowScriptlets**
-
+
Home
@@ -7381,8 +7645,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -7391,8 +7655,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage whether the user can run scriptlets.
If you enable this policy setting, the user can run scriptlets.
@@ -7401,7 +7665,7 @@ If you disable this policy setting, the user cannot run scriptlets.
If you do not configure this policy setting, the user can enable or disable scriptlets.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -7409,20 +7673,22 @@ If you do not configure this policy setting, the user can enable or disable scri
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Allow scriptlets*
- GP name: *IZ_Policy_AllowScriptlets_9*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LocalMachineZoneAllowSmartScreenIE**
-
+
Home
@@ -7444,8 +7710,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -7454,8 +7720,8 @@ ADMX Info:
-
-
+
+
This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.
If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content.
@@ -7466,7 +7732,7 @@ If you do not configure this policy setting, the user can choose whether SmartSc
Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -7474,20 +7740,22 @@ Note: In Internet Explorer 7, this policy setting controls whether Phishing Filt
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Turn on SmartScreen Filter scan*
- GP name: *IZ_Policy_Phishing_9*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LocalMachineZoneAllowUserDataPersistence**
-
+
Home
@@ -7509,8 +7777,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -7519,8 +7787,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.
If you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.
@@ -7529,7 +7797,7 @@ If you disable this policy setting, users cannot preserve information in the bro
If you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -7537,20 +7805,22 @@ If you do not configure this policy setting, users can preserve information in t
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Userdata persistence*
- GP name: *IZ_PolicyUserdataPersistence_9*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LocalMachineZoneDoNotRunAntimalwareAgainstActiveXControls**
-
+
Home
@@ -7572,8 +7842,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -7582,9 +7852,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -7592,20 +7863,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Don't run antimalware programs against ActiveX controls*
- GP name: *IZ_PolicyAntiMalwareCheckingOfActiveXControls_9*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LocalMachineZoneInitializeAndScriptActiveXControls**
-
+
Home
@@ -7627,8 +7900,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -7637,8 +7910,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage ActiveX controls not marked as safe.
If you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. This setting is not recommended, except for secure and administered zones. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option.
@@ -7649,7 +7922,7 @@ If you disable this policy setting, ActiveX controls that cannot be made safe ar
If you do not configure this policy setting, users are queried whether to allow the control to be loaded with parameters or scripted.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -7657,20 +7930,22 @@ If you do not configure this policy setting, users are queried whether to allow
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Initialize and script ActiveX controls not marked as safe*
- GP name: *IZ_PolicyScriptActiveXNotMarkedSafe_9*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LocalMachineZoneJavaPermissions**
-
+
Home
@@ -7692,8 +7967,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -7702,9 +7977,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -7712,20 +7988,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Java permissions*
- GP name: *IZ_PolicyJavaPermissions_9*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LocalMachineZoneNavigateWindowsAndFrames**
-
+
Home
@@ -7747,8 +8025,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -7757,8 +8035,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.
If you enable this policy setting, users can open windows and frames from othe domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains.
@@ -7767,7 +8045,7 @@ If you disable this policy setting, users cannot open windows and frames to acce
If you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -7775,20 +8053,22 @@ If you do not configure this policy setting, users can open windows and frames f
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Navigate windows and frames across different domains*
- GP name: *IZ_PolicyNavigateSubframesAcrossDomains_9*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownInternetZoneAllowAccessToDataSources**
-
+
Home
@@ -7810,8 +8090,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -7820,8 +8100,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).
If you enable this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you select Prompt in the drop-down box, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.
@@ -7830,7 +8110,7 @@ If you disable this policy setting, users cannot load a page in the zone that us
If you do not configure this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -7838,20 +8118,22 @@ If you do not configure this policy setting, users cannot load a page in the zon
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Access data sources across domains*
- GP name: *IZ_PolicyAccessDataSourcesAcrossDomains_2*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownInternetZoneAllowAutomaticPromptingForActiveXControls**
-
+
Home
@@ -7873,8 +8155,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -7883,8 +8165,8 @@ ADMX Info:
-
-
+
+
This policy setting manages whether users will be automatically prompted for ActiveX control installations.
If you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.
@@ -7893,7 +8175,7 @@ If you disable this policy setting, ActiveX control installations will be blocke
If you do not configure this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -7901,20 +8183,22 @@ If you do not configure this policy setting, ActiveX control installations will
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Automatic prompting for ActiveX controls*
- GP name: *IZ_PolicyNotificationBarActiveXURLaction_2*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownInternetZoneAllowAutomaticPromptingForFileDownloads**
-
+
Home
@@ -7936,8 +8220,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -7946,15 +8230,15 @@ ADMX Info:
-
-
+
+
This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.
If you enable this setting, users will receive a file download dialog for automatic download attempts.
If you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the Notification bar instead of the file download dialog. Users can then click the Notification bar to allow the file download prompt.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -7962,20 +8246,22 @@ If you disable or do not configure this setting, file downloads that are not use
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Automatic prompting for file downloads*
- GP name: *IZ_PolicyNotificationBarDownloadURLaction_2*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownInternetZoneAllowFontDownloads**
-
+
Home
@@ -7997,8 +8283,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -8007,8 +8293,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage whether pages of the zone may download HTML fonts.
If you enable this policy setting, HTML fonts can be downloaded automatically. If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.
@@ -8017,7 +8303,7 @@ If you disable this policy setting, HTML fonts are prevented from downloading.
If you do not configure this policy setting, HTML fonts can be downloaded automatically.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -8025,20 +8311,22 @@ If you do not configure this policy setting, HTML fonts can be downloaded automa
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Allow font downloads*
- GP name: *IZ_PolicyFontDownload_2*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownInternetZoneAllowLessPrivilegedSites**
-
+
Home
@@ -8060,8 +8348,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -8070,8 +8358,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage whether Web sites from less privileged zones, such as Internet sites, can navigate into this zone.
If you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur.
@@ -8080,7 +8368,7 @@ If you disable this policy setting, the possibly harmful navigations are prevent
If you do not configure this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -8088,20 +8376,22 @@ If you do not configure this policy setting, the possibly harmful navigations ar
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Web sites in less privileged Web content zones can navigate into this zone*
- GP name: *IZ_PolicyZoneElevationURLaction_2*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownInternetZoneAllowNETFrameworkReliantComponents**
-
+
Home
@@ -8123,8 +8413,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -8133,8 +8423,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.
If you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components.
@@ -8143,7 +8433,7 @@ If you disable this policy setting, Internet Explorer will not execute unsigned
If you do not configure this policy setting, Internet Explorer will not execute unsigned managed components.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -8151,20 +8441,22 @@ If you do not configure this policy setting, Internet Explorer will not execute
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Run .NET Framework-reliant components not signed with Authenticode*
- GP name: *IZ_PolicyUnsignedFrameworkComponentsURLaction_2*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownInternetZoneAllowScriptlets**
-
+
Home
@@ -8186,8 +8478,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -8196,8 +8488,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage whether the user can run scriptlets.
If you enable this policy setting, the user can run scriptlets.
@@ -8206,7 +8498,7 @@ If you disable this policy setting, the user cannot run scriptlets.
If you do not configure this policy setting, the user can enable or disable scriptlets.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -8214,20 +8506,22 @@ If you do not configure this policy setting, the user can enable or disable scri
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Allow scriptlets*
- GP name: *IZ_Policy_AllowScriptlets_2*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownInternetZoneAllowSmartScreenIE**
-
+
Home
@@ -8249,8 +8543,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -8259,8 +8553,8 @@ ADMX Info:
-
-
+
+
This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.
If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content.
@@ -8271,7 +8565,7 @@ If you do not configure this policy setting, the user can choose whether SmartSc
Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -8279,20 +8573,22 @@ Note: In Internet Explorer 7, this policy setting controls whether Phishing Filt
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Turn on SmartScreen Filter scan*
- GP name: *IZ_Policy_Phishing_2*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownInternetZoneAllowUserDataPersistence**
-
+
Home
@@ -8314,8 +8610,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -8324,8 +8620,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.
If you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.
@@ -8334,7 +8630,7 @@ If you disable this policy setting, users cannot preserve information in the bro
If you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -8342,20 +8638,22 @@ If you do not configure this policy setting, users can preserve information in t
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Userdata persistence*
- GP name: *IZ_PolicyUserdataPersistence_2*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownInternetZoneInitializeAndScriptActiveXControls**
-
+
Home
@@ -8377,8 +8675,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -8387,8 +8685,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage ActiveX controls not marked as safe.
If you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. This setting is not recommended, except for secure and administered zones. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option.
@@ -8399,7 +8697,7 @@ If you disable this policy setting, ActiveX controls that cannot be made safe ar
If you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -8407,20 +8705,22 @@ If you do not configure this policy setting, ActiveX controls that cannot be mad
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Initialize and script ActiveX controls not marked as safe*
- GP name: *IZ_PolicyScriptActiveXNotMarkedSafe_2*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownInternetZoneJavaPermissions**
-
+
Home
@@ -8442,8 +8742,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -8452,9 +8752,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -8462,20 +8763,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Java permissions*
- GP name: *IZ_PolicyJavaPermissions_2*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownInternetZoneNavigateWindowsAndFrames**
-
+
Home
@@ -8497,8 +8800,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -8507,8 +8810,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.
If you enable this policy setting, users can open windows and frames from othe domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains.
@@ -8517,7 +8820,7 @@ If you disable this policy setting, users cannot open windows and frames to acce
If you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -8525,20 +8828,22 @@ If you do not configure this policy setting, users can open windows and frames f
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Navigate windows and frames across different domains*
- GP name: *IZ_PolicyNavigateSubframesAcrossDomains_2*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownIntranetZoneAllowAccessToDataSources**
-
+
Home
@@ -8560,8 +8865,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -8570,8 +8875,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).
If you enable this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you select Prompt in the drop-down box, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.
@@ -8580,7 +8885,7 @@ If you disable this policy setting, users cannot load a page in the zone that us
If you do not configure this policy setting, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -8588,20 +8893,22 @@ If you do not configure this policy setting, users are queried to choose whether
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Access data sources across domains*
- GP name: *IZ_PolicyAccessDataSourcesAcrossDomains_4*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownIntranetZoneAllowAutomaticPromptingForActiveXControls**
-
+
Home
@@ -8623,8 +8930,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -8633,8 +8940,8 @@ ADMX Info:
-
-
+
+
This policy setting manages whether users will be automatically prompted for ActiveX control installations.
If you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.
@@ -8643,7 +8950,7 @@ If you disable this policy setting, ActiveX control installations will be blocke
If you do not configure this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -8651,20 +8958,22 @@ If you do not configure this policy setting, ActiveX control installations will
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Automatic prompting for ActiveX controls*
- GP name: *IZ_PolicyNotificationBarActiveXURLaction_4*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownIntranetZoneAllowAutomaticPromptingForFileDownloads**
-
+
Home
@@ -8686,8 +8995,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -8696,15 +9005,15 @@ ADMX Info:
-
-
+
+
This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.
If you enable this setting, users will receive a file download dialog for automatic download attempts.
If you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the Notification bar instead of the file download dialog. Users can then click the Notification bar to allow the file download prompt.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -8712,20 +9021,22 @@ If you disable or do not configure this setting, file downloads that are not use
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Automatic prompting for file downloads*
- GP name: *IZ_PolicyNotificationBarDownloadURLaction_4*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownIntranetZoneAllowFontDownloads**
-
+
Home
@@ -8747,8 +9058,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -8757,8 +9068,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage whether pages of the zone may download HTML fonts.
If you enable this policy setting, HTML fonts can be downloaded automatically. If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.
@@ -8767,7 +9078,7 @@ If you disable this policy setting, HTML fonts are prevented from downloading.
If you do not configure this policy setting, HTML fonts can be downloaded automatically.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -8775,20 +9086,22 @@ If you do not configure this policy setting, HTML fonts can be downloaded automa
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Allow font downloads*
- GP name: *IZ_PolicyFontDownload_4*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownIntranetZoneAllowLessPrivilegedSites**
-
+
Home
@@ -8810,8 +9123,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -8820,8 +9133,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage whether Web sites from less privileged zones, such as Internet sites, can navigate into this zone.
If you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur.
@@ -8830,7 +9143,7 @@ If you disable this policy setting, the possibly harmful navigations are prevent
If you do not configure this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -8838,20 +9151,22 @@ If you do not configure this policy setting, the possibly harmful navigations ar
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Web sites in less privileged Web content zones can navigate into this zone*
- GP name: *IZ_PolicyZoneElevationURLaction_4*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownIntranetZoneAllowNETFrameworkReliantComponents**
-
+
Home
@@ -8873,8 +9188,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -8883,8 +9198,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.
If you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components.
@@ -8893,7 +9208,7 @@ If you disable this policy setting, Internet Explorer will not execute unsigned
If you do not configure this policy setting, Internet Explorer will not execute unsigned managed components.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -8901,20 +9216,22 @@ If you do not configure this policy setting, Internet Explorer will not execute
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Run .NET Framework-reliant components not signed with Authenticode*
- GP name: *IZ_PolicyUnsignedFrameworkComponentsURLaction_4*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownIntranetZoneAllowScriptlets**
-
+
Home
@@ -8936,8 +9253,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -8946,8 +9263,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage whether the user can run scriptlets.
If you enable this policy setting, the user can run scriptlets.
@@ -8956,7 +9273,7 @@ If you disable this policy setting, the user cannot run scriptlets.
If you do not configure this policy setting, the user can enable or disable scriptlets.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -8964,20 +9281,22 @@ If you do not configure this policy setting, the user can enable or disable scri
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Allow scriptlets*
- GP name: *IZ_Policy_AllowScriptlets_4*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownIntranetZoneAllowSmartScreenIE**
-
+
Home
@@ -8999,8 +9318,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -9009,8 +9328,8 @@ ADMX Info:
-
-
+
+
This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.
If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content.
@@ -9021,7 +9340,7 @@ If you do not configure this policy setting, the user can choose whether SmartSc
Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -9029,20 +9348,22 @@ Note: In Internet Explorer 7, this policy setting controls whether Phishing Filt
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Turn on SmartScreen Filter scan*
- GP name: *IZ_Policy_Phishing_4*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownIntranetZoneAllowUserDataPersistence**
-
+
Home
@@ -9064,8 +9385,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -9074,8 +9395,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.
If you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.
@@ -9084,7 +9405,7 @@ If you disable this policy setting, users cannot preserve information in the bro
If you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -9092,20 +9413,22 @@ If you do not configure this policy setting, users can preserve information in t
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Userdata persistence*
- GP name: *IZ_PolicyUserdataPersistence_4*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownIntranetZoneInitializeAndScriptActiveXControls**
-
+
Home
@@ -9127,8 +9450,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -9137,8 +9460,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage ActiveX controls not marked as safe.
If you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. This setting is not recommended, except for secure and administered zones. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option.
@@ -9149,7 +9472,7 @@ If you disable this policy setting, ActiveX controls that cannot be made safe ar
If you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -9157,20 +9480,22 @@ If you do not configure this policy setting, ActiveX controls that cannot be mad
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Initialize and script ActiveX controls not marked as safe*
- GP name: *IZ_PolicyScriptActiveXNotMarkedSafe_4*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownIntranetZoneNavigateWindowsAndFrames**
-
+
Home
@@ -9192,8 +9517,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -9202,8 +9527,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.
If you enable this policy setting, users can open windows and frames from othe domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains.
@@ -9212,7 +9537,7 @@ If you disable this policy setting, users cannot open windows and frames to acce
If you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -9220,20 +9545,22 @@ If you do not configure this policy setting, users can open windows and frames f
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Navigate windows and frames across different domains*
- GP name: *IZ_PolicyNavigateSubframesAcrossDomains_4*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownLocalMachineZoneAllowAccessToDataSources**
-
+
Home
@@ -9255,8 +9582,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -9265,8 +9592,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).
If you enable this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you select Prompt in the drop-down box, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.
@@ -9275,7 +9602,7 @@ If you disable this policy setting, users cannot load a page in the zone that us
If you do not configure this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -9283,20 +9610,22 @@ If you do not configure this policy setting, users can load a page in the zone t
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Access data sources across domains*
- GP name: *IZ_PolicyAccessDataSourcesAcrossDomains_10*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownLocalMachineZoneAllowAutomaticPromptingForActiveXControls**
-
+
Home
@@ -9318,8 +9647,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -9328,8 +9657,8 @@ ADMX Info:
-
-
+
+
This policy setting manages whether users will be automatically prompted for ActiveX control installations.
If you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.
@@ -9338,7 +9667,7 @@ If you disable this policy setting, ActiveX control installations will be blocke
If you do not configure this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -9346,20 +9675,22 @@ If you do not configure this policy setting, ActiveX control installations will
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Automatic prompting for ActiveX controls*
- GP name: *IZ_PolicyNotificationBarActiveXURLaction_10*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownLocalMachineZoneAllowAutomaticPromptingForFileDownloads**
-
+
Home
@@ -9381,8 +9712,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -9391,15 +9722,15 @@ ADMX Info:
-
-
+
+
This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.
If you enable this setting, users will receive a file download dialog for automatic download attempts.
If you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the Notification bar instead of the file download dialog. Users can then click the Notification bar to allow the file download prompt.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -9407,20 +9738,22 @@ If you disable or do not configure this setting, file downloads that are not use
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Automatic prompting for file downloads*
- GP name: *IZ_PolicyNotificationBarDownloadURLaction_10*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownLocalMachineZoneAllowFontDownloads**
-
+
Home
@@ -9442,8 +9775,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -9452,8 +9785,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage whether pages of the zone may download HTML fonts.
If you enable this policy setting, HTML fonts can be downloaded automatically. If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.
@@ -9462,7 +9795,7 @@ If you disable this policy setting, HTML fonts are prevented from downloading.
If you do not configure this policy setting, HTML fonts can be downloaded automatically.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -9470,20 +9803,22 @@ If you do not configure this policy setting, HTML fonts can be downloaded automa
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Allow font downloads*
- GP name: *IZ_PolicyFontDownload_10*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownLocalMachineZoneAllowLessPrivilegedSites**
-
+
Home
@@ -9505,8 +9840,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -9515,8 +9850,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage whether Web sites from less privileged zones, such as Internet sites, can navigate into this zone.
If you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur.
@@ -9525,7 +9860,7 @@ If you disable this policy setting, the possibly harmful navigations are prevent
If you do not configure this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -9533,20 +9868,22 @@ If you do not configure this policy setting, the possibly harmful navigations ar
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Web sites in less privileged Web content zones can navigate into this zone*
- GP name: *IZ_PolicyZoneElevationURLaction_10*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownLocalMachineZoneAllowNETFrameworkReliantComponents**
-
+
Home
@@ -9568,8 +9905,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -9578,8 +9915,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.
If you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components.
@@ -9588,7 +9925,7 @@ If you disable this policy setting, Internet Explorer will not execute unsigned
If you do not configure this policy setting, Internet Explorer will not execute unsigned managed components.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -9596,20 +9933,22 @@ If you do not configure this policy setting, Internet Explorer will not execute
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Run .NET Framework-reliant components not signed with Authenticode*
- GP name: *IZ_PolicyUnsignedFrameworkComponentsURLaction_10*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownLocalMachineZoneAllowScriptlets**
-
+
Home
@@ -9631,8 +9970,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -9641,8 +9980,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage whether the user can run scriptlets.
If you enable this policy setting, the user can run scriptlets.
@@ -9651,7 +9990,7 @@ If you disable this policy setting, the user cannot run scriptlets.
If you do not configure this policy setting, the user can enable or disable scriptlets.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -9659,20 +9998,22 @@ If you do not configure this policy setting, the user can enable or disable scri
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Allow scriptlets*
- GP name: *IZ_Policy_AllowScriptlets_10*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownLocalMachineZoneAllowSmartScreenIE**
-
+
Home
@@ -9694,8 +10035,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -9704,8 +10045,8 @@ ADMX Info:
-
-
+
+
This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.
If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content.
@@ -9716,7 +10057,7 @@ If you do not configure this policy setting, the user can choose whether SmartSc
Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -9724,20 +10065,22 @@ Note: In Internet Explorer 7, this policy setting controls whether Phishing Filt
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Turn on SmartScreen Filter scan*
- GP name: *IZ_Policy_Phishing_10*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownLocalMachineZoneAllowUserDataPersistence**
-
+
Home
@@ -9759,8 +10102,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -9769,8 +10112,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.
If you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.
@@ -9779,7 +10122,7 @@ If you disable this policy setting, users cannot preserve information in the bro
If you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -9787,20 +10130,22 @@ If you do not configure this policy setting, users can preserve information in t
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Userdata persistence*
- GP name: *IZ_PolicyUserdataPersistence_10*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownLocalMachineZoneInitializeAndScriptActiveXControls**
-
+
Home
@@ -9822,8 +10167,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -9832,8 +10177,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage ActiveX controls not marked as safe.
If you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. This setting is not recommended, except for secure and administered zones. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option.
@@ -9844,7 +10189,7 @@ If you disable this policy setting, ActiveX controls that cannot be made safe ar
If you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -9852,20 +10197,22 @@ If you do not configure this policy setting, ActiveX controls that cannot be mad
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Initialize and script ActiveX controls not marked as safe*
- GP name: *IZ_PolicyScriptActiveXNotMarkedSafe_10*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownLocalMachineZoneJavaPermissions**
-
+
Home
@@ -9887,8 +10234,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -9897,9 +10244,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -9907,20 +10255,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Java permissions*
- GP name: *IZ_PolicyJavaPermissions_10*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownLocalMachineZoneNavigateWindowsAndFrames**
-
+
Home
@@ -9942,8 +10292,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -9952,8 +10302,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.
If you enable this policy setting, users can open windows and frames from othe domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains.
@@ -9962,7 +10312,7 @@ If you disable this policy setting, users cannot open windows and frames to acce
If you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -9970,20 +10320,22 @@ If you do not configure this policy setting, users can open windows and frames f
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Navigate windows and frames across different domains*
- GP name: *IZ_PolicyNavigateSubframesAcrossDomains_10*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownRestrictedSitesZoneAllowAccessToDataSources**
-
+
Home
@@ -10005,8 +10357,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -10015,8 +10367,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).
If you enable this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you select Prompt in the drop-down box, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.
@@ -10025,7 +10377,7 @@ If you disable this policy setting, users cannot load a page in the zone that us
If you do not configure this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -10033,20 +10385,22 @@ If you do not configure this policy setting, users cannot load a page in the zon
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Access data sources across domains*
- GP name: *IZ_PolicyAccessDataSourcesAcrossDomains_8*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownRestrictedSitesZoneAllowAutomaticPromptingForActiveXControls**
-
+
Home
@@ -10068,8 +10422,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -10078,8 +10432,8 @@ ADMX Info:
-
-
+
+
This policy setting manages whether users will be automatically prompted for ActiveX control installations.
If you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.
@@ -10088,7 +10442,7 @@ If you disable this policy setting, ActiveX control installations will be blocke
If you do not configure this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -10096,20 +10450,22 @@ If you do not configure this policy setting, ActiveX control installations will
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Automatic prompting for ActiveX controls*
- GP name: *IZ_PolicyNotificationBarActiveXURLaction_8*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownRestrictedSitesZoneAllowAutomaticPromptingForFileDownloads**
-
+
Home
@@ -10131,8 +10487,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -10141,15 +10497,15 @@ ADMX Info:
-
-
+
+
This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.
If you enable this setting, users will receive a file download dialog for automatic download attempts.
If you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the Notification bar instead of the file download dialog. Users can then click the Notification bar to allow the file download prompt.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -10157,20 +10513,22 @@ If you disable or do not configure this setting, file downloads that are not use
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Automatic prompting for file downloads*
- GP name: *IZ_PolicyNotificationBarDownloadURLaction_8*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownRestrictedSitesZoneAllowFontDownloads**
-
+
Home
@@ -10192,8 +10550,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -10202,8 +10560,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage whether pages of the zone may download HTML fonts.
If you enable this policy setting, HTML fonts can be downloaded automatically. If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.
@@ -10212,7 +10570,7 @@ If you disable this policy setting, HTML fonts are prevented from downloading.
If you do not configure this policy setting, users are queried whether to allow HTML fonts to download.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -10220,20 +10578,22 @@ If you do not configure this policy setting, users are queried whether to allow
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Allow font downloads*
- GP name: *IZ_PolicyFontDownload_8*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownRestrictedSitesZoneAllowLessPrivilegedSites**
-
+
Home
@@ -10255,8 +10615,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -10265,8 +10625,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage whether Web sites from less privileged zones, such as Internet sites, can navigate into this zone.
If you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur.
@@ -10275,7 +10635,7 @@ If you disable this policy setting, the possibly harmful navigations are prevent
If you do not configure this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -10283,20 +10643,22 @@ If you do not configure this policy setting, the possibly harmful navigations ar
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Web sites in less privileged Web content zones can navigate into this zone*
- GP name: *IZ_PolicyZoneElevationURLaction_8*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownRestrictedSitesZoneAllowNETFrameworkReliantComponents**
-
+
Home
@@ -10318,8 +10680,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -10328,8 +10690,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.
If you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components.
@@ -10338,7 +10700,7 @@ If you disable this policy setting, Internet Explorer will not execute unsigned
If you do not configure this policy setting, Internet Explorer will not execute unsigned managed components.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -10346,20 +10708,22 @@ If you do not configure this policy setting, Internet Explorer will not execute
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Run .NET Framework-reliant components not signed with Authenticode*
- GP name: *IZ_PolicyUnsignedFrameworkComponentsURLaction_8*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownRestrictedSitesZoneAllowScriptlets**
-
+
Home
@@ -10381,8 +10745,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -10391,8 +10755,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage whether the user can run scriptlets.
If you enable this policy setting, the user can run scriptlets.
@@ -10401,7 +10765,7 @@ If you disable this policy setting, the user cannot run scriptlets.
If you do not configure this policy setting, the user can enable or disable scriptlets.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -10409,20 +10773,22 @@ If you do not configure this policy setting, the user can enable or disable scri
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Allow scriptlets*
- GP name: *IZ_Policy_AllowScriptlets_8*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownRestrictedSitesZoneAllowSmartScreenIE**
-
+
Home
@@ -10444,8 +10810,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -10454,8 +10820,8 @@ ADMX Info:
-
-
+
+
This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.
If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content.
@@ -10466,7 +10832,7 @@ If you do not configure this policy setting, the user can choose whether SmartSc
Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -10474,20 +10840,22 @@ Note: In Internet Explorer 7, this policy setting controls whether Phishing Filt
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Turn on SmartScreen Filter scan*
- GP name: *IZ_Policy_Phishing_8*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownRestrictedSitesZoneAllowUserDataPersistence**
-
+
Home
@@ -10509,8 +10877,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -10519,8 +10887,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.
If you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.
@@ -10529,7 +10897,7 @@ If you disable this policy setting, users cannot preserve information in the bro
If you do not configure this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -10537,20 +10905,22 @@ If you do not configure this policy setting, users cannot preserve information i
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Userdata persistence*
- GP name: *IZ_PolicyUserdataPersistence_8*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownRestrictedSitesZoneInitializeAndScriptActiveXControls**
-
+
Home
@@ -10572,8 +10942,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -10582,8 +10952,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage ActiveX controls not marked as safe.
If you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. This setting is not recommended, except for secure and administered zones. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option.
@@ -10594,7 +10964,7 @@ If you disable this policy setting, ActiveX controls that cannot be made safe ar
If you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -10602,20 +10972,22 @@ If you do not configure this policy setting, ActiveX controls that cannot be mad
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Initialize and script ActiveX controls not marked as safe*
- GP name: *IZ_PolicyScriptActiveXNotMarkedSafe_8*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownRestrictedSitesZoneJavaPermissions**
-
+
Home
@@ -10637,8 +11009,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -10647,9 +11019,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -10657,20 +11030,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Java permissions*
- GP name: *IZ_PolicyJavaPermissions_8*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownRestrictedSitesZoneNavigateWindowsAndFrames**
-
+
Home
@@ -10692,8 +11067,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -10702,8 +11077,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.
If you enable this policy setting, users can open additional windows and frames from other domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow additional windows and frames to access applications from other domains.
@@ -10712,7 +11087,7 @@ If you disable this policy setting, users cannot open other windows and frames f
If you do not configure this policy setting, users cannot open other windows and frames from different domains or access applications from different domains.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -10720,20 +11095,22 @@ If you do not configure this policy setting, users cannot open other windows and
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Navigate windows and frames across different domains*
- GP name: *IZ_PolicyNavigateSubframesAcrossDomains_8*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownTrustedSitesZoneAllowAccessToDataSources**
-
+
Home
@@ -10755,8 +11132,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -10765,8 +11142,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).
If you enable this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you select Prompt in the drop-down box, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.
@@ -10775,7 +11152,7 @@ If you disable this policy setting, users cannot load a page in the zone that us
If you do not configure this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -10783,20 +11160,22 @@ If you do not configure this policy setting, users can load a page in the zone t
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Access data sources across domains*
- GP name: *IZ_PolicyAccessDataSourcesAcrossDomains_6*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownTrustedSitesZoneAllowAutomaticPromptingForActiveXControls**
-
+
Home
@@ -10818,8 +11197,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -10828,8 +11207,8 @@ ADMX Info:
-
-
+
+
This policy setting manages whether users will be automatically prompted for ActiveX control installations.
If you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.
@@ -10838,7 +11217,7 @@ If you disable this policy setting, ActiveX control installations will be blocke
If you do not configure this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -10846,20 +11225,22 @@ If you do not configure this policy setting, ActiveX control installations will
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Automatic prompting for ActiveX controls*
- GP name: *IZ_PolicyNotificationBarActiveXURLaction_6*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownTrustedSitesZoneAllowAutomaticPromptingForFileDownloads**
-
+
Home
@@ -10881,8 +11262,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -10891,15 +11272,15 @@ ADMX Info:
-
-
+
+
This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.
If you enable this setting, users will receive a file download dialog for automatic download attempts.
If you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the Notification bar instead of the file download dialog. Users can then click the Notification bar to allow the file download prompt.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -10907,20 +11288,22 @@ If you disable or do not configure this setting, file downloads that are not use
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Automatic prompting for file downloads*
- GP name: *IZ_PolicyNotificationBarDownloadURLaction_6*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownTrustedSitesZoneAllowFontDownloads**
-
+
Home
@@ -10942,8 +11325,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -10952,8 +11335,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage whether pages of the zone may download HTML fonts.
If you enable this policy setting, HTML fonts can be downloaded automatically. If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.
@@ -10962,7 +11345,7 @@ If you disable this policy setting, HTML fonts are prevented from downloading.
If you do not configure this policy setting, HTML fonts can be downloaded automatically.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -10970,20 +11353,22 @@ If you do not configure this policy setting, HTML fonts can be downloaded automa
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Allow font downloads*
- GP name: *IZ_PolicyFontDownload_6*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownTrustedSitesZoneAllowLessPrivilegedSites**
-
+
Home
@@ -11005,8 +11390,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -11015,8 +11400,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage whether Web sites from less privileged zones, such as Internet sites, can navigate into this zone.
If you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur.
@@ -11025,7 +11410,7 @@ If you disable this policy setting, the possibly harmful navigations are prevent
If you do not configure this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -11033,20 +11418,22 @@ If you do not configure this policy setting, the possibly harmful navigations ar
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Web sites in less privileged Web content zones can navigate into this zone*
- GP name: *IZ_PolicyZoneElevationURLaction_6*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownTrustedSitesZoneAllowNETFrameworkReliantComponents**
-
+
Home
@@ -11068,8 +11455,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -11078,8 +11465,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.
If you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components.
@@ -11088,7 +11475,7 @@ If you disable this policy setting, Internet Explorer will not execute unsigned
If you do not configure this policy setting, Internet Explorer will not execute unsigned managed components.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -11096,20 +11483,22 @@ If you do not configure this policy setting, Internet Explorer will not execute
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Run .NET Framework-reliant components not signed with Authenticode*
- GP name: *IZ_PolicyUnsignedFrameworkComponentsURLaction_6*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownTrustedSitesZoneAllowScriptlets**
-
+
Home
@@ -11131,8 +11520,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -11141,8 +11530,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage whether the user can run scriptlets.
If you enable this policy setting, the user can run scriptlets.
@@ -11151,7 +11540,7 @@ If you disable this policy setting, the user cannot run scriptlets.
If you do not configure this policy setting, the user can enable or disable scriptlets.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -11159,20 +11548,22 @@ If you do not configure this policy setting, the user can enable or disable scri
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Allow scriptlets*
- GP name: *IZ_Policy_AllowScriptlets_6*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownTrustedSitesZoneAllowSmartScreenIE**
-
+
Home
@@ -11194,8 +11585,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -11204,8 +11595,8 @@ ADMX Info:
-
-
+
+
This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.
If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content.
@@ -11216,7 +11607,7 @@ If you do not configure this policy setting, the user can choose whether SmartSc
Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -11224,20 +11615,22 @@ Note: In Internet Explorer 7, this policy setting controls whether Phishing Filt
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Turn on SmartScreen Filter scan*
- GP name: *IZ_Policy_Phishing_6*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownTrustedSitesZoneAllowUserDataPersistence**
-
+
Home
@@ -11259,8 +11652,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -11269,8 +11662,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.
If you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.
@@ -11279,7 +11672,7 @@ If you disable this policy setting, users cannot preserve information in the bro
If you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -11287,20 +11680,22 @@ If you do not configure this policy setting, users can preserve information in t
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Userdata persistence*
- GP name: *IZ_PolicyUserdataPersistence_6*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownTrustedSitesZoneInitializeAndScriptActiveXControls**
-
+
Home
@@ -11322,8 +11717,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -11332,8 +11727,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage ActiveX controls not marked as safe.
If you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. This setting is not recommended, except for secure and administered zones. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option.
@@ -11344,7 +11739,7 @@ If you disable this policy setting, ActiveX controls that cannot be made safe ar
If you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -11352,20 +11747,22 @@ If you do not configure this policy setting, ActiveX controls that cannot be mad
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Initialize and script ActiveX controls not marked as safe*
- GP name: *IZ_PolicyScriptActiveXNotMarkedSafe_6*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownTrustedSitesZoneJavaPermissions**
-
+
Home
@@ -11387,8 +11784,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -11397,9 +11794,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -11407,20 +11805,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Java permissions*
- GP name: *IZ_PolicyJavaPermissions_6*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/LockedDownTrustedSitesZoneNavigateWindowsAndFrames**
-
+
Home
@@ -11442,8 +11842,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -11452,8 +11852,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.
If you enable this policy setting, users can open windows and frames from othe domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains.
@@ -11462,7 +11862,7 @@ If you disable this policy setting, users cannot open windows and frames to acce
If you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -11470,20 +11870,22 @@ If you do not configure this policy setting, users can open windows and frames f
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Navigate windows and frames across different domains*
- GP name: *IZ_PolicyNavigateSubframesAcrossDomains_6*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/MKProtocolSecurityRestrictionInternetExplorerProcesses**
-
+
Home
@@ -11505,8 +11907,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -11515,9 +11917,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -11525,20 +11928,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Internet Explorer Processes*
- GP name: *IESF_PolicyExplorerProcesses_3*
- GP path: *Windows Components/Internet Explorer/Security Features/MK Protocol Security Restriction*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/MimeSniffingSafetyFeatureInternetExplorerProcesses**
-
+
Home
@@ -11560,8 +11965,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -11570,9 +11975,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -11580,20 +11986,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Internet Explorer Processes*
- GP name: *IESF_PolicyExplorerProcesses_6*
- GP path: *Windows Components/Internet Explorer/Security Features/Mime Sniffing Safety Feature*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/NotificationBarInternetExplorerProcesses**
-
+
Home
@@ -11615,8 +12023,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -11625,9 +12033,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -11635,20 +12044,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Internet Explorer Processes*
- GP name: *IESF_PolicyExplorerProcesses_10*
- GP path: *Windows Components/Internet Explorer/Security Features/Notification bar*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/PreventManagingSmartScreenFilter**
-
+
Home
@@ -11670,8 +12081,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -11680,9 +12091,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -11690,20 +12102,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Prevent managing SmartScreen Filter*
- GP name: *Disable_Managing_Safety_Filter_IE9*
- GP path: *Windows Components/Internet Explorer*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/PreventPerUserInstallationOfActiveXControls**
-
+
Home
@@ -11725,8 +12139,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -11735,9 +12149,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -11745,20 +12160,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Prevent per-user installation of ActiveX controls*
- GP name: *DisablePerUserActiveXInstall*
- GP path: *Windows Components/Internet Explorer*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/ProtectionFromZoneElevationInternetExplorerProcesses**
-
+
Home
@@ -11780,8 +12197,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -11790,9 +12207,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -11800,20 +12218,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *All Processes*
- GP name: *IESF_PolicyAllProcesses_9*
- GP path: *Windows Components/Internet Explorer/Security Features/Protection From Zone Elevation*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/RemoveRunThisTimeButtonForOutdatedActiveXControls**
-
+
Home
@@ -11835,8 +12255,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -11845,9 +12265,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -11855,20 +12276,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Remove "Run this time" button for outdated ActiveX controls in Internet Explorer *
- GP name: *VerMgmtDisableRunThisTime*
- GP path: *Windows Components/Internet Explorer/Security Features/Add-on Management*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/RestrictActiveXInstallInternetExplorerProcesses**
-
+
Home
@@ -11890,8 +12313,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -11900,9 +12323,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -11910,20 +12334,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *All Processes*
- GP name: *IESF_PolicyAllProcesses_11*
- GP path: *Windows Components/Internet Explorer/Security Features/Restrict ActiveX Install*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/RestrictFileDownloadInternetExplorerProcesses**
-
+
Home
@@ -11945,8 +12371,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -11955,9 +12381,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -11965,20 +12392,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *All Processes*
- GP name: *IESF_PolicyAllProcesses_12*
- GP path: *Windows Components/Internet Explorer/Security Features/Restrict File Download*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/RestrictedSitesZoneAllowAccessToDataSources**
-
+
Home
@@ -12000,8 +12429,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -12010,8 +12439,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).
If you enable this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you select Prompt in the drop-down box, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.
@@ -12020,7 +12449,7 @@ If you disable this policy setting, users cannot load a page in the zone that us
If you do not configure this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -12028,20 +12457,22 @@ If you do not configure this policy setting, users cannot load a page in the zon
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Access data sources across domains*
- GP name: *IZ_PolicyAccessDataSourcesAcrossDomains_7*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/RestrictedSitesZoneAllowActiveScripting**
-
+
Home
@@ -12063,8 +12494,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -12073,9 +12504,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -12083,20 +12515,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Allow active scripting*
- GP name: *IZ_PolicyActiveScripting_7*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/RestrictedSitesZoneAllowAutomaticPromptingForActiveXControls**
-
+
Home
@@ -12118,8 +12552,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -12128,8 +12562,8 @@ ADMX Info:
-
-
+
+
This policy setting manages whether users will be automatically prompted for ActiveX control installations.
If you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.
@@ -12138,7 +12572,7 @@ If you disable this policy setting, ActiveX control installations will be blocke
If you do not configure this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -12146,20 +12580,22 @@ If you do not configure this policy setting, ActiveX control installations will
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Automatic prompting for ActiveX controls*
- GP name: *IZ_PolicyNotificationBarActiveXURLaction_7*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/RestrictedSitesZoneAllowAutomaticPromptingForFileDownloads**
-
+
Home
@@ -12181,8 +12617,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -12191,15 +12627,15 @@ ADMX Info:
-
-
+
+
This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.
If you enable this setting, users will receive a file download dialog for automatic download attempts.
If you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the Notification bar instead of the file download dialog. Users can then click the Notification bar to allow the file download prompt.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -12207,20 +12643,22 @@ If you disable or do not configure this setting, file downloads that are not use
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Automatic prompting for file downloads*
- GP name: *IZ_PolicyNotificationBarDownloadURLaction_7*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/RestrictedSitesZoneAllowBinaryAndScriptBehaviors**
-
+
Home
@@ -12242,8 +12680,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -12252,9 +12690,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -12262,20 +12701,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Allow binary and script behaviors*
- GP name: *IZ_PolicyBinaryBehaviors_7*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/RestrictedSitesZoneAllowCopyPasteViaScript**
-
+
Home
@@ -12297,8 +12738,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -12307,9 +12748,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -12317,20 +12759,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Allow cut, copy or paste operations from the clipboard via script*
- GP name: *IZ_PolicyAllowPasteViaScript_7*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/RestrictedSitesZoneAllowDragAndDropCopyAndPasteFiles**
-
+
Home
@@ -12352,8 +12796,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -12362,9 +12806,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -12372,20 +12817,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Allow drag and drop or copy and paste files*
- GP name: *IZ_PolicyDropOrPasteFiles_7*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/RestrictedSitesZoneAllowFileDownloads**
-
+
Home
@@ -12407,8 +12854,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -12417,9 +12864,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -12427,20 +12875,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Allow file downloads*
- GP name: *IZ_PolicyFileDownload_7*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/RestrictedSitesZoneAllowFontDownloads**
-
+
Home
@@ -12462,8 +12912,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -12472,8 +12922,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage whether pages of the zone may download HTML fonts.
If you enable this policy setting, HTML fonts can be downloaded automatically. If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.
@@ -12482,7 +12932,7 @@ If you disable this policy setting, HTML fonts are prevented from downloading.
If you do not configure this policy setting, users are queried whether to allow HTML fonts to download.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -12490,20 +12940,22 @@ If you do not configure this policy setting, users are queried whether to allow
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Allow font downloads*
- GP name: *IZ_PolicyFontDownload_7*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/RestrictedSitesZoneAllowLessPrivilegedSites**
-
+
Home
@@ -12525,8 +12977,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -12535,8 +12987,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage whether Web sites from less privileged zones, such as Internet sites, can navigate into this zone.
If you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur.
@@ -12545,7 +12997,7 @@ If you disable this policy setting, the possibly harmful navigations are prevent
If you do not configure this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -12553,20 +13005,22 @@ If you do not configure this policy setting, the possibly harmful navigations ar
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Web sites in less privileged Web content zones can navigate into this zone*
- GP name: *IZ_PolicyZoneElevationURLaction_7*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/RestrictedSitesZoneAllowLoadingOfXAMLFiles**
-
+
Home
@@ -12588,8 +13042,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -12598,9 +13052,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -12608,20 +13063,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Allow loading of XAML files*
- GP name: *IZ_Policy_XAML_7*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/RestrictedSitesZoneAllowMETAREFRESH**
-
+
Home
@@ -12643,8 +13100,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -12653,9 +13110,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -12663,20 +13121,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Allow META REFRESH*
- GP name: *IZ_PolicyAllowMETAREFRESH_7*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/RestrictedSitesZoneAllowNETFrameworkReliantComponents**
-
+
Home
@@ -12698,8 +13158,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -12708,8 +13168,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.
If you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components.
@@ -12718,7 +13178,7 @@ If you disable this policy setting, Internet Explorer will not execute unsigned
If you do not configure this policy setting, Internet Explorer will not execute unsigned managed components.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -12726,20 +13186,22 @@ If you do not configure this policy setting, Internet Explorer will not execute
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Run .NET Framework-reliant components not signed with Authenticode*
- GP name: *IZ_PolicyUnsignedFrameworkComponentsURLaction_7*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/RestrictedSitesZoneAllowOnlyApprovedDomainsToUseActiveXControls**
-
+
Home
@@ -12761,8 +13223,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -12771,9 +13233,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -12781,20 +13244,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Allow only approved domains to use ActiveX controls without prompt*
- GP name: *IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Restricted*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/RestrictedSitesZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl**
-
+
Home
@@ -12816,8 +13281,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -12826,9 +13291,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -12836,20 +13302,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Allow only approved domains to use the TDC ActiveX control*
- GP name: *IZ_PolicyAllowTDCControl_Both_Restricted*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/RestrictedSitesZoneAllowScriptInitiatedWindows**
-
+
Home
@@ -12871,8 +13339,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -12881,9 +13349,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -12891,20 +13360,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Allow script-initiated windows without size or position constraints*
- GP name: *IZ_PolicyWindowsRestrictionsURLaction_7*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/RestrictedSitesZoneAllowScriptingOfInternetExplorerWebBrowserControls**
-
+
Home
@@ -12926,8 +13397,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -12936,9 +13407,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -12946,20 +13418,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Allow scripting of Internet Explorer WebBrowser controls*
- GP name: *IZ_Policy_WebBrowserControl_7*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/RestrictedSitesZoneAllowScriptlets**
-
+
Home
@@ -12981,8 +13455,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -12991,8 +13465,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage whether the user can run scriptlets.
If you enable this policy setting, the user can run scriptlets.
@@ -13001,7 +13475,7 @@ If you disable this policy setting, the user cannot run scriptlets.
If you do not configure this policy setting, the user can enable or disable scriptlets.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -13009,20 +13483,22 @@ If you do not configure this policy setting, the user can enable or disable scri
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Allow scriptlets*
- GP name: *IZ_Policy_AllowScriptlets_7*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/RestrictedSitesZoneAllowSmartScreenIE**
-
+
Home
@@ -13044,8 +13520,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -13054,8 +13530,8 @@ ADMX Info:
-
-
+
+
This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.
If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content.
@@ -13066,7 +13542,7 @@ If you do not configure this policy setting, the user can choose whether SmartSc
Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -13074,20 +13550,22 @@ Note: In Internet Explorer 7, this policy setting controls whether Phishing Filt
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Turn on SmartScreen Filter scan*
- GP name: *IZ_Policy_Phishing_7*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/RestrictedSitesZoneAllowUpdatesToStatusBarViaScript**
-
+
Home
@@ -13109,8 +13587,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -13119,9 +13597,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -13129,20 +13608,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Allow updates to status bar via script*
- GP name: *IZ_Policy_ScriptStatusBar_7*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/RestrictedSitesZoneAllowUserDataPersistence**
-
+
Home
@@ -13164,8 +13645,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -13174,8 +13655,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.
If you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.
@@ -13184,7 +13665,7 @@ If you disable this policy setting, users cannot preserve information in the bro
If you do not configure this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -13192,20 +13673,22 @@ If you do not configure this policy setting, users cannot preserve information i
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Userdata persistence*
- GP name: *IZ_PolicyUserdataPersistence_7*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/RestrictedSitesZoneDoNotRunAntimalwareAgainstActiveXControls**
-
+
Home
@@ -13227,8 +13710,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -13237,9 +13720,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -13247,20 +13731,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Don't run antimalware programs against ActiveX controls*
- GP name: *IZ_PolicyAntiMalwareCheckingOfActiveXControls_7*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/RestrictedSitesZoneDownloadSignedActiveXControls**
-
+
Home
@@ -13282,8 +13768,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -13292,9 +13778,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -13302,20 +13789,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Download signed ActiveX controls*
- GP name: *IZ_PolicyDownloadSignedActiveX_7*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/RestrictedSitesZoneDownloadUnsignedActiveXControls**
-
+
Home
@@ -13337,8 +13826,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -13347,9 +13836,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -13357,20 +13847,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Download unsigned ActiveX controls*
- GP name: *IZ_PolicyDownloadUnsignedActiveX_7*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/RestrictedSitesZoneEnableCrossSiteScriptingFilter**
-
+
Home
@@ -13392,8 +13884,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -13402,9 +13894,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -13412,20 +13905,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Turn on Cross-Site Scripting Filter*
- GP name: *IZ_PolicyTurnOnXSSFilter_Both_Restricted*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows**
-
+
Home
@@ -13447,8 +13942,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -13457,9 +13952,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -13467,20 +13963,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Enable dragging of content from different domains across windows*
- GP name: *IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Restricted*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows**
-
+
Home
@@ -13502,8 +14000,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -13512,9 +14010,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -13522,20 +14021,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Enable dragging of content from different domains within a window*
- GP name: *IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Restricted*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/RestrictedSitesZoneEnableMIMESniffing**
-
+
Home
@@ -13557,8 +14058,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -13567,9 +14068,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -13577,20 +14079,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Enable MIME Sniffing*
- GP name: *IZ_PolicyMimeSniffingURLaction_7*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/RestrictedSitesZoneIncludeLocalPathWhenUploadingFilesToServer**
-
+
Home
@@ -13612,8 +14116,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -13622,9 +14126,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -13632,20 +14137,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Include local path when user is uploading files to a server*
- GP name: *IZ_Policy_LocalPathForUpload_7*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/RestrictedSitesZoneInitializeAndScriptActiveXControls**
-
+
Home
@@ -13667,8 +14174,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -13677,8 +14184,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage ActiveX controls not marked as safe.
If you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. This setting is not recommended, except for secure and administered zones. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option.
@@ -13689,7 +14196,7 @@ If you disable this policy setting, ActiveX controls that cannot be made safe ar
If you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -13697,20 +14204,22 @@ If you do not configure this policy setting, ActiveX controls that cannot be mad
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Initialize and script ActiveX controls not marked as safe*
- GP name: *IZ_PolicyScriptActiveXNotMarkedSafe_7*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/RestrictedSitesZoneJavaPermissions**
-
+
Home
@@ -13732,8 +14241,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -13742,9 +14251,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -13752,20 +14262,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Java permissions*
- GP name: *IZ_PolicyJavaPermissions_7*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/RestrictedSitesZoneLaunchingApplicationsAndFilesInIFRAME**
-
+
Home
@@ -13787,8 +14299,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -13797,9 +14309,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -13807,20 +14320,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Launching applications and files in an IFRAME*
- GP name: *IZ_PolicyLaunchAppsAndFilesInIFRAME_7*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/RestrictedSitesZoneLogonOptions**
-
+
Home
@@ -13842,8 +14357,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -13852,9 +14367,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -13862,20 +14378,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Logon options*
- GP name: *IZ_PolicyLogon_7*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/RestrictedSitesZoneNavigateWindowsAndFrames**
-
+
Home
@@ -13897,8 +14415,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -13907,8 +14425,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.
If you enable this policy setting, users can open additional windows and frames from other domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow additional windows and frames to access applications from other domains.
@@ -13917,7 +14435,7 @@ If you disable this policy setting, users cannot open other windows and frames f
If you do not configure this policy setting, users cannot open other windows and frames from different domains or access applications from different domains.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -13925,20 +14443,22 @@ If you do not configure this policy setting, users cannot open other windows and
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Navigate windows and frames across different domains*
- GP name: *IZ_PolicyNavigateSubframesAcrossDomains_7*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/RestrictedSitesZoneRunActiveXControlsAndPlugins**
-
+
Home
@@ -13960,8 +14480,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -13970,9 +14490,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -13980,20 +14501,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Run ActiveX controls and plugins*
- GP name: *IZ_PolicyRunActiveXControls_7*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/RestrictedSitesZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode**
-
+
Home
@@ -14015,8 +14538,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -14025,9 +14548,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -14035,20 +14559,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Run .NET Framework-reliant components signed with Authenticode*
- GP name: *IZ_PolicySignedFrameworkComponentsURLaction_7*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/RestrictedSitesZoneScriptActiveXControlsMarkedSafeForScripting**
-
+
Home
@@ -14070,8 +14596,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -14080,9 +14606,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -14090,20 +14617,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Script ActiveX controls marked safe for scripting*
- GP name: *IZ_PolicyScriptActiveXMarkedSafe_7*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/RestrictedSitesZoneScriptingOfJavaApplets**
-
+
Home
@@ -14125,8 +14654,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -14135,9 +14664,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -14145,20 +14675,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Scripting of Java applets*
- GP name: *IZ_PolicyScriptingOfJavaApplets_7*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/RestrictedSitesZoneShowSecurityWarningForPotentiallyUnsafeFiles**
-
+
Home
@@ -14180,8 +14712,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -14190,9 +14722,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -14200,20 +14733,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Show security warning for potentially unsafe files*
- GP name: *IZ_Policy_UnsafeFiles_7*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/RestrictedSitesZoneTurnOnProtectedMode**
-
+
Home
@@ -14235,8 +14770,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -14245,9 +14780,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -14255,20 +14791,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Turn on Protected Mode*
- GP name: *IZ_Policy_TurnOnProtectedMode_7*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/RestrictedSitesZoneUsePopupBlocker**
-
+
Home
@@ -14290,8 +14828,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -14300,9 +14838,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -14310,20 +14849,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Use Pop-up Blocker*
- GP name: *IZ_PolicyBlockPopupWindows_7*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/ScriptedWindowSecurityRestrictionsInternetExplorerProcesses**
-
+
Home
@@ -14345,8 +14886,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -14355,9 +14896,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -14365,20 +14907,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *All Processes*
- GP name: *IESF_PolicyAllProcesses_8*
- GP path: *Windows Components/Internet Explorer/Security Features/Scripted Window Security Restrictions*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/SearchProviderList**
-
+
Home
@@ -14400,8 +14944,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -14410,15 +14954,15 @@ ADMX Info:
-
-
+
+
This policy setting allows you to restrict the search providers that appear in the Search box in Internet Explorer to those defined in the list of policy keys for search providers (found under [HKCU or HKLM\Software\policies\Microsoft\Internet Explorer\SearchScopes]). Normally, search providers can be added from third-party toolbars or in Setup, but the user can also add them from a search provider's website.
If you enable this policy setting, the user cannot configure the list of search providers on his or her computer, and any default providers installed do not appear (including providers installed from other applications). The only providers that appear are those in the list of policy keys for search providers. Note: This list can be created through a custom administrative template file. For information about creating this custom administrative template file, see the Internet Explorer documentation on search providers.
If you disable or do not configure this policy setting, the user can configure his or her list of search providers.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -14426,20 +14970,22 @@ If you disable or do not configure this policy setting, the user can configure h
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Restrict search providers to a specific list*
- GP name: *SpecificSearchProvider*
- GP path: *Windows Components/Internet Explorer*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/SecurityZonesUseOnlyMachineSettings**
-
+
Home
@@ -14461,8 +15007,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -14470,9 +15016,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -14480,20 +15027,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Security Zones: Use only machine settings *
- GP name: *Security_HKLM_only*
- GP path: *Windows Components/Internet Explorer*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/SpecifyUseOfActiveXInstallerService**
-
+
Home
@@ -14515,8 +15064,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -14525,9 +15074,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -14535,20 +15085,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Specify use of ActiveX Installer Service for installation of ActiveX controls*
- GP name: *OnlyUseAXISForActiveXInstall*
- GP path: *Windows Components/Internet Explorer*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/TrustedSitesZoneAllowAccessToDataSources**
-
+
Home
@@ -14570,8 +15122,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -14580,8 +15132,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).
If you enable this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you select Prompt in the drop-down box, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.
@@ -14590,7 +15142,7 @@ If you disable this policy setting, users cannot load a page in the zone that us
If you do not configure this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -14598,20 +15150,22 @@ If you do not configure this policy setting, users can load a page in the zone t
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Access data sources across domains*
- GP name: *IZ_PolicyAccessDataSourcesAcrossDomains_5*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/TrustedSitesZoneAllowAutomaticPromptingForActiveXControls**
-
+
Home
@@ -14633,8 +15187,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -14643,8 +15197,8 @@ ADMX Info:
-
-
+
+
This policy setting manages whether users will be automatically prompted for ActiveX control installations.
If you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.
@@ -14653,7 +15207,7 @@ If you disable this policy setting, ActiveX control installations will be blocke
If you do not configure this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -14661,20 +15215,22 @@ If you do not configure this policy setting, users will receive a prompt when a
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Automatic prompting for ActiveX controls*
- GP name: *IZ_PolicyNotificationBarActiveXURLaction_5*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/TrustedSitesZoneAllowAutomaticPromptingForFileDownloads**
-
+
Home
@@ -14696,8 +15252,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -14706,15 +15262,15 @@ ADMX Info:
-
-
+
+
This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.
If you enable this setting, users will receive a file download dialog for automatic download attempts.
If you disable or do not configure this setting, users will receive a file download dialog for automatic download attempts.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -14722,20 +15278,22 @@ If you disable or do not configure this setting, users will receive a file downl
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Automatic prompting for file downloads*
- GP name: *IZ_PolicyNotificationBarDownloadURLaction_5*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/TrustedSitesZoneAllowFontDownloads**
-
+
Home
@@ -14757,8 +15315,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -14767,8 +15325,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage whether pages of the zone may download HTML fonts.
If you enable this policy setting, HTML fonts can be downloaded automatically. If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.
@@ -14777,7 +15335,7 @@ If you disable this policy setting, HTML fonts are prevented from downloading.
If you do not configure this policy setting, HTML fonts can be downloaded automatically.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -14785,20 +15343,22 @@ If you do not configure this policy setting, HTML fonts can be downloaded automa
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Allow font downloads*
- GP name: *IZ_PolicyFontDownload_5*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/TrustedSitesZoneAllowLessPrivilegedSites**
-
+
Home
@@ -14820,8 +15380,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -14830,8 +15390,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage whether Web sites from less privileged zones, such as Restricted Sites, can navigate into this zone.
If you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur.
@@ -14840,7 +15400,7 @@ If you disable this policy setting, the possibly harmful navigations are prevent
If you do not configure this policy setting, a warning is issued to the user that potentially risky navigation is about to occur.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -14848,20 +15408,22 @@ If you do not configure this policy setting, a warning is issued to the user tha
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Web sites in less privileged Web content zones can navigate into this zone*
- GP name: *IZ_PolicyZoneElevationURLaction_5*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/TrustedSitesZoneAllowNETFrameworkReliantComponents**
-
+
Home
@@ -14883,8 +15445,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -14893,8 +15455,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.
If you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components.
@@ -14903,7 +15465,7 @@ If you disable this policy setting, Internet Explorer will not execute unsigned
If you do not configure this policy setting, Internet Explorer will execute unsigned managed components.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -14911,20 +15473,22 @@ If you do not configure this policy setting, Internet Explorer will execute unsi
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Run .NET Framework-reliant components not signed with Authenticode*
- GP name: *IZ_PolicyUnsignedFrameworkComponentsURLaction_5*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/TrustedSitesZoneAllowScriptlets**
-
+
Home
@@ -14946,8 +15510,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -14956,8 +15520,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage whether the user can run scriptlets.
If you enable this policy setting, the user can run scriptlets.
@@ -14966,7 +15530,7 @@ If you disable this policy setting, the user cannot run scriptlets.
If you do not configure this policy setting, the user can enable or disable scriptlets.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -14974,20 +15538,22 @@ If you do not configure this policy setting, the user can enable or disable scri
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Allow scriptlets*
- GP name: *IZ_Policy_AllowScriptlets_5*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/TrustedSitesZoneAllowSmartScreenIE**
-
+
Home
@@ -15009,8 +15575,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -15019,8 +15585,8 @@ ADMX Info:
-
-
+
+
This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.
If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content.
@@ -15031,7 +15597,7 @@ If you do not configure this policy setting, the user can choose whether SmartSc
Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -15039,20 +15605,22 @@ Note: In Internet Explorer 7, this policy setting controls whether Phishing Filt
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Turn on SmartScreen Filter scan*
- GP name: *IZ_Policy_Phishing_5*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/TrustedSitesZoneAllowUserDataPersistence**
-
+
Home
@@ -15074,8 +15642,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -15084,8 +15652,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.
If you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.
@@ -15094,7 +15662,7 @@ If you disable this policy setting, users cannot preserve information in the bro
If you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -15102,20 +15670,22 @@ If you do not configure this policy setting, users can preserve information in t
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Userdata persistence*
- GP name: *IZ_PolicyUserdataPersistence_5*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/TrustedSitesZoneDoNotRunAntimalwareAgainstActiveXControls**
-
+
Home
@@ -15137,8 +15707,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -15147,9 +15717,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -15157,20 +15728,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Don't run antimalware programs against ActiveX controls*
- GP name: *IZ_PolicyAntiMalwareCheckingOfActiveXControls_5*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/TrustedSitesZoneInitializeAndScriptActiveXControls**
-
+
Home
@@ -15192,8 +15765,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -15202,8 +15775,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage ActiveX controls not marked as safe.
If you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. This setting is not recommended, except for secure and administered zones. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option.
@@ -15214,7 +15787,7 @@ If you disable this policy setting, ActiveX controls that cannot be made safe ar
If you do not configure this policy setting, users are queried whether to allow the control to be loaded with parameters or scripted.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -15222,20 +15795,22 @@ If you do not configure this policy setting, users are queried whether to allow
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Initialize and script ActiveX controls not marked as safe*
- GP name: *IZ_PolicyScriptActiveXNotMarkedSafe_5*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/TrustedSitesZoneJavaPermissions**
-
+
Home
@@ -15257,8 +15832,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -15267,9 +15842,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -15277,20 +15853,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Java permissions*
- GP name: *IZ_PolicyJavaPermissions_5*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
+
-
+
+
**InternetExplorer/TrustedSitesZoneNavigateWindowsAndFrames**
-
+
Home
@@ -15312,8 +15890,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -15322,8 +15900,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.
If you enable this policy setting, users can open windows and frames from othe domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains.
@@ -15332,7 +15910,7 @@ If you disable this policy setting, users cannot open windows and frames to acce
If you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -15340,15 +15918,15 @@ If you do not configure this policy setting, users can open windows and frames f
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Navigate windows and frames across different domains*
- GP name: *IZ_PolicyNavigateSubframesAcrossDomains_5*
- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone*
- GP ADMX file name: *inetres.admx*
-
-
+
+
Footnote:
@@ -15357,5 +15935,5 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
diff --git a/windows/client-management/mdm/policy-csp-kerberos.md b/windows/client-management/mdm/policy-csp-kerberos.md
index 43b40603af..361a19a81c 100644
--- a/windows/client-management/mdm/policy-csp-kerberos.md
+++ b/windows/client-management/mdm/policy-csp-kerberos.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - Kerberos
@@ -15,7 +15,7 @@ ms.date: 11/01/2017
-
+
## Kerberos policies
@@ -36,11 +36,13 @@ ms.date: 11/01/2017
+
-
+
+
**Kerberos/AllowForestSearchOrder**
-
+
Home
@@ -62,8 +64,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -71,15 +73,15 @@ ms.date: 11/01/2017
-
-
+
+
This policy setting defines the list of trusting forests that the Kerberos client searches when attempting to resolve two-part service principal names (SPNs).
If you enable this policy setting, the Kerberos client searches the forests in this list, if it is unable to resolve a two-part SPN. If a match is found, the Kerberos client requests a referral ticket to the appropriate domain.
If you disable or do not configure this policy setting, the Kerberos client does not search the listed forests to resolve the SPN. If the Kerberos client is unable to resolve the SPN because the name is not found, NTLM authentication might be used.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -87,20 +89,22 @@ If you disable or do not configure this policy setting, the Kerberos client does
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Use forest search order*
- GP name: *ForestSearch*
- GP path: *System/Kerberos*
- GP ADMX file name: *Kerberos.admx*
-
-
+
+
+
-
+
+
**Kerberos/KerberosClientSupportsClaimsCompoundArmor**
-
+
Home
@@ -122,8 +126,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -131,14 +135,14 @@ ADMX Info:
-
-
+
+
This policy setting controls whether a device will request claims and compound authentication for Dynamic Access Control and Kerberos armoring using Kerberos authentication with domains that support these features.
If you enable this policy setting, the client computers will request claims, provide information required to create compounded authentication and armor Kerberos messages in domains which support claims and compound authentication for Dynamic Access Control and Kerberos armoring.
If you disable or do not configure this policy setting, the client devices will not request claims, provide information required to create compounded authentication and armor Kerberos messages. Services hosted on the device will not be able to retrieve claims for clients using Kerberos protocol transition.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -146,20 +150,22 @@ If you disable or do not configure this policy setting, the client devices will
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Kerberos client support for claims, compound authentication and Kerberos armoring*
- GP name: *EnableCbacAndArmor*
- GP path: *System/Kerberos*
- GP ADMX file name: *Kerberos.admx*
-
-
+
+
+
-
+
+
**Kerberos/RequireKerberosArmoring**
-
+
Home
@@ -181,8 +187,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -190,8 +196,8 @@ ADMX Info:
-
-
+
+
This policy setting controls whether a computer requires that Kerberos message exchanges be armored when communicating with a domain controller.
Warning: When a domain does not support Kerberos armoring by enabling "Support Dynamic Access Control and Kerberos armoring", then all authentication for all its users will fail from computers with this policy setting enabled.
@@ -202,7 +208,7 @@ Note: The Kerberos Group Policy "Kerberos client support for claims, compound au
If you disable or do not configure this policy setting, the client computers in the domain enforce the use of Kerberos armoring when possible as supported by the target domain.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -210,20 +216,22 @@ If you disable or do not configure this policy setting, the client computers in
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Fail authentication requests when Kerberos armoring is not available*
- GP name: *ClientRequireFast*
- GP path: *System/Kerberos*
- GP ADMX file name: *Kerberos.admx*
-
-
+
+
+
-
+
+
**Kerberos/RequireStrictKDCValidation**
-
+
Home
@@ -245,8 +253,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -254,15 +262,15 @@ ADMX Info:
-
-
+
+
This policy setting controls the Kerberos client's behavior in validating the KDC certificate for smart card and system certificate logon.
If you enable this policy setting, the Kerberos client requires that the KDC's X.509 certificate contains the KDC key purpose object identifier in the Extended Key Usage (EKU) extensions, and that the KDC's X.509 certificate contains a dNSName subjectAltName (SAN) extension that matches the DNS name of the domain. If the computer is joined to a domain, the Kerberos client requires that the KDC's X.509 certificate must be signed by a Certificate Authority (CA) in the NTAuth store. If the computer is not joined to a domain, the Kerberos client allows the root CA certificate on the smart card to be used in the path validation of the KDC's X.509 certificate.
If you disable or do not configure this policy setting, the Kerberos client requires only that the KDC certificate contain the Server Authentication purpose object identifier in the EKU extensions which can be issued to any server.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -270,20 +278,22 @@ If you disable or do not configure this policy setting, the Kerberos client requ
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Require strict KDC validation*
- GP name: *ValidateKDC*
- GP path: *System/Kerberos*
- GP ADMX file name: *Kerberos.admx*
-
-
+
+
+
-
+
+
**Kerberos/SetMaximumContextTokenSize**
-
+
Home
@@ -305,8 +315,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -314,8 +324,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to set the value returned to applications which request the maximum size of the SSPI context token buffer size.
The size of the context token buffer determines the maximum size of SSPI context tokens an application expects and allocates. Depending upon authentication request processing and group memberships, the buffer might be smaller than the actual size of the SSPI context token.
@@ -326,7 +336,7 @@ If you disable or do not configure this policy setting, the Kerberos client or s
Note: This policy setting configures the existing MaxTokenSize registry value in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters, which was added in Windows XP and Windows Server 2003, with a default value of 12,000 bytes. Beginning with Windows 8 the default is 48,000 bytes. Due to HTTP's base64 encoding of authentication context tokens, it is not advised to set this value more than 48,000 bytes.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -334,15 +344,15 @@ Note: This policy setting configures the existing MaxTokenSize registry value in
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Set maximum Kerberos SSPI context token buffer size*
- GP name: *MaxTokenSize*
- GP path: *System/Kerberos*
- GP ADMX file name: *Kerberos.admx*
-
-
+
+
Footnote:
@@ -351,5 +361,5 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
diff --git a/windows/client-management/mdm/policy-csp-kioskbrowser.md b/windows/client-management/mdm/policy-csp-kioskbrowser.md
new file mode 100644
index 0000000000..6606c038b3
--- /dev/null
+++ b/windows/client-management/mdm/policy-csp-kioskbrowser.md
@@ -0,0 +1,319 @@
+---
+title: Policy CSP - KioskBrowser
+description: Policy CSP - KioskBrowser
+ms.author: maricia
+ms.topic: article
+ms.prod: w10
+ms.technology: windows
+author: nickbrower
+ms.date: 01/30/2018
+---
+
+# Policy CSP - KioskBrowser
+
+> [!WARNING]
+> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
+
+
+
+
+
+## KioskBrowser policies
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
+
+Added in Windows 10, next major update. List of exceptions to the blocked website URLs (with wildcard support). This is used to configure URLs kiosk browsers are allowed to navigate to, which are a subset of the blocked URLs.
+
+
+
+
+
+
+
+**KioskBrowser/BlockedUrls**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
+
+Added in Windows 10, next major update. List of blocked website URLs (with wildcard support). This is used to configure blocked URLs kiosk browsers cannot navigate to.
+
+
+
+
+
+
+
+**KioskBrowser/DefaultURL**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
+
+Added in Windows 10, next major update. Configures the default URL kiosk browsers to navigate on launch and restart.
+
+
+
+
+
+
+
+**KioskBrowser/EnableHomeButton**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
+
+Added in Windows 10, next major update. Enable/disable kiosk browser's home button.
+
+
+
+
+
+
+
+**KioskBrowser/EnableNavigationButtons**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
+
+Added in Windows 10, next major update. Enable/disable kiosk browser's navigation buttons (forward/back).
+
+
+
+
+
+
+
+**KioskBrowser/RestartOnIdleTime**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
+
+Added in Windows 10, next major update. Amount of time in minutes the session is idle until the kiosk browser restarts in a fresh state.
+
+The value is an int 1-1440 that specifies the amount of minutes the session is idle until the kiosk browser restarts in a fresh state. The default value is empty which means there is no idle timeout within the kiosk browser.
+
+
+
+
+
+Footnote:
+
+- 1 - Added in Windows 10, version 1607.
+- 2 - Added in Windows 10, version 1703.
+- 3 - Added in Windows 10, version 1709.
+
+
+
diff --git a/windows/client-management/mdm/policy-csp-licensing.md b/windows/client-management/mdm/policy-csp-licensing.md
index 42ba032275..66109605f7 100644
--- a/windows/client-management/mdm/policy-csp-licensing.md
+++ b/windows/client-management/mdm/policy-csp-licensing.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - Licensing
@@ -15,7 +15,7 @@ ms.date: 11/01/2017
-
+
## Licensing policies
Added in Windows 10, version 1607. Enables or Disable Windows license reactivation on managed devices.
+
+
+Added in Windows 10, version 1607. Enables or Disable Windows license reactivation on managed devices.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – Disable Windows license reactivation on managed devices.
- 1 (default) – Enable Windows license reactivation on managed devices.
-
-
+
+
+
Added in Windows 10, version 1607. Enabling this setting prevents this computer from sending data to Microsoft regarding its activation state.
+
+
+Added in Windows 10, version 1607. Enabling this setting prevents this computer from sending data to Microsoft regarding its activation state.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 (default) – Disabled.
- 1 – Enabled.
-
-
+
+
Footnote:
@@ -127,5 +135,5 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
diff --git a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md
index dcf0734b03..f67234078a 100644
--- a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md
+++ b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md
@@ -6,16 +6,18 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - LocalPoliciesSecurityOptions
+> [!WARNING]
+> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
+
## LocalPoliciesSecurityOptions policies
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -128,8 +225,8 @@ ms.date: 11/01/2017
-
-
+
+
This policy setting prevents users from adding new Microsoft accounts on this computer.
If you select the "Users cannot add Microsoft accounts" option, users will not be able to create new Microsoft accounts on this computer, switch a local account to a Microsoft account, or connect a domain account to a Microsoft account. This is the preferred option if you need to limit the use of Microsoft accounts in your enterprise.
@@ -138,18 +235,24 @@ If you select the "Users cannot add or log on with Microsoft accounts" option, e
If you disable or do not configure this policy (recommended), users will be able to use Microsoft accounts with Windows.
-Valid values:
-- 0 - disabled (users will be able to use Microsoft accounts with Windows)
-- 1 - enabled (users cannot add Microsoft accounts)
Value type is integer. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
+The following list shows the supported values:
+
+- 0 - disabled (users will be able to use Microsoft accounts with Windows).
+- 1 - enabled (users cannot add Microsoft accounts).
+
+
+
+
-
+
+
**LocalPoliciesSecurityOptions/Accounts_EnableAdministratorAccountStatus**
-
+
Home
@@ -171,8 +274,8 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -180,8 +283,8 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
This security setting determines whether the local Administrator account is enabled or disabled.
If you try to reenable the Administrator account after it has been disabled, and if the current Administrator password does not meet the password requirements, you cannot reenable the account. In this case, an alternative member of the Administrators group must reset the password on the Administrator account. For information about how to reset a password, see To reset a password.
@@ -190,19 +293,24 @@ Disabling the Administrator account can become a maintenance issue under certain
Under Safe Mode boot, the disabled Administrator account will only be enabled if the machine is non-domain joined and there are no other local active administrator accounts. If the computer is domain joined the disabled administrator will not be enabled.
Default: Disabled.
+
+Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
+
+
Valid values:
- 0 - local Administrator account is disabled
- 1 - local Administrator account is enabled
-Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
+
-
-
-
+
+
**LocalPoliciesSecurityOptions/Accounts_EnableGuestAccountStatus**
-
+
Home
@@ -224,8 +332,8 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -233,26 +341,31 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
This security setting determines if the Guest account is enabled or disabled.
Default: Disabled.
-Valid values:
-- 0 - local Guest account is disabled
-- 1 - local Guest account is enabled
Note: If the Guest account is disabled and the security option Network Access: Sharing and Security Model for local accounts is set to Guest Only, network logons, such as those performed by the Microsoft Network Server (SMB Service), will fail.
Value type is integer. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
+Valid values:
+- 0 - local Guest account is disabled
+- 1 - local Guest account is enabled
+
+
+
+
-
+
+
**LocalPoliciesSecurityOptions/Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly**
-
+
Home
@@ -274,8 +387,8 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -283,16 +396,13 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
Accounts: Limit local account use of blank passwords to console logon only
This security setting determines whether local accounts that are not password protected can be used to log on from locations other than the physical computer console. If enabled, local accounts that are not password protected will only be able to log on at the computer's keyboard.
Default: Enabled.
-Valid values:
-- 0 - disabled - local accounts that are not password protected can be used to log on from locations other than the physical computer console
-- 1 - enabled - local accounts that are not password protected will only be able to log on at the computer's keyboard
Warning:
@@ -304,13 +414,21 @@ It is possible for applications that use remote interactive logons to bypass thi
Value type is integer. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
+Valid values:
+- 0 - disabled - local accounts that are not password protected can be used to log on from locations other than the physical computer console
+- 1 - enabled - local accounts that are not password protected will only be able to log on at the computer's keyboard
+
+
+
+
-
+
+
**LocalPoliciesSecurityOptions/Accounts_RenameAdministratorAccount**
-
+
Home
@@ -332,8 +450,8 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -341,8 +459,8 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
Accounts: Rename administrator account
This security setting determines whether a different account name is associated with the security identifier (SID) for the account Administrator. Renaming the well-known Administrator account makes it slightly more difficult for unauthorized persons to guess this privileged user name and password combination.
@@ -351,13 +469,15 @@ Default: Administrator.
Value type is string. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
+
-
+
+
**LocalPoliciesSecurityOptions/Accounts_RenameGuestAccount**
-
+
Home
@@ -379,8 +499,8 @@ Value type is string. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -388,8 +508,8 @@ Value type is string. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
Accounts: Rename guest account
This security setting determines whether a different account name is associated with the security identifier (SID) for the account "Guest." Renaming the well-known Guest account makes it slightly more difficult for unauthorized persons to guess this user name and password combination.
@@ -398,13 +518,549 @@ Default: Guest.
Value type is string. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
+
-
+
+
+**LocalPoliciesSecurityOptions/Devices_AllowUndockWithoutHavingToLogon**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Devices: Allow undock without having to log on.
+
+This security setting determines whether a portable computer can be undocked without having to log on. If this policy is enabled, logon is not required and an external hardware eject button can be used to undock the computer. If disabled, a user must log on and have the Remove computer from docking station privilege to undock the computer.
+Default: Enabled.
+
+Caution:
+
+Disabling this policy may tempt users to try and physically remove the laptop from its docking station using methods other than the external hardware eject button. Since this may cause damage to the hardware, this setting, in general, should only be disabled on laptop configurations that are physically securable.
+
+
+
+
+
+
+
+**LocalPoliciesSecurityOptions/Devices_AllowedToFormatAndEjectRemovableMedia**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Devices: Allowed to format and eject removable media
+
+This security setting determines who is allowed to format and eject removable NTFS media. This capability can be given to:
+
+- Administrators
+- Administrators and Interactive Users
+
+Default: This policy is not defined and only Administrators have this ability.
+
+
+
+
+
+
+
+**LocalPoliciesSecurityOptions/Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Devices: Prevent users from installing printer drivers when connecting to shared printers
+
+For a computer to print to a shared printer, the driver for that shared printer must be installed on the local computer. This security setting determines who is allowed to install a printer driver as part of connecting to a shared printer. If this setting is enabled, only Administrators can install a printer driver as part of connecting to a shared printer. If this setting is disabled, any user can install a printer driver as part of connecting to a shared printer.
+
+Default on servers: Enabled.
+Default on workstations: Disabled
+
+Note
+
+This setting does not affect the ability to add a local printer. This setting does not affect Administrators.
+
+
+
+
+
+
+
+**LocalPoliciesSecurityOptions/Devices_RestrictCDROMAccessToLocallyLoggedOnUserOnly**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Devices: Restrict CD-ROM access to locally logged-on user only
+
+This security setting determines whether a CD-ROM is accessible to both local and remote users simultaneously.
+
+If this policy is enabled, it allows only the interactively logged-on user to access removable CD-ROM media. If this policy is enabled and no one is logged on interactively, the CD-ROM can be accessed over the network.
+
+Default: This policy is not defined and CD-ROM access is not restricted to the locally logged-on user.
+
+
+
+
+
+
+
+**LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Domain member: Digitally encrypt or sign secure channel data (always)
+
+This security setting determines whether all secure channel traffic initiated by the domain member must be signed or encrypted.
+
+When a computer joins a domain, a computer account is created. After that, when the system starts, it uses the computer account password to create a secure channel with a domain controller for its domain. This secure channel is used to perform operations such as NTLM pass through authentication, LSA SID/name Lookup etc.
+
+This setting determines whether or not all secure channel traffic initiated by the domain member meets minimum security requirements. Specifically it determines whether all secure channel traffic initiated by the domain member must be signed or encrypted. If this policy is enabled, then the secure channel will not be established unless either signing or encryption of all secure channel traffic is negotiated. If this policy is disabled, then encryption and signing of all secure channel traffic is negotiated with the Domain Controller in which case the level of signing and encryption depends on the version of the Domain Controller and the settings of the following two policies:
+
+Domain member: Digitally encrypt secure channel data (when possible)
+Domain member: Digitally sign secure channel data (when possible)
+
+Default: Enabled.
+
+Notes:
+
+If this policy is enabled, the policy Domain member: Digitally sign secure channel data (when possible) is assumed to be enabled regardless of its current setting. This ensures that the domain member attempts to negotiate at least signing of the secure channel traffic.
+If this policy is enabled, the policy Domain member: Digitally sign secure channel data (when possible) is assumed to be enabled regardless of its current setting. This ensures that the domain member attempts to negotiate at least signing of the secure channel traffic.
+Logon information transmitted over the secure channel is always encrypted regardless of whether encryption of ALL other secure channel traffic is negotiated or not.
+
+
+
+
+
+
+
+**LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptSecureChannelDataWhenPossible**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Domain member: Digitally encrypt secure channel data (when possible)
+
+This security setting determines whether a domain member attempts to negotiate encryption for all secure channel traffic that it initiates.
+
+When a computer joins a domain, a computer account is created. After that, when the system starts, it uses the computer account password to create a secure channel with a domain controller for its domain. This secure channel is used to perform operations such as NTLM pass-through authentication, LSA SID/name Lookup etc.
+
+This setting determines whether or not the domain member attempts to negotiate encryption for all secure channel traffic that it initiates. If enabled, the domain member will request encryption of all secure channel traffic. If the domain controller supports encryption of all secure channel traffic, then all secure channel traffic will be encrypted. Otherwise only logon information transmitted over the secure channel will be encrypted. If this setting is disabled, then the domain member will not attempt to negotiate secure channel encryption.
+
+Default: Enabled.
+
+Important
+
+There is no known reason for disabling this setting. Besides unnecessarily reducing the potential confidentiality level of the secure channel, disabling this setting may unnecessarily reduce secure channel throughput, because concurrent API calls that use the secure channel are only possible when the secure channel is signed or encrypted.
+
+Note: Domain controllers are also domain members and establish secure channels with other domain controllers in the same domain as well as domain controllers in trusted domains.
+
+
+
+
+
+
+
+**LocalPoliciesSecurityOptions/DomainMember_DigitallySignSecureChannelDataWhenPossible**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Domain member: Digitally sign secure channel data (when possible)
+
+This security setting determines whether a domain member attempts to negotiate signing for all secure channel traffic that it initiates.
+
+When a computer joins a domain, a computer account is created. After that, when the system starts, it uses the computer account password to create a secure channel with a domain controller for its domain. This secure channel is used to perform operations such as NTLM pass through authentication, LSA SID/name Lookup etc.
+
+This setting determines whether or not the domain member attempts to negotiate signing for all secure channel traffic that it initiates. If enabled, the domain member will request signing of all secure channel traffic. If the Domain Controller supports signing of all secure channel traffic, then all secure channel traffic will be signed which ensures that it cannot be tampered with in transit.
+
+Default: Enabled.
+
+
+
+
+
+
+
+**LocalPoliciesSecurityOptions/DomainMember_DisableMachineAccountPasswordChanges**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Domain member: Disable machine account password changes
+
+Determines whether a domain member periodically changes its computer account password. If this setting is enabled, the domain member does not attempt to change its computer account password. If this setting is disabled, the domain member attempts to change its computer account password as specified by the setting for Domain Member: Maximum age for machine account password, which by default is every 30 days.
+
+Default: Disabled.
+
+Notes
+
+This security setting should not be enabled. Computer account passwords are used to establish secure channel communications between members and domain controllers and, within the domain, between the domain controllers themselves. Once it is established, the secure channel is used to transmit sensitive information that is necessary for making authentication and authorization decisions.
+This setting should not be used in an attempt to support dual-boot scenarios that use the same computer account. If you want to dual-boot two installations that are joined to the same domain, give the two installations different computer names.
+
+
+
+
+
+
+
+**LocalPoliciesSecurityOptions/DomainMember_MaximumMachineAccountPasswordAge**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Domain member: Maximum machine account password age
+
+This security setting determines how often a domain member will attempt to change its computer account password.
+
+Default: 30 days.
+
+Important
+
+This setting applies to Windows 2000 computers, but it is not available through the Security Configuration Manager tools on these computers.
+
+
+
+
+
+
+
+**LocalPoliciesSecurityOptions/DomainMember_RequireStrongSessionKey**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Domain member: Require strong (Windows 2000 or later) session key
+
+This security setting determines whether 128-bit key strength is required for encrypted secure channel data.
+
+When a computer joins a domain, a computer account is created. After that, when the system starts, it uses the computer account password to create a secure channel with a domain controller within the domain. This secure channel is used to perform operations such as NTLM pass-through authentication, LSA SID/name Lookup, and so on.
+
+Depending on what version of Windows is running on the domain controller that the domain member is communicating with and the settings of the parameters:
+
+Domain member: Digitally encrypt or sign secure channel data (always)
+Domain member: Digitally encrypt secure channel data (when possible)
+Some or all of the information that is transmitted over the secure channel will be encrypted. This policy setting determines whether or not 128-bit key strength is required for the secure channel information that is encrypted.
+
+If this setting is enabled, then the secure channel will not be established unless 128-bit encryption can be performed. If this setting is disabled, then the key strength is negotiated with the domain controller.
+
+Default: Enabled.
+
+Important
+
+In order to take advantage of this policy on member workstations and servers, all domain controllers that constitute the member's domain must be running Windows 2000 or later.
+In order to take advantage of this policy on domain controllers, all domain controllers in the same domain as well as all trusted domains must run Windows 2000 or later.
+
+
+
+
+
+
+
**LocalPoliciesSecurityOptions/InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked**
-
+
Home
@@ -426,8 +1082,8 @@ Value type is string. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -435,24 +1091,29 @@ Value type is string. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
Interactive Logon:Display user information when the session is locked
+
+Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
+
+
Valid values:
- 1 - User display name, domain and user names
- 2 - User display name only
- 3 - Do not display user information
-Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
+
-
-
-
+
+
**LocalPoliciesSecurityOptions/InteractiveLogon_DoNotDisplayLastSignedIn**
-
+
Home
@@ -474,8 +1135,8 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -483,8 +1144,8 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
Interactive logon: Don't display last signed-in
This security setting determines whether the Windows sign-in screen will show the username of the last person who signed in on this PC.
@@ -493,19 +1154,24 @@ If this policy is enabled, the username will not be shown.
If this policy is disabled, the username will be shown.
Default: Disabled.
+
+Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
+
+
Valid values:
- 0 - disabled (username will be shown)
- 1 - enabled (username will not be shown)
-Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
+
-
-
-
+
+
**LocalPoliciesSecurityOptions/InteractiveLogon_DoNotDisplayUsernameAtSignIn**
-
+
Home
@@ -527,8 +1193,8 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -536,8 +1202,8 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
Interactive logon: Don't display username at sign-in
This security setting determines whether the username of the person signing in to this PC appears at Windows sign-in, after credentials are entered, and before the PC desktop is shown.
@@ -547,19 +1213,24 @@ If this policy is enabled, the username will not be shown.
If this policy is disabled, the username will be shown.
Default: Disabled.
+
+Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
+
+
Valid values:
- 0 - disabled (username will be shown)
- 1 - enabled (username will not be shown)
-Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
+
-
-
-
+
+
**LocalPoliciesSecurityOptions/InteractiveLogon_DoNotRequireCTRLALTDEL**
-
+
Home
@@ -581,8 +1252,8 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -590,8 +1261,8 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
Interactive logon: Do not require CTRL+ALT+DEL
This security setting determines whether pressing CTRL+ALT+DEL is required before a user can log on.
@@ -602,19 +1273,24 @@ If this policy is disabled, any user is required to press CTRL+ALT+DEL before lo
Default on domain-computers: Enabled: At least Windows 8/Disabled: Windows 7 or earlier.
Default on stand-alone computers: Enabled.
+
+Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
+
+
Valid values:
- 0 - disabled
- 1 - enabled (a user is not required to press CTRL+ALT+DEL to log on)
-Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
+
-
-
-
+
+
**LocalPoliciesSecurityOptions/InteractiveLogon_MachineInactivityLimit**
-
+
Home
@@ -636,8 +1312,8 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -645,26 +1321,31 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
Interactive logon: Machine inactivity limit.
Windows notices inactivity of a logon session, and if the amount of inactive time exceeds the inactivity limit, then the screen saver will run, locking the session.
Default: not enforced.
+
+Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
+
+
Valid values:
- 0 - disabled
- 1 - enabled (session will lock after amount of inactive time exceeds the inactivity limit)
-Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
+
-
-
-
+
+
**LocalPoliciesSecurityOptions/InteractiveLogon_MessageTextForUsersAttemptingToLogOn**
-
+
Home
@@ -686,8 +1367,8 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -695,8 +1376,8 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
Interactive logon: Message text for users attempting to log on
This security setting specifies a text message that is displayed to users when they log on.
@@ -707,13 +1388,15 @@ Default: No message.
Value type is string. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
+
-
+
+
**LocalPoliciesSecurityOptions/InteractiveLogon_MessageTitleForUsersAttemptingToLogOn**
-
+
Home
@@ -735,8 +1418,8 @@ Value type is string. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -744,8 +1427,8 @@ Value type is string. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
Interactive logon: Message title for users attempting to log on
This security setting allows the specification of a title to appear in the title bar of the window that contains the Interactive logon: Message text for users attempting to log on.
@@ -754,13 +1437,15 @@ Default: No message.
Value type is string. Supported operations are Add, Get, Replace, and Delete.
-
-
-
-
-**LocalPoliciesSecurityOptions/NetworkSecurity_AllowPKU2UAuthenticationRequests**
+
+
-
+
+
+
+**LocalPoliciesSecurityOptions/InteractiveLogon_SmartCardRemovalBehavior**
+
+
Home
@@ -773,17 +1458,17 @@ Value type is string. Supported operations are Add, Get, Replace, and Delete.
-
3
-
3
-
3
-
3
+
4
+
4
+
4
+
4
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -791,25 +1476,721 @@ Value type is string. Supported operations are Add, Get, Replace, and Delete.
-
-
-Network security: Allow PKU2U authentication requests to this computer to use online identities.
+
+
+Interactive logon: Smart card removal behavior
-This policy will be turned off by default on domain joined machines. This would prevent online identities from authenticating to the domain joined machine.
+This security setting determines what happens when the smart card for a logged-on user is removed from the smart card reader.
-Valid values:
-- 0 - disabled
-- 1 - enabled (allow PKU2U authentication requests to this computer to use online identities.)
+The options are:
-Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+ No Action
+ Lock Workstation
+ Force Logoff
+ Disconnect if a Remote Desktop Services session
+
+If you click Lock Workstation in the Properties dialog box for this policy, the workstation is locked when the smart card is removed, allowing users to leave the area, take their smart card with them, and still maintain a protected session.
+
+If you click Force Logoff in the Properties dialog box for this policy, the user is automatically logged off when the smart card is removed.
+
+If you click Disconnect if a Remote Desktop Services session, removal of the smart card disconnects the session without logging the user off. This allows the user to insert the smart card and resume the session later, or at another smart card reader-equipped computer, without having to log on again. If the session is local, this policy functions identically to Lock Workstation.
+
+Note: Remote Desktop Services was called Terminal Services in previous versions of Windows Server.
+
+Default: This policy is not defined, which means that the system treats it as No action.
+
+On Windows Vista and above: For this setting to work, the Smart Card Removal Policy service must be started.
+
+
+
-
-
-
-**LocalPoliciesSecurityOptions/RecoveryConsole_AllowAutomaticAdministrativeLogon**
-
+
+**LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsAlways**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Microsoft network client: Digitally sign communications (always)
+
+This security setting determines whether packet signing is required by the SMB client component.
+
+The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether SMB packet signing must be negotiated before further communication with an SMB server is permitted.
+
+If this setting is enabled, the Microsoft network client will not communicate with a Microsoft network server unless that server agrees to perform SMB packet signing. If this policy is disabled, SMB packet signing is negotiated between the client and server.
+
+Default: Disabled.
+
+Important
+
+For this policy to take effect on computers running Windows 2000, client-side packet signing must also be enabled. To enable client-side SMB packet signing, set Microsoft network client: Digitally sign communications (if server agrees).
+
+Notes
+
+All Windows operating systems support both a client-side SMB component and a server-side SMB component. On Windows 2000 and later operating systems, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings:
+Microsoft network client: Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing.
+Microsoft network client: Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled.
+Microsoft network server: Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing.
+Microsoft network server: Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled.
+SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors.
+For more information, reference: https://go.microsoft.com/fwlink/?LinkID=787136.
+
+
+
+
+
+
+
+**LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Microsoft network client: Digitally sign communications (if server agrees)
+
+This security setting determines whether the SMB client attempts to negotiate SMB packet signing.
+
+The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether the SMB client component attempts to negotiate SMB packet signing when it connects to an SMB server.
+
+If this setting is enabled, the Microsoft network client will ask the server to perform SMB packet signing upon session setup. If packet signing has been enabled on the server, packet signing will be negotiated. If this policy is disabled, the SMB client will never negotiate SMB packet signing.
+
+Default: Enabled.
+
+Notes
+
+All Windows operating systems support both a client-side SMB component and a server-side SMB component. On Windows 2000 and later, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings:
+Microsoft network client: Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing.
+Microsoft network client: Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled.
+Microsoft network server: Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing.
+Microsoft network server: Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled.
+If both client-side and server-side SMB signing is enabled and the client establishes an SMB 1.0 connection to the server, SMB signing will be attempted.
+SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors. This setting only applies to SMB 1.0 connections.
+For more information, reference: https://go.microsoft.com/fwlink/?LinkID=787136.
+
+
+
+
+
+
+
+**LocalPoliciesSecurityOptions/MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Microsoft network client: Send unencrypted password to connect to third-party SMB servers
+
+If this security setting is enabled, the Server Message Block (SMB) redirector is allowed to send plaintext passwords to non-Microsoft SMB servers that do not support password encryption during authentication.
+
+Sending unencrypted passwords is a security risk.
+
+Default: Disabled.
+
+
+
+
+
+
+
+**LocalPoliciesSecurityOptions/MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Microsoft network server: Amount of idle time required before suspending a session
+
+This security setting determines the amount of continuous idle time that must pass in a Server Message Block (SMB) session before the session is suspended due to inactivity.
+
+Administrators can use this policy to control when a computer suspends an inactive SMB session. If client activity resumes, the session is automatically reestablished.
+
+For this policy setting, a value of 0 means to disconnect an idle session as quickly as is reasonably possible. The maximum value is 99999, which is 208 days; in effect, this value disables the policy.
+
+Default:This policy is not defined, which means that the system treats it as 15 minutes for servers and undefined for workstations.
+
+
+
+
+
+
+
+**LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsAlways**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Microsoft network server: Digitally sign communications (always)
+
+This security setting determines whether packet signing is required by the SMB server component.
+
+The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether SMB packet signing must be negotiated before further communication with an SMB client is permitted.
+
+If this setting is enabled, the Microsoft network server will not communicate with a Microsoft network client unless that client agrees to perform SMB packet signing. If this setting is disabled, SMB packet signing is negotiated between the client and server.
+
+Default:
+
+Disabled for member servers.
+Enabled for domain controllers.
+
+Notes
+
+All Windows operating systems support both a client-side SMB component and a server-side SMB component. On Windows 2000 and later, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings:
+Microsoft network client: Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing.
+Microsoft network client: Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled.
+Microsoft network server: Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing.
+Microsoft network server: Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled.
+Similarly, if client-side SMB signing is required, that client will not be able to establish a session with servers that do not have packet signing enabled. By default, server-side SMB signing is enabled only on domain controllers.
+If server-side SMB signing is enabled, SMB packet signing will be negotiated with clients that have client-side SMB signing enabled.
+SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors.
+
+Important
+
+For this policy to take effect on computers running Windows 2000, server-side packet signing must also be enabled. To enable server-side SMB packet signing, set the following policy:
+Microsoft network server: Digitally sign communications (if server agrees)
+
+For Windows 2000 servers to negotiate signing with Windows NT 4.0 clients, the following registry value must be set to 1 on the Windows 2000 server:
+HKLM\System\CurrentControlSet\Services\lanmanserver\parameters\enableW9xsecuritysignature
+For more information, reference: https://go.microsoft.com/fwlink/?LinkID=787136.
+
+
+
+
+
+
+
+**LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Microsoft network server: Digitally sign communications (if client agrees)
+
+This security setting determines whether the SMB server will negotiate SMB packet signing with clients that request it.
+
+The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether the SMB server will negotiate SMB packet signing when an SMB client requests it.
+
+If this setting is enabled, the Microsoft network server will negotiate SMB packet signing as requested by the client. That is, if packet signing has been enabled on the client, packet signing will be negotiated. If this policy is disabled, the SMB client will never negotiate SMB packet signing.
+
+Default: Enabled on domain controllers only.
+
+Important
+
+For Windows 2000 servers to negotiate signing with Windows NT 4.0 clients, the following registry value must be set to 1 on the server running Windows 2000: HKLM\System\CurrentControlSet\Services\lanmanserver\parameters\enableW9xsecuritysignature
+
+Notes
+
+All Windows operating systems support both a client-side SMB component and a server-side SMB component. For Windows 2000 and above, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings:
+Microsoft network client: Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing.
+Microsoft network client: Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled.
+Microsoft network server: Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing.
+Microsoft network server: Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled.
+If both client-side and server-side SMB signing is enabled and the client establishes an SMB 1.0 connection to the server, SMB signing will be attempted.
+SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors. This setting only applies to SMB 1.0 connections.
+For more information, reference: https://go.microsoft.com/fwlink/?LinkID=787136.
+
+
+
+
+
+
+
+**LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Network access: Do not allow anonymous enumeration of SAM accounts
+
+This security setting determines what additional permissions will be granted for anonymous connections to the computer.
+
+Windows allows anonymous users to perform certain activities, such as enumerating the names of domain accounts and network shares. This is convenient, for example, when an administrator wants to grant access to users in a trusted domain that does not maintain a reciprocal trust.
+
+This security option allows additional restrictions to be placed on anonymous connections as follows:
+
+Enabled: Do not allow enumeration of SAM accounts. This option replaces Everyone with Authenticated Users in the security permissions for resources.
+Disabled: No additional restrictions. Rely on default permissions.
+
+Default on workstations: Enabled.
+Default on server:Enabled.
+
+Important
+
+This policy has no impact on domain controllers.
+
+
+
+
+
+
+
+**LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSamAccountsAndShares**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Network access: Do not allow anonymous enumeration of SAM accounts and shares
+
+This security setting determines whether anonymous enumeration of SAM accounts and shares is allowed.
+
+Windows allows anonymous users to perform certain activities, such as enumerating the names of domain accounts and network shares. This is convenient, for example, when an administrator wants to grant access to users in a trusted domain that does not maintain a reciprocal trust. If you do not want to allow anonymous enumeration of SAM accounts and shares, then enable this policy.
+
+Default: Disabled.
+
+
+
+
+
+
+
+**LocalPoliciesSecurityOptions/NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Network access: Let Everyone permissions apply to anonymous users
+
+This security setting determines what additional permissions are granted for anonymous connections to the computer.
+
+Windows allows anonymous users to perform certain activities, such as enumerating the names of domain accounts and network shares. This is convenient, for example, when an administrator wants to grant access to users in a trusted domain that does not maintain a reciprocal trust. By Default, the Everyone security identifier (SID) is removed from the token created for anonymous connections. Therefore, permissions granted to the Everyone group do not apply to anonymous users. If this option is set, anonymous users can only access those resources for which the anonymous user has been explicitly given permission.
+
+If this policy is enabled, the Everyone SID is added to the token that is created for anonymous connections. In this case, anonymous users are able to access any resource for which the Everyone group has been given permissions.
+
+Default: Disabled.
+
+
+
+
+
+
+
+**LocalPoliciesSecurityOptions/NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Network access: Restrict anonymous access to Named Pipes and Shares
+
+When enabled, this security setting restricts anonymous access to shares and pipes to the settings for:
+
+Network access: Named pipes that can be accessed anonymously
+Network access: Shares that can be accessed anonymously
+Default: Enabled.
+
+
+
+
+
+
+
+**LocalPoliciesSecurityOptions/NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Network access: Restrict clients allowed to make remote calls to SAM
+
+This policy setting allows you to restrict remote rpc connections to SAM.
+
+If not selected, the default security descriptor will be used.
+
+This policy is supported on at least Windows Server 2016.
+
+
+
+
+
+
+
+**LocalPoliciesSecurityOptions/NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Network security: Allow Local System to use computer identity for NTLM
+
+This policy setting allows Local System services that use Negotiate to use the computer identity when reverting to NTLM authentication.
+
+If you enable this policy setting, services running as Local System that use Negotiate will use the computer identity. This might cause some authentication requests between Windows operating systems to fail and log an error.
+
+If you disable this policy setting, services running as Local System that use Negotiate when reverting to NTLM authentication will authenticate anonymously.
+
+By default, this policy is enabled on Windows 7 and above.
+
+By default, this policy is disabled on Windows Vista.
+
+This policy is supported on at least Windows Vista or Windows Server 2008.
+
+Note: Windows Vista or Windows Server 2008 do not expose this setting in Group Policy.
+
+
+
+
+
+
+
+**LocalPoliciesSecurityOptions/NetworkSecurity_AllowPKU2UAuthenticationRequests**
+
+
Home
@@ -831,26 +2212,316 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Network security: Allow PKU2U authentication requests to this computer to use online identities.
+
+This policy will be turned off by default on domain joined machines. This would prevent online identities from authenticating to the domain joined machine.
+
+
+Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
+
+
+Valid values:
+- 0 - disabled
+- 1 - enabled (allow PKU2U authentication requests to this computer to use online identities.)
+
+
+
+
+
+
+
+**LocalPoliciesSecurityOptions/NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Network security: Do not store LAN Manager hash value on next password change
+
+This security setting determines if, at the next password change, the LAN Manager (LM) hash value for the new password is stored. The LM hash is relatively weak and prone to attack, as compared with the cryptographically stronger Windows NT hash. Since the LM hash is stored on the local computer in the security database the passwords can be compromised if the security database is attacked.
+
+
+Default on Windows Vista and above: Enabled
+Default on Windows XP: Disabled.
+
+Important
+
+Windows 2000 Service Pack 2 (SP2) and above offer compatibility with authentication to previous versions of Windows, such as Microsoft Windows NT 4.0.
+This setting can affect the ability of computers running Windows 2000 Server, Windows 2000 Professional, Windows XP, and the Windows Server 2003 family to communicate with computers running Windows 95 and Windows 98.
+
+
+
+
+
+
+
+**LocalPoliciesSecurityOptions/NetworkSecurity_LANManagerAuthenticationLevel**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Network security LAN Manager authentication level
+
+This security setting determines which challenge/response authentication protocol is used for network logons. This choice affects the level of authentication protocol used by clients, the level of session security negotiated, and the level of authentication accepted by servers as follows:
+
+Send LM and NTLM responses: Clients use LM and NTLM authentication and never use NTLMv2 session security; domain controllers accept LM, NTLM, and NTLMv2 authentication.
+
+Send LM and NTLM - use NTLMv2 session security if negotiated: Clients use LM and NTLM authentication and use NTLMv2 session security if the server supports it; domain controllers accept LM, NTLM, and NTLMv2 authentication.
+
+Send NTLM response only: Clients use NTLM authentication only and use NTLMv2 session security if the server supports it; domain controllers accept LM, NTLM, and NTLMv2 authentication.
+
+Send NTLMv2 response only: Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it; domain controllers accept LM, NTLM, and NTLMv2 authentication.
+
+Send NTLMv2 response only\refuse LM: Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it; domain controllers refuse LM (accept only NTLM and NTLMv2 authentication).
+
+Send NTLMv2 response only\refuse LM and NTLM: Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it; domain controllers refuse LM and NTLM (accept only NTLMv2 authentication).
+
+Important
+
+This setting can affect the ability of computers running Windows 2000 Server, Windows 2000 Professional, Windows XP Professional, and the Windows Server 2003 family to communicate with computers running Windows NT 4.0 and earlier over the network. For example, at the time of this writing, computers running Windows NT 4.0 SP4 and earlier did not support NTLMv2. Computers running Windows 95 and Windows 98 did not support NTLM.
+
+Default:
+
+Windows 2000 and windows XP: send LM and NTLM responses
+
+Windows Server 2003: Send NTLM response only
+
+Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2: Send NTLMv2 response only
+
+
+
+
+
+
+
+**LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Network security: Minimum session security for NTLM SSP based (including secure RPC) clients
+
+This security setting allows a client to require the negotiation of 128-bit encryption and/or NTLMv2 session security. These values are dependent on the LAN Manager Authentication Level security setting value. The options are:
+
+Require NTLMv2 session security: The connection will fail if NTLMv2 protocol is not negotiated.
+Require 128-bit encryption: The connection will fail if strong encryption (128-bit) is not negotiated.
+
+Default:
+
+Windows XP, Windows Vista, Windows 2000 Server, Windows Server 2003, and Windows Server 2008: No requirements.
+
+Windows 7 and Windows Server 2008 R2: Require 128-bit encryption
+
+
+
+
+
+
+
+**LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Network security: Minimum session security for NTLM SSP based (including secure RPC) servers
+
+This security setting allows a server to require the negotiation of 128-bit encryption and/or NTLMv2 session security. These values are dependent on the LAN Manager Authentication Level security setting value. The options are:
+
+Require NTLMv2 session security: The connection will fail if message integrity is not negotiated.
+Require 128-bit encryption. The connection will fail if strong encryption (128-bit) is not negotiated.
+
+Default:
+
+Windows XP, Windows Vista, Windows 2000 Server, Windows Server 2003, and Windows Server 2008: No requirements.
+
+Windows 7 and Windows Server 2008 R2: Require 128-bit encryption
+
+
+
+
+
+
+
+**LocalPoliciesSecurityOptions/RecoveryConsole_AllowAutomaticAdministrativeLogon**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
3
+
3
+
3
+
3
+
+
+
+
+
+
+
Recovery console: Allow automatic administrative logon
This security setting determines if the password for the Administrator account must be given before access to the system is granted. If this option is enabled, the Recovery Console does not require you to provide a password, and it automatically logs on to the system.
Default: This policy is not defined and automatic administrative logon is not allowed.
+
+Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
+
+
Valid values:
- 0 - disabled
- 1 - enabled (allow automatic administrative logon)
-Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
+
-
-
-
+
+
**LocalPoliciesSecurityOptions/Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn**
-
+
Home
@@ -872,8 +2543,8 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -881,8 +2552,8 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
Shutdown: Allow system to be shut down without having to log on
This security setting determines whether a computer can be shut down without having to log on to Windows.
@@ -893,19 +2564,124 @@ When this policy is disabled, the option to shut down the computer does not appe
Default on workstations: Enabled.
Default on servers: Disabled.
+
+Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
+
+
Valid values:
- 0 - disabled
- 1 - enabled (allow system to be shut down without having to log on)
-Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
+
-
-
-
+
+
+**LocalPoliciesSecurityOptions/Shutdown_ClearVirtualMemoryPageFile**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Shutdown: Clear virtual memory pagefile
+
+This security setting determines whether the virtual memory pagefile is cleared when the system is shut down.
+
+Virtual memory support uses a system pagefile to swap pages of memory to disk when they are not used. On a running system, this pagefile is opened exclusively by the operating system, and it is well protected. However, systems that are configured to allow booting to other operating systems might have to make sure that the system pagefile is wiped clean when this system shuts down. This ensures that sensitive information from process memory that might go into the pagefile is not available to an unauthorized user who manages to directly access the pagefile.
+
+When this policy is enabled, it causes the system pagefile to be cleared upon clean shutdown. If you enable this security option, the hibernation file (hiberfil.sys) is also zeroed out when hibernation is disabled.
+
+Default: Disabled.
+
+
+
+
+
+
+
+**LocalPoliciesSecurityOptions/SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+System objects: Require case insensitivity for non-Windows subsystems
+
+This security setting determines whether case insensitivity is enforced for all subsystems. The Win32 subsystem is case insensitive. However, the kernel supports case sensitivity for other subsystems, such as POSIX.
+
+If this setting is enabled, case insensitivity is enforced for all directory objects, symbolic links, and IO objects, including file objects. Disabling this setting does not allow the Win32 subsystem to become case sensitive.
+
+Default: Enabled.
+
+
+
+
+
+
+
**LocalPoliciesSecurityOptions/UserAccountControl_AllowUIAccessApplicationsToPromptForElevation**
-
+
Home
@@ -927,8 +2703,8 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -936,8 +2712,8 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop.
This policy setting controls whether User Interface Accessibility (UIAccess or UIA) programs can automatically disable the secure desktop for elevation prompts used by a standard user.
@@ -945,21 +2721,26 @@ This policy setting controls whether User Interface Accessibility (UIAccess or U
Enabled: UIA programs, including Windows Remote Assistance, automatically disable the secure desktop for elevation prompts. If you do not disable the "User Account Control: Switch to the secure desktop when prompting for elevation" policy setting, the prompts appear on the interactive user's desktop instead of the secure desktop.
Disabled: (Default)
-Valid values:
-- 0 - disabled
-- 1 - enabled (allow UIAccess applications to prompt for elevation without using the secure desktop)
The secure desktop can be disabled only by the user of the interactive desktop or by disabling the "User Account Control: Switch to the secure desktop when prompting for elevation" policy setting.
Value type is integer. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
+Valid values:
+- 0 - disabled
+- 1 - enabled (allow UIAccess applications to prompt for elevation without using the secure desktop)
+
+
+
+
-
+
+
**LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForAdministrators**
-
+
Home
@@ -981,8 +2762,8 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -990,8 +2771,8 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode
This policy setting controls the behavior of the elevation prompt for administrators.
@@ -1012,13 +2793,15 @@ The options are:
Value type is integer. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
+
-
+
+
**LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers**
-
+
Home
@@ -1040,8 +2823,8 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1049,28 +2832,81 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
User Account Control: Behavior of the elevation prompt for standard users
This policy setting controls the behavior of the elevation prompt for standard users.
-The options are:
-
-- 3 - Prompt for credentials: (Default) When an operation requires elevation of privilege, the user is prompted to enter an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege.
-
-- 0 - Automatically deny elevation requests: When an operation requires elevation of privilege, a configurable access denied error message is displayed. An enterprise that is running desktops as standard user may choose this setting to reduce help desk calls.
-
-- 1 - Prompt for credentials on the secure desktop: When an operation requires elevation of privilege, the user is prompted on the secure desktop to enter a different user name and password. If the user enters valid credentials, the operation continues with the applicable privilege.
-
Value type is integer. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
+The following list shows the supported values:
+
+- 0 - Automatically deny elevation requests: When an operation requires elevation of privilege, a configurable access denied error message is displayed. An enterprise that is running desktops as standard user may choose this setting to reduce help desk calls.
+- 1 - Prompt for credentials on the secure desktop: When an operation requires elevation of privilege, the user is prompted on the secure desktop to enter a different user name and password. If the user enters valid credentials, the operation continues with the applicable privilege.
+- 3 (Default) - Prompt for credentials: When an operation requires elevation of privilege, the user is prompted to enter an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege.
+
+
+
+
-
+
+
+**LocalPoliciesSecurityOptions/UserAccountControl_DetectApplicationInstallationsAndPromptForElevation**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+User Account Control: Detect application installations and prompt for elevation
+
+This policy setting controls the behavior of application installation detection for the computer.
+
+The options are:
+
+Enabled: (Default) When an application installation package is detected that requires elevation of privilege, the user is prompted to enter an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege.
+
+Disabled: Application installation packages are not detected and prompted for elevation. Enterprises that are running standard user desktops and use delegated installation technologies such as Group Policy Software Installation or Systems Management Server (SMS) should disable this policy setting. In this case, installer detection is unnecessary.
+
+
+
+
+
+
+
**LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateExecutableFilesThatAreSignedAndValidated**
-
+
Home
@@ -1092,8 +2928,8 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1101,8 +2937,8 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
User Account Control: Only elevate executable files that are signed and validated
This policy setting enforces public key infrastructure (PKI) signature checks for any interactive applications that request elevation of privilege. Enterprise administrators can control which applications are allowed to run by adding certificates to the Trusted Publishers certificate store on local computers.
@@ -1113,13 +2949,15 @@ The options are:
Value type is integer. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
+
-
+
+
**LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations**
-
+
Home
@@ -1141,8 +2979,8 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1150,8 +2988,8 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
User Account Control: Only elevate UIAccess applications that are installed in secure locations
This policy setting controls whether applications that request to run with a User Interface Accessibility (UIAccess) integrity level must reside in a secure location in the file system. Secure locations are limited to the following:
@@ -1168,13 +3006,15 @@ The options are:
Value type is integer. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
+
-
+
+
**LocalPoliciesSecurityOptions/UserAccountControl_RunAllAdministratorsInAdminApprovalMode**
-
+
Home
@@ -1196,8 +3036,8 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1205,8 +3045,8 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
User Account Control: Turn on Admin Approval Mode
This policy setting controls the behavior of all User Account Control (UAC) policy settings for the computer. If you change this policy setting, you must restart your computer.
@@ -1218,13 +3058,15 @@ The options are:
Value type is integer. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
+
-
+
+
**LocalPoliciesSecurityOptions/UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation**
-
+
Home
@@ -1246,8 +3088,8 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1255,8 +3097,8 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
User Account Control: Switch to the secure desktop when prompting for elevation
This policy setting controls whether the elevation request prompt is displayed on the interactive user's desktop or the secure desktop.
@@ -1267,13 +3109,66 @@ The options are:
Value type is integer. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
+
-
+
+
+**LocalPoliciesSecurityOptions/UserAccountControl_UseAdminApprovalMode**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+User Account Control: Use Admin Approval Mode for the built-in Administrator account
+
+This policy setting controls the behavior of Admin Approval Mode for the built-in Administrator account.
+
+The options are:
+
+• Enabled: The built-in Administrator account uses Admin Approval Mode. By default, any operation that requires elevation of privilege will prompt the user to approve the operation.
+
+• Disabled: (Default) The built-in Administrator account runs all applications with full administrative privilege.
+
+
+
+
+
+
+
**LocalPoliciesSecurityOptions/UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations**
-
+
Home
@@ -1295,8 +3190,8 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1304,20 +3199,23 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
User Account Control: Virtualize file and registry write failures to per-user locations
This policy setting controls whether application write failures are redirected to defined registry and file system locations. This policy setting mitigates applications that run as administrator and write run-time application data to %ProgramFiles%, %Windir%, %Windir%\system32, or HKLM\Software.
-The options are:
+Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
+
+
+The following list shows the supported values:
+
- 0 - Disabled: Applications that write data to protected locations fail.
- 1 - Enabled: (Default) Application write failures are redirected at run time to defined user locations for both the file system and registry.
-Value type is integer. Supported operations are Add, Get, Replace, and Delete.
-
-
-
+
+
Footnote:
@@ -1326,5 +3224,5 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
diff --git a/windows/client-management/mdm/policy-csp-location.md b/windows/client-management/mdm/policy-csp-location.md
index 9c979b9d53..ac9c25abfa 100644
--- a/windows/client-management/mdm/policy-csp-location.md
+++ b/windows/client-management/mdm/policy-csp-location.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - Location
@@ -15,7 +15,7 @@ ms.date: 11/01/2017
-
+
## Location policies
Added in Windows 10, version 1703. Optional policy that allows for IT admin to preconfigure whether or not Location Service's Device Switch is enabled or disabled for the device. Setting this policy is not required for Location Services to function. This policy controls a device wide state that affects all users, apps, and services ability to find the device's latitude and longitude on a map. There is a separate user switch that defines whether the location service is allowed to retrieve a position for the current user. In order to retrieve a position for a specific user, both the Device Switch and the User Switch must be enabled. If either is disabled, positions cannot be retrieved for the user. The user can later change both the User Switch and the Device Switch through the user interface on the Settings -> Privacy -> Location page.
+
+
+Added in Windows 10, version 1703. Optional policy that allows for IT admin to preconfigure whether or not Location Service's Device Switch is enabled or disabled for the device. Setting this policy is not required for Location Services to function. This policy controls a device wide state that affects all users, apps, and services ability to find the device's latitude and longitude on a map. There is a separate user switch that defines whether the location service is allowed to retrieve a position for the current user. In order to retrieve a position for a specific user, both the Device Switch and the User Switch must be enabled. If either is disabled, positions cannot be retrieved for the user. The user can later change both the User Switch and the Device Switch through the user interface on the Settings -> Privacy -> Location page.
> [!IMPORTANT]
> This policy is not intended to ever be set, pushed, or refreshed more than one time after the first boot of the device because it is meant as initial configuration. Refreshing this policy might result in the Location Service's Device Switch changing state to something the user did not select, which is not an intended use for this policy.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 (default) – Disabled.
- 1 – Enabled.
-
To validate on Desktop, do the following:
+
+
+To validate on Desktop, do the following:
1. Verify that Settings -> Privacy -> Location -> Location for this device is On/Off as expected.
2. Use Windows Maps Application (or similar) to see if a location can or cannot be obtained.
-
-
+
+
Footnote:
@@ -86,5 +92,5 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
diff --git a/windows/client-management/mdm/policy-csp-lockdown.md b/windows/client-management/mdm/policy-csp-lockdown.md
index c15d05c78e..a63d073566 100644
--- a/windows/client-management/mdm/policy-csp-lockdown.md
+++ b/windows/client-management/mdm/policy-csp-lockdown.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - LockDown
@@ -15,7 +15,7 @@ ms.date: 11/01/2017
-
+
## LockDown policies
Added in Windows 10, version 1607. Allows the user to invoke any system user interface by swiping in from any screen edge using touch.
+
+
+Added in Windows 10, version 1607. Allows the user to invoke any system user interface by swiping in from any screen edge using touch.
-
The following list shows the supported values:
+The easiest way to verify the policy is to restart the explorer process or to reboot after the policy is applied. And then try to swipe from the right edge of the screen. The desired result is for Action Center to not be invoked by the swipe. You can also enter tablet mode and attempt to swipe from the top of the screen to rearrange. That will also be disabled.
+
+
+
+The following list shows the supported values:
- 0 - disallow edge swipe.
- 1 (default, not configured) - allow edge swipe.
-
The easiest way to verify the policy is to restart the explorer process or to reboot after the policy is applied. And then try to swipe from the right edge of the screen. The desired result is for Action Center to not be invoked by the swipe. You can also enter tablet mode and attempt to swipe from the top of the screen to rearrange. That will also be disabled.
-
-
-
+
+
Footnote:
@@ -80,5 +84,5 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
diff --git a/windows/client-management/mdm/policy-csp-maps.md b/windows/client-management/mdm/policy-csp-maps.md
index efff0efc3d..4d5a5f55ec 100644
--- a/windows/client-management/mdm/policy-csp-maps.md
+++ b/windows/client-management/mdm/policy-csp-maps.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - Maps
@@ -15,7 +15,7 @@ ms.date: 11/01/2017
-
+
## Maps policies
Added in Windows 10, version 1607. Allows the download and update of map data over metered connections.
+
+
+Added in Windows 10, version 1607. Allows the download and update of map data over metered connections.
-
The following list shows the supported values:
+After the policy is applied, you can verify the settings in the user interface in **System** > **Offline Maps**.
+
+
+
+The following list shows the supported values:
-- 65535 (default) – Not configured. User's choice.
- 0 – Disabled. Force disable auto-update over metered connection.
- 1 – Enabled. Force enable auto-update over metered connection.
+- 65535 (default) – Not configured. User's choice.
-
After the policy is applied, you can verify the settings in the user interface in **System** > **Offline Maps**.
+
+
-
-
Added in Windows 10, version 1607. Disables the automatic download and update of map data.
+
+
+Added in Windows 10, version 1607. Disables the automatic download and update of map data.
-
The following list shows the supported values:
+After the policy is applied, you can verify the settings in the user interface in **System** > **Offline Maps**.
+
+
+
+The following list shows the supported values:
-- 65535 (default) – Not configured. User's choice.
- 0 – Disabled. Force off auto-update.
- 1 – Enabled. Force on auto-update.
+- 65535 (default) – Not configured. User's choice.
-
After the policy is applied, you can verify the settings in the user interface in **System** > **Offline Maps**.
-
-
-
+
+
Footnote:
@@ -133,5 +141,5 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
diff --git a/windows/client-management/mdm/policy-csp-messaging.md b/windows/client-management/mdm/policy-csp-messaging.md
index 4d41080dfa..abd33e0f71 100644
--- a/windows/client-management/mdm/policy-csp-messaging.md
+++ b/windows/client-management/mdm/policy-csp-messaging.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - Messaging
@@ -15,7 +15,7 @@ ms.date: 11/01/2017
-
+
## Messaging policies
@@ -30,11 +30,13 @@ ms.date: 11/01/2017
+
-
+
+
**Messaging/AllowMMS**
-
+
Home
@@ -56,8 +58,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -65,25 +67,29 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
-
Added in Windows 10, version 1703. Enables or disables the MMS send/receive functionality on the device. For enterprises, this policy can be used to disable MMS on devices as part of the auditing or management requirement.
+Added in Windows 10, version 1703. Enables or disables the MMS send/receive functionality on the device. For enterprises, this policy can be used to disable MMS on devices as part of the auditing or management requirement.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 - Disabled.
- 1 (default) - Enabled.
-
-
+
+
+
Added in Windows 10, version 1607. Enables text message back up and restore and Messaging Everywhere. This policy allows an organization to disable these features to avoid information being stored on servers outside of their control.
+
+
+Added in Windows 10, version 1607. Enables text message back up and restore and Messaging Everywhere. This policy allows an organization to disable these features to avoid information being stored on servers outside of their control.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 - message sync is not allowed and cannot be changed by the user.
- 1 - message sync is allowed. The user can change this setting.
-
-
+
+
+
-
+
+
**Messaging/AllowRCS**
-
+
Home
@@ -151,8 +161,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -160,20 +170,22 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
-
Added in Windows 10, version 1703. Enables or disables the RCS send/receive functionality on the device. For enterprises, this policy can be used to disable RCS on devices as part of the auditing or management requirement.
+Added in Windows 10, version 1703. Enables or disables the RCS send/receive functionality on the device. For enterprises, this policy can be used to disable RCS on devices as part of the auditing or management requirement.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 - Disabled.
- 1 (default) - Enabled.
-
-
+
+
Footnote:
@@ -182,5 +194,5 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
diff --git a/windows/client-management/mdm/policy-csp-networkisolation.md b/windows/client-management/mdm/policy-csp-networkisolation.md
index 2e86a44453..445d9a8d6d 100644
--- a/windows/client-management/mdm/policy-csp-networkisolation.md
+++ b/windows/client-management/mdm/policy-csp-networkisolation.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - NetworkIsolation
@@ -15,7 +15,7 @@ ms.date: 11/01/2017
-
+
## NetworkIsolation policies
Contains a list of Enterprise resource domains hosted in the cloud that need to be protected. Connections to these resources are considered enterprise data. If a proxy is paired with a cloud resource, traffic to the cloud resource will be routed through the enterprise network via the denoted proxy server (on Port 80). A proxy server used for this purpose must also be configured using the **EnterpriseInternalProxyServers** policy. This domain list is a pipe-separated list of cloud resources. Each cloud resource can also be paired optionally with an internal proxy server by using a trailing comma followed by the proxy address. For example, **<*cloudresource*>|<*cloudresource*>|<*cloudresource*>,<*proxy*>|<*cloudresource*>|<*cloudresource*>,<*proxy*>|**.
+
+
+Contains a list of Enterprise resource domains hosted in the cloud that need to be protected. Connections to these resources are considered enterprise data. If a proxy is paired with a cloud resource, traffic to the cloud resource will be routed through the enterprise network via the denoted proxy server (on Port 80). A proxy server used for this purpose must also be configured using the **EnterpriseInternalProxyServers** policy. This domain list is a pipe-separated list of cloud resources. Each cloud resource can also be paired optionally with an internal proxy server by using a trailing comma followed by the proxy address. For example, **<*cloudresource*>|<*cloudresource*>|<*cloudresource*>,<*proxy*>|<*cloudresource*>|<*cloudresource*>,<*proxy*>|**.
+
+
+
-
-
Sets the enterprise IP ranges that define the computers in the enterprise network. Data that comes from those computers will be considered part of the enterprise and protected. These locations will be considered a safe destination for enterprise data to be shared to. This is a comma-separated list of IPv4 and IPv6 ranges. For example:
+
+
+Sets the enterprise IP ranges that define the computers in the enterprise network. Data that comes from those computers will be considered part of the enterprise and protected. These locations will be considered a safe destination for enterprise data to be shared to. This is a comma-separated list of IPv4 and IPv6 ranges.
+
+
+
+For example:
``` syntax
10.0.0.0-10.255.255.255,157.54.0.0-157.54.255.255,
@@ -134,13 +142,15 @@ fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
```
-
-
+
+
+
Boolean value that tells the client to accept the configured list and not to use heuristics to attempt to find other subnets.
+
+
+Boolean value that tells the client to accept the configured list and not to use heuristics to attempt to find other subnets.
+
+
+
-
-
This is the comma-separated list of internal proxy servers. For example "157.54.14.28, 157.54.11.118, 10.202.14.167, 157.53.14.163, 157.69.210.59". These proxies have been configured by the admin to connect to specific resources on the Internet. They are considered to be enterprise network locations. The proxies are only leveraged in configuring the **EnterpriseCloudResources** policy to force traffic to the matched cloud resources through these proxies.
+
+
+This is the comma-separated list of internal proxy servers. For example "157.54.14.28, 157.54.11.118, 10.202.14.167, 157.53.14.163, 157.69.210.59". These proxies have been configured by the admin to connect to specific resources on the Internet. They are considered to be enterprise network locations. The proxies are only leveraged in configuring the **EnterpriseCloudResources** policy to force traffic to the matched cloud resources through these proxies.
+
+
+
-
-
This is the list of domains that comprise the boundaries of the enterprise. Data from one of these domains that is sent to a device will be considered enterprise data and protected These locations will be considered a safe destination for enterprise data to be shared to. This is a comma-separated list of domains, for example "contoso.sharepoint.com, Fabrikam.com".
+
+
+This is the list of domains that comprise the boundaries of the enterprise. Data from one of these domains that is sent to a device will be considered enterprise data and protected These locations will be considered a safe destination for enterprise data to be shared to. This is a comma-separated list of domains, for example "contoso.sharepoint.com, Fabrikam.com".
> [!NOTE]
> The client requires domain name to be canonical, otherwise the setting will be rejected by the client.
-
Here are the steps to create canonical domain names:
+Here are the steps to create canonical domain names:
1. Transform the ASCII characters (A-Z only) to lower case. For example, Microsoft.COM -> microsoft.com.
2. Call [IdnToAscii](https://msdn.microsoft.com/library/windows/desktop/dd318149.aspx) with IDN\_USE\_STD3\_ASCII\_RULES as the flags.
3. Call [IdnToUnicode](https://msdn.microsoft.com/library/windows/desktop/dd318151.aspx) with no flags set (dwFlags = 0).
-
-
+
+
+
This is a comma-separated list of proxy servers. Any server on this list is considered non-enterprise. For example "157.54.14.28, 157.54.11.118, 10.202.14.167, 157.53.14.163, 157.69.210.59".
+
+
+This is a comma-separated list of proxy servers. Any server on this list is considered non-enterprise. For example "157.54.14.28, 157.54.11.118, 10.202.14.167, 157.53.14.163, 157.69.210.59".
+
+
+
-
-
Boolean value that tells the client to accept the configured list of proxies and not try to detect other work proxies.
+
+
+Boolean value that tells the client to accept the configured list of proxies and not try to detect other work proxies.
+
+
+
-
-
Added in Windows 10, version 1607. Boolean value that turns off notification mirroring.
+
+
+Added in Windows 10, version 1607. Boolean value that turns off notification mirroring.
-
For each user logged into the device, if you enable this policy (set value to 1) the app and system notifications received by this user on this device will not get mirrored to other devices of the same logged in user. If you disable or do not configure this policy (set value to 0) the notifications received by this user on this device will be mirrored to other devices of the same logged in user. This feature can be turned off by apps that do not want to participate in Notification Mirroring. This feature can also be turned off by the user in the Cortana setting page.
+For each user logged into the device, if you enable this policy (set value to 1) the app and system notifications received by this user on this device will not get mirrored to other devices of the same logged in user. If you disable or do not configure this policy (set value to 0) the notifications received by this user on this device will be mirrored to other devices of the same logged in user. This feature can be turned off by apps that do not want to participate in Notification Mirroring. This feature can also be turned off by the user in the Cortana setting page.
-
No reboot or service restart is required for this policy to take effect.
+No reboot or service restart is required for this policy to take effect.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
-- 0 (default)– enable notification mirroring.
-- 1 – disable notification mirroring.
+- 0 (default) – enable notification mirroring.
+- 1 - disable notification mirroring.
-
-
+
+
Footnote:
@@ -82,5 +86,5 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
diff --git a/windows/client-management/mdm/policy-csp-power.md b/windows/client-management/mdm/policy-csp-power.md
index 533e43da2d..5bc495e5d8 100644
--- a/windows/client-management/mdm/policy-csp-power.md
+++ b/windows/client-management/mdm/policy-csp-power.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - Power
@@ -15,7 +15,7 @@ ms.date: 11/01/2017
-
+
## Power policies
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -83,15 +85,15 @@ ms.date: 11/01/2017
-
-
+
+
This policy setting manages whether or not Windows is allowed to use standby states when putting the computer in a sleep state.
If you enable or do not configure this policy setting, Windows uses standby states to put the computer in a sleep state.
If you disable this policy setting, standby states (S1-S3) are not allowed.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -99,20 +101,22 @@ If you disable this policy setting, standby states (S1-S3) are not allowed.
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Allow standby states (S1-S3) when sleeping (plugged in)*
- GP name: *AllowStandbyStatesAC_2*
- GP path: *System/Power Management/Sleep Settings*
- GP ADMX file name: *power.admx*
-
-
+
+
+
-
+
+
**Power/DisplayOffTimeoutOnBattery**
-
+
Added in Windows 10, version 1709. Turn off the display (on battery). This policy setting allows you to specify the period of inactivity before Windows turns off the display.
+
+
+Added in Windows 10, version 1709. Turn off the display (on battery). This policy setting allows you to specify the period of inactivity before Windows turns off the display.
-
If you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows turns off the display.
+If you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows turns off the display.
-
If you disable or do not configure this policy setting, users control this setting.
+If you disable or do not configure this policy setting, users control this setting.
-
If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the display from turning off. The "Prevent enabling lock screen slide show" (DeviceLock/PreventLockScreenSlideShow) policy setting can be used to disable the slide show feature.
+If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the display from turning off. The "Prevent enabling lock screen slide show" (DeviceLock/PreventLockScreenSlideShow) policy setting can be used to disable the slide show feature.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -161,20 +165,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Turn off the display (on battery)*
- GP name: *VideoPowerDownTimeOutDC_2*
- GP path: *System/Power Management/Video and Display Settings*
- GP ADMX file name: *power.admx*
-
-
+
+
+
Added in Windows 10, version 1709. Turn off the display (plugged in). This policy setting allows you to specify the period of inactivity before Windows turns off the display.
+
+
+Added in Windows 10, version 1709. Turn off the display (plugged in). This policy setting allows you to specify the period of inactivity before Windows turns off the display.
-
If you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows turns off the display.
+If you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows turns off the display.
-
If you disable or do not configure this policy setting, users control this setting.
+If you disable or do not configure this policy setting, users control this setting.
-
If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the display from turning off. The "Prevent enabling lock screen slide show" (DeviceLock/PreventLockScreenSlideShow) policy setting can be used to disable the slide show feature.
+If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the display from turning off. The "Prevent enabling lock screen slide show" (DeviceLock/PreventLockScreenSlideShow) policy setting can be used to disable the slide show feature.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -223,20 +229,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Turn off the display (plugged in)*
- GP name: *VideoPowerDownTimeOutAC_2*
- GP path: *System/Power Management/Video and Display Settings*
- GP ADMX file name: *power.admx*
-
-
+
+
+
Added in Windows 10, version 1709. Specify the system hibernate timeout (on battery). This policy setting allows you to specify the period of inactivity before Windows transitions the system to hibernate.
+
+
+Added in Windows 10, version 1709. Specify the system hibernate timeout (on battery). This policy setting allows you to specify the period of inactivity before Windows transitions the system to hibernate.
-
If you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows transitions to hibernate.
+If you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows transitions to hibernate.
-
If you disable or do not configure this policy setting, users control this setting.
+If you disable or do not configure this policy setting, users control this setting.
-
If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the sleep transition from occuring. The "Prevent enabling lock screen slide show" (DeviceLock/PreventLockScreenSlideShow) policy setting can be used to disable the slide show feature.
+If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the sleep transition from occuring. The "Prevent enabling lock screen slide show" (DeviceLock/PreventLockScreenSlideShow) policy setting can be used to disable the slide show feature.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -286,20 +294,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Specify the system hibernate timeout (on battery)*
- GP name: *DCHibernateTimeOut_2*
- GP path: *System/Power Management/Sleep Settings*
- GP ADMX file name: *power.admx*
-
-
+
+
+
Added in Windows 10, version 1709. Specify the system hibernate timeout (plugged in). This policy setting allows you to specify the period of inactivity before Windows transitions the system to hibernate.
+
+
+Added in Windows 10, version 1709. Specify the system hibernate timeout (plugged in). This policy setting allows you to specify the period of inactivity before Windows transitions the system to hibernate.
-
If you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows transitions to hibernate.
+If you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows transitions to hibernate.
-
If you disable or do not configure this policy setting, users control this setting.
+If you disable or do not configure this policy setting, users control this setting.
-
If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the sleep transition from occuring. The "Prevent enabling lock screen slide show" (DeviceLock/PreventLockScreenSlideShow) policy setting can be used to disable the slide show feature.
+If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the sleep transition from occuring. The "Prevent enabling lock screen slide show" (DeviceLock/PreventLockScreenSlideShow) policy setting can be used to disable the slide show feature.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -348,20 +358,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Specify the system hibernate timeout (plugged in)*
- GP name: *ACHibernateTimeOut_2*
- GP path: *System/Power Management/Sleep Settings*
- GP ADMX file name: *power.admx*
-
-
+
+
+
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -392,15 +404,15 @@ ADMX Info:
-
-
+
+
This policy setting specifies whether or not the user is prompted for a password when the system resumes from sleep.
If you enable or do not configure this policy setting, the user is prompted for a password when the system resumes from sleep.
If you disable this policy setting, the user is not prompted for a password when the system resumes from sleep.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -408,20 +420,22 @@ If you disable this policy setting, the user is not prompted for a password when
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Require a password when a computer wakes (on battery)*
- GP name: *DCPromptForPasswordOnResume_2*
- GP path: *System/Power Management/Sleep Settings*
- GP ADMX file name: *power.admx*
-
-
+
+
+
-
+
+
**Power/RequirePasswordWhenComputerWakesPluggedIn**
-
+
Home
@@ -443,8 +457,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -452,15 +466,15 @@ ADMX Info:
-
-
+
+
This policy setting specifies whether or not the user is prompted for a password when the system resumes from sleep.
If you enable or do not configure this policy setting, the user is prompted for a password when the system resumes from sleep.
If you disable this policy setting, the user is not prompted for a password when the system resumes from sleep.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -468,20 +482,22 @@ If you disable this policy setting, the user is not prompted for a password when
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Require a password when a computer wakes (plugged in)*
- GP name: *ACPromptForPasswordOnResume_2*
- GP path: *System/Power Management/Sleep Settings*
- GP ADMX file name: *power.admx*
-
-
+
+
+
-
+
+
**Power/StandbyTimeoutOnBattery**
-
+
Added in Windows 10, version 1709. Specify the system sleep timeout (on battery). This policy setting allows you to specify the period of inactivity before Windows transitions the system to sleep.
+
+
+Added in Windows 10, version 1709. Specify the system sleep timeout (on battery). This policy setting allows you to specify the period of inactivity before Windows transitions the system to sleep.
-
If you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows transitions to sleep.
+If you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows transitions to sleep.
-
If you disable or do not configure this policy setting, users control this setting.
+If you disable or do not configure this policy setting, users control this setting.
-
If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the sleep transition from occuring. The "Prevent enabling lock screen slide show" (DeviceLock/PreventLockScreenSlideShow) policy setting can be used to disable the slide show feature.
+If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the sleep transition from occuring. The "Prevent enabling lock screen slide show" (DeviceLock/PreventLockScreenSlideShow) policy setting can be used to disable the slide show feature.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -530,20 +546,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Specify the system sleep timeout (on battery)*
- GP name: *DCStandbyTimeOut_2*
- GP path: *System/Power Management/Sleep Settings*
- GP ADMX file name: *power.admx*
-
-
+
+
+
Added in Windows 10, version 1709. Specify the system sleep timeout (plugged in). This policy setting allows you to specify the period of inactivity before Windows transitions the system to sleep.
+
+
+Added in Windows 10, version 1709. Specify the system sleep timeout (plugged in). This policy setting allows you to specify the period of inactivity before Windows transitions the system to sleep.
-
If you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows transitions to sleep.
+If you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows transitions to sleep.
-
If you disable or do not configure this policy setting, users control this setting.
+If you disable or do not configure this policy setting, users control this setting.
-
If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the sleep transition from occuring. The "Prevent enabling lock screen slide show" (DeviceLock/PreventLockScreenSlideShow) policy setting can be used to disable the slide show feature.
+If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the sleep transition from occuring. The "Prevent enabling lock screen slide show" (DeviceLock/PreventLockScreenSlideShow) policy setting can be used to disable the slide show feature.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -592,15 +610,15 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Specify the system sleep timeout (plugged in)*
- GP name: *ACStandbyTimeOut_2*
- GP path: *System/Power Management/Sleep Settings*
- GP ADMX file name: *power.admx*
-
-
+
+
Footnote:
@@ -609,5 +627,5 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
diff --git a/windows/client-management/mdm/policy-csp-printers.md b/windows/client-management/mdm/policy-csp-printers.md
index 8718ad65f0..2e10fa65e7 100644
--- a/windows/client-management/mdm/policy-csp-printers.md
+++ b/windows/client-management/mdm/policy-csp-printers.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - Printers
@@ -15,7 +15,7 @@ ms.date: 11/01/2017
-
+
## Printers policies
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -65,8 +67,8 @@ ms.date: 11/01/2017
-
-
+
+
This policy setting controls the client Point and Print behavior, including the security prompts for Windows Vista computers. The policy setting applies only to non-Print Administrator clients, and only to computers that are members of a domain.
If you enable this policy setting:
@@ -86,7 +88,7 @@ If you disable this policy setting:
-Windows Server 2003 and Windows XP client computers can create a printer connection to any server using Point and Print.
-The "Users can only point and print to computers in their forest" setting applies only to Windows Server 2003 and Windows XP SP1 (and later service packs).
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -94,20 +96,22 @@ If you disable this policy setting:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Point and Print Restrictions*
- GP name: *PointAndPrint_Restrictions_Win7*
- GP path: *Printers*
- GP ADMX file name: *Printing.admx*
-
-
+
+
+
-
+
+
**Printers/PointAndPrintRestrictions_User**
-
+
Home
@@ -129,8 +133,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -138,8 +142,8 @@ ADMX Info:
-
-
+
+
This policy setting controls the client Point and Print behavior, including the security prompts for Windows Vista computers. The policy setting applies only to non-Print Administrator clients, and only to computers that are members of a domain.
If you enable this policy setting:
@@ -159,7 +163,7 @@ If you disable this policy setting:
-Windows Server 2003 and Windows XP client computers can create a printer connection to any server using Point and Print.
-The "Users can only point and print to computers in their forest" setting applies only to Windows Server 2003 and Windows XP SP1 (and later service packs).
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -167,20 +171,22 @@ If you disable this policy setting:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Point and Print Restrictions*
- GP name: *PointAndPrint_Restrictions*
- GP path: *Control Panel/Printers*
- GP ADMX file name: *Printing.admx*
-
-
+
+
+
-
+
+
**Printers/PublishPrinters**
-
+
Home
@@ -202,8 +208,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -211,8 +217,8 @@ ADMX Info:
-
-
+
+
Determines whether the computer's shared printers can be published in Active Directory.
If you enable this setting or do not configure it, users can use the "List in directory" option in the Printer's Properties' Sharing tab to publish shared printers in Active Directory.
@@ -221,7 +227,7 @@ If you disable this setting, this computer's shared printers cannot be published
Note: This settings takes priority over the setting "Automatically publish new printers in the Active Directory".
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -229,15 +235,15 @@ Note: This settings takes priority over the setting "Automatically publish new p
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Allow printers to be published*
- GP name: *PublishPrinters*
- GP path: *Printers*
- GP ADMX file name: *Printing2.admx*
-
-
+
+
Footnote:
@@ -246,5 +252,5 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
diff --git a/windows/client-management/mdm/policy-csp-privacy.md b/windows/client-management/mdm/policy-csp-privacy.md
index 8293364a2d..c42149d2f1 100644
--- a/windows/client-management/mdm/policy-csp-privacy.md
+++ b/windows/client-management/mdm/policy-csp-privacy.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - Privacy
@@ -15,7 +15,7 @@ ms.date: 11/01/2017
-
+
## Privacy policies
Allows or disallows the automatic acceptance of the pairing and privacy user consent dialog when launching apps.
+
+
+Allows or disallows the automatic acceptance of the pairing and privacy user consent dialog when launching apps.
> [!Note]
> There were issues reported with the previous release of this policy and a fix was added in Windows 10, version 1709.
-
The following list shows the supported values:
+
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 (default)– Not allowed.
- 1 – Allowed.
-
Updated in Windows 10, version 1709. Allows the usage of cloud based speech services for Cortana, dictation, or Store applications. Setting this policy to 1, lets Microsoft use the user's voice data to improve cloud speech services for all users.
+
+
+Updated in Windows 10, version 1709. Allows the usage of cloud based speech services for Cortana, dictation, or Store applications. Setting this policy to 1, lets Microsoft use the user's voice data to improve cloud speech services for all users.
-
The following list shows the supported values:
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
Added in Windows 10, version 1607. Enables or disables the Advertising ID.
+
+
+Added in Windows 10, version 1607. Enables or disables the Advertising ID.
-
The following list shows the supported values:
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 – Disabled.
- 1 – Enabled.
- 65535 (default)- Not configured.
-
Most restricted value is 0.
+
+
-
-
-
+
+
**Privacy/EnableActivityFeed**
-
+
Home
@@ -427,8 +441,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -436,22 +450,26 @@ ms.date: 11/01/2017
-
-
+
+
Added in Windows 10, version 1709. Allows IT Admins to allow Apps/OS to publish to the activity feed.
+
+
The following list shows the supported values:
- 0 – Disabled. Apps/OS can't publish the activities and roaming is disabled. (not published to the cloud).
- 1 – (default) Enabled. Apps/OS can publish the activities and will be roamed across device graph.
-
-
+
+
+
-
+
+
**Privacy/LetAppsAccessAccountInfo**
-
+
Home
@@ -473,8 +491,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -482,25 +500,30 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. Specifies whether Windows apps can access account information.
+
+
+Added in Windows 10, version 1607. Specifies whether Windows apps can access account information.
-
The following list shows the supported values:
+
+Most restricted value is 2.
+
+
+
+The following list shows the supported values:
- 0 – User in control.
- 1 – Force allow.
- 2 - Force deny.
-
@@ -522,8 +545,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -531,17 +554,19 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are allowed access to account information. This setting overrides the default LetAppsAccessAccountInfo policy setting for the specified Windows apps.
+
+
+Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are allowed access to account information. This setting overrides the default LetAppsAccessAccountInfo policy setting for the specified Windows apps.
+
+
+
-
-
@@ -563,8 +588,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -572,17 +597,19 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are denied access to account information. This setting overrides the default LetAppsAccessAccountInfo policy setting for the specified Windows apps.
+
+
+Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are denied access to account information. This setting overrides the default LetAppsAccessAccountInfo policy setting for the specified Windows apps.
+
+
+
-
-
@@ -604,8 +631,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -613,17 +640,19 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. The user is able to control the account information privacy setting for the listed Windows apps. This setting overrides the default LetAppsAccessAccountInfo policy setting for the specified Windows apps.
+
+
+Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. The user is able to control the account information privacy setting for the listed Windows apps. This setting overrides the default LetAppsAccessAccountInfo policy setting for the specified Windows apps.
+
+
+
-
-
-
+
+
**Privacy/LetAppsAccessCalendar**
-
+
Home
@@ -645,8 +674,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -654,25 +683,30 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. Specifies whether Windows apps can access the calendar.
+
+
+Added in Windows 10, version 1607. Specifies whether Windows apps can access the calendar.
-
The following list shows the supported values:
+
+Most restricted value is 2.
+
+
+
+The following list shows the supported values:
- 0 – User in control.
- 1 – Force allow.
- 2 - Force deny.
-
@@ -694,8 +728,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -703,17 +737,19 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are allowed access to the calendar. This setting overrides the default LetAppsAccessCalendar policy setting for the specified Windows apps.
+
+
+Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are allowed access to the calendar. This setting overrides the default LetAppsAccessCalendar policy setting for the specified Windows apps.
+
+
+
-
-
@@ -735,8 +771,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -744,17 +780,19 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are denied access to the calendar. This setting overrides the default LetAppsAccessCalendar policy setting for the specified Windows apps.
+
+
+Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are denied access to the calendar. This setting overrides the default LetAppsAccessCalendar policy setting for the specified Windows apps.
+
+
+
-
-
@@ -776,8 +814,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -785,17 +823,19 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. The user is able to control the calendar privacy setting for the listed Windows apps. This setting overrides the default LetAppsAccessCalendar policy setting for the specified Windows apps.
+
+
+Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. The user is able to control the calendar privacy setting for the listed Windows apps. This setting overrides the default LetAppsAccessCalendar policy setting for the specified Windows apps.
+
+
+
-
-
-
+
+
**Privacy/LetAppsAccessCallHistory**
-
+
Home
@@ -817,8 +857,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -826,25 +866,30 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. Specifies whether Windows apps can access call history.
+
+
+Added in Windows 10, version 1607. Specifies whether Windows apps can access call history.
-
The following list shows the supported values:
+
+Most restricted value is 2.
+
+
+
+The following list shows the supported values:
- 0 – User in control.
- 1 – Force allow.
- 2 - Force deny.
-
@@ -866,8 +911,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -875,17 +920,19 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are allowed access to call history. This setting overrides the default LetAppsAccessCallHistory policy setting for the specified Windows apps.
+
+
+Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are allowed access to call history. This setting overrides the default LetAppsAccessCallHistory policy setting for the specified Windows apps.
+
+
+
-
-
@@ -907,8 +954,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -916,17 +963,19 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are denied access to call history. This setting overrides the default LetAppsAccessCallHistory policy setting for the specified Windows apps.
+
+
+Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are denied access to call history. This setting overrides the default LetAppsAccessCallHistory policy setting for the specified Windows apps.
+
+
+
-
-
@@ -948,8 +997,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -957,17 +1006,19 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. The user is able to control the call history privacy setting for the listed Windows apps. This setting overrides the default LetAppsAccessCallHistory policy setting for the specified Windows apps.
+
+
+Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. The user is able to control the call history privacy setting for the listed Windows apps. This setting overrides the default LetAppsAccessCallHistory policy setting for the specified Windows apps.
+
+
+
-
-
-
+
+
**Privacy/LetAppsAccessCamera**
-
+
Home
@@ -989,8 +1040,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -998,25 +1049,30 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. Specifies whether Windows apps can access the camera.
+
+
+Added in Windows 10, version 1607. Specifies whether Windows apps can access the camera.
-
The following list shows the supported values:
+
+Most restricted value is 2.
+
+
+
+The following list shows the supported values:
- 0 – User in control.
- 1 – Force allow.
- 2 - Force deny.
-
@@ -1038,8 +1094,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1047,17 +1103,19 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to the camera. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps.
+
+
+Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to the camera. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps.
+
+
+
-
-
@@ -1079,8 +1137,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1088,17 +1146,19 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to the camera. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps.
+
+
+Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to the camera. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps.
+
+
+
-
-
@@ -1120,8 +1180,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1129,17 +1189,19 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the camera privacy setting for the listed apps. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps.
+
+
+Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the camera privacy setting for the listed apps. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps.
+
+
+
-
-
-
+
+
**Privacy/LetAppsAccessContacts**
-
+
Home
@@ -1161,8 +1223,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1170,25 +1232,30 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. Specifies whether Windows apps can access contacts.
+
+
+Added in Windows 10, version 1607. Specifies whether Windows apps can access contacts.
-
The following list shows the supported values:
+
+Most restricted value is 2.
+
+
+
+The following list shows the supported values:
- 0 – User in control.
- 1 – Force allow.
- 2 - Force deny.
-
@@ -1210,8 +1277,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1219,17 +1286,19 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to contacts. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps.
+
+
+Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to contacts. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps.
+
+
+
-
-
@@ -1251,8 +1320,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1260,17 +1329,19 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to contacts. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps.
+
+
+Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to contacts. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps.
+
+
+
-
-
@@ -1292,8 +1363,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1301,17 +1372,19 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the contacts privacy setting for the listed apps. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps.
+
+
+Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the contacts privacy setting for the listed apps. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps.
+
+
+
-
-
-
+
+
**Privacy/LetAppsAccessEmail**
-
+
Home
@@ -1333,8 +1406,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1342,25 +1415,30 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. Specifies whether Windows apps can access email.
+
+
+Added in Windows 10, version 1607. Specifies whether Windows apps can access email.
-
The following list shows the supported values:
+
+Most restricted value is 2.
+
+
+
+The following list shows the supported values:
- 0 – User in control.
- 1 – Force allow.
- 2 - Force deny.
-
@@ -1382,8 +1460,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1391,17 +1469,19 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to email. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps.
+
+
+Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to email. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps.
+
+
+
-
-
@@ -1423,8 +1503,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1432,17 +1512,19 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to email. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps.
+
+
+Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to email. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps.
+
+
+
-
-
@@ -1464,8 +1546,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1473,17 +1555,19 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the email privacy setting for the listed apps. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps.
+
+
+Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the email privacy setting for the listed apps. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps.
+
+
+
-
-
-
+
+
**Privacy/LetAppsAccessLocation**
-
+
Home
@@ -1505,8 +1589,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1514,25 +1598,30 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. Specifies whether Windows apps can access location.
+
+
+Added in Windows 10, version 1607. Specifies whether Windows apps can access location.
-
The following list shows the supported values:
+
+Most restricted value is 2.
+
+
+
+The following list shows the supported values:
- 0 – User in control.
- 1 – Force allow.
- 2 - Force deny.
-
@@ -1554,8 +1643,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1563,17 +1652,19 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to location. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps.
+
+
+Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to location. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps.
+
+
+
-
-
@@ -1595,8 +1686,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1604,17 +1695,19 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to location. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps.
+
+
+Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to location. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps.
+
+
+
-
-
@@ -1636,8 +1729,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1645,17 +1738,19 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the location privacy setting for the listed apps. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps.
+
+
+Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the location privacy setting for the listed apps. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps.
+
+
+
-
-
-
+
+
**Privacy/LetAppsAccessMessaging**
-
+
Home
@@ -1677,8 +1772,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1686,25 +1781,30 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. Specifies whether Windows apps can read or send messages (text or MMS).
+
+
+Added in Windows 10, version 1607. Specifies whether Windows apps can read or send messages (text or MMS).
-
The following list shows the supported values:
+
+Most restricted value is 2.
+
+
+
+The following list shows the supported values:
- 0 – User in control.
- 1 – Force allow.
- 2 - Force deny.
-
@@ -1726,8 +1826,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1735,17 +1835,19 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed to read or send messages (text or MMS). This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps.
+
+
+Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed to read or send messages (text or MMS). This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps.
+
+
+
-
-
@@ -1767,8 +1869,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1776,17 +1878,19 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are not allowed to read or send messages (text or MMS). This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps.
+
+
+Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are not allowed to read or send messages (text or MMS). This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps.
+
+
+
-
-
@@ -1808,8 +1912,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1817,17 +1921,19 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the messaging privacy setting for the listed apps. This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps.
+
+
+Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the messaging privacy setting for the listed apps. This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps.
+
+
+
-
-
-
+
+
**Privacy/LetAppsAccessMicrophone**
-
+
Home
@@ -1849,8 +1955,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1858,25 +1964,30 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. Specifies whether Windows apps can access the microphone.
+
+
+Added in Windows 10, version 1607. Specifies whether Windows apps can access the microphone.
-
The following list shows the supported values:
+
+Most restricted value is 2.
+
+
+
+The following list shows the supported values:
- 0 – User in control.
- 1 – Force allow.
- 2 - Force deny.
-
@@ -1898,8 +2009,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1907,17 +2018,19 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to the microphone. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps.
+
+
+Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to the microphone. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps.
+
+
+
-
-
@@ -1939,8 +2052,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1948,17 +2061,19 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to the microphone. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps.
+
+
+Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to the microphone. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps.
+
+
+
-
-
@@ -1980,8 +2095,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1989,17 +2104,19 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the microphone privacy setting for the listed apps. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps.
+
+
+Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the microphone privacy setting for the listed apps. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps.
+
+
+
-
-
-
+
+
**Privacy/LetAppsAccessMotion**
-
+
Home
@@ -2021,8 +2138,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -2030,25 +2147,30 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. Specifies whether Windows apps can access motion data.
+
+
+Added in Windows 10, version 1607. Specifies whether Windows apps can access motion data.
-
The following list shows the supported values:
+
+Most restricted value is 2.
+
+
+
+The following list shows the supported values:
- 0 – User in control.
- 1 – Force allow.
- 2 - Force deny.
-
@@ -2070,8 +2192,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -2079,17 +2201,19 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to motion data. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps.
+
+
+Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to motion data. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps.
+
+
+
-
-
@@ -2111,8 +2235,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -2120,17 +2244,19 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to motion data. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps.
+
+
+Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to motion data. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps.
+
+
+
-
-
@@ -2152,8 +2278,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -2161,17 +2287,19 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the motion privacy setting for the listed apps. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps.
+
+
+Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the motion privacy setting for the listed apps. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps.
+
+
+
-
-
-
+
+
**Privacy/LetAppsAccessNotifications**
-
+
Home
@@ -2193,8 +2321,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -2202,25 +2330,30 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. Specifies whether Windows apps can access notifications.
+
+
+Added in Windows 10, version 1607. Specifies whether Windows apps can access notifications.
-
The following list shows the supported values:
+
+Most restricted value is 2.
+
+
+
+The following list shows the supported values:
- 0 – User in control.
- 1 – Force allow.
- 2 - Force deny.
-
@@ -2242,8 +2375,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -2251,17 +2384,19 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to notifications. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps.
+
+
+Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to notifications. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps.
+
+
+
-
-
@@ -2283,8 +2418,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -2292,17 +2427,19 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to notifications. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps.
+
+
+Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to notifications. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps.
+
+
+
-
-
@@ -2324,8 +2461,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -2333,17 +2470,19 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the notifications privacy setting for the listed apps. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps.
+
+
+Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the notifications privacy setting for the listed apps. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps.
+
+
+
-
-
-
+
+
**Privacy/LetAppsAccessPhone**
-
+
Home
@@ -2365,8 +2504,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -2374,25 +2513,30 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. Specifies whether Windows apps can make phone calls.
+
+
+Added in Windows 10, version 1607. Specifies whether Windows apps can make phone calls.
-
The following list shows the supported values:
+
+Most restricted value is 2.
+
+
+
+The following list shows the supported values:
- 0 – User in control.
- 1 – Force allow.
- 2 - Force deny.
-
@@ -2414,8 +2558,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -2423,17 +2567,19 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed to make phone calls. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps.
+
+
+Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed to make phone calls. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps.
+
+
+
-
-
@@ -2455,8 +2601,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -2464,17 +2610,19 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are not allowed to make phone calls. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps.
+
+
+Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are not allowed to make phone calls. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps.
+
+
+
-
-
@@ -2496,8 +2644,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -2505,17 +2653,19 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the phone call privacy setting for the listed apps. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps.
+
+
+Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the phone call privacy setting for the listed apps. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps.
+
+
+
-
-
-
+
+
**Privacy/LetAppsAccessRadios**
-
+
Home
@@ -2537,8 +2687,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -2546,25 +2696,30 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. Specifies whether Windows apps have access to control radios.
+
+
+Added in Windows 10, version 1607. Specifies whether Windows apps have access to control radios.
-
The following list shows the supported values:
+
+Most restricted value is 2.
+
+
+
+The following list shows the supported values:
- 0 – User in control.
- 1 – Force allow.
- 2 - Force deny.
-
@@ -2586,8 +2741,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -2595,17 +2750,19 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will have access to control radios. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps.
+
+
+Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will have access to control radios. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps.
+
+
+
-
-
@@ -2627,8 +2784,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -2636,17 +2793,19 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not have access to control radios. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps.
+
+
+Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not have access to control radios. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps.
+
+
+
-
-
@@ -2668,8 +2827,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -2677,17 +2836,19 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the radios privacy setting for the listed apps. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps.
+
+
+Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the radios privacy setting for the listed apps. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps.
+
+
+
-
-
-
+
+
**Privacy/LetAppsAccessTasks**
-
+
Home
@@ -2709,8 +2870,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -2718,17 +2879,19 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1703. Specifies whether Windows apps can access tasks.
+
+
+Added in Windows 10, version 1703. Specifies whether Windows apps can access tasks.
+
+
+
-
-
@@ -2750,8 +2913,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -2759,17 +2922,19 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to tasks. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps.
+
+
+Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to tasks. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps.
+
+
+
-
-
@@ -2791,8 +2956,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -2800,17 +2965,19 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to tasks. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps.
+
+
+Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to tasks. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps.
+
+
+
-
-
@@ -2832,8 +2999,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -2841,17 +3008,19 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the tasks privacy setting for the listed apps. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps.
+
+
+Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the tasks privacy setting for the listed apps. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps.
+
+
+
-
-
-
+
+
**Privacy/LetAppsAccessTrustedDevices**
-
+
Home
@@ -2873,8 +3042,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -2882,25 +3051,30 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. Specifies whether Windows apps can access trusted devices.
+
+
+Added in Windows 10, version 1607. Specifies whether Windows apps can access trusted devices.
-
The following list shows the supported values:
+
+Most restricted value is 2.
+
+
+
+The following list shows the supported values:
- 0 – User in control.
- 1 – Force allow.
- 2 - Force deny.
-
@@ -2922,8 +3096,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -2931,17 +3105,19 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will have access to trusted devices. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps.
+
+
+Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will have access to trusted devices. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps.
+
+
+
-
-
@@ -2963,8 +3139,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -2972,17 +3148,19 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not have access to trusted devices. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps.
+
+
+Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not have access to trusted devices. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps.
+
+
+
-
-
@@ -3004,8 +3182,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -3013,17 +3191,19 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the 'trusted devices' privacy setting for the listed apps. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps.
+
+
+Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the 'trusted devices' privacy setting for the listed apps. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps.
+
+
+
-
-
-
+
+
**Privacy/LetAppsGetDiagnosticInfo**
-
+
Home
@@ -3045,8 +3225,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -3054,25 +3234,30 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1703. Force allow, force deny or give user control of apps that can get diagnostic information about other running apps.
+
+
+Added in Windows 10, version 1703. Force allow, force deny or give user control of apps that can get diagnostic information about other running apps.
-
The following list shows the supported values:
+
+Most restricted value is 2.
+
+
+
+The following list shows the supported values:
- 0 – User in control.
- 1 – Force allow.
- 2 - Force deny.
-
@@ -3094,8 +3279,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -3103,17 +3288,19 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will have access to diagnostic information about other running apps. This setting overrides the default LetAppsGetDiagnosticInfo policy setting for the specified apps.
+
+
+Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will have access to diagnostic information about other running apps. This setting overrides the default LetAppsGetDiagnosticInfo policy setting for the specified apps.
+
+
+
-
-
@@ -3135,8 +3322,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -3144,17 +3331,19 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not have access to diagnostic information about other running apps. This setting overrides the default LetAppsGetDiagnosticInfo policy setting for the specified apps.
+
+
+Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not have access to diagnostic information about other running apps. This setting overrides the default LetAppsGetDiagnosticInfo policy setting for the specified apps.
+
+
+
-
-
@@ -3176,8 +3365,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -3185,17 +3374,19 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the 'get diagnostic info' privacy setting for the listed apps. This setting overrides the default LetAppsGetDiagnosticInfo policy setting for the specified apps.
+
+
+Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the 'get diagnostic info' privacy setting for the listed apps. This setting overrides the default LetAppsGetDiagnosticInfo policy setting for the specified apps.
+
+
+
-
-
-
+
+
**Privacy/LetAppsRunInBackground**
-
+
Home
@@ -3217,8 +3408,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -3226,27 +3417,32 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1703. Specifies whether Windows apps can run in the background.
+
+
+Added in Windows 10, version 1703. Specifies whether Windows apps can run in the background.
-
The following list shows the supported values:
+
+Most restricted value is 2.
+> [!WARNING]
+> Be careful when determining which apps should have their background activity disabled. Communication apps normally update tiles and notifications through background processes. Turning off background activity for these types of apps could cause text message, email, and voicemail notifications to not function. This could also cause background email syncing to not function properly.
+
+
+
+The following list shows the supported values:
- 0 – User in control (default).
- 1 – Force allow.
- 2 - Force deny.
-
Most restricted value is 2.
-> [!WARNING]
-> Be careful when determining which apps should have their background activity disabled. Communication apps normally update tiles and notifications through background processes. Turning off background activity for these types of apps could cause text message, email, and voicemail notifications to not function. This could also cause background email syncing to not function properly.
+
+
-
-
@@ -3268,8 +3464,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -3277,17 +3473,19 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are able to run in the background. This setting overrides the default LetAppsRunInBackground policy setting for the specified apps.
+
+
+Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are able to run in the background. This setting overrides the default LetAppsRunInBackground policy setting for the specified apps.
+
+
+
-
-
@@ -3309,8 +3507,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -3318,17 +3516,19 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied the ability to run in the background. This setting overrides the default LetAppsRunInBackground policy setting for the specified apps.
+
+
+Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied the ability to run in the background. This setting overrides the default LetAppsRunInBackground policy setting for the specified apps.
+
+
+
-
-
@@ -3350,8 +3550,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -3359,17 +3559,19 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the background apps privacy setting for the listed apps. This setting overrides the default LetAppsRunInBackground policy setting for the specified apps.
+
+
+Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the background apps privacy setting for the listed apps. This setting overrides the default LetAppsRunInBackground policy setting for the specified apps.
+
+
+
-
-
-
+
+
**Privacy/LetAppsSyncWithDevices**
-
+
Home
@@ -3391,8 +3593,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -3400,25 +3602,30 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. Specifies whether Windows apps can sync with devices.
+
+
+Added in Windows 10, version 1607. Specifies whether Windows apps can sync with devices.
-
The following list shows the supported values:
+
+Most restricted value is 2.
+
+
+
+The following list shows the supported values:
- 0 – User in control.
- 1 – Force allow.
- 2 - Force deny.
-
@@ -3440,8 +3647,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -3449,17 +3656,19 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will have access to sync with devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps.
+
+
+Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will have access to sync with devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps.
+
+
+
-
-
@@ -3481,8 +3690,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -3490,17 +3699,19 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not have access to sync with devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps.
+
+
+Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not have access to sync with devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps.
+
+
+
-
-
@@ -3522,8 +3733,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -3531,17 +3742,19 @@ The following list shows the supported values:
-
-
-
Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the 'sync with devices' privacy setting for the listed apps. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps.
+
+
+Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the 'sync with devices' privacy setting for the listed apps. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps.
+
+
+
-
-
-
+
+
**Privacy/PublishUserActivities**
-
+
Home
@@ -3563,8 +3776,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -3572,17 +3785,19 @@ The following list shows the supported values:
-
-
+
+
Added in Windows 10, version 1709. Allows It Admins to enable publishing of user activities to the activity feed.
+
+
The following list shows the supported values:
- 0 – Disabled. Apps/OS can't publish the *user activities*.
- 1 – (default) Enabled. Apps/OS can publish the *user activities*.
-
-
+
+
Footnote:
@@ -3591,7 +3806,7 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
## Privacy policies supported by Windows Holographic for Business
diff --git a/windows/client-management/mdm/policy-csp-remoteassistance.md b/windows/client-management/mdm/policy-csp-remoteassistance.md
index 29f29a7267..79ab76a706 100644
--- a/windows/client-management/mdm/policy-csp-remoteassistance.md
+++ b/windows/client-management/mdm/policy-csp-remoteassistance.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - RemoteAssistance
@@ -15,7 +15,7 @@ ms.date: 11/01/2017
-
+
## RemoteAssistance policies
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -68,8 +70,8 @@ ms.date: 11/01/2017
-
-
+
+
This policy setting lets you customize warning messages.
The "Display warning message before sharing control" policy setting allows you to specify a custom message to display before a user shares control of his or her computer.
@@ -82,7 +84,7 @@ If you disable this policy setting, the user sees the default warning message.
If you do not configure this policy setting, the user sees the default warning message.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -90,20 +92,22 @@ If you do not configure this policy setting, the user sees the default warning m
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Customize warning messages*
- GP name: *RA_Options*
- GP path: *System/Remote Assistance*
- GP ADMX file name: *remoteassistance.admx*
-
-
+
+
+
-
+
+
**RemoteAssistance/SessionLogging**
-
+
Home
@@ -125,8 +129,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -134,8 +138,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to turn logging on or off. Log files are located in the user's Documents folder under Remote Assistance.
If you enable this policy setting, log files are generated.
@@ -144,7 +148,7 @@ If you disable this policy setting, log files are not generated.
If you do not configure this setting, application-based settings are used.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -152,20 +156,22 @@ If you do not configure this setting, application-based settings are used.
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Turn on session logging*
- GP name: *RA_Logging*
- GP path: *System/Remote Assistance*
- GP ADMX file name: *remoteassistance.admx*
-
-
+
+
+
-
+
+
**RemoteAssistance/SolicitedRemoteAssistance**
-
+
Home
@@ -187,8 +193,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -196,8 +202,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to turn on or turn off Solicited (Ask for) Remote Assistance on this computer.
If you enable this policy setting, users on this computer can use email or file transfer to ask someone for help. Also, users can use instant messaging programs to allow connections to this computer, and you can configure additional Remote Assistance settings.
@@ -214,7 +220,7 @@ The "Select the method for sending email invitations" setting specifies which em
If you enable this policy setting you should also enable appropriate firewall exceptions to allow Remote Assistance communications.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -222,20 +228,22 @@ If you enable this policy setting you should also enable appropriate firewall ex
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Configure Solicited Remote Assistance*
- GP name: *RA_Solicit*
- GP path: *System/Remote Assistance*
- GP ADMX file name: *remoteassistance.admx*
-
-
+
+
+
-
+
+
**RemoteAssistance/UnsolicitedRemoteAssistance**
-
+
Home
@@ -257,8 +265,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -266,8 +274,8 @@ ADMX Info:
-
-
+
+
This policy setting allows you to turn on or turn off Offer (Unsolicited) Remote Assistance on this computer.
If you enable this policy setting, users on this computer can get help from their corporate technical support staff using Offer (Unsolicited) Remote Assistance.
@@ -307,7 +315,7 @@ Port 135:TCP
%WINDIR%\PCHealth\HelpCtr\Binaries\Helpctr.exe
Allow Remote Desktop Exception
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -315,15 +323,15 @@ Allow Remote Desktop Exception
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Configure Offer Remote Assistance*
- GP name: *RA_Unsolicit*
- GP path: *System/Remote Assistance*
- GP ADMX file name: *remoteassistance.admx*
-
-
+
+
Footnote:
@@ -332,5 +340,5 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
diff --git a/windows/client-management/mdm/policy-csp-remotedesktopservices.md b/windows/client-management/mdm/policy-csp-remotedesktopservices.md
index dc0834d71a..79615e7c27 100644
--- a/windows/client-management/mdm/policy-csp-remotedesktopservices.md
+++ b/windows/client-management/mdm/policy-csp-remotedesktopservices.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - RemoteDesktopServices
@@ -15,7 +15,7 @@ ms.date: 11/01/2017
-
+
## RemoteDesktopServices policies
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -74,8 +76,8 @@ ms.date: 11/01/2017
-
-
+
+
This policy setting allows you to configure remote access to computers by using Remote Desktop Services.
If you enable this policy setting, users who are members of the Remote Desktop Users group on the target computer can connect remotely to the target computer by using Remote Desktop Services.
@@ -88,7 +90,7 @@ Note: You can limit which clients are able to connect remotely by using Remote D
You can limit the number of users who can connect simultaneously by configuring the policy setting at Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections\Limit number of connections, or by configuring the policy setting Maximum Connections by using the Remote Desktop Session Host WMI Provider.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -96,20 +98,22 @@ You can limit the number of users who can connect simultaneously by configuring
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Allow users to connect remotely by using Remote Desktop Services*
- GP name: *TS_DISABLE_CONNECTIONS*
- GP path: *Windows Components/Remote Desktop Services/Remote Desktop Session Host/Connections*
- GP ADMX file name: *terminalserver.admx*
-
-
+
+
+
-
+
+
**RemoteDesktopServices/ClientConnectionEncryptionLevel**
-
+
Home
@@ -131,8 +135,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -140,8 +144,8 @@ ADMX Info:
-
-
+
+
Specifies whether to require the use of a specific encryption level to secure communications between client computers and RD Session Host servers during Remote Desktop Protocol (RDP) connections. This policy only applies when you are using native RDP encryption. However, native RDP encryption (as opposed to SSL encryption) is not recommended. This policy does not apply to SSL encryption.
If you enable this policy setting, all communications between clients and RD Session Host servers during remote connections must use the encryption method specified in this setting. By default, the encryption level is set to High. The following encryption methods are available:
@@ -158,7 +162,7 @@ Important
FIPS compliance can be configured through the System cryptography. Use FIPS compliant algorithms for encryption, hashing, and signing settings in Group Policy (under Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options.) The FIPS compliant setting encrypts and decrypts data sent from the client to the server and from the server to the client, with the Federal Information Processing Standard (FIPS) 140 encryption algorithms, by using Microsoft cryptographic modules. Use this encryption level when communications between clients and RD Session Host servers requires the highest level of encryption.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -166,20 +170,22 @@ FIPS compliance can be configured through the System cryptography. Use FIPS comp
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Set client connection encryption level*
- GP name: *TS_ENCRYPTION_POLICY*
- GP path: *Windows Components/Remote Desktop Services/Remote Desktop Session Host/Security*
- GP ADMX file name: *terminalserver.admx*
-
-
+
+
+
-
+
+
**RemoteDesktopServices/DoNotAllowDriveRedirection**
-
+
Home
@@ -201,8 +207,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -210,8 +216,8 @@ ADMX Info:
-
-
+
+
This policy setting specifies whether to prevent the mapping of client drives in a Remote Desktop Services session (drive redirection).
By default, an RD Session Host server maps client drives automatically upon connection. Mapped drives appear in the session folder tree in File Explorer or Computer in the format on . You can use this policy setting to override this behavior.
@@ -222,7 +228,7 @@ If you disable this policy setting, client drive redirection is always allowed.
If you do not configure this policy setting, client drive redirection and Clipboard file copy redirection are not specified at the Group Policy level.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -230,20 +236,22 @@ If you do not configure this policy setting, client drive redirection and Clipbo
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Do not allow drive redirection*
- GP name: *TS_CLIENT_DRIVE_M*
- GP path: *Windows Components/Remote Desktop Services/Remote Desktop Session Host/Device and Resource Redirection*
- GP ADMX file name: *terminalserver.admx*
-
-
+
+
+
-
+
+
**RemoteDesktopServices/DoNotAllowPasswordSaving**
-
+
Home
@@ -265,8 +273,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -274,15 +282,15 @@ ADMX Info:
-
-
+
+
Controls whether passwords can be saved on this computer from Remote Desktop Connection.
If you enable this setting the password saving checkbox in Remote Desktop Connection will be disabled and users will no longer be able to save passwords. When a user opens an RDP file using Remote Desktop Connection and saves his settings, any password that previously existed in the RDP file will be deleted.
If you disable this setting or leave it not configured, the user will be able to save passwords using Remote Desktop Connection.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -290,20 +298,22 @@ If you disable this setting or leave it not configured, the user will be able to
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Do not allow passwords to be saved*
- GP name: *TS_CLIENT_DISABLE_PASSWORD_SAVING_2*
- GP path: *Windows Components/Remote Desktop Services/Remote Desktop Connection Client*
- GP ADMX file name: *terminalserver.admx*
-
-
+
+
+
-
+
+
**RemoteDesktopServices/PromptForPasswordUponConnection**
-
+
Home
@@ -325,8 +335,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -334,8 +344,8 @@ ADMX Info:
-
-
+
+
This policy setting specifies whether Remote Desktop Services always prompts the client for a password upon connection.
You can use this setting to enforce a password prompt for users logging on to Remote Desktop Services, even if they already provided the password in the Remote Desktop Connection client.
@@ -348,7 +358,7 @@ If you disable this policy setting, users can always log on to Remote Desktop Se
If you do not configure this policy setting, automatic logon is not specified at the Group Policy level.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -356,20 +366,22 @@ If you do not configure this policy setting, automatic logon is not specified at
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Always prompt for password upon connection*
- GP name: *TS_PASSWORD*
- GP path: *Windows Components/Remote Desktop Services/Remote Desktop Session Host/Security*
- GP ADMX file name: *terminalserver.admx*
-
-
+
+
+
-
+
+
**RemoteDesktopServices/RequireSecureRPCCommunication**
-
+
Home
@@ -391,8 +403,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -400,8 +412,8 @@ ADMX Info:
-
-
+
+
Specifies whether a Remote Desktop Session Host server requires secure RPC communication with all clients or allows unsecured communication.
You can use this setting to strengthen the security of RPC communication with clients by allowing only authenticated and encrypted requests.
@@ -414,7 +426,7 @@ If the status is set to Not Configured, unsecured communication is allowed.
Note: The RPC interface is used for administering and configuring Remote Desktop Services.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -422,15 +434,15 @@ Note: The RPC interface is used for administering and configuring Remote Desktop
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Require secure RPC communication*
- GP name: *TS_RPC_ENCRYPTION*
- GP path: *Windows Components/Remote Desktop Services/Remote Desktop Session Host/Security*
- GP ADMX file name: *terminalserver.admx*
-
-
+
+
Footnote:
@@ -439,5 +451,5 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
diff --git a/windows/client-management/mdm/policy-csp-remotemanagement.md b/windows/client-management/mdm/policy-csp-remotemanagement.md
index 315cac1258..609bfc4763 100644
--- a/windows/client-management/mdm/policy-csp-remotemanagement.md
+++ b/windows/client-management/mdm/policy-csp-remotemanagement.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - RemoteManagement
@@ -15,7 +15,7 @@ ms.date: 11/01/2017
-
+
## RemoteManagement policies
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -101,9 +103,10 @@ ms.date: 11/01/2017
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -111,20 +114,22 @@ ms.date: 11/01/2017
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Allow Basic authentication*
- GP name: *AllowBasic_2*
- GP path: *Windows Components/Windows Remote Management (WinRM)/WinRM Client*
- GP ADMX file name: *WindowsRemoteManagement.admx*
-
-
+
+
+
-
+
+
**RemoteManagement/AllowBasicAuthentication_Service**
-
+
Home
@@ -146,8 +151,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -155,9 +160,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -165,20 +171,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Allow Basic authentication*
- GP name: *AllowBasic_1*
- GP path: *Windows Components/Windows Remote Management (WinRM)/WinRM Service*
- GP ADMX file name: *WindowsRemoteManagement.admx*
-
-
+
+
+
-
+
+
**RemoteManagement/AllowCredSSPAuthenticationClient**
-
+
Home
@@ -200,8 +208,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -209,9 +217,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -219,20 +228,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Allow CredSSP authentication*
- GP name: *AllowCredSSP_2*
- GP path: *Windows Components/Windows Remote Management (WinRM)/WinRM Client*
- GP ADMX file name: *WindowsRemoteManagement.admx*
-
-
+
+
+
-
+
+
**RemoteManagement/AllowCredSSPAuthenticationService**
-
+
Home
@@ -254,8 +265,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -263,9 +274,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -273,20 +285,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Allow CredSSP authentication*
- GP name: *AllowCredSSP_1*
- GP path: *Windows Components/Windows Remote Management (WinRM)/WinRM Service*
- GP ADMX file name: *WindowsRemoteManagement.admx*
-
-
+
+
+
-
+
+
**RemoteManagement/AllowRemoteServerManagement**
-
+
Home
@@ -308,8 +322,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -317,9 +331,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -327,20 +342,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Allow remote server management through WinRM*
- GP name: *AllowAutoConfig*
- GP path: *Windows Components/Windows Remote Management (WinRM)/WinRM Service*
- GP ADMX file name: *WindowsRemoteManagement.admx*
-
-
+
+
+
-
+
+
**RemoteManagement/AllowUnencryptedTraffic_Client**
-
+
Home
@@ -362,8 +379,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -371,9 +388,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -381,20 +399,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Allow unencrypted traffic*
- GP name: *AllowUnencrypted_2*
- GP path: *Windows Components/Windows Remote Management (WinRM)/WinRM Client*
- GP ADMX file name: *WindowsRemoteManagement.admx*
-
-
+
+
+
-
+
+
**RemoteManagement/AllowUnencryptedTraffic_Service**
-
+
Home
@@ -416,8 +436,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -425,9 +445,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -435,20 +456,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Allow unencrypted traffic*
- GP name: *AllowUnencrypted_1*
- GP path: *Windows Components/Windows Remote Management (WinRM)/WinRM Service*
- GP ADMX file name: *WindowsRemoteManagement.admx*
-
-
+
+
+
-
+
+
**RemoteManagement/DisallowDigestAuthentication**
-
+
Home
@@ -470,8 +493,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -479,9 +502,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -489,20 +513,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Disallow Digest authentication*
- GP name: *DisallowDigest*
- GP path: *Windows Components/Windows Remote Management (WinRM)/WinRM Client*
- GP ADMX file name: *WindowsRemoteManagement.admx*
-
-
+
+
+
-
+
+
**RemoteManagement/DisallowNegotiateAuthenticationClient**
-
+
Home
@@ -524,8 +550,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -533,9 +559,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -543,20 +570,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Disallow Negotiate authentication*
- GP name: *DisallowNegotiate_2*
- GP path: *Windows Components/Windows Remote Management (WinRM)/WinRM Client*
- GP ADMX file name: *WindowsRemoteManagement.admx*
-
-
+
+
+
-
+
+
**RemoteManagement/DisallowNegotiateAuthenticationService**
-
+
Home
@@ -578,8 +607,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -587,9 +616,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -597,20 +627,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Disallow Negotiate authentication*
- GP name: *DisallowNegotiate_1*
- GP path: *Windows Components/Windows Remote Management (WinRM)/WinRM Service*
- GP ADMX file name: *WindowsRemoteManagement.admx*
-
-
+
+
+
-
+
+
**RemoteManagement/DisallowStoringOfRunAsCredentials**
-
+
Home
@@ -632,8 +664,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -641,9 +673,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -651,20 +684,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Disallow WinRM from storing RunAs credentials*
- GP name: *DisableRunAs*
- GP path: *Windows Components/Windows Remote Management (WinRM)/WinRM Service*
- GP ADMX file name: *WindowsRemoteManagement.admx*
-
-
+
+
+
-
+
+
**RemoteManagement/SpecifyChannelBindingTokenHardeningLevel**
-
+
Home
@@ -686,8 +721,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -695,9 +730,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -705,20 +741,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Specify channel binding token hardening level*
- GP name: *CBTHardeningLevel_1*
- GP path: *Windows Components/Windows Remote Management (WinRM)/WinRM Service*
- GP ADMX file name: *WindowsRemoteManagement.admx*
-
-
+
+
+
-
+
+
**RemoteManagement/TrustedHosts**
-
+
Home
@@ -740,8 +778,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -749,9 +787,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -759,20 +798,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Trusted Hosts*
- GP name: *TrustedHosts*
- GP path: *Windows Components/Windows Remote Management (WinRM)/WinRM Client*
- GP ADMX file name: *WindowsRemoteManagement.admx*
-
-
+
+
+
-
+
+
**RemoteManagement/TurnOnCompatibilityHTTPListener**
-
+
Home
@@ -794,8 +835,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -803,9 +844,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -813,20 +855,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Turn On Compatibility HTTP Listener*
- GP name: *HttpCompatibilityListener*
- GP path: *Windows Components/Windows Remote Management (WinRM)/WinRM Service*
- GP ADMX file name: *WindowsRemoteManagement.admx*
-
-
+
+
+
-
+
+
**RemoteManagement/TurnOnCompatibilityHTTPSListener**
-
+
Home
@@ -848,8 +892,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -857,9 +901,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -867,15 +912,15 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Turn On Compatibility HTTPS Listener*
- GP name: *HttpsCompatibilityListener*
- GP path: *Windows Components/Windows Remote Management (WinRM)/WinRM Service*
- GP ADMX file name: *WindowsRemoteManagement.admx*
-
-
+
+
Footnote:
@@ -884,5 +929,5 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
diff --git a/windows/client-management/mdm/policy-csp-remoteprocedurecall.md b/windows/client-management/mdm/policy-csp-remoteprocedurecall.md
index 1569a65e29..16adbb0e97 100644
--- a/windows/client-management/mdm/policy-csp-remoteprocedurecall.md
+++ b/windows/client-management/mdm/policy-csp-remoteprocedurecall.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - RemoteProcedureCall
@@ -15,7 +15,7 @@ ms.date: 11/01/2017
-
+
## RemoteProcedureCall policies
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -62,8 +64,8 @@ ms.date: 11/01/2017
-
-
+
+
This policy setting controls whether RPC clients authenticate with the Endpoint Mapper Service when the call they are making contains authentication information. The Endpoint Mapper Service on computers running Windows NT4 (all service packs) cannot process authentication information supplied in this manner.
If you disable this policy setting, RPC clients will not authenticate to the Endpoint Mapper Service, but they will be able to communicate with the Endpoint Mapper Service on Windows NT4 Server.
@@ -74,7 +76,7 @@ If you do not configure this policy setting, it remains disabled. RPC clients w
Note: This policy will not be applied until the system is rebooted.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -82,20 +84,22 @@ Note: This policy will not be applied until the system is rebooted.
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Enable RPC Endpoint Mapper Client Authentication*
- GP name: *RpcEnableAuthEpResolution*
- GP path: *System/Remote Procedure Call*
- GP ADMX file name: *rpc.admx*
-
-
+
+
+
-
+
+
**RemoteProcedureCall/RestrictUnauthenticatedRPCClients**
-
+
Home
@@ -117,8 +121,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -126,8 +130,8 @@ ADMX Info:
-
-
+
+
This policy setting controls how the RPC server runtime handles unauthenticated RPC clients connecting to RPC servers.
This policy setting impacts all RPC applications. In a domain environment this policy setting should be used with caution as it can impact a wide range of functionality including group policy processing itself. Reverting a change to this policy setting can require manual intervention on each affected machine. This policy setting should never be applied to a domain controller.
@@ -146,7 +150,7 @@ If you enable this policy setting, it directs the RPC server runtime to restrict
Note: This policy setting will not be applied until the system is rebooted.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -154,15 +158,15 @@ Note: This policy setting will not be applied until the system is rebooted.
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Restrict Unauthenticated RPC clients*
- GP name: *RpcRestrictRemoteClients*
- GP path: *System/Remote Procedure Call*
- GP ADMX file name: *rpc.admx*
-
-
+
+
Footnote:
@@ -171,5 +175,5 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
diff --git a/windows/client-management/mdm/policy-csp-remoteshell.md b/windows/client-management/mdm/policy-csp-remoteshell.md
index a9538c867b..5f9c72ad15 100644
--- a/windows/client-management/mdm/policy-csp-remoteshell.md
+++ b/windows/client-management/mdm/policy-csp-remoteshell.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - RemoteShell
@@ -15,7 +15,7 @@ ms.date: 11/01/2017
-
+
## RemoteShell policies
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -77,9 +79,10 @@ ms.date: 11/01/2017
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -87,20 +90,22 @@ ms.date: 11/01/2017
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Allow Remote Shell Access*
- GP name: *AllowRemoteShellAccess*
- GP path: *Windows Components/Windows Remote Shell*
- GP ADMX file name: *WindowsRemoteShell.admx*
-
-
+
+
+
-
+
+
**RemoteShell/MaxConcurrentUsers**
-
+
Home
@@ -122,8 +127,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -131,9 +136,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -141,20 +147,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *MaxConcurrentUsers*
- GP name: *MaxConcurrentUsers*
- GP path: *Windows Components/Windows Remote Shell*
- GP ADMX file name: *WindowsRemoteShell.admx*
-
-
+
+
+
-
+
+
**RemoteShell/SpecifyIdleTimeout**
-
+
Home
@@ -176,8 +184,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -185,9 +193,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -195,20 +204,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Specify idle Timeout*
- GP name: *IdleTimeout*
- GP path: *Windows Components/Windows Remote Shell*
- GP ADMX file name: *WindowsRemoteShell.admx*
-
-
+
+
+
-
+
+
**RemoteShell/SpecifyMaxMemory**
-
+
Home
@@ -230,8 +241,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -239,9 +250,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -249,20 +261,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Specify maximum amount of memory in MB per Shell*
- GP name: *MaxMemoryPerShellMB*
- GP path: *Windows Components/Windows Remote Shell*
- GP ADMX file name: *WindowsRemoteShell.admx*
-
-
+
+
+
-
+
+
**RemoteShell/SpecifyMaxProcesses**
-
+
Home
@@ -284,8 +298,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -293,9 +307,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -303,20 +318,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Specify maximum number of processes per Shell*
- GP name: *MaxProcessesPerShell*
- GP path: *Windows Components/Windows Remote Shell*
- GP ADMX file name: *WindowsRemoteShell.admx*
-
-
+
+
+
-
+
+
**RemoteShell/SpecifyMaxRemoteShells**
-
+
Home
@@ -338,8 +355,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -347,9 +364,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -357,20 +375,22 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Specify maximum number of remote shells per user*
- GP name: *MaxShellsPerUser*
- GP path: *Windows Components/Windows Remote Shell*
- GP ADMX file name: *WindowsRemoteShell.admx*
-
-
+
+
+
-
+
+
**RemoteShell/SpecifyShellTimeout**
-
+
Home
@@ -392,8 +412,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -401,9 +421,10 @@ ADMX Info:
-
-
-
+
+
+
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -411,15 +432,15 @@ ADMX Info:
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Specify Shell Timeout*
- GP name: *ShellTimeOut*
- GP path: *Windows Components/Windows Remote Shell*
- GP ADMX file name: *WindowsRemoteShell.admx*
-
-
+
+
Footnote:
@@ -428,5 +449,5 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
diff --git a/windows/client-management/mdm/policy-csp-search.md b/windows/client-management/mdm/policy-csp-search.md
index 29d698f38d..616c8eb992 100644
--- a/windows/client-management/mdm/policy-csp-search.md
+++ b/windows/client-management/mdm/policy-csp-search.md
@@ -6,22 +6,27 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - Search
+> [!WARNING]
+> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
+
## Search policies
Added in Windows 10, version 1709. Allow search and Cortana to search cloud sources like OneDrive and SharePoint. This policy allows corporate administrators to control whether employees can turn off/on the search of these cloud sources. The default policy value is to allow employees access to the setting that controls search of cloud sources.
+
+
+Added in Windows 10, version 1709. Allow search and Cortana to search cloud sources like OneDrive and SharePoint. This policy allows corporate administrators to control whether employees can turn off/on the search of these cloud sources. The default policy value is to allow employees access to the setting that controls search of cloud sources.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
-
+
+
+
-
+
+
+**Search/AllowCortanaInAAD**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Added in Windows 10, next major update. This specifies whether the Cortana consent page can appear in the Azure Active Directory (AAD) device out-of-box-experience (OOBE) flow. If this policy is left in its default state, Cortana will not be shown in the AAD OOBE flow. If you opt-in to this policy, then the Cortana consent page will appear in the AAD OOBE flow..
+
+
+
+The following list shows the supported values:
+
+- 0 (default) - Not allowed. The Cortana consent page will not appear in AAD OOBE during setup.
+- 1 - Allowed. The Cortana consent page will appear in Azure AAD OOBE during setup.
+
+
+
+
+
+
+
**Search/AllowIndexingEncryptedStoresOrItems**
-
+
Allows or disallows the indexing of items. This switch is for the Windows Search Indexer, which controls whether it will index items that are encrypted, such as the Windows Information Protection (WIP) protected files.
+
+
+Allows or disallows the indexing of items. This switch is for the Windows Search Indexer, which controls whether it will index items that are encrypted, such as the Windows Information Protection (WIP) protected files.
-
When the policy is enabled, WIP protected items are indexed and the metadata about them are stored in an unencrypted location. The metadata includes things like file path and date modified.
+When the policy is enabled, WIP protected items are indexed and the metadata about them are stored in an unencrypted location. The metadata includes things like file path and date modified.
-
When the policy is disabled, the WIP protected items are not indexed and do not show up in the results in Cortana or file explorer. There may also be a performance impact on photos and Groove apps if there are a lot of WIP protected media files on the device.
+When the policy is disabled, the WIP protected items are not indexed and do not show up in the results in Cortana or file explorer. There may also be a performance impact on photos and Groove apps if there are a lot of WIP protected media files on the device.
-
The following list shows the supported values:
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
Specifies whether search can leverage location information.
+
+
+Specifies whether search can leverage location information.
-
The following list shows the supported values:
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
Allows the use of diacritics.
+
+
+Allows the use of diacritics.
-
The following list shows the supported values:
+
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
Most restricted value is 0.
+
+
-
-
-
+
+
**Search/AllowWindowsIndexer**
-
+
Home
@@ -286,41 +374,8 @@ ms.date: 11/01/2017
-
-
-
Allow Windows indexer. Value type is integer.
-
-
-
-
-
Specifies whether to always use automatic language detection when indexing content and properties.
+
+
+Allow Windows indexer. Value type is integer.
-
The following list shows the supported values:
+
+
+
+
+
+
+**Search/AlwaysUseAutoLangDetection**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Specifies whether to always use automatic language detection when indexing content and properties.
+
+
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
If enabled, the search indexer backoff feature will be disabled. Indexing will continue at full speed even when system activity is high. If disabled, backoff logic will be used to throttle back indexing activity when system activity is high. Default is disabled.
+
+
+If enabled, the search indexer backoff feature will be disabled. Indexing will continue at full speed even when system activity is high. If disabled, backoff logic will be used to throttle back indexing activity when system activity is high. Default is disabled.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 (default) – Disable.
- 1 – Enable.
-
-
+
+
+
This policy setting configures whether or not locations on removable drives can be added to libraries.
+
+
+This policy setting configures whether or not locations on removable drives can be added to libraries.
-
If you enable this policy setting, locations on removable drives cannot be added to libraries. In addition, locations on removable drives cannot be indexed.
+If you enable this policy setting, locations on removable drives cannot be added to libraries. In addition, locations on removable drives cannot be indexed.
-
If you disable or do not configure this policy setting, locations on removable drives can be added to libraries. In addition, locations on removable drives can be indexed.
+If you disable or do not configure this policy setting, locations on removable drives can be added to libraries. In addition, locations on removable drives can be indexed.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 (default) – Disable.
- 1 – Enable.
-
-
+
+
+
-
+
+
+**Search/DoNotUseWebResults**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Added in Windows 10, next major update. Don't search the web or display web results in Search.
+
+This policy setting allows you to control whether or not Search can perform queries on the web, and if the web results are displayed in Search.
+If you enable this policy setting, queries won't be performed on the web and web results won't be displayed when a user performs a query in Search.
+
+If you disable this policy setting, queries will be performed on the web and web results will be displayed when a user performs a query in Search.
+
+
+
+The following list shows the supported values:
+
+- 0 - Not allowed. Queries won't be performed on the web and web results won't be displayed when a user performs a query in Search.
+- 1 (default) - Allowed. Queries will be performed on the web and web results will be displayed when a user performs a query in Search.
+
+
+
+
+
+
+
**Search/PreventIndexingLowDiskSpaceMB**
-
+
Enabling this policy prevents indexing from continuing after less than the specified amount of hard drive space is left on the same drive as the index location. Select between 0 and 1.
+
+
+Enabling this policy prevents indexing from continuing after less than the specified amount of hard drive space is left on the same drive as the index location. Select between 0 and 1.
-
Enable this policy if computers in your environment have extremely limited hard drive space.
+Enable this policy if computers in your environment have extremely limited hard drive space.
-
When this policy is disabled or not configured, Windows Desktop Search automatically manages your index size.
+When this policy is disabled or not configured, Windows Desktop Search automatically manages your index size.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – Disable.
- 1 (default) – Enable.
-
-
+
+
+
If enabled, clients will be unable to query this computer's index remotely. Thus, when they are browsing network shares that are stored on this computer, they will not search them using the index. If disabled, client search requests will use this computer's index..
+
+
+If enabled, clients will be unable to query this computer's index remotely. Thus, when they are browsing network shares that are stored on this computer, they will not search them using the index. If disabled, client search requests will use this computer's index..
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – Disable.
- 1 (default) – Enable.
-
-
+
+
+
-
+
+
**Search/SafeSearchPermissions**
-
+
Home
@@ -559,8 +733,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -568,23 +742,26 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
-
Specifies what level of safe search (filtering adult content) is required.
+Specifies what level of safe search (filtering adult content) is required.
-
The following list shows the supported values:
+
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 – Strict, highest filtering against adult content.
- 1 (default) – Moderate filtering against adult content (valid search results will not be filtered).
-
Most restricted value is 0.
-
-
-
+
+
Footnote:
@@ -593,7 +770,7 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
## Search policies that can be set using Exchange Active Sync (EAS)
diff --git a/windows/client-management/mdm/policy-csp-security.md b/windows/client-management/mdm/policy-csp-security.md
index b57251df17..fa48adfe0d 100644
--- a/windows/client-management/mdm/policy-csp-security.md
+++ b/windows/client-management/mdm/policy-csp-security.md
@@ -6,16 +6,18 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - Security
+> [!WARNING]
+> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
+
## Security policies
Specifies whether to allow the runtime configuration agent to install provisioning packages.
+
+
+Specifies whether to allow the runtime configuration agent to install provisioning packages.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
-
+
+
+
-
-
+
+
> [!NOTE]
> This policy has been deprecated in Windows 10, version 1607
@@ -134,20 +145,24 @@ ms.date: 11/01/2017
> This policy is only enforced in Windows 10 for desktop and not supported in Windows 10 Mobile.
-
Specifies whether to allow automatic device encryption during OOBE when the device is Azure AD joined.
+Specifies whether to allow automatic device encryption during OOBE when the device is Azure AD joined.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
-
+
+
+
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -178,28 +193,32 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
-
Specifies whether the user is allowed to manually install root and intermediate CA certificates.
+Specifies whether the user is allowed to manually install root and intermediate CA certificates.
-
The following list shows the supported values:
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
Specifies whether to allow the runtime configuration agent to remove provisioning packages.
+
+
+Specifies whether to allow the runtime configuration agent to remove provisioning packages.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
-
+
+
+
-
+
+
**Security/AntiTheftMode**
-
+
Home
@@ -267,8 +290,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -276,26 +299,30 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
-
Allows or disallow Anti Theft Mode on the device.
+Allows or disallow Anti Theft Mode on the device.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – Don't allow Anti Theft Mode.
- 1 (default) – Anti Theft Mode will follow the default device configuration (region-dependent).
-
-
+
+
+
-
+
+
**Security/ClearTPMIfNotReady**
-
+
Home
@@ -317,8 +344,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -326,25 +353,83 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop and not supported in Windows 10 Mobile.
Added in Windows 10, version 1709. Admin access is required. The prompt will appear on first admin logon after a reboot when the TPM is in a non-ready state that can be remediated with a TPM Clear. The prompt will have a description of what clearing the TPM does and that it requires a reboot. The user can dismiss it, but it will appear on next admin logon after restart.
+
+
The following list shows the supported values:
- 0 (default) – Will not force recovery from a non-ready TPM state.
- 1 – Will prompt to clear the TPM if the TPM is in a non-ready state (or reduced functionality) which can be remediated with a TPM Clear.
-
-
+
+
+
-
+
+
+**Security/ConfigureWindowsPasswords**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
4
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Added in Windows 10, next major update. Configures the use of passwords for Windows features.
+
+> [!Note]
+> This policy is only supported in Windows 10 S.
+
+
+
+The following list shows the supported values:
+
+- 0 -Disallow passwords (Asymmetric credentials will be promoted to replace passwords on Windows features)
+- 1- Allow passwords (Passwords continue to be allowed to be used for Windows features)
+- 2- Default (Feature defaults as per SKU and device capabilities. Windows 10 S devices will exhibit "Disallow passwords" default, and all other devices will default to "Allow passwords")
+
+
+
+
+
+
+
**Security/PreventAutomaticDeviceEncryptionForAzureADJoinedDevices**
-
+
Home
@@ -366,8 +451,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -375,28 +460,32 @@ The following list shows the supported values:
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop and not supported in Windows 10 Mobile.
-
Added in Windows 10, version 1607 to replace the deprecated policy **Security/AllowAutomaticDeviceEncryptionForAzureADJoinedDevices**.
+Added in Windows 10, version 1607 to replace the deprecated policy **Security/AllowAutomaticDeviceEncryptionForAzureADJoinedDevices**.
-
Specifies whether to allow automatic device encryption during OOBE when the device is Azure AD joined.
+Specifies whether to allow automatic device encryption during OOBE when the device is Azure AD joined.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 (default) – Encryption enabled.
- 1 – Encryption disabled.
-
-
+
+
+
-
+
+
**Security/RequireDeviceEncryption**
-
+
Home
@@ -409,17 +498,17 @@ The following list shows the supported values:
-
-
-
-
+
+
+
+
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -427,30 +516,32 @@ The following list shows the supported values:
-
-
-> [!NOTE]
-> This policy is only enforced in Windows 10 Mobile. In Windows 10 for desktop, you can query encryption status by using the [DeviceStatus CSP](devicestatus-csp.md) node **DeviceStatus/Compliance/EncryptionCompliance**.
+
+
+Allows enterprise to turn on internal storage encryption.
-
Allows enterprise to turn on internal storage encryption.
-
The following list shows the supported values:
-
-- 0 (default) – Encryption is not required.
-- 1 – Encryption is required.
-
-
Most restricted value is 1.
+Most restricted value is 1.
> [!IMPORTANT]
> If encryption has been enabled, it cannot be turned off by using this policy.
-
-
+
+
+The following list shows the supported values:
+
+- 0 (default) – Encryption is not required.
+- 1 – Encryption is required.
+
+
+
+
@@ -472,8 +563,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -481,22 +572,26 @@ The following list shows the supported values:
-
-
-
Specifies whether provisioning packages must have a certificate signed by a device trusted authority.
+
+
+Specifies whether provisioning packages must have a certificate signed by a device trusted authority.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 (default) – Not required.
- 1 – Required.
-
-
+
+
+
@@ -518,8 +613,8 @@ The following list shows the supported values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -527,16 +622,12 @@ The following list shows the supported values:
-
-
-
Specifies whether to retrieve and post TCG Boot logs, and get or cache an encrypted or signed Health Attestation Report from the Microsoft Health Attestation Service (HAS) when a device boots or reboots.
+
+
+Specifies whether to retrieve and post TCG Boot logs, and get or cache an encrypted or signed Health Attestation Report from the Microsoft Health Attestation Service (HAS) when a device boots or reboots.
-
The following list shows the supported values:
-- 0 (default) – Not required.
-- 1 – Required.
-
-
Setting this policy to 1 (Required):
+Setting this policy to 1 (Required):
- Determines whether a device is capable of Remote Device Health Attestation, by verifying if the device has TPM 2.0.
- Improves the performance of the device by enabling the device to fetch and cache data to reduce the latency during Device Health Verification.
@@ -545,10 +636,17 @@ The following list shows the supported values:
> We recommend that this policy is set to Required after MDM enrollment.
-
Most restricted value is 1.
+Most restricted value is 1.
-
-
+
+
+The following list shows the supported values:
+
+- 0 (default) – Not required.
+- 1 – Required.
+
+
+
Footnote:
@@ -557,7 +655,7 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
## Security policies that can be set using Exchange Active Sync (EAS)
diff --git a/windows/client-management/mdm/policy-csp-settings.md b/windows/client-management/mdm/policy-csp-settings.md
index 8ba5c167ce..bd6a64ba12 100644
--- a/windows/client-management/mdm/policy-csp-settings.md
+++ b/windows/client-management/mdm/policy-csp-settings.md
@@ -6,16 +6,18 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - Settings
+> [!WARNING]
+> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
+
## Settings policies
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -95,29 +102,33 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop and not supported in Windows 10 Mobile.
-
Allows the user to change Auto Play settings.
-
-
The following list shows the supported values:
-
-- 0 – Not allowed.
-- 1 (default) – Allowed.
+Allows the user to change Auto Play settings.
> [!NOTE]
> Setting this policy to 0 (Not allowed) does not affect the autoplay dialog box that appears when a device is connected.
-
-
+
+
+The following list shows the supported values:
+
+- 0 – Not allowed.
+- 1 (default) – Allowed.
+
+
+
+
Allows the user to change Data Sense settings.
+
+
+Allows the user to change Data Sense settings.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
-
+
+
+
Allows the user to change date and time settings.
+
+
+Allows the user to change date and time settings.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
-
+
+
+
Allows editing of the device name.
+
+
+Allows editing of the device name.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
-
+
+
+
-
+
+
**Settings/AllowLanguage**
-
+
Home
@@ -277,8 +300,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -286,26 +309,75 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop and not supported in Windows 10 Mobile.
-
Allows the user to change the language settings.
+Allows the user to change the language settings.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
-
+
+
+
-
+
+
+**Settings/AllowOnlineTips**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
3
+
3
+
3
+
3
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Enables or disables the retrieval of online tips and help for the Settings app.
+
+If disabled, Settings will not contact Microsoft content services to retrieve tips and help content.
+
+
+
+
+
+
+
**Settings/AllowPowerSleep**
-
+
Home
@@ -327,8 +399,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -336,26 +408,30 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop and not supported in Windows 10 Mobile.
-
Allows the user to change power and sleep settings.
+Allows the user to change power and sleep settings.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
-
+
+
+
-
+
+
**Settings/AllowRegion**
-
+
Home
@@ -377,8 +453,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -386,26 +462,30 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop and not supported in Windows 10 Mobile.
-
Allows the user to change the region settings.
+Allows the user to change the region settings.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
-
+
+
+
-
+
+
**Settings/AllowSignInOptions**
-
+
Home
@@ -427,8 +507,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -436,26 +516,30 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop and not supported in Windows 10 Mobile.
-
Allows the user to change sign-in options.
+Allows the user to change sign-in options.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
-
+
+
+
Allows the user to change VPN settings.
+
+
+Allows the user to change VPN settings.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
-
+
+
+
-
+
+
**Settings/AllowWorkplace**
-
+
Home
@@ -523,8 +611,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -532,26 +620,30 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop and not supported in Windows 10 Mobile.
-
Allows user to change workplace settings.
+Allows user to change workplace settings.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
-
+
+
+
Allows user to change account settings.
+
+
+Allows user to change account settings.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
-
+
+
+
Added in Windows 10, version 1703. Allows IT Admins to configure the default setting for showing additional calendars (besides the default calendar for the locale) in the taskbar clock and calendar flyout. In this version of Windows 10, supported additional calendars are: Simplified or Traditional Chinese lunar calendar. Turning on one of these calendars will display Chinese lunar dates below the default calendar for the locale. Select "Don't show additional calendars" to prevent showing other calendars besides the default calendar for the locale.
+
+
+Added in Windows 10, version 1703. Allows IT Admins to configure the default setting for showing additional calendars (besides the default calendar for the locale) in the taskbar clock and calendar flyout. In this version of Windows 10, supported additional calendars are: Simplified or Traditional Chinese lunar calendar. Turning on one of these calendars will display Chinese lunar dates below the default calendar for the locale. Select "Don't show additional calendars" to prevent showing other calendars besides the default calendar for the locale.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 (default) – User will be allowed to configure the setting.
- 1 – Don't show additional calendars.
- 2 - Simplified Chinese (Lunar).
- 3 - Traditional Chinese (Lunar).
-
-
+
+
+
Added in Windows 10, version 1703. Allows IT Admins to either prevent specific pages in the System Settings app from being visible or accessible, or to do so for all pages except those specified. The mode will be specified by the policy string beginning with either the string "showonly:" or "hide:". Pages are identified by a shortened version of their already published URIs, which is the URI minus the "ms-settings:" prefix. For example, if the URI for a settings page is "ms-settings:foo", the page identifier used in the policy will be just "foo". Multiple page identifiers are separated by semicolons.
+
+
+Added in Windows 10, version 1703. Allows IT Admins to either prevent specific pages in the System Settings app from being visible or accessible, or to do so for all pages except those specified. The mode will be specified by the policy string beginning with either the string "showonly:" or "hide:". Pages are identified by a shortened version of their already published URIs, which is the URI minus the "ms-settings:" prefix. For example, if the URI for a settings page is "ms-settings:foo", the page identifier used in the policy will be just "foo". Multiple page identifiers are separated by semicolons.
-
The following example illustrates a policy that would allow access only to the about and bluetooth pages, which have URI "ms-settings:about" and "ms-settings:bluetooth" respectively:
+The following example illustrates a policy that would allow access only to the about and bluetooth pages, which have URI "ms-settings:about" and "ms-settings:bluetooth" respectively:
-
If the policy is not specified, the behavior will be that no pages are affected. If the policy string is formatted incorrectly, it will be ignored entirely (i.e. treated as not set) to prevent the machine from becoming unserviceable if data corruption occurs. Note that if a page is already hidden for another reason, then it will remain hidden even if it is in a "showonly:" list.
+If the policy is not specified, the behavior will be that no pages are affected. If the policy string is formatted incorrectly, it will be ignored entirely (i.e. treated as not set) to prevent the machine from becoming unserviceable if data corruption occurs. Note that if a page is already hidden for another reason, then it will remain hidden even if it is in a "showonly:" list.
-
The format of the PageVisibilityList value is as follows:
+The format of the PageVisibilityList value is as follows:
- The value is a unicode string up to 10,000 characters long, which will be used without case sensitivity.
- There are two variants: one that shows only the given pages and one which hides the given pages.
@@ -694,24 +794,26 @@ ms.date: 11/01/2017
- Following the variant identifier is a semicolon-delimited list of page identifiers, which must not have any extra whitespace.
- Each page identifier is the ms-settings:xyz URI for the page, minus the ms-settings: prefix, so the identifier for the page with URI "ms-settings:wi-fi" would be just "wi-fi".
-
The default value for this setting is an empty string, which is interpreted as show everything.
+The default value for this setting is an empty string, which is interpreted as show everything.
-
Example 1, specifies that only the wifi and bluetooth pages should be shown (they have URIs ms-settings:wi-fi and ms-settings:bluetooth). All other pages (and the categories they're in) will be hidden:
+Example 1, specifies that only the wifi and bluetooth pages should be shown (they have URIs ms-settings:wi-fi and ms-settings:bluetooth). All other pages (and the categories they're in) will be hidden:
-
Example 2, specifies that the wifi page should not be shown:
+Example 2, specifies that the wifi page should not be shown:
-
hide:wifi
+hide:wifi
-
To validate on Desktop, do the following:
+
+
+To validate on Desktop, do the following:
1. Open System Settings and verfiy that the About page is visible and accessible.
2. Configure the policy with the following string: "hide:about".
3. Open System Settings again and verify that the About page is no longer accessible.
-
-
+
+
Footnote:
@@ -720,7 +822,7 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
## Settings policies supported by Windows Holographic for Business
diff --git a/windows/client-management/mdm/policy-csp-smartscreen.md b/windows/client-management/mdm/policy-csp-smartscreen.md
index fbc0b3e56a..f52bfb67a6 100644
--- a/windows/client-management/mdm/policy-csp-smartscreen.md
+++ b/windows/client-management/mdm/policy-csp-smartscreen.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - SmartScreen
@@ -15,7 +15,7 @@ ms.date: 11/01/2017
-
+
## SmartScreen policies
Added in Windows 10, version 1703. Allows IT Admins to control whether users are allowed to install apps from places other than the Store.
+
+
+Added in Windows 10, version 1703. Allows IT Admins to control whether users are allowed to install apps from places other than the Store.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – Turns off Application Installation Control, allowing users to download and install files from anywhere on the web.
- 1 – Turns on Application Installation Control, allowing users to only install apps from the Store.
-
-
+
+
+
Added in Windows 10, version 1703. Allows IT Admins to configure SmartScreen for Windows.
+
+
+Added in Windows 10, version 1703. Allows IT Admins to configure SmartScreen for Windows.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – Turns off SmartScreen in Windows.
- 1 – Turns on SmartScreen in Windows.
-
-
+
+
+
Added in Windows 10, version 1703. Allows IT Admins to control whether users can can ignore SmartScreen warnings and run malicious files.
+
+
+Added in Windows 10, version 1703. Allows IT Admins to control whether users can can ignore SmartScreen warnings and run malicious files.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – Employees can ignore SmartScreen warnings and run malicious files.
- 1 – Employees cannot ignore SmartScreen warnings and run malicious files.
-
-
+
+
Footnote:
@@ -176,5 +188,5 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
diff --git a/windows/client-management/mdm/policy-csp-speech.md b/windows/client-management/mdm/policy-csp-speech.md
index d00aaf1542..e5c27c3200 100644
--- a/windows/client-management/mdm/policy-csp-speech.md
+++ b/windows/client-management/mdm/policy-csp-speech.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - Speech
@@ -15,7 +15,7 @@ ms.date: 11/01/2017
-
+
## Speech policies
Added in Windows 10, version 1607. Specifies whether the device will receive updates to the speech recognition and speech synthesis models. A speech model contains data used by the speech engine to convert audio to text (or vice-versa). The models are periodically updated to improve accuracy and performance. Models are non-executable data files. If enabled, the device will periodically check for updated speech models and then download them from a Microsoft service using the Background Internet Transfer Service (BITS).
+
+
+Added in Windows 10, version 1607. Specifies whether the device will receive updates to the speech recognition and speech synthesis models. A speech model contains data used by the speech engine to convert audio to text (or vice-versa). The models are periodically updated to improve accuracy and performance. Models are non-executable data files. If enabled, the device will periodically check for updated speech models and then download them from a Microsoft service using the Background Internet Transfer Service (BITS).
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
-
+
+
Footnote:
@@ -78,5 +82,5 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
diff --git a/windows/client-management/mdm/policy-csp-start.md b/windows/client-management/mdm/policy-csp-start.md
index d3392ef73f..e8122802b3 100644
--- a/windows/client-management/mdm/policy-csp-start.md
+++ b/windows/client-management/mdm/policy-csp-start.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - Start
@@ -15,7 +15,7 @@ ms.date: 11/01/2017
-
+
## Start policies
Added in Windows 10, version 1703. This policy controls the visibility of the Documents shortcut on the Start menu.
+
+
+Added in Windows 10, version 1703. This policy controls the visibility of the Documents shortcut on the Start menu.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – The shortcut is hidden and disables the setting in the Settings app.
- 1 – The shortcut is visible and disables the setting in the Settings app.
- 65535 (default) - There is no enforced configuration and the setting can be changed by the user.
-
-
+
+
+
Added in Windows 10, version 1703. This policy controls the visibility of the Downloads shortcut on the Start menu.
+
+
+Added in Windows 10, version 1703. This policy controls the visibility of the Downloads shortcut on the Start menu.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – The shortcut is hidden and disables the setting in the Settings app.
- 1 – The shortcut is visible and disables the setting in the Settings app.
- 65535 (default) - There is no enforced configuration and the setting can be changed by the user.
-
-
+
+
+
Added in Windows 10, version 1703. This policy controls the visibility of the File Explorer shortcut on the Start menu.
+
+
+Added in Windows 10, version 1703. This policy controls the visibility of the File Explorer shortcut on the Start menu.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – The shortcut is hidden and disables the setting in the Settings app.
- 1 – The shortcut is visible and disables the setting in the Settings app.
- 65535 (default) - There is no enforced configuration and the setting can be changed by the user.
-
-
+
+
+
Added in Windows 10, version 1703. This policy controls the visibility of the HomeGroup shortcut on the Start menu.
+
+
+Added in Windows 10, version 1703. This policy controls the visibility of the HomeGroup shortcut on the Start menu.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – The shortcut is hidden and disables the setting in the Settings app.
- 1 – The shortcut is visible and disables the setting in the Settings app.
- 65535 (default) - There is no enforced configuration and the setting can be changed by the user.
-
-
+
+
+
Added in Windows 10, version 1703. This policy controls the visibility of the Music shortcut on the Start menu.
+
+
+Added in Windows 10, version 1703. This policy controls the visibility of the Music shortcut on the Start menu.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – The shortcut is hidden and disables the setting in the Settings app.
- 1 – The shortcut is visible and disables the setting in the Settings app.
- 65535 (default) - There is no enforced configuration and the setting can be changed by the user.
-
-
+
+
+
Added in Windows 10, version 1703. This policy controls the visibility of the Network shortcut on the Start menu.
+
+
+Added in Windows 10, version 1703. This policy controls the visibility of the Network shortcut on the Start menu.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – The shortcut is hidden and disables the setting in the Settings app.
- 1 – The shortcut is visible and disables the setting in the Settings app.
- 65535 (default) - There is no enforced configuration and the setting can be changed by the user.
-
-
+
+
+
Added in Windows 10, version 1703. This policy controls the visibility of the PersonalFolder shortcut on the Start menu.
+
+
+Added in Windows 10, version 1703. This policy controls the visibility of the PersonalFolder shortcut on the Start menu.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – The shortcut is hidden and disables the setting in the Settings app.
- 1 – The shortcut is visible and disables the setting in the Settings app.
- 65535 (default) - There is no enforced configuration and the setting can be changed by the user.
-
-
+
+
+
Added in Windows 10, version 1703. This policy controls the visibility of the Pictures shortcut on the Start menu.
+
+
+Added in Windows 10, version 1703. This policy controls the visibility of the Pictures shortcut on the Start menu.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – The shortcut is hidden and disables the setting in the Settings app.
- 1 – The shortcut is visible and disables the setting in the Settings app.
- 65535 (default) - There is no enforced configuration and the setting can be changed by the user.
-
-
+
+
+
Added in Windows 10, version 1703. This policy controls the visibility of the Settings shortcut on the Start menu.
+
+
+Added in Windows 10, version 1703. This policy controls the visibility of the Settings shortcut on the Start menu.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – The shortcut is hidden and disables the setting in the Settings app.
- 1 – The shortcut is visible and disables the setting in the Settings app.
- 65535 (default) - There is no enforced configuration and the setting can be changed by the user.
-
-
+
+
+
Added in Windows 10, version 1703. This policy controls the visibility of the Videos shortcut on the Start menu.
+
+
+Added in Windows 10, version 1703. This policy controls the visibility of the Videos shortcut on the Start menu.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – The shortcut is hidden and disables the setting in the Settings app.
- 1 – The shortcut is visible and disables the setting in the Settings app.
- 65535 (default) - There is no enforced configuration and the setting can be changed by the user.
-
-
+
+
+
-
+
+
**Start/ForceStartSize**
-
+
Home
@@ -604,8 +646,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -613,29 +655,34 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop and not supported in Windows 10 Mobile.
-
Forces the start screen size.
+Forces the start screen size.
-
The following list shows the supported values:
+
+If there is policy configuration conflict, the latest configuration request is applied to the device.
+
+
+
+The following list shows the supported values:
- 0 (default) – Do not force size of Start.
- 1 – Force non-fullscreen size of Start.
- 2 - Force a fullscreen size of Start.
-
If there is policy configuration conflict, the latest configuration request is applied to the device.
+
+
-
-
-
+
+
**Start/HideAppList**
-
+
Home
@@ -657,8 +704,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -666,37 +713,42 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy requires reboot to take effect.
-
Allows IT Admins to configure Start by collapsing or removing the all apps list.
+Allows IT Admins to configure Start by collapsing or removing the all apps list.
> [!Note]
> There were issues reported with the previous release of this policy and a fix was added in Windows 10, version 1709.
-
The following list shows the supported values:
-- 0 (default) – None.
-- 1 – Hide all apps list.
-- 2 - Hide all apps list, and Disable "Show app list in Start menu" in Settings app.
-- 3 - Hide all apps list, remove all apps button, and Disable "Show app list in Start menu" in Settings app.
-
-
To validate on Desktop, do the following:
+To validate on Desktop, do the following:
- 1 - Enable policy and restart explorer.exe
- 2a - If set to '1': Verify that the all apps list is collapsed, and that the Settings toggle is not grayed out.
- 2b - If set to '2': Verify that the all apps list is collapsed, and that the Settings toggle is grayed out.
- 2c - If set to '3': Verify that there is no way of opening the all apps list from Start, and that the Settings toggle is grayed out.
-
-
+
+
+The following list shows the supported values:
+
+- 0 (default) – None.
+- 1 – Hide all apps list.
+- 2 - Hide all apps list, and Disable "Show app list in Start menu" in Settings app.
+- 3 - Hide all apps list, remove all apps button, and Disable "Show app list in Start menu" in Settings app.
+
+
+
+
Added in Windows 10, version 1703. Allows IT Admins to configure Start by hiding "Change account settings" from appearing in the user tile.
+
+
+Added in Windows 10, version 1703. Allows IT Admins to configure Start by hiding "Change account settings" from appearing in the user tile.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 (default) – False (do not hide).
- 1 - True (hide).
-
To validate on Desktop, do the following:
+
+
+To validate on Desktop, do the following:
1. Enable policy.
2. Open Start, click on the user tile, and verify that "Change account settings" is not available.
-
-
+
+
+
-
+
+
**Start/HideFrequentlyUsedApps**
-
+
Home
@@ -769,8 +827,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -778,19 +836,23 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy requires reboot to take effect.
-
Added in Windows 10, version 1703. Allows IT Admins to configure Start by hiding most used apps.
+Added in Windows 10, version 1703. Allows IT Admins to configure Start by hiding most used apps.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 (default) – False (do not hide).
- 1 - True (hide).
-
To validate on Desktop, do the following:
+
+
+To validate on Desktop, do the following:
1. Enable "Show most used apps" in the Settings app.
2. Use some apps to get them into the most used group in Start.
@@ -799,13 +861,15 @@ ms.date: 11/01/2017
5. Check that "Show most used apps" Settings toggle is grayed out.
6. Check that most used apps do not appear in Start.
-
-
+
+
+
Added in Windows 10, version 1703. Allows IT Admins to configure Start by hiding "Hibernate" from appearing in the Power button.
+
+
+Added in Windows 10, version 1703. Allows IT Admins to configure Start by hiding "Hibernate" from appearing in the Power button.
-
The following list shows the supported values:
-
-- 0 (default) – False (do not hide).
-- 1 - True (hide).
-
-
To validate on Laptop, do the following:
-
-1. Enable policy.
-2. Open Start, click on the Power button, and verify "Hibernate" is not available.
> [!NOTE]
> This policy can only be verified on laptops as "Hibernate" does not appear on regular PC's.
-
-
+
+
+The following list shows the supported values:
+
+- 0 (default) – False (do not hide).
+- 1 - True (hide).
+
+
+
+To validate on Laptop, do the following:
+
+1. Enable policy.
+2. Open Start, click on the Power button, and verify "Hibernate" is not available.
+
+
+
+
Added in Windows 10, version 1703. Allows IT Admins to configure Start by hiding "Lock" from appearing in the user tile.
+
+
+Added in Windows 10, version 1703. Allows IT Admins to configure Start by hiding "Lock" from appearing in the user tile.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 (default) – False (do not hide).
- 1 - True (hide).
-
To validate on Desktop, do the following:
+
+
+To validate on Desktop, do the following:
1. Enable policy.
2. Open Start, click on the user tile, and verify "Lock" is not available.
-
-
+
+
+
Added in Windows 10, version 1709. Enabling this policy removes the people icon from the taskbar as well as the corresponding settings toggle. It also prevents users from pinning people to the taskbar.
+> [!div class = "checklist"]
+> * User
-
Value type is integer.
-
-
-
-
+
+
+
+Added in Windows 10, version 1709. Enabling this policy removes the people icon from the taskbar as well as the corresponding settings toggle. It also prevents users from pinning people to the taskbar.
+
+Value type is integer.
+
+
+
+
+
+
+
**Start/HidePowerButton**
-
+
Home
@@ -967,8 +1054,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -976,30 +1063,36 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy requires reboot to take effect.
-
Added in Windows 10, version 1703. Allows IT Admins to configure Start by hiding the Power button from appearing.
+Added in Windows 10, version 1703. Allows IT Admins to configure Start by hiding the Power button from appearing.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 (default) – False (do not hide).
- 1 - True (hide).
-
To validate on Desktop, do the following:
+
+
+To validate on Desktop, do the following:
1. Enable policy.
2. Open Start, and verify the power button is not available.
-
-
+
+
+
-
+
+
**Start/HideRecentJumplists**
-
+
Home
@@ -1021,8 +1114,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1030,19 +1123,23 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy requires reboot to take effect.
-
Added in Windows 10, version 1703. Allows IT Admins to configure Start by hiding recently opened items in the jumplists from appearing.
+Added in Windows 10, version 1703. Allows IT Admins to configure Start by hiding recently opened items in the jumplists from appearing.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 (default) – False (do not hide).
- 1 - True (hide).
-
To validate on Desktop, do the following:
+
+
+To validate on Desktop, do the following:
1. Enable "Show recently opened items in Jump Lists on Start of the taskbar" in Settings.
2. Pin Photos to the taskbar, and open some images in the photos app.
@@ -1054,13 +1151,15 @@ ms.date: 11/01/2017
8. Repeat Step 2.
9. Right Click pinned photos app and verify that there is no jumplist of recent items.
-
-
+
+
+
-
+
+
**Start/HideRecentlyAddedApps**
-
+
Home
@@ -1082,8 +1181,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1091,19 +1190,23 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy requires reboot to take effect.
-
Added in Windows 10, version 1703. Allows IT Admins to configure Start by hiding recently added apps.
+Added in Windows 10, version 1703. Allows IT Admins to configure Start by hiding recently added apps.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 (default) – False (do not hide).
- 1 - True (hide).
-
To validate on Desktop, do the following:
+
+
+To validate on Desktop, do the following:
1. Enable "Show recently added apps" in the Settings app.
2. Check if there are recently added apps in Start (if not, install some).
@@ -1112,13 +1215,15 @@ ms.date: 11/01/2017
5. Check that "Show recently added apps" Settings toggle is grayed out.
6. Check that recently added apps do not appear in Start.
-
-
+
+
+
Added in Windows 10, version 1703. Allows IT Admins to configure Start by hiding "Restart" and "Update and restart" from appearing in the Power button.
+
+
+Added in Windows 10, version 1703. Allows IT Admins to configure Start by hiding "Restart" and "Update and restart" from appearing in the Power button.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 (default) – False (do not hide).
- 1 - True (hide).
-
To validate on Desktop, do the following:
+
+
+To validate on Desktop, do the following:
1. Enable policy.
2. Open Start, click on the Power button, and verify "Restart" and "Update and restart" are not available.
-
-
+
+
+
Added in Windows 10, version 1703. Allows IT Admins to configure Start by hiding "Shut down" and "Update and shut down" from appearing in the Power button.
+
+
+Added in Windows 10, version 1703. Allows IT Admins to configure Start by hiding "Shut down" and "Update and shut down" from appearing in the Power button.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 (default) – False (do not hide).
- 1 - True (hide).
-
To validate on Desktop, do the following:
+
+
+To validate on Desktop, do the following:
1. Enable policy.
2. Open Start, click on the Power button, and verify "Shut down" and "Update and shut down" are not available.
-
-
+
+
+
Added in Windows 10, version 1703. Allows IT Admins to configure Start by hiding "Sign out" from appearing in the user tile.
+
+
+Added in Windows 10, version 1703. Allows IT Admins to configure Start by hiding "Sign out" from appearing in the user tile.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 (default) – False (do not hide).
- 1 - True (hide).
-
To validate on Desktop, do the following:
+
+
+To validate on Desktop, do the following:
1. Enable policy.
2. Open Start, click on the user tile, and verify "Sign out" is not available.
-
-
+
+
+
Added in Windows 10, version 1703. Allows IT Admins to configure Start by hiding "Sleep" from appearing in the Power button.
+
+
+Added in Windows 10, version 1703. Allows IT Admins to configure Start by hiding "Sleep" from appearing in the Power button.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 (default) – False (do not hide).
- 1 - True (hide).
-
To validate on Desktop, do the following:
+
+
+To validate on Desktop, do the following:
1. Enable policy.
2. Open Start, click on the Power button, and verify that "Sleep" is not available.
-
-
+
+
+
Added in Windows 10, version 1703. Allows IT Admins to configure Start by hiding "Switch account" from appearing in the user tile.
+
+
+Added in Windows 10, version 1703. Allows IT Admins to configure Start by hiding "Switch account" from appearing in the user tile.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 (default) – False (do not hide).
- 1 - True (hide).
-
To validate on Desktop, do the following:
+
+
+To validate on Desktop, do the following:
1. Enable policy.
2. Open Start, click on the user tile, and verify that "Switch account" is not available.
-
-
+
+
+
-
+
+
**Start/HideUserTile**
-
+
Home
@@ -1395,8 +1530,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1404,31 +1539,37 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy requires reboot to take effect.
-
Added in Windows 10, version 1703. Allows IT Admins to configure Start by hiding the user tile.
+Added in Windows 10, version 1703. Allows IT Admins to configure Start by hiding the user tile.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 (default) – False (do not hide).
- 1 - True (hide).
-
To validate on Desktop, do the following:
+
+
+To validate on Desktop, do the following:
1. Enable policy.
2. Log off.
3. Log in, and verify that the user tile is gone from Start.
-
-
+
+
+
-
+
+
**Start/ImportEdgeAssets**
-
+
Home
@@ -1450,8 +1591,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1459,32 +1600,36 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy requires reboot to take effect.
-
Added in Windows 10, version 1703. This policy imports Edge assets (e.g. .png/.jpg files) for secondary tiles into its local app data path which allows the StartLayout policy to pin Edge secondary tiles as weblink that tie to the image asset files.
+Added in Windows 10, version 1703. This policy imports Edge assets (e.g. .png/.jpg files) for secondary tiles into its local app data path which allows the StartLayout policy to pin Edge secondary tiles as weblink that tie to the image asset files.
> [!IMPORTANT]
> Please note that the import happens only when StartLayout policy is changed. So it is better to always change ImportEdgeAssets policy at the same time as StartLayout policy whenever there are Edge secondary tiles to be pinned from StartLayout policy.
-
The value set for this policy is an XML string containing Edge assets. For an example XML string, see [Add image for secondary Microsoft Edge tiles](https://docs.microsoft.com/en-us/windows/configuration/start-secondary-tiles).
+The value set for this policy is an XML string containing Edge assets. For an example XML string, see [Add image for secondary Microsoft Edge tiles](https://docs.microsoft.com/en-us/windows/configuration/start-secondary-tiles).
-
To validate on Desktop, do the following:
+
+
+To validate on Desktop, do the following:
1. Set policy with an XML for Edge assets.
2. Set StartLayout policy to anything so that it would trigger the Edge assets import.
3. Sign out/in.
4. Verify that all Edge assets defined in XML show up in %LOCALAPPDATA%\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState path.
-
-
+
+
+
Added in Windows 10, version 1703. Allows IT Admins to configure the taskbar by disabling pinning and unpinning apps on the taskbar.
+
+
+Added in Windows 10, version 1703. Allows IT Admins to configure the taskbar by disabling pinning and unpinning apps on the taskbar.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 (default) – False (pinning enabled).
- 1 - True (pinning disabled).
-
To validate on Desktop, do the following:
+
+
+To validate on Desktop, do the following:
1. Enable policy.
2. Right click on a program pinned to taskbar.
@@ -1532,13 +1681,15 @@ ms.date: 11/01/2017
4. Open Start and right click on one of the app list icons.
5. Verify that More->Pin to taskbar menu does not show.
-
-
+
+
+
-
+
+
**Start/StartLayout**
-
+
Home
@@ -1560,8 +1711,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1570,17 +1721,17 @@ ms.date: 11/01/2017
-
-
+
+
> [!IMPORTANT]
> Added in Windows 10 version 1703: In addition to being able to set this node on a per user-basis, it can now also be set on a per-device basis. For more information, see [Policy scope](./policy-configuration-service-provider.md#policy-scope)
-
Allows you to override the default Start layout and prevents the user from changing it. If both user and device policies are set, the user policy will be used. Apps pinned to the taskbar can also be changed with this policy
+Allows you to override the default Start layout and prevents the user from changing it. If both user and device policies are set, the user policy will be used. Apps pinned to the taskbar can also be changed with this policy
-
For further details on how to customize the Start layout, please see [Customize and export Start layout](https://docs.microsoft.com/en-us/windows/configuration/customize-and-export-start-layout) and [Configure Windows 10 taskbar](https://docs.microsoft.com/en-us/windows/configuration/configure-windows-10-taskbar).
+For further details on how to customize the Start layout, please see [Customize and export Start layout](https://docs.microsoft.com/en-us/windows/configuration/customize-and-export-start-layout) and [Configure Windows 10 taskbar](https://docs.microsoft.com/en-us/windows/configuration/configure-windows-10-taskbar).
-
-
+
+
Footnote:
@@ -1589,5 +1740,5 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
diff --git a/windows/client-management/mdm/policy-csp-storage.md b/windows/client-management/mdm/policy-csp-storage.md
index 3a559d0f2c..dbcdfe8bd5 100644
--- a/windows/client-management/mdm/policy-csp-storage.md
+++ b/windows/client-management/mdm/policy-csp-storage.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - Storage
@@ -15,23 +15,25 @@ ms.date: 11/01/2017
-
+
## Storage policies
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -62,36 +64,30 @@ ms.date: 11/01/2017
-
-
-This policy setting configures whether or not Windows will activate an Enhanced Storage device.
+
+
+Added in Windows 10, version 1709. Allows disk health model updates.
-If you enable this policy setting, Windows will not activate unactivated Enhanced Storage devices.
-If you disable or do not configure this policy setting, Windows will activate unactivated Enhanced Storage devices.
-
-> [!TIP]
-> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
+Value type is integer.
-> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
+
+
+The following list shows the supported values:
-> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
+- 0 - Do not allow
+- 1 (default) - Allow
-
-ADMX Info:
-- GP English name: *Do not allow Windows to activate Enhanced Storage devices*
-- GP name: *TCGSecurityActivationDisabled*
-- GP path: *System/Enhanced Storage Access*
-- GP ADMX file name: *enhancedstorage.admx*
+
+
-
-
-
-**Storage/AllowDiskHealthModelUpdates**
-
+
+**Storage/EnhancedStorageDevices**
+
+
Home
@@ -104,29 +100,49 @@ ADMX Info:
-
3
-
3
-
3
-
3
+
+
+
+
-
-
-
Added in Windows 10, version 1709. Allows disk health model updates.
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+> [!div class = "checklist"]
+> * Device
-
The following list shows the supported values:
+
-- 0 - Do not allow
-- 1 (default) - Allow
+
+
+This policy setting configures whether or not Windows will activate an Enhanced Storage device.
-
Value type is integer.
+If you enable this policy setting, Windows will not activate unactivated Enhanced Storage devices.
-
-
+If you disable or do not configure this policy setting, Windows will activate unactivated Enhanced Storage devices.
+
+
+> [!TIP]
+> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
+
+> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
+
+> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
+
+
+ADMX Info:
+- GP English name: *Do not allow Windows to activate Enhanced Storage devices*
+- GP name: *TCGSecurityActivationDisabled*
+- GP path: *System/Enhanced Storage Access*
+- GP ADMX file name: *enhancedstorage.admx*
+
+
+
Footnote:
@@ -135,5 +151,5 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md
index c688af26cd..f45d4b3ddc 100644
--- a/windows/client-management/mdm/policy-csp-system.md
+++ b/windows/client-management/mdm/policy-csp-system.md
@@ -6,16 +6,18 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - System
+> [!WARNING]
+> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
+
## System policies
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -95,29 +105,33 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy setting applies only to devices running Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education, Windows 10 Mobile, and Windows 10 Mobile Enterprise.
-
This policy setting determines whether users can access the Insider build controls in the Advanced Options for Windows Update. These controls are located under "Get Insider builds," and enable users to make their devices available for downloading and installing Windows preview software.
+This policy setting determines whether users can access the Insider build controls in the Advanced Options for Windows Update. These controls are located under "Get Insider builds," and enable users to make their devices available for downloading and installing Windows preview software.
-
If you enable or do not configure this policy setting, users can download and install Windows preview software on their devices. If you disable this policy setting, the item "Get Insider builds" will be unavailable.
+If you enable or do not configure this policy setting, users can download and install Windows preview software on their devices. If you disable this policy setting, the item "Get Insider builds" will be unavailable.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – Not allowed. The item "Get Insider builds" is unavailable, users are unable to make their devices available for preview software.
- 1 – Allowed. Users can make their devices available for downloading and installing preview software.
- 2 (default) – Not configured. Users can make their devices available for downloading and installing preview software.
-
-
+
+
+
Specifies whether set general purpose device to be in embedded mode.
+
+
+Specifies whether set general purpose device to be in embedded mode.
-
The following list shows the supported values:
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 (default) – Not allowed.
- 1 – Allowed.
-
Most restricted value is 0.
+
+
-
-
-
+
+
**System/AllowExperimentation**
-
+
Home
@@ -187,8 +205,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -196,28 +214,33 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> This policy is not supported in Windows 10, version 1607.
-
This policy setting determines the level that Microsoft can experiment with the product to study user preferences or device behavior.
+This policy setting determines the level that Microsoft can experiment with the product to study user preferences or device behavior.
-
The following list shows the supported values:
+
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 – Disabled.
- 1 (default) – Permits Microsoft to configure device settings only.
- 2 – Allows Microsoft to conduct full experimentations.
-
Added in Windows 10, version 1703. Boolean policy setting that determines whether Windows is allowed to download fonts and font catalog data from an online font provider. If you enable this setting, Windows periodically queries an online font provider to determine whether a new font catalog is available. Windows may also download font data if needed to format or render text. If you disable this policy setting, Windows does not connect to an online font provider and only enumerates locally-installed fonts.
+
+
+Added in Windows 10, version 1703. Boolean policy setting that determines whether Windows is allowed to download fonts and font catalog data from an online font provider. If you enable this setting, Windows periodically queries an online font provider to determine whether a new font catalog is available. Windows may also download font data if needed to format or render text. If you disable this policy setting, Windows does not connect to an online font provider and only enumerates locally-installed fonts.
-
Supported values:
+This MDM setting corresponds to the EnableFontProviders Group Policy setting. If both the Group Policy and the MDM settings are configured, the group policy setting takes precedence. If neither is configured, the behavior depends on a DisableFontProviders registry value. In server editions, this registry value is set to 1 by default, so the default behavior is false (disabled). In all other editions, the registry value is not set by default, so the default behavior is true (enabled).
-- false - No traffic to fs.microsoft.com and only locally-installed fonts are available.
-- true (default) - There may be network traffic to fs.microsoft.com and downloadable fonts are available to apps that support them.
-
-
This MDM setting corresponds to the EnableFontProviders Group Policy setting. If both the Group Policy and the MDM settings are configured, the group policy setting takes precedence. If neither is configured, the behavior depends on a DisableFontProviders registry value. In server editions, this registry value is set to 1 by default, so the default behavior is false (disabled). In all other editions, the registry value is not set by default, so the default behavior is true (enabled).
-
-
This setting is used by lower-level components for text display and fond handling and has not direct effect on web browsers, which may download web fonts used in web content.
+This setting is used by lower-level components for text display and fond handling and has not direct effect on web browsers, which may download web fonts used in web content.
> [!Note]
> Reboot is required after setting the policy; alternatively you can stop and restart the FontCache service.
-
To verify if System/AllowFontProviders is set to true:
+
+
+The following list shows the supported values:
+
+- 0 - false - No traffic to fs.microsoft.com and only locally-installed fonts are available.
+- 1 - true (default) - There may be network traffic to fs.microsoft.com and downloadable fonts are available to apps that support them.
+
+
+
+To verify if System/AllowFontProviders is set to true:
- After a client machine is rebooted, check whether there is any network traffic from client machine to fs.microsoft.com.
-
-
+
+
+
Specifies whether to allow app access to the Location service.
+
+
+Specifies whether to allow app access to the Location service.
-
The following list shows the supported values:
+
+Most restricted value is 0.
+
+While the policy is set to 0 (Force Location Off) or 2 (Force Location On), any Location service call from an app would trigger the value set by this policy.
+
+When switching the policy back from 0 (Force Location Off) or 2 (Force Location On) to 1 (User Control), the app reverts to its original Location service setting.
+
+For example, an app's original Location setting is Off. The administrator then sets the **AllowLocation** policy to 2 (Force Location On.) The Location service starts working for that app, overriding the original setting. Later, if the administrator switches the **AllowLocation** policy back to 1 (User Control), the app will revert to using its original setting of Off.
+
+
+
+The following list shows the supported values:
- 0 – Force Location Off. All Location Privacy settings are toggled off and greyed out. Users cannot change the settings, and no apps are allowed access to the Location service, including Cortana and Search.
- 1 (default) – Location service is allowed. The user has control and can change Location Privacy settings on or off.
- 2 – Force Location On. All Location Privacy settings are toggled on and greyed out. Users cannot change the settings and all consent permissions will be automatically suppressed.
-
Most restricted value is 0.
+
+
-
While the policy is set to 0 (Force Location Off) or 2 (Force Location On), any Location service call from an app would trigger the value set by this policy.
-
-
When switching the policy back from 0 (Force Location Off) or 2 (Force Location On) to 1 (User Control), the app reverts to its original Location service setting.
-
-
For example, an app's original Location setting is Off. The administrator then sets the **AllowLocation** policy to 2 (Force Location On.) The Location service starts working for that app, overriding the original setting. Later, if the administrator switches the **AllowLocation** policy back to 1 (User Control), the app will revert to using its original setting of Off.
-
-
-
Controls whether the user is allowed to use the storage card for device storage. This setting prevents programmatic access to the storage card.
+
+
+Controls whether the user is allowed to use the storage card for device storage. This setting prevents programmatic access to the storage card.
-
The following list shows the supported values:
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 – SD card use is not allowed and USB drives are disabled. This setting does not prevent programmatic access to the storage card.
- 1 (default) – Allow a storage card.
-
Allow the device to send diagnostic and usage telemetry data, such as Watson.
+
+
+Allow the device to send diagnostic and usage telemetry data, such as Watson.
-
The following tables describe the supported values:
+The following tables describe the supported values:
Windows 8.1 Values:
@@ -486,15 +524,17 @@ Windows 10 Values:
> If you are using Windows 8.1 MDM server and set a value of 0 using the legacy AllowTelemetry policy on a Windows 10 Mobile device, then the value is not respected and the telemetry level is silently set to level 1.
-
Most restricted value is 0.
+Most restricted value is 0.
+
+
+
-
-
-
+
+
**System/AllowUserToResetPhone**
-
+
Home
@@ -516,8 +556,8 @@ Windows 10 Values:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -525,24 +565,29 @@ Windows 10 Values:
-
-
-
Specifies whether to allow the user to factory reset the phone by using control panel and hardware key combination.
+
+
+Specifies whether to allow the user to factory reset the phone by using control panel and hardware key combination.
-
The following list shows the supported values:
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
+orted values:
- 0 – Not allowed.
- 1 (default) – Allowed to reset to factory default settings.
-
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -573,11 +618,11 @@ Windows 10 Values:
-
-
+
+
N/A
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -585,18 +630,63 @@ N/A
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP name: *POL_DriverLoadPolicy_Name*
- GP ADMX file name: *earlylauncham.admx*
-
-
+
+
+
-
+
+
+**System/DisableEnterpriseAuthProxy**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
3
+
3
+
3
+
3
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+This policy setting blocks the Connected User Experience and Telemetry service from automatically using an authenticated proxy to send data back to Microsoft on Windows 10. If you disable or do not configure this policy setting, the Connected User Experience and Telemetry service will automatically use an authenticated proxy to send data back to Microsoft. Enabling this policy will block the Connected User Experience and Telemetry service from automatically using an authenticated proxy.
+
+
+
+
+
+
+
**System/DisableOneDriveFileSync**
-
+
Added in Windows 10, version 1703. Allows IT Admins to prevent apps and features from working with files on OneDrive. If you enable this policy setting:
+
+
+Added in Windows 10, version 1703. Allows IT Admins to prevent apps and features from working with files on OneDrive. If you enable this policy setting:
* Users cannot access OneDrive from the OneDrive app or file picker.
* Microsoft Store apps cannot access OneDrive using the WinRT API.
@@ -637,26 +727,32 @@ ADMX Info:
* OneDrive files are not kept in sync with the cloud.
* Users cannot automatically upload photos and videos from the camera roll folder.
-
If you disable or do not configure this policy setting, apps and features can work with OneDrive file storage.
+If you disable or do not configure this policy setting, apps and features can work with OneDrive file storage.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 (default) – False (sync enabled).
- 1 – True (sync disabled).
-
To validate on Desktop, do the following:
+
+
+To validate on Desktop, do the following:
1. Enable policy.
2. Restart machine.
3. Verify that OneDrive.exe is not running in Task Manager.
-
-
+
+
+
-
+
+
**System/DisableSystemRestore**
-
+
Home
@@ -678,8 +774,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -687,8 +783,8 @@ ADMX Info:
-
-
+
+
Allows you to disable System Restore.
This policy setting allows you to turn off System Restore.
@@ -701,7 +797,7 @@ If you disable or do not configure this policy setting, users can perform System
Also, see the "Turn off System Restore configuration" policy setting. If the "Turn off System Restore" policy setting is disabled or not configured, the "Turn off System Restore configuration" policy setting is used to determine whether the option to configure System Restore is available.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -709,20 +805,72 @@ Also, see the "Turn off System Restore configuration" policy setting. If the "Tu
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Turn off System Restore*
- GP name: *SR_DisableSR*
- GP path: *System/System Restore*
- GP ADMX file name: *systemrestore.admx*
-
-
+
+
+
-
+
+
+**System/FeedbackHubAlwaysSaveDiagnosticsLocally**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
4
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Added in Windows 10, next major update. When filing feedback in the Feedback Hub, diagnostic logs are collected for certain types of feedback. We now offer the option for users to save it locally, in addition to sending it to Microsoft. This policy will allow enterprises to mandate that all diagnostics are saved locally for use in internal investigations.
+
+
+
+The following list shows the supported values:
+
+- 0 (default) - False. The Feedback Hub will not always save a local copy of diagnostics that may be created when a feedback is submitted. The user will have the option to do so.
+- 1 - True. The Feedback Hub should always save a local copy of diagnostics that may be created when a feedback is submitted.
+
+
+
+
+
+
+
**System/LimitEnhancedDiagnosticDataWindowsAnalytics**
-
+
This policy setting, in combination with the System/AllowTelemetry
+
+
+This policy setting, in combination with the System/AllowTelemetry
policy setting, enables organizations to send Microsoft a specific set of diagnostic data for IT insights via Windows Analytics services.
-
To enable this behavior you must complete two steps:
+To enable this behavior you must complete two steps:
Enable this policy setting
Set Allow Telemetry to level 2 (Enhanced)
-
When you configure these policy settings, a basic level of diagnostic data plus additional events that are required for Windows Analytics are sent to Microsoft. These events are documented here: [Windows 10, version 1709 enhanced telemetry events and fields used by Windows Analytics](https://go.microsoft.com/fwlink/?linkid=847594).
+When you configure these policy settings, a basic level of diagnostic data plus additional events that are required for Windows Analytics are sent to Microsoft. These events are documented here: [Windows 10, version 1709 enhanced telemetry events and fields used by Windows Analytics](https://go.microsoft.com/fwlink/?linkid=847594).
-
Enabling enhanced diagnostic data in the System/AllowTelemetry policy in combination with not configuring this policy will also send the required events for Windows Analytics, plus additional enhanced level telemetry data. This setting has no effect on computers configured to send full, basic or security level diagnostic data to Microsoft.
+Enabling enhanced diagnostic data in the System/AllowTelemetry policy in combination with not configuring this policy will also send the required events for Windows Analytics, plus additional enhanced level telemetry data. This setting has no effect on computers configured to send full, basic or security level diagnostic data to Microsoft.
-
If you disable or do not configure this policy setting, then the level of diagnostic data sent to Microsoft is determined by the System/AllowTelemetry policy.
+If you disable or do not configure this policy setting, then the level of diagnostic data sent to Microsoft is determined by the System/AllowTelemetry policy.
+
+
+
-
-
Allows you to specify the fully qualified domain name (FQDN) or IP address of a proxy server to forward Connected User Experiences and Telemetry requests. The format for this setting is *<server>:<port>*. The connection is made over a Secure Sockets Layer (SSL) connection. If the named proxy fails, or if there is no proxy specified when this policy is enabled, the Connected User Experiences and Telemetry data will not be transmitted and will remain on the local device.
+
+
+Allows you to specify the fully qualified domain name (FQDN) or IP address of a proxy server to forward Connected User Experiences and Telemetry requests. The format for this setting is *<server>:<port>*. The connection is made over a Secure Sockets Layer (SSL) connection. If the named proxy fails, or if there is no proxy specified when this policy is enabled, the Connected User Experiences and Telemetry data will not be transmitted and will remain on the local device.
-
If you disable or do not configure this policy setting, Connected User Experiences and Telemetry will go to Microsoft using the default proxy configuration.
+If you disable or do not configure this policy setting, Connected User Experiences and Telemetry will go to Microsoft using the default proxy configuration.
-
-
+
+
Footnote:
@@ -823,7 +973,7 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
## System policies that can be set using Exchange Active Sync (EAS)
diff --git a/windows/client-management/mdm/policy-csp-systemservices.md b/windows/client-management/mdm/policy-csp-systemservices.md
new file mode 100644
index 0000000000..7071a57f68
--- /dev/null
+++ b/windows/client-management/mdm/policy-csp-systemservices.md
@@ -0,0 +1,311 @@
+---
+title: Policy CSP - SystemServices
+description: Policy CSP - SystemServices
+ms.author: maricia
+ms.topic: article
+ms.prod: w10
+ms.technology: windows
+author: nickbrower
+ms.date: 01/30/2018
+---
+
+# Policy CSP - SystemServices
+
+> [!WARNING]
+> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
+
+
+
+
+
+## SystemServices policies
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Added in Windows 10, next major update. This setting determines whether the service's start type is Automaic(2), Manual(3), Disabled(4). Default: Manual.
+
+
+
+
+
+
+
+**SystemServices/ConfigureHomeGroupProviderServiceStartupMode**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Added in Windows 10, next major update. This setting determines whether the service's start type is Automaic(2), Manual(3), Disabled(4). Default: Manual.
+
+
+
+
+
+
+
+**SystemServices/ConfigureXboxAccessoryManagementServiceStartupMode**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Added in Windows 10, next major update. This setting determines whether the service's start type is Automaic(2), Manual(3), Disabled(4). Default: Manual.
+
+
+
+
+
+
+
+**SystemServices/ConfigureXboxLiveAuthManagerServiceStartupMode**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Added in Windows 10, next major update. This setting determines whether the service's start type is Automaic(2), Manual(3), Disabled(4). Default: Manual.
+
+
+
+
+
+
+
+**SystemServices/ConfigureXboxLiveGameSaveServiceStartupMode**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Added in Windows 10, next major update. This setting determines whether the service's start type is Automaic(2), Manual(3), Disabled(4). Default: Manual.
+
+
+
+
+
+
+
+**SystemServices/ConfigureXboxLiveNetworkingServiceStartupMode**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Added in Windows 10, next major update. This setting determines whether the service's start type is Automaic(2), Manual(3), Disabled(4). Default: Manual.
+
+
+
+
+
+Footnote:
+
+- 1 - Added in Windows 10, version 1607.
+- 2 - Added in Windows 10, version 1703.
+- 3 - Added in Windows 10, version 1709.
+
+
+
diff --git a/windows/client-management/mdm/policy-csp-taskscheduler.md b/windows/client-management/mdm/policy-csp-taskscheduler.md
new file mode 100644
index 0000000000..e55edde857
--- /dev/null
+++ b/windows/client-management/mdm/policy-csp-taskscheduler.md
@@ -0,0 +1,81 @@
+---
+title: Policy CSP - TaskScheduler
+description: Policy CSP - TaskScheduler
+ms.author: maricia
+ms.topic: article
+ms.prod: w10
+ms.technology: windows
+author: nickbrower
+ms.date: 01/30/2018
+---
+
+# Policy CSP - TaskScheduler
+
+> [!WARNING]
+> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
+
+
+
+
+
+## TaskScheduler policies
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Added in Windows 10, next major update. This setting determines whether the specific task is enabled (1) or disabled (0). Default: Enabled.
+
+
+
+
+
+Footnote:
+
+- 1 - Added in Windows 10, version 1607.
+- 2 - Added in Windows 10, version 1703.
+- 3 - Added in Windows 10, version 1709.
+
+
+
diff --git a/windows/client-management/mdm/policy-csp-textinput.md b/windows/client-management/mdm/policy-csp-textinput.md
index 3dae6dd1e7..ef51165474 100644
--- a/windows/client-management/mdm/policy-csp-textinput.md
+++ b/windows/client-management/mdm/policy-csp-textinput.md
@@ -6,16 +6,18 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - TextInput
+> [!WARNING]
+> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
+
## TextInput policies
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -95,28 +102,32 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> The policy is only enforced in Windows 10 for desktop.
-
Allows the user to turn on and off the logging for incorrect conversion and saving auto-tuning result to a file and history-based predictive input.
+Allows the user to turn on and off the logging for incorrect conversion and saving auto-tuning result to a file and history-based predictive input.
-
The following list shows the supported values:
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
Most restricted value is 0.
+
+
-
-
-
+
+
**TextInput/AllowIMENetworkAccess**
-
+
Home
@@ -138,8 +149,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -147,28 +158,32 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> The policy is only enforced in Windows 10 for desktop.
-
Allows the user to turn on Open Extended Dictionary, Internet search integration, or cloud candidate features to provide input suggestions that do not exist in the device's local dictionary.
+Allows the user to turn on Open Extended Dictionary, Internet search integration, or cloud candidate features to provide input suggestions that do not exist in the device's local dictionary.
-
The following list shows the supported values:
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
Most restricted value is 0.
+
+
-
-
-
+
+
**TextInput/AllowInputPanel**
-
+
Home
@@ -190,8 +205,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -199,28 +214,32 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> The policy is only enforced in Windows 10 for desktop.
-
Allows the IT admin to disable the touch/handwriting keyboard on Windows.
+Allows the IT admin to disable the touch/handwriting keyboard on Windows.
-
The following list shows the supported values:
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -251,28 +270,33 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> The policy is only enforced in Windows 10 for desktop.
-
Allows the Japanese IME surrogate pair characters.
+Allows the Japanese IME surrogate pair characters.
-
The following list shows the supported values:
+
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -303,28 +327,32 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> The policy is only enforced in Windows 10 for desktop.
-
Allows Japanese Ideographic Variation Sequence (IVS) characters.
+Allows Japanese Ideographic Variation Sequence (IVS) characters.
-
The following list shows the supported values:
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -355,28 +383,32 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> The policy is only enforced in Windows 10 for desktop.
-
Allows the Japanese non-publishing standard glyph.
+Allows the Japanese non-publishing standard glyph.
-
The following list shows the supported values:
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -407,28 +439,32 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> The policy is only enforced in Windows 10 for desktop.
-
Allows the Japanese user dictionary.
+Allows the Japanese user dictionary.
-
The following list shows the supported values:
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -459,42 +495,50 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> The policy is only enforced in Windows 10 for desktop.
-
Added in Windows 10, version 1703. Specifies whether text prediction is enabled or disabled for the on-screen keyboard, touch keyboard, and handwriting recognition tool. When this policy is set to disabled, text prediction is disabled.
+Added in Windows 10, version 1703. Specifies whether text prediction is enabled or disabled for the on-screen keyboard, touch keyboard, and handwriting recognition tool. When this policy is set to disabled, text prediction is disabled.
-
The following list shows the supported values:
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 – Disabled.
- 1 (default) – Enabled.
-
Most restricted value is 0.
-
-
To validate that text prediction is disabled on Windows 10 for desktop, do the following:
+
+
+To validate that text prediction is disabled on Windows 10 for desktop, do the following:
1. Search for and launch the on-screen keyboard. Verify that text prediction is disabled by typing some text. Text prediction on the keyboard will be disabled even if the “Use Text Prediction” setting is enabled from the options button.
2. Launch the input panel/touch keyboard by touching a text input field or launching it from the taskbar. Verify that text prediction is disabled by typing some text. Text prediction on the keyboard will be disabled even if the “Show text suggestions as I type” setting is enabled in the Settings app.
3. Launch the handwriting tool from the touch keyboard. Verify that text prediction is disabled when you write using the tool.
-
-
+
+
+
-
+
+
**TextInput/AllowKoreanExtendedHanja**
-
-
This policy has been deprecated.
+
+This policy has been deprecated.
+
+
+
-
-
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -525,28 +569,88 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> The policy is only enforced in Windows 10 for desktop.
-
Allows the uninstall of language features, such as spell checkers, on a device.
+Allows the uninstall of language features, such as spell checkers, on a device.
-
The following list shows the supported values:
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Added in Windows 10, next major update. This policy allows the IT admin to enable the touch keyboard to automatically show up when the device is in the desktop mode.
+
+The touch keyboard is enabled in both the tablet and desktop mode. In the tablet mode, when you touch a textbox, the touch keyboard automatically shows up.
+But in the desktop mode, by default, the touch keyboard does not automatically show up when you touch a textbox. The user must click the system tray to enable the touch keyboard.
+When this policy is enabled, the touch keyboard automatically shows up when the device is in the desktop mode.
+
+This policy corresponds to "Show the touch keyboard when not in tablet mode and there's no keyboard attached" in the Settings app.
+
+
+
+The following list shows the supported values:
+
+- 0 (default) - Disabled.
+- 1 - Enabled.
+
+
+
+
+
+
+
**TextInput/ExcludeJapaneseIMEExceptJIS0208**
-
+
Home
@@ -568,8 +672,8 @@ ms.date: 11/01/2017
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -577,26 +681,30 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> The policy is only enforced in Windows 10 for desktop.
-
Allows the users to restrict character code range of conversion by setting the character filter.
+Allows the users to restrict character code range of conversion by setting the character filter.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 (default) – No characters are filtered.
- 1 – All characters except JIS0208 are filtered.
-
-
+
+
+
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -627,26 +735,30 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> The policy is only enforced in Windows 10 for desktop.
-
Allows the users to restrict character code range of conversion by setting the character filter.
+Allows the users to restrict character code range of conversion by setting the character filter.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 (default) – No characters are filtered.
- 1 – All characters except JIS0208 and EUDC are filtered.
-
-
+
+
+
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -677,21 +789,23 @@ ms.date: 11/01/2017
-
-
+
+
> [!NOTE]
> The policy is only enforced in Windows 10 for desktop.
-
Allows the users to restrict character code range of conversion by setting the character filter.
+Allows the users to restrict character code range of conversion by setting the character filter.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 (default) – No characters are filtered.
- 1 – All characters except ShiftJIS are filtered.
-
-
+
+
Footnote:
@@ -700,7 +814,7 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
## TextInput policies supported by Microsoft Surface Hub
diff --git a/windows/client-management/mdm/policy-csp-timelanguagesettings.md b/windows/client-management/mdm/policy-csp-timelanguagesettings.md
index a2ad26f40c..c926c03e45 100644
--- a/windows/client-management/mdm/policy-csp-timelanguagesettings.md
+++ b/windows/client-management/mdm/policy-csp-timelanguagesettings.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - TimeLanguageSettings
@@ -15,7 +15,7 @@ ms.date: 11/01/2017
-
+
## TimeLanguageSettings policies
Allows for the configuration of the default clock setting to be the 24 hour format. Selecting 'Set 24 hour Clock' enables this setting. Selecting 'Locale default setting' uses the default clock as prescribed by the current locale setting.
+
+
+Allows for the configuration of the default clock setting to be the 24 hour format. Selecting 'Set 24 hour Clock' enables this setting. Selecting 'Locale default setting' uses the default clock as prescribed by the current locale setting.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – Locale default setting.
- 1 (default) – Set 24 hour clock.
-
-
+
+
Footnote:
@@ -78,13 +82,5 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
-
-
-## TimeLanguageSettings policies supported by Microsoft Surface Hub
-
-- [TimeLanguageSettings/Set24HourClock](#timelanguagesettings-set24hourclock)
-- [TimeLanguageSettings/SetCountry](#timelanguagesettings-setcountry)
-- [TimeLanguageSettings/SetLanguage](#timelanguagesettings-setlanguage)
-
+
diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md
index 9edfd3e3e2..47a34b96dd 100644
--- a/windows/client-management/mdm/policy-csp-update.md
+++ b/windows/client-management/mdm/policy-csp-update.md
@@ -6,16 +6,18 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - Update
+> [!WARNING]
+> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
+
## Update policies
Added in Windows 10, version 1607. Allows the IT admin (when used with **Update/ActiveHoursStart**) to manage a range of active hours where update reboots are not scheduled. This value sets the end time. There is a 12 hour maximum from start time.
+
+
+Added in Windows 10, version 1607. Allows the IT admin (when used with **Update/ActiveHoursStart**) to manage a range of active hours where update reboots are not scheduled. This value sets the end time. There is a 12 hour maximum from start time.
> [!NOTE]
> The default maximum difference from start time has been increased to 18 in Windows 10, version 1703. In this version of Windows 10, the maximum range of active hours can now be configured. See **Update/ActiveHoursMaxRange** below for more information.
-
Supported values are 0-23, where 0 is 12 AM, 1 is 1 AM, etc.
+Supported values are 0-23, where 0 is 12 AM, 1 is 1 AM, etc.
-
The default is 17 (5 PM).
+The default is 17 (5 PM).
+
+
+
-
-
Added in Windows 10, version 1703. Allows the IT admin to specify the max active hours range. This value sets max number of active hours from start time.
+
+
+Added in Windows 10, version 1703. Allows the IT admin to specify the max active hours range. This value sets max number of active hours from start time.
-
Supported values are 8-18.
+Supported values are 8-18.
-
The default value is 18 (hours).
+The default value is 18 (hours).
+
+
+
-
-
Added in Windows 10, version 1607. Allows the IT admin (when used with **Update/ActiveHoursEnd**) to manage a range of hours where update reboots are not scheduled. This value sets the start time. There is a 12 hour maximum from end time.
+
+
+Added in Windows 10, version 1607. Allows the IT admin (when used with **Update/ActiveHoursEnd**) to manage a range of hours where update reboots are not scheduled. This value sets the start time. There is a 12 hour maximum from end time.
> [!NOTE]
> The default maximum difference from end time has been increased to 18 in Windows 10, version 1703. In this version of Windows 10, the maximum range of active hours can now be configured. See **Update/ActiveHoursMaxRange** above for more information.
-
Supported values are 0-23, where 0 is 12 AM, 1 is 1 AM, etc.
+Supported values are 0-23, where 0 is 12 AM, 1 is 1 AM, etc.
-
The default value is 8 (8 AM).
+The default value is 8 (8 AM).
+
+
+
-
-
Enables the IT admin to manage automatic update behavior to scan, download, and install updates.
+
+
+Enables the IT admin to manage automatic update behavior to scan, download, and install updates.
-
Supported operations are Get and Replace.
+Supported operations are Get and Replace.
-
The following list shows the supported values:
+
+> [!IMPORTANT]
+> This option should be used only for systems under regulatory compliance, as you will not get security updates as well.
+
+
+If the policy is not configured, end-users get the default behavior (Auto install and restart).
+
+
+
+The following list shows the supported values:
- 0 – Notify the user before downloading the update. This policy is used by the enterprise who wants to enable the end-users to manage data usage. With this option users are notified when there are updates that apply to the device and are ready for download. Users can download and install the updates from the Windows Update control panel.
- 1 – Auto install the update and then notify the user to schedule a device restart. Updates are downloaded automatically on non-metered networks and installed during "Automatic Maintenance" when the device is not in use and is not running on battery power. If automatic maintenance is unable to install updates for two days, Windows Update will install updates immediately. If the installation requires a restart, the end-user is prompted to schedule the restart time. The end-user has up to seven days to schedule the restart and after that, a restart of the device is forced. Enabling the end-user to control the start time reduces the risk of accidental data loss caused by applications that do not shutdown properly on restart.
@@ -350,19 +375,15 @@ ms.date: 11/01/2017
- 4 – Auto install and restart without end-user control. Updates are downloaded automatically on non-metered networks and installed during "Automatic Maintenance" when the device is not in use and is not running on battery power. If automatic maintenance is unable to install updates for two days, Windows Update will install updates right away. If a restart is required, then the device is automatically restarted when the device is not actively being used. This setting option also sets the end-user control panel to read-only.
- 5 – Turn off automatic updates.
-> [!IMPORTANT]
-> This option should be used only for systems under regulatory compliance, as you will not get security updates as well.
-
+
+
-
If the policy is not configured, end-users get the default behavior (Auto install and restart).
-
-
-
Added in Windows 10, version 1709. Option to download updates automatically over metered connections (off by default). Value type is integer.
-
-- 0 (default) - Not allowed
-- 1 - Allowed
+
+
+Added in Windows 10, version 1709. Option to download updates automatically over metered connections (off by default). Value type is integer.
A significant number of devices primarily use cellular data and do not have Wi-Fi access, which leads to a lower number of devices getting updates. Since a large number of devices have large data plans or unlimited data, this policy can unblock devices from getting updates.
This policy is accessible through the Update setting in the user interface or Group Policy.
-
-
+
+
+The following list shows the supported values:
+
+- 0 (default) - Not allowed
+- 1 - Allowed
+
+
+
+
-
+
+
**Update/AllowMUUpdateService**
-
+
Home
@@ -432,8 +459,8 @@ This policy is accessible through the Update setting in the user interface or Gr
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -441,22 +468,26 @@ This policy is accessible through the Update setting in the user interface or Gr
-
-
-
Added in Windows 10, version 1607. Allows the IT admin to manage whether to scan for app updates from Microsoft Update.
+
+
+Added in Windows 10, version 1607. Allows the IT admin to manage whether to scan for app updates from Microsoft Update.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – Not allowed or not configured.
- 1 – Allowed. Accepts updates received through Microsoft Update.
-
-
+
+
+
@@ -478,8 +509,8 @@ This policy is accessible through the Update setting in the user interface or Gr
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -487,26 +518,30 @@ This policy is accessible through the Update setting in the user interface or Gr
-
-
-
Allows the IT admin to manage whether Automatic Updates accepts updates signed by entities other than Microsoft when the update is found at the UpdateServiceUrl location. This policy supports using WSUS for 3rd party software and patch distribution.
+
+
+Allows the IT admin to manage whether Automatic Updates accepts updates signed by entities other than Microsoft when the update is found at the UpdateServiceUrl location. This policy supports using WSUS for 3rd party software and patch distribution.
-
Supported operations are Get and Replace.
+Supported operations are Get and Replace.
-
The following list shows the supported values:
+This policy is specific to desktop and local publishing via WSUS for 3rd party updates (binaries and updates not hosted on Microsoft Update) and allows IT to manage whether Automatic Updates accepts updates signed by entities other than Microsoft when the update is found on an intranet Microsoft update service location.
+
+
+
+The following list shows the supported values:
- 0 – Not allowed or not configured. Updates from an intranet Microsoft update service location must be signed by Microsoft.
- 1 – Allowed. Accepts updates received through an intranet Microsoft update service location, if they are signed by a certificate found in the "Trusted Publishers" certificate store of the local computer.
-
This policy is specific to desktop and local publishing via WSUS for 3rd party updates (binaries and updates not hosted on Microsoft Update) and allows IT to manage whether Automatic Updates accepts updates signed by entities other than Microsoft when the update is found on an intranet Microsoft update service location.
+
+
-
-
-
+
+
**Update/AllowUpdateService**
-
+
Home
@@ -528,8 +563,8 @@ This policy is accessible through the Update setting in the user interface or Gr
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -537,29 +572,33 @@ This policy is accessible through the Update setting in the user interface or Gr
-
-
-
Specifies whether the device could use Microsoft Update, Windows Server Update Services (WSUS), or Microsoft Store.
+
+
+Specifies whether the device could use Microsoft Update, Windows Server Update Services (WSUS), or Microsoft Store.
-
Even when Windows Update is configured to receive updates from an intranet update service, it will periodically retrieve information from the public Windows Update service to enable future connections to Windows Update, and other services like Microsoft Update or the Microsoft Store
+Even when Windows Update is configured to receive updates from an intranet update service, it will periodically retrieve information from the public Windows Update service to enable future connections to Windows Update, and other services like Microsoft Update or the Microsoft Store
-
Enabling this policy will disable that functionality, and may cause connection to public services such as the Microsoft Store to stop working.
-
-
The following list shows the supported values:
-
-- 0 – Update service is not allowed.
-- 1 (default) – Update service is allowed.
+Enabling this policy will disable that functionality, and may cause connection to public services such as the Microsoft Store to stop working.
> [!NOTE]
> This policy applies only when the desktop or device is configured to connect to an intranet update service using the "Specify intranet Microsoft update service location" policy.
-
-
+
+
+The following list shows the supported values:
+
+- 0 – Update service is not allowed.
+- 1 (default) – Update service is allowed.
+
+
+
+
@@ -581,8 +620,8 @@ This policy is accessible through the Update setting in the user interface or Gr
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -590,21 +629,23 @@ This policy is accessible through the Update setting in the user interface or Gr
-
-
-
Added in Windows 10, version 1703. This policy defines the deadline in days after which a reboot for updates will become mandatory.
+
+
+Added in Windows 10, version 1703. This policy defines the deadline in days after which a reboot for updates will become mandatory.
-
Supported values are 2-30 days.
+Supported values are 2-30 days.
-
The default value is 7 days.
+The default value is 7 days.
+
+
+
-
-
@@ -626,8 +667,8 @@ This policy is accessible through the Update setting in the user interface or Gr
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -635,21 +676,25 @@ This policy is accessible through the Update setting in the user interface or Gr
-
-
-
Added in Windows 10, version 1703. Allows the IT Admin to specify the period for auto-restart reminder notifications.
+
+
+Added in Windows 10, version 1703. Allows the IT Admin to specify the period for auto-restart reminder notifications.
-
Supported values are 15, 30, 60, 120, and 240 (minutes).
+The default value is 15 (minutes).
-
The default value is 15 (minutes).
+
+
+Supported values are 15, 30, 60, 120, and 240 (minutes).
+
+
+
-
-
@@ -671,8 +716,8 @@ This policy is accessible through the Update setting in the user interface or Gr
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -680,22 +725,26 @@ This policy is accessible through the Update setting in the user interface or Gr
-
-
-
Added in Windows 10, version 1703. Allows the IT Admin to specify the method by which the auto-restart required notification is dismissed.
+
+
+Added in Windows 10, version 1703. Allows the IT Admin to specify the method by which the auto-restart required notification is dismissed.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 1 (default) – Auto Dismissal.
- 2 – User Dismissal.
-
-
+
+
+
-
+
+
**Update/BranchReadinessLevel**
-
+
Home
@@ -717,8 +766,8 @@ This policy is accessible through the Update setting in the user interface or Gr
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -726,11 +775,13 @@ This policy is accessible through the Update setting in the user interface or Gr
-
-
-
Added in Windows 10, version 1607. Allows the IT admin to set which branch a device receives their updates from.
+
+
+Added in Windows 10, version 1607. Allows the IT admin to set which branch a device receives their updates from.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 2 {0x2} - Windows Insider build - Fast (added in Windows 10, version 1709)
- 4 {0x4} - Windows Insider build - Slow (added in Windows 10, version 1709)
@@ -738,13 +789,49 @@ This policy is accessible through the Update setting in the user interface or Gr
- 16 {0x10} - (default) Semi-annual Channel (Targeted). Device gets all applicable feature updates from Semi-annual Channel (Targeted).
- 32 {0x20} - Semi-annual Channel. Device gets feature updates from Semi-annual Channel.
-
-
+
+
+
+
+
+
+Added in Windows 10, next major update. Enable IT admin to configure feature update uninstall period. Values range 2 - 60 days. Default is 10 days.
+
+
+
+
+
+
+
**Update/DeferFeatureUpdatesPeriodInDays**
-
+
Home
@@ -766,8 +853,8 @@ This policy is accessible through the Update setting in the user interface or Gr
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -775,24 +862,26 @@ This policy is accessible through the Update setting in the user interface or Gr
-
-
-
Since this policy is not blocked, you will not get a failure message when you use it to configure a Windows 10 Mobile device. However, the policy will not take effect.
+
+
+Since this policy is not blocked, you will not get a failure message when you use it to configure a Windows 10 Mobile device. However, the policy will not take effect.
-
Added in Windows 10, version 1607. Defers Feature Updates for the specified number of days.
+Added in Windows 10, version 1607. Defers Feature Updates for the specified number of days.
-
Supported values are 0-365 days.
+Supported values are 0-365 days.
> [!IMPORTANT]
> The default maximum number of days to defer an update has been increased from 180 (Windows 10, version 1607) to 365 in Windows 10, version 1703.
-
-
+
+
+
@@ -814,8 +903,8 @@ This policy is accessible through the Update setting in the user interface or Gr
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -823,19 +912,21 @@ This policy is accessible through the Update setting in the user interface or Gr
-
-
-
Added in Windows 10, version 1607. Defers Quality Updates for the specified number of days.
+
+
+Added in Windows 10, version 1607. Defers Quality Updates for the specified number of days.
-
Supported values are 0-30.
+Supported values are 0-30.
+
+
+
-
-
-
+
+
**Update/DeferUpdatePeriod**
-
+
Home
@@ -857,8 +948,8 @@ This policy is accessible through the Update setting in the user interface or Gr
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -866,24 +957,24 @@ This policy is accessible through the Update setting in the user interface or Gr
-
-
+
+
> [!NOTE]
> Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](device-update-management.md#windows10version1607forupdatemanagement). You can continue to use DeferUpdatePeriod for Windows 10, version 1511 devices.
-
Allows IT Admins to specify update delays for up to 4 weeks.
+Allows IT Admins to specify update delays for up to 4 weeks.
-
Supported values are 0-4, which refers to the number of weeks to defer updates.
+Supported values are 0-4, which refers to the number of weeks to defer updates.
-
In Windows 10 Mobile Enterprise version 1511 devices set to automatic updates, for DeferUpdatePeriod to work, you must set the following:
+In Windows 10 Mobile Enterprise version 1511 devices set to automatic updates, for DeferUpdatePeriod to work, you must set the following:
- Update/RequireDeferUpgrade must be set to 1
- System/AllowTelemetry must be set to 1 or higher
-
If the "Specify intranet Microsoft update service location" policy is enabled, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect.
+If the "Specify intranet Microsoft update service location" policy is enabled, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect.
-
If the Allow Telemetry policy is enabled and the Options value is set to 0, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect.
+If the Allow Telemetry policy is enabled and the Options value is set to 0, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect.
OS upgrade:
- Maximum deferral: 8 months
@@ -963,13 +1054,15 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-->
-
-
+
+
+
-
+
+
**Update/DeferUpgradePeriod**
-
+
Home
@@ -991,8 +1084,8 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1000,29 +1093,31 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
+
+
> [!NOTE]
> Since this policy is not blocked, you will not get a failure message when you use it to configure a Windows 10 Mobile device. However, the policy will not take effect.
>
> Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](device-update-management.md#windows10version1607forupdatemanagement). You can continue to use DeferUpgradePeriod for Windows 10, version 1511 devices.
-
Allows IT Admins to specify additional upgrade delays for up to 8 months.
+Allows IT Admins to specify additional upgrade delays for up to 8 months.
-
Supported values are 0-8, which refers to the number of months to defer upgrades.
+Supported values are 0-8, which refers to the number of months to defer upgrades.
-
If the "Specify intranet Microsoft update service location" policy is enabled, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect.
+If the "Specify intranet Microsoft update service location" policy is enabled, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect.
-
If the "Allow Telemetry" policy is enabled and the Options value is set to 0, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect.
+If the "Allow Telemetry" policy is enabled and the Options value is set to 0, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect.
+
+
+
-
-
-
+
+
**Update/DetectionFrequency**
-
+
Home
@@ -1044,8 +1139,8 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1053,17 +1148,19 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
-
Added in Windows 10, version 1703. Specifies the scan frequency from every 1 - 22 hours. Default is 22 hours.
+
+
+Added in Windows 10, version 1703. Specifies the scan frequency from every 1 - 22 hours. Default is 22 hours.
+
+
+
-
-
-
+
+
**Update/DisableDualScan**
-
+
Home
@@ -1085,8 +1182,8 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1094,26 +1191,32 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
-
Added in Windows 10, version 1709, but was added to 1607 and 1703 service releases. Do not allow update deferral policies to cause scans against Windows Update. If this policy is not enabled, then configuring deferral policies will result in the client unexpectedly scanning Windows update. With the policy enabled, those scans are prevented, and users can configure deferral policies as much as they like.
+
+
+Added in Windows 10, version 1709, but was added to 1607 and 1703 service releases. Do not allow update deferral policies to cause scans against Windows Update. If this policy is not enabled, then configuring deferral policies will result in the client unexpectedly scanning Windows update. With the policy enabled, those scans are prevented, and users can configure deferral policies as much as they like.
-
For more information about dual scan, see [Demystifying "Dual Scan"](https://blogs.technet.microsoft.com/wsus/2017/05/05/demystifying-dual-scan/) and [Improving Dual Scan on 1607](https://blogs.technet.microsoft.com/wsus/2017/08/04/improving-dual-scan-on-1607/).
+For more information about dual scan, see [Demystifying "Dual Scan"](https://blogs.technet.microsoft.com/wsus/2017/05/05/demystifying-dual-scan/) and [Improving Dual Scan on 1607](https://blogs.technet.microsoft.com/wsus/2017/08/04/improving-dual-scan-on-1607/).
+
+This is the same as the Group Policy in Windows Components > Window Update "Do not allow update deferral policies to cause scans against Windows Update."
+
+Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
+
+
+The following list shows the supported values:
- 0 - allow scan against Windows Update
-- 1 - do not allow update deferral policies to cause scans against Windows Update
+- 1 - do not allow update deferral policies to cause scans against Windows Update
-
This is the same as the Group Policy in Windows Components > Window Update "Do not allow update deferral policies to cause scans against Windows Update."
+
+
-
Value type is integer. Supported operations are Add, Get, Replace, and Delete.
-
-
-
-
+
+
**Update/EngagedRestartDeadline**
-
+
Home
@@ -1135,8 +1238,8 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1144,21 +1247,23 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
-
Added in Windows 10, version 1703. Allows the IT Admin to specify the deadline in days before automatically scheduling and executing a pending restart outside of active hours. The deadline can be set between 2 and 30 days from the time the restart becomes pending. If configured, the pending restart will transition from Auto-restart to Engaged restart (pending user schedule) to be automatically executed within the specified period. If no deadline is specified or deadline is set to 0, the restart will not be automatically executed and will remain Engaged restart (pending user scheduling).
+
+
+Added in Windows 10, version 1703. Allows the IT Admin to specify the deadline in days before automatically scheduling and executing a pending restart outside of active hours. The deadline can be set between 2 and 30 days from the time the restart becomes pending. If configured, the pending restart will transition from Auto-restart to Engaged restart (pending user schedule) to be automatically executed within the specified period. If no deadline is specified or deadline is set to 0, the restart will not be automatically executed and will remain Engaged restart (pending user scheduling).
-
Supported values are 2-30 days.
+Supported values are 2-30 days.
-
The default value is 0 days (not specified).
+The default value is 0 days (not specified).
+
+
+
-
-
-
+
+
**Update/EngagedRestartSnoozeSchedule**
-
+
Home
@@ -1180,8 +1285,8 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1189,21 +1294,23 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
-
Added in Windows 10, version 1703. Allows the IT Admin to control the number of days a user can snooze Engaged restart reminder notifications.
+
+
+Added in Windows 10, version 1703. Allows the IT Admin to control the number of days a user can snooze Engaged restart reminder notifications.
-
Supported values are 1-3 days.
+Supported values are 1-3 days.
-
The default value is 3 days.
+The default value is 3 days.
+
+
+
-
-
@@ -1225,8 +1332,8 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1234,21 +1341,23 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
-
Added in Windows 10, version 1703. Allows the IT Admin to control the timing before transitioning from Auto restarts scheduled outside of active hours to Engaged restart, which requires the user to schedule. The period can be set between 2 and 30 days from the time the restart becomes pending.
+
+
+Added in Windows 10, version 1703. Allows the IT Admin to control the timing before transitioning from Auto restarts scheduled outside of active hours to Engaged restart, which requires the user to schedule. The period can be set between 2 and 30 days from the time the restart becomes pending.
-
Supported values are 2-30 days.
+Supported values are 2-30 days.
-
The default value is 7 days.
+The default value is 7 days.
+
+
+
-
-
@@ -1270,8 +1379,8 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1279,25 +1388,29 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
+
+
> [!NOTE]
> Since this policy is not blocked, you will not get a failure message when you use it to configure a Windows 10 Mobile device. However, the policy will not take effect.
-
Added in Windows 10, version 1607. Allows IT Admins to exclude Windows Update (WU) drivers during updates.
+Added in Windows 10, version 1607. Allows IT Admins to exclude Windows Update (WU) drivers during updates.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 (default) – Allow Windows Update drivers.
- 1 – Exclude Windows Update drivers.
-
-
+
+
+
-
+
+
**Update/FillEmptyContentUrls**
-
+
Home
@@ -1319,8 +1432,8 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1328,25 +1441,29 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
-
Added in the April service release of Windows 10, version 1607. Allows Windows Update Agent to determine the download URL when it is missing from the metadata. This scenario will occur when intranet update service stores the metadata files but the download contents are stored in the ISV file cache (specified as the alternate download URL).
+
+
+Added in the April service release of Windows 10, version 1607. Allows Windows Update Agent to determine the download URL when it is missing from the metadata. This scenario will occur when intranet update service stores the metadata files but the download contents are stored in the ISV file cache (specified as the alternate download URL).
> [!NOTE]
> This setting should only be used in combination with an alternate download URL and configured to use ISV file cache. This setting is used when the intranet update service does not provide download URLs in the update metadata for files which are available on the alternate download server.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 (default) – Disabled.
- 1 – Enabled.
-
-
+
+
+
-
+
+
**Update/IgnoreMOAppDownloadLimit**
-
+
Home
@@ -1368,8 +1485,8 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1377,19 +1494,23 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
-
Added in Windows 10, version 1703. Specifies whether to ignore the MO download limit (allow unlimited downloading) over a cellular network for apps and their updates. If lower-level limits (for example, mobile caps) are required, those limits are controlled by external policies.
+
+
+Added in Windows 10, version 1703. Specifies whether to ignore the MO download limit (allow unlimited downloading) over a cellular network for apps and their updates. If lower-level limits (for example, mobile caps) are required, those limits are controlled by external policies.
> [!WARNING]
> Setting this policy might cause devices to incur costs from MO operators.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 (default) – Do not ignore MO download limit for apps and their updates.
- 1 – Ignore MO download limit (allow unlimited downloading) for apps and their updates.
-
To validate this policy:
+
+
+To validate this policy:
1. Enable the policy ensure the device is on a cellular network.
2. Run the scheduled task on your device to check for app updates in the background. For example, on a mobile device, run the following commands in TShell:
@@ -1399,13 +1520,15 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
3. Verify that any downloads that are above the download size limit will complete without being paused.
-
-
+
+
+
-
+
+
**Update/IgnoreMOUpdateDownloadLimit**
-
+
Home
@@ -1427,8 +1550,8 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1436,33 +1559,41 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
-
Added in Windows 10, version 1703. Specifies whether to ignore the MO download limit (allow unlimited downloading) over a cellular network for OS updates. If lower-level limits (for example, mobile caps) are required, those limits are controlled by external policies.
+
+
+Added in Windows 10, version 1703. Specifies whether to ignore the MO download limit (allow unlimited downloading) over a cellular network for OS updates. If lower-level limits (for example, mobile caps) are required, those limits are controlled by external policies.
> [!WARNING]
> Setting this policy might cause devices to incur costs from MO operators.
-
The following list shows the supported values:
-- 0 (default) – Do not ignore MO download limit for OS updates.
-- 1 – Ignore MO download limit (allow unlimited downloading) for OS updates.
-
-
To validate this policy:
-
-1. Enable the policy and ensure the device is on a cellular network.
-2. Run the scheduled task on phone to check for OS updates in the background. For example, on a mobile device, run the following commands in TShell:
- `exec-device schtasks.exe -arguments ""/run /tn """"\Microsoft\Windows\WindowsUpdate\AUScheduledInstall"""" /I""`
3. Verify that any downloads that are above the download size limit will complete without being paused.
-
-
+
+
+The following list shows the supported values:
+
+- 0 (default) – Do not ignore MO download limit for OS updates.
+- 1 – Ignore MO download limit (allow unlimited downloading) for OS updates.
+
+
+
+To validate this policy:
+
+1. Enable the policy and ensure the device is on a cellular network.
+2. Run the scheduled task on phone to check for OS updates in the background. For example, on a mobile device, run the following commands in TShell:
+
+
+
+
-
+
+
**Update/ManagePreviewBuilds**
-
+
Home
@@ -1484,24 +1615,36 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
Added in Windows 10, version 1709. Used to manage Windows 10 Insider Preview builds. Value type is integer.
+> [!div class = "checklist"]
+> * Device
-
The following list shows the supported values:
+
+
+
+
+Added in Windows 10, version 1709. Used to manage Windows 10 Insider Preview builds. Value type is integer.
+
+
+
+The following list shows the supported values:
- 0 - Disable Preview builds
- 1 - Disable Preview builds once the next release is public
- 2 - Enable Preview builds
-
-
+
+
+
-
+
+
**Update/PauseDeferrals**
-
+
Home
@@ -1523,8 +1666,8 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1532,30 +1675,35 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
+
+
> [!NOTE]
> Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](device-update-management.md#windows10version1607forupdatemanagement). You can continue to use PauseDeferrals for Windows 10, version 1511 devices.
-
Allows IT Admins to pause updates and upgrades for up to 5 weeks. Paused deferrals will be reset after 5 weeks.
+Allows IT Admins to pause updates and upgrades for up to 5 weeks. Paused deferrals will be reset after 5 weeks.
-
The following list shows the supported values:
+
+If the "Specify intranet Microsoft update service location" policy is enabled, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect.
+
+If the "Allow Telemetry" policy is enabled and the Options value is set to 0, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect.
+
+
+
+The following list shows the supported values:
- 0 (default) – Deferrals are not paused.
- 1 – Deferrals are paused.
-
If the "Specify intranet Microsoft update service location" policy is enabled, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect.
+
+
-
If the "Allow Telemetry" policy is enabled and the Options value is set to 0, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect.
-
-
-
-
+
+
**Update/PauseFeatureUpdates**
-
+
Home
@@ -1577,8 +1725,8 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1586,25 +1734,29 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
-
Since this policy is not blocked, you will not get a failure message when you use it to configure a Windows 10 Mobile device. However, the policy will not take effect.
+
+
+Since this policy is not blocked, you will not get a failure message when you use it to configure a Windows 10 Mobile device. However, the policy will not take effect.
-
Added in Windows 10, version 1607. Allows IT Admins to pause Feature Updates for up to 60 days.
+Added in Windows 10, version 1607. Allows IT Admins to pause Feature Updates for up to 60 days.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 (default) – Feature Updates are not paused.
- 1 – Feature Updates are paused for 60 days or until value set to back to 0, whichever is sooner.
-
-
+
+
+
-
+
+
**Update/PauseFeatureUpdatesStartTime**
-
+
Home
@@ -1626,8 +1778,8 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1635,19 +1787,21 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
-
Added in Windows 10, version 1703. Specifies the date and time when the IT admin wants to start pausing the Feature Updates.
+
+
+Added in Windows 10, version 1703. Specifies the date and time when the IT admin wants to start pausing the Feature Updates.
-
Value type is string. Supported operations are Add, Get, Delete, and Replace.
+Value type is string. Supported operations are Add, Get, Delete, and Replace.
+
+
+
-
-
-
+
+
**Update/PauseQualityUpdates**
-
+
Home
@@ -1669,8 +1823,8 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1678,22 +1832,26 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
-
Added in Windows 10, version 1607. Allows IT Admins to pause Quality Updates.
+
+
+Added in Windows 10, version 1607. Allows IT Admins to pause Quality Updates.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 (default) – Quality Updates are not paused.
- 1 – Quality Updates are paused for 35 days or until value set back to 0, whichever is sooner.
-
-
+
+
+
-
+
+
**Update/PauseQualityUpdatesStartTime**
-
+
Home
@@ -1715,8 +1873,8 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1724,19 +1882,32 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
-
Added in Windows 10, version 1703. Specifies the date and time when the IT admin wants to start pausing the Quality Updates.
+
+
+Added in Windows 10, version 1703. Specifies the date and time when the IT admin wants to start pausing the Quality Updates.
-
Value type is string. Supported operations are Add, Get, Delete, and Replace.
+Value type is string. Supported operations are Add, Get, Delete, and Replace.
+
+
+
-
-
@@ -1758,8 +1929,8 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1767,26 +1938,30 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
+
+
> [!NOTE]
> Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](device-update-management.md#windows10version1607forupdatemanagement). You can continue to use RequireDeferUpgrade for Windows 10, version 1511 devices.
-
Allows the IT admin to set a device to Semi-Annual Channel train.
+Allows the IT admin to set a device to Semi-Annual Channel train.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 (default) – User gets upgrades from Semi-Annual Channel (Targeted).
- 1 – User gets upgrades from Semi-Annual Channel.
-
-
+
+
+
-
+
+
**Update/RequireUpdateApproval**
-
+
Home
@@ -1808,8 +1983,8 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1817,28 +1992,32 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
+
+
> [!NOTE]
> If you previously used the **Update/PhoneUpdateRestrictions** policy in previous versions of Windows, it has been deprecated. Please use this policy instead.
-
Allows the IT admin to restrict the updates that are installed on a device to only those on an update approval list. It enables IT to accept the End User License Agreement (EULA) associated with the approved update on behalf of the end-user. EULAs are approved once an update is approved.
+Allows the IT admin to restrict the updates that are installed on a device to only those on an update approval list. It enables IT to accept the End User License Agreement (EULA) associated with the approved update on behalf of the end-user. EULAs are approved once an update is approved.
-
Supported operations are Get and Replace.
+Supported operations are Get and Replace.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 – Not configured. The device installs all applicable updates.
- 1 – The device only installs updates that are both applicable and on the Approved Updates list. Set this policy to 1 if IT wants to control the deployment of updates on devices, such as when testing is required prior to deployment.
-
-
+
+
+
@@ -1860,8 +2039,8 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1869,21 +2048,25 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
-
Added in Windows 10, version 1703. Allows the IT Admin to specify the period for auto-restart imminent warning notifications.
+
+
+Added in Windows 10, version 1703. Allows the IT Admin to specify the period for auto-restart imminent warning notifications.
-
Supported values are 15, 30, or 60 (minutes).
+The default value is 15 (minutes).
-
The default value is 15 (minutes).
+
+
+Supported values are 15, 30, or 60 (minutes).
+
+
+
-
-
-
+
+
**Update/ScheduleRestartWarning**
-
+
Home
@@ -1905,8 +2088,8 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1914,25 +2097,29 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
+
+
> [!NOTE]
> This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education, and Windows 10 Mobile Enterprise
-
Added in Windows 10, version 1703. Allows the IT Admin to specify the period for auto-restart warning reminder notifications.
+Added in Windows 10, version 1703. Allows the IT Admin to specify the period for auto-restart warning reminder notifications.
-
Supported values are 2, 4, 8, 12, or 24 (hours).
+The default value is 4 (hours).
-
The default value is 4 (hours).
+
+
+Supported values are 2, 4, 8, 12, or 24 (hours).
+
+
+
-
-
-
+
+
**Update/ScheduledInstallDay**
-
+
Home
@@ -1954,8 +2141,8 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -1963,15 +2150,17 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
-
Enables the IT admin to schedule the day of the update installation.
+
+
+Enables the IT admin to schedule the day of the update installation.
-
The data type is a integer.
+The data type is a integer.
-
Supported operations are Add, Delete, Get, and Replace.
+Supported operations are Add, Delete, Get, and Replace.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 (default) – Every day
- 1 – Sunday
@@ -1982,13 +2171,15 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
- 6 – Friday
- 7 – Saturday
-
-
+
+
+
-
+
+
**Update/ScheduledInstallEveryWeek**
-
+
Home
@@ -2010,8 +2201,8 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -2019,21 +2210,23 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
-
Added in Windows 10, version 1709. Enables the IT admin to schedule the update installation on the every week. Value type is integer. Supported values:
+
+
+Added in Windows 10, version 1709. Enables the IT admin to schedule the update installation on the every week. Value type is integer. Supported values:
@@ -2055,8 +2248,8 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -2064,21 +2257,23 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
-
Added in Windows 10, version 1709. Enables the IT admin to schedule the update installation on the first week of the month. Value type is integer. Supported values:
+
+
+Added in Windows 10, version 1709. Enables the IT admin to schedule the update installation on the first week of the month. Value type is integer. Supported values:
0 - no update in the schedule
1 - update is scheduled every first week of the month
@@ -2100,8 +2295,8 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -2109,21 +2304,23 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
-
Added in Windows 10, version 1709. Enables the IT admin to schedule the update installation on the fourth week of the month. Value type is integer. Supported values:
+
+
+Added in Windows 10, version 1709. Enables the IT admin to schedule the update installation on the fourth week of the month. Value type is integer. Supported values:
0 - no update in the schedule
1 - update is scheduled every fourth week of the month
@@ -2145,8 +2342,8 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -2154,21 +2351,23 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
-
Added in Windows 10, version 1709. Enables the IT admin to schedule the update installation on the second week of the month. Value type is integer. Supported values:
+
+
+Added in Windows 10, version 1709. Enables the IT admin to schedule the update installation on the second week of the month. Value type is integer. Supported values:
0 - no update in the schedule
1 - update is scheduled every second week of the month
@@ -2190,8 +2389,8 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -2199,21 +2398,23 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
-
Added in Windows 10, version 1709. Enables the IT admin to schedule the update installation on the third week of the month. Value type is integer. Supported values:
+
+
+Added in Windows 10, version 1709. Enables the IT admin to schedule the update installation on the third week of the month. Value type is integer. Supported values:
0 - no update in the schedule
1 - update is scheduled every third week of the month
@@ -2235,8 +2436,8 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -2244,29 +2445,31 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
+
+
> [!NOTE]
> This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education, and Windows 10 Mobile Enterprise
-
Enables the IT admin to schedule the time of the update installation.
+Enables the IT admin to schedule the time of the update installation.
-
The data type is a integer.
+The data type is a integer.
-
Supported operations are Add, Delete, Get, and Replace.
+Supported operations are Add, Delete, Get, and Replace.
-
Supported values are 0-23, where 0 = 12 AM and 23 = 11 PM.
+Supported values are 0-23, where 0 = 12 AM and 23 = 11 PM.
-
The default value is 3.
+The default value is 3.
+
+
+
-
-
@@ -2288,8 +2491,8 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -2297,22 +2500,26 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
-
Added in Windows 10, version 1703. Allows the IT Admin to disable auto-restart notifications for update installations.
+
+
+Added in Windows 10, version 1703. Allows the IT Admin to disable auto-restart notifications for update installations.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 (default) – Enabled
- 1 – Disabled
-
-
+
+
+
-
+
+
**Update/SetEDURestart**
-
+
Home
@@ -2334,8 +2541,8 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -2343,22 +2550,26 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
-
Added in Windows 10, version 1703. For devices in a cart, this policy skips the check for battery level to ensure that the reboot will happen at ScheduledInstallTime.
+
+
+Added in Windows 10, version 1703. For devices in a cart, this policy skips all restart checks to ensure that the reboot will happen at ScheduledInstallTime.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 - not configured
- 1 - configured
-
-
+
+
+
-
+
+
**Update/UpdateServiceUrl**
-
+
Home
@@ -2380,8 +2591,8 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -2389,20 +2600,24 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-
-
+
+
> [!Important]
> Starting in Windows 10, version 1703 this policy is not supported in Windows 10 Mobile Enteprise and IoT Mobile.
-
Allows the device to check for updates from a WSUS server instead of Microsoft Update. This is useful for on-premise MDMs that need to update devices that cannot connect to the Internet.
+Allows the device to check for updates from a WSUS server instead of Microsoft Update. This is useful for on-premise MDMs that need to update devices that cannot connect to the Internet.
-
Supported operations are Get and Replace.
+Supported operations are Get and Replace.
-
The following list shows the supported values:
+
+
+The following list shows the supported values:
- Not configured. The device checks for updates from Microsoft Update.
- Set to a URL, such as `http://abcd-srv:8530`. The device checks for updates from the WSUS server at the specified URL.
+
+
Example
``` syntax
@@ -2421,13 +2636,15 @@ Example
```
-
-
+
+
+
-
+
+
**Update/UpdateServiceUrlAlternate**
-
+
Home
@@ -2449,8 +2666,8 @@ Example
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -2458,23 +2675,23 @@ Example
-
-
-
Added in the January service release of Windows 10, version 1607. Specifies an alternate intranet server to host updates from Microsoft Update. You can then use this update service to automatically update computers on your network.
+
+
+Added in the January service release of Windows 10, version 1607. Specifies an alternate intranet server to host updates from Microsoft Update. You can then use this update service to automatically update computers on your network.
-
This setting lets you specify a server on your network to function as an internal update service. The Automatic Updates client will search this service for updates that apply to the computers on your network.
+This setting lets you specify a server on your network to function as an internal update service. The Automatic Updates client will search this service for updates that apply to the computers on your network.
-
To use this setting, you must set two server name values: the server from which the Automatic Updates client detects and downloads updates, and the server to which updated workstations upload statistics. You can set both values to be the same server. An optional server name value can be specified to configure Windows Update agent, and download updates from an alternate download server instead of WSUS Server.
+To use this setting, you must set two server name values: the server from which the Automatic Updates client detects and downloads updates, and the server to which updated workstations upload statistics. You can set both values to be the same server. An optional server name value can be specified to configure Windows Update agent, and download updates from an alternate download server instead of WSUS Server.
-
Value type is string and the default value is an empty string, "". If the setting is not configured, and if Automatic Updates is not disabled by policy or user preference, the Automatic Updates client connects directly to the Windows Update site on the Internet.
+Value type is string and the default value is an empty string, "". If the setting is not configured, and if Automatic Updates is not disabled by policy or user preference, the Automatic Updates client connects directly to the Windows Update site on the Internet.
> [!Note]
> If the "Configure Automatic Updates" Group Policy is disabled, then this policy has no effect.
> If the "Alternate Download Server" Group Policy is not set, it will use the WSUS server by default to download updates.
> This policy is not supported on Windows RT. Setting this policy will not have any effect on Windows RT PCs.
-
-
+
+
Footnote:
@@ -2483,7 +2700,7 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
## Update policies supported by Windows Holographic for Business
diff --git a/windows/client-management/mdm/policy-csp-userrights.md b/windows/client-management/mdm/policy-csp-userrights.md
new file mode 100644
index 0000000000..b091456af0
--- /dev/null
+++ b/windows/client-management/mdm/policy-csp-userrights.md
@@ -0,0 +1,1373 @@
+---
+title: Policy CSP - UserRights
+description: Policy CSP - UserRights
+ms.author: maricia
+ms.topic: article
+ms.prod: w10
+ms.technology: windows
+author: nickbrower
+ms.date: 01/30/2018
+---
+
+# Policy CSP - UserRights
+
+> [!WARNING]
+> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
+
+
+
+
+
+## UserRights policies
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+This user right is used by Credential Manager during Backup/Restore. No accounts should have this privilege, as it is only assigned to Winlogon. Users' saved credentials might be compromised if this privilege is given to other entities.
+
+
+
+
+
+
+
+**UserRights/AccessFromNetwork**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+This user right determines which users and groups are allowed to connect to the computer over the network. Remote Desktop Services are not affected by this user right.Note: Remote Desktop Services was called Terminal Services in previous versions of Windows Server.
+
+
+
+
+
+
+
+**UserRights/ActAsPartOfTheOperatingSystem**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+This user right allows a process to impersonate any user without authentication. The process can therefore gain access to the same local resources as that user. Processes that require this privilege should use the LocalSystem account, which already includes this privilege, rather than using a separate user account with this privilege specially assigned. Caution:Assigning this user right can be a security risk. Only assign this user right to trusted users.
+
+
+
+
+
+
+
+**UserRights/AllowLocalLogOn**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+This user right determines which users can log on to the computer. Note: Modifying this setting may affect compatibility with clients, services, and applications. For compatibility information about this setting, see Allow log on locally (https://go.microsoft.com/fwlink/?LinkId=24268 ) at the Microsoft website.
+
+
+
+
+
+
+
+**UserRights/BackupFilesAndDirectories**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+This user right determines which users can bypass file, directory, registry, and other persistent objects permissions when backing up files and directories.Specifically, this user right is similar to granting the following permissions to the user or group in question on all files and folders on the system:Traverse Folder/Execute File, Read. Caution: Assigning this user right can be a security risk. Since users with this user right can read any registry settings and files, only assign this user right to trusted users
+
+
+
+
+
+
+
+**UserRights/ChangeSystemTime**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+This user right determines which users and groups can change the time and date on the internal clock of the computer. Users that are assigned this user right can affect the appearance of event logs. If the system time is changed, events that are logged will reflect this new time, not the actual time that the events occurred.
+
+
+
+
+
+
+
+**UserRights/CreateGlobalObjects**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+This security setting determines whether users can create global objects that are available to all sessions. Users can still create objects that are specific to their own session if they do not have this user right. Users who can create global objects could affect processes that run under other users' sessions, which could lead to application failure or data corruption. Caution: Assigning this user right can be a security risk. Assign this user right only to trusted users.
+
+
+
+
+
+
+
+**UserRights/CreatePageFile**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+This user right determines which users and groups can call an internal application programming interface (API) to create and change the size of a page file. This user right is used internally by the operating system and usually does not need to be assigned to any users
+
+
+
+
+
+
+
+**UserRights/CreatePermanentSharedObjects**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+This user right determines which accounts can be used by processes to create a directory object using the object manager. This user right is used internally by the operating system and is useful to kernel-mode components that extend the object namespace. Because components that are running in kernel mode already have this user right assigned to them, it is not necessary to specifically assign it.
+
+
+
+
+
+
+
+**UserRights/CreateSymbolicLinks**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+This user right determines if the user can create a symbolic link from the computer he is logged on to. Caution: This privilege should only be given to trusted users. Symbolic links can expose security vulnerabilities in applications that aren't designed to handle them. Note: This setting can be used in conjunction a symlink filesystem setting that can be manipulated with the command line utility to control the kinds of symlinks that are allowed on the machine. Type 'fsutil behavior set symlinkevaluation /?' at the command line to get more information about fsutil and symbolic links.
+
+
+
+
+
+
+
+**UserRights/CreateToken**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+This user right determines which accounts can be used by processes to create a token that can then be used to get access to any local resources when the process uses an internal application programming interface (API) to create an access token. This user right is used internally by the operating system. Unless it is necessary, do not assign this user right to a user, group, or process other than Local System. Caution: Assigning this user right can be a security risk. Do not assign this user right to any user, group, or process that you do not want to take over the system.
+
+
+
+
+
+
+
+**UserRights/DebugPrograms**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+This user right determines which users can attach a debugger to any process or to the kernel. Developers who are debugging their own applications do not need to be assigned this user right. Developers who are debugging new system components will need this user right to be able to do so. This user right provides complete access to sensitive and critical operating system components. Caution:Assigning this user right can be a security risk. Only assign this user right to trusted users.
+
+
+
+
+
+
+
+**UserRights/DenyAccessFromNetwork**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+This user right determines which users are prevented from accessing a computer over the network. This policy setting supersedes the Access this computer from the network policy setting if a user account is subject to both policies.
+
+
+
+
+
+
+
+**UserRights/DenyLocalLogOn**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+This security setting determines which service accounts are prevented from registering a process as a service. Note: This security setting does not apply to the System, Local Service, or Network Service accounts.
+
+
+
+
+
+
+
+**UserRights/DenyRemoteDesktopServicesLogOn**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+This user right determines which users and groups are prohibited from logging on as a Remote Desktop Services client.
+
+
+
+
+
+
+
+**UserRights/EnableDelegation**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+This user right determines which users can set the Trusted for Delegation setting on a user or computer object. The user or object that is granted this privilege must have write access to the account control flags on the user or computer object. A server process running on a computer (or under a user context) that is trusted for delegation can access resources on another computer using delegated credentials of a client, as long as the client account does not have the Account cannot be delegated account control flag set. Caution: Misuse of this user right, or of the Trusted for Delegation setting, could make the network vulnerable to sophisticated attacks using Trojan horse programs that impersonate incoming clients and use their credentials to gain access to network resources.
+
+
+
+
+
+
+
+**UserRights/GenerateSecurityAudits**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+This user right determines which accounts can be used by a process to add entries to the security log. The security log is used to trace unauthorized system access. Misuse of this user right can result in the generation of many auditing events, potentially hiding evidence of an attack or causing a denial of service. Shut down system immediately if unable to log security audits security policy setting is enabled.
+
+
+
+
+
+
+
+**UserRights/ImpersonateClient**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Assigning this user right to a user allows programs running on behalf of that user to impersonate a client. Requiring this user right for this kind of impersonation prevents an unauthorized user from convincing a client to connect (for example, by remote procedure call (RPC) or named pipes) to a service that they have created and then impersonating that client, which can elevate the unauthorized user's permissions to administrative or system levels. Caution: Assigning this user right can be a security risk. Only assign this user right to trusted users. Note: By default, services that are started by the Service Control Manager have the built-in Service group added to their access tokens. Component Object Model (COM) servers that are started by the COM infrastructure and that are configured to run under a specific account also have the Service group added to their access tokens. As a result, these services get this user right when they are started. In addition, a user can also impersonate an access token if any of the following conditions exist.
+1) The access token that is being impersonated is for this user.
+2) The user, in this logon session, created the access token by logging on to the network with explicit credentials.
+3) The requested level is less than Impersonate, such as Anonymous or Identify.
+Because of these factors, users do not usually need this user right. Warning: If you enable this setting, programs that previously had the Impersonate privilege may lose it, and they may not run.
+
+
+
+
+
+
+
+**UserRights/IncreaseSchedulingPriority**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+This user right determines which accounts can use a process with Write Property access to another process to increase the execution priority assigned to the other process. A user with this privilege can change the scheduling priority of a process through the Task Manager user interface.
+
+
+
+
+
+
+
+**UserRights/LoadUnloadDeviceDrivers**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+This user right determines which users can dynamically load and unload device drivers or other code in to kernel mode. This user right does not apply to Plug and Play device drivers. It is recommended that you do not assign this privilege to other users. Caution: Assigning this user right can be a security risk. Do not assign this user right to any user, group, or process that you do not want to take over the system.
+
+
+
+
+
+
+
+**UserRights/LockMemory**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+This user right determines which accounts can use a process to keep data in physical memory, which prevents the system from paging the data to virtual memory on disk. Exercising this privilege could significantly affect system performance by decreasing the amount of available random access memory (RAM).
+
+
+
+
+
+
+
+**UserRights/ManageAuditingAndSecurityLog**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+This user right determines which users can specify object access auditing options for individual resources, such as files, Active Directory objects, and registry keys. This security setting does not allow a user to enable file and object access auditing in general. You can view audited events in the security log of the Event Viewer. A user with this privilege can also view and clear the security log.
+
+
+
+
+
+
+
+**UserRights/ManageVolume**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+This user right determines which users and groups can run maintenance tasks on a volume, such as remote defragmentation. Use caution when assigning this user right. Users with this user right can explore disks and extend files in to memory that contains other data. When the extended files are opened, the user might be able to read and modify the acquired data.
+
+
+
+
+
+
+
+**UserRights/ModifyFirmwareEnvironment**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+This user right determines who can modify firmware environment values. Firmware environment variables are settings stored in the nonvolatile RAM of non-x86-based computers. The effect of the setting depends on the processor.On x86-based computers, the only firmware environment value that can be modified by assigning this user right is the Last Known Good Configuration setting, which should only be modified by the system. On Itanium-based computers, boot information is stored in nonvolatile RAM. Users must be assigned this user right to run bootcfg.exe and to change the Default Operating System setting on Startup and Recovery in System Properties. On all computers, this user right is required to install or upgrade Windows.Note: This security setting does not affect who can modify the system environment variables and user environment variables that are displayed on the Advanced tab of System Properties.
+
+
+
+
+
+
+
+**UserRights/ModifyObjectLabel**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+This user right determines which user accounts can modify the integrity label of objects, such as files, registry keys, or processes owned by other users. Processes running under a user account can modify the label of an object owned by that user to a lower level without this privilege.
+
+
+
+
+
+
+
+**UserRights/ProfileSingleProcess**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+This user right determines which users can use performance monitoring tools to monitor the performance of system processes.
+
+
+
+
+
+
+
+**UserRights/RemoteShutdown**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+This user right determines which users are allowed to shut down a computer from a remote location on the network. Misuse of this user right can result in a denial of service.
+
+
+
+
+
+
+
+**UserRights/RestoreFilesAndDirectories**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+This user right determines which users can bypass file, directory, registry, and other persistent objects permissions when restoring backed up files and directories, and determines which users can set any valid security principal as the owner of an object. Specifically, this user right is similar to granting the following permissions to the user or group in question on all files and folders on the system:Traverse Folder/Execute File, Write. Caution: Assigning this user right can be a security risk. Since users with this user right can overwrite registry settings, hide data, and gain ownership of system objects, only assign this user right to trusted users.
+
+
+
+
+
+
+
+**UserRights/TakeOwnership**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+This user right determines which users can take ownership of any securable object in the system, including Active Directory objects, files and folders, printers, registry keys, processes, and threads. Caution: Assigning this user right can be a security risk. Since owners of objects have full control of them, only assign this user right to trusted users.
+
+
+
+
+
+Footnote:
+
+- 1 - Added in Windows 10, version 1607.
+- 2 - Added in Windows 10, version 1703.
+- 3 - Added in Windows 10, version 1709.
+
+
+
diff --git a/windows/client-management/mdm/policy-csp-wifi.md b/windows/client-management/mdm/policy-csp-wifi.md
index 6b07a4af85..8fa7a54082 100644
--- a/windows/client-management/mdm/policy-csp-wifi.md
+++ b/windows/client-management/mdm/policy-csp-wifi.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - Wifi
@@ -15,7 +15,7 @@ ms.date: 11/01/2017
-
+
## Wifi policies
@@ -42,20 +42,24 @@ ms.date: 11/01/2017
+
-
+
+
**WiFi/AllowWiFiHotSpotReporting**
-
-
This policy has been deprecated.
+
+This policy has been deprecated.
+
+
+
-
-
Allow or disallow the device to automatically connect to Wi-Fi hotspots.
+
+
+Allow or disallow the device to automatically connect to Wi-Fi hotspots.
-
The following list shows the supported values:
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 – Not allowed.
- 1 (default) – Allowed.
-
Allow or disallow internet sharing.
+
+
+Allow or disallow internet sharing.
-
The following list shows the supported values:
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 – Do not allow the use of Internet Sharing.
- 1 (default) – Allow the use of Internet Sharing.
-
Allow or disallow connecting to Wi-Fi outside of MDM server-installed networks.
+
+
+Allow or disallow connecting to Wi-Fi outside of MDM server-installed networks.
-
The following list shows the supported values:
-
-- 0 – No Wi-Fi connection outside of MDM provisioned network is allowed.
-- 1 (default) – Adding new network SSIDs beyond the already MDM provisioned ones is allowed.
-
-
Most restricted value is 0.
+Most restricted value is 0.
> [!NOTE]
> Setting this policy deletes any previously installed user-configured and Wi-Fi sense Wi-Fi profiles from the device. Certain Wi-Fi profiles that are not user configured nor Wi-Fi sense might not be deleted. In addition, not all non-MDM profiles are completely deleted.
-
-
+
+
+The following list shows the supported values:
+
+- 0 – No Wi-Fi connection outside of MDM provisioned network is allowed.
+- 1 (default) – Adding new network SSIDs beyond the already MDM provisioned ones is allowed.
+
+
+
+
Allow or disallow WiFi connection.
+
+
+Allow or disallow WiFi connection.
-
The following list shows the supported values:
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
- 0 – WiFi connection is not allowed.
- 1 (default) – WiFi connection is allowed.
-
Added in Windows 10, version 1703. Allow WiFi Direct connection..
+
+
+Added in Windows 10, version 1703. Allow WiFi Direct connection..
+
+
+
+The following list shows the supported values:
- 0 - WiFi Direct connection is not allowed.
- 1 - WiFi Direct connection is allowed.
-
-
+
+
+
Allow an enterprise to control the WLAN scanning behavior and how aggressively devices should be actively scanning for Wi-Fi networks to get devices connected.
+
+
+Allow an enterprise to control the WLAN scanning behavior and how aggressively devices should be actively scanning for Wi-Fi networks to get devices connected.
-
Supported values are 0-500, where 100 = normal scan frequency and 500 = low scan frequency.
+Supported values are 0-500, where 100 = normal scan frequency and 500 = low scan frequency.
-
The default value is 0.
+The default value is 0.
-
Supported operations are Add, Delete, Get, and Replace.
+Supported operations are Add, Delete, Get, and Replace.
-
-
+
+
Footnote:
@@ -345,7 +371,7 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
## Wifi policies that can be set using Exchange Active Sync (EAS)
diff --git a/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md b/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md
index fadfbb83c4..65c25b116e 100644
--- a/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md
+++ b/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md
@@ -6,25 +6,33 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - WindowsDefenderSecurityCenter
+> [!WARNING]
+> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
+
## WindowsDefenderSecurityCenter policies
Added in Windows 10, version 1709. The company name that is displayed to the users. CompanyName is required for both EnableCustomizedToasts and EnableInAppCustomization. If you disable or do not configure this setting, or do not have EnableCustomizedToasts or EnableInAppCustomization enabled, then devices will not display the contact options.
+
+
+Added in Windows 10, version 1709. The company name that is displayed to the users. CompanyName is required for both EnableCustomizedToasts and EnableInAppCustomization. If you disable or do not configure this setting, or do not have EnableCustomizedToasts or EnableInAppCustomization enabled, then devices will not display the contact options.
-
Value type is string. Supported operations are Add, Get, Replace and Delete.
+Value type is string. Supported operations are Add, Get, Replace and Delete.
+
+
+
-
-
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Added in Windows 10, next major release. Use this policy setting to specify if to display the Account protection area in Windows Defender Security Center. If you disable or do not configure this setting, Windows defender Security Center will display this area.
+
+
+
+Valid values:
+
+- 0 - (Disable) The users can see the display of the Account protection area in Windows Defender Security Center.
+- 1 - (Enable) The users cannot see the display of the Account protection area in Windows Defender Security Center.
+
+
+
+
+
+
+
**WindowsDefenderSecurityCenter/DisableAppBrowserUI**
-
+
Added in Windows 10, version 1709. Use this policy setting if you want to disable the display of the app and browser protection area in Windows Defender Security Center. If you disable or do not configure this setting, Windows defender Security Center will display this area.
+
+
+Added in Windows 10, version 1709. Use this policy setting if you want to disable the display of the app and browser protection area in Windows Defender Security Center. If you disable or do not configure this setting, Windows defender Security Center will display this area.
-
Value type is integer. Supported operations are Add, Get, Replace and Delete. Valid values:
+Value type is integer. Supported operations are Add, Get, Replace and Delete.
+
+
+
+The following list shows the supported values:
- 0 - (Disable) The users can see the display of the app and browser protection area in Windows Defender Security Center.
- 1 - (Enable) The users cannot see the display of the app and browser protection area in Windows Defender Security Center.
-
-
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Added in Windows 10, next major release. Use this policy setting if you want to disable the display of the Device security area in the Windows Defender Security Center. If you disable or do not configure this setting, Windows defender Security Center will display this area.
+
+
+
+Valid values:
+
+- 0 - (Disable) The users can see the display of the Device security area in Windows Defender Security Center.
+- 1 - (Enable) The users cannot see the display of the Device secuirty area in Windows Defender Security Center.
+
+
+
+
+
+
+
**WindowsDefenderSecurityCenter/DisableEnhancedNotifications**
-
+
Added in Windows 10, version 1709. Use this policy if you want Windows Defender Security Center to only display notifications which are considered critical. If you disable or do not configure this setting, Windows Defender Security Center will display critical and non-critical notifications to users.
+
+
+Added in Windows 10, version 1709. Use this policy if you want Windows Defender Security Center to only display notifications which are considered critical. If you disable or do not configure this setting, Windows Defender Security Center will display critical and non-critical notifications to users.
> [!Note]
> If Suppress notification is enabled then users will not see critical or non-critical messages.
-
Value type is integer. Supported operations are Add, Get, Replace and Delete. Valid values:
+Value type is integer. Supported operations are Add, Get, Replace and Delete.
+
+
+
+The following list shows the supported values:
- 0 - (Disable) Windows Defender Security Center will display critical and non-critical notifications to users..
- 1 - (Enable) Windows Defender Security Center only display notifications which are considered critical on clients.
-
-
+
+
+
Added in Windows 10, version 1709. Use this policy setting if you want to disable the display of the family options area in Windows Defender Security Center. If you disable or do not configure this setting, Windows defender Security Center will display this area.
+
+
+Added in Windows 10, version 1709. Use this policy setting if you want to disable the display of the family options area in Windows Defender Security Center. If you disable or do not configure this setting, Windows defender Security Center will display this area.
-
Value type is integer. Supported operations are Add, Get, Replace and Delete. Valid values:
+Value type is integer. Supported operations are Add, Get, Replace and Delete.
+
+
+
+The following list shows the supported values:
- 0 - (Disable) The users can see the display of the family options area in Windows Defender Security Center.
- 1 - (Enable) The users cannot see the display of the family options area in Windows Defender Security Center.
-
-
+
+
+
Added in Windows 10, version 1709. Use this policy setting if you want to disable the display of the device performance and health area in Windows Defender Security Center. If you disable or do not configure this setting, Windows defender Security Center will display this area.
+
+
+Added in Windows 10, version 1709. Use this policy setting if you want to disable the display of the device performance and health area in Windows Defender Security Center. If you disable or do not configure this setting, Windows defender Security Center will display this area.
-
Value type is integer. Supported operations are Add, Get, Replace and Delete. Valid values:
+Value type is integer. Supported operations are Add, Get, Replace and Delete.
+
+
+
+The following list shows the supported values:
- 0 - (Disable) The users can see the display of the device performance and health area in Windows Defender Security Center.
- 1 - (Enable) The users cannot see the display of the device performance and health area in Windows Defender Security Center.
-
-
+
+
+
Added in Windows 10, version 1709. Use this policy setting if you want to disable the display of the firewall and network protection area in Windows Defender Security Center. If you disable or do not configure this setting, Windows defender Security Center will display this area.
+
+
+Added in Windows 10, version 1709. Use this policy setting if you want to disable the display of the firewall and network protection area in Windows Defender Security Center. If you disable or do not configure this setting, Windows defender Security Center will display this area.
-
Value type is integer. Supported operations are Add, Get, Replace and Delete. Valid values:
+Value type is integer. Supported operations are Add, Get, Replace and Delete.
+
+
+
+The following list shows the supported values:
- 0 - (Disable) The users can see the display of the firewall and network protection area in Windows Defender Security Center.
- 1 - (Enable) The users cannot see the display of the firewall and network protection area in Windows Defender Security Center.
-
-
+
+
+
Added in Windows 10, version 1709. Use this policy setting if you want to disable the display of Windows Defender Security Center notifications. If you disable or do not configure this setting, Windows Defender Security Center notifications will display on devices.
+
+
+Added in Windows 10, version 1709. Use this policy setting if you want to disable the display of Windows Defender Security Center notifications. If you disable or do not configure this setting, Windows Defender Security Center notifications will display on devices.
-
Value type is integer. Supported operations are Add, Get, Replace and Delete. Valid values:
+Value type is integer. Supported operations are Add, Get, Replace and Delete.
+
+
+
+The following list shows the supported values:
- 0 - (Disable) The users can see the display of Windows Defender Security Center notifications.
- 1 - (Enable) The users cannot see the display of Windows Defender Security Center notifications.
-
-
+
+
+
Added in Windows 10, version 1709. Use this policy setting if you want to disable the display of the virus and threat protection area in Windows Defender Security Center. If you disable or do not configure this setting, Windows defender Security Center will display this area.
+
+
+Added in Windows 10, version 1709. Use this policy setting if you want to disable the display of the virus and threat protection area in Windows Defender Security Center. If you disable or do not configure this setting, Windows defender Security Center will display this area.
-
Value type is integer. Supported operations are Add, Get, Replace and Delete. Valid values:
+Value type is integer. Supported operations are Add, Get, Replace and Delete.
+
+
+
+The following list shows the supported values:
- 0 - (Disable) The users can see the display of the virus and threat protection area in Windows Defender Security Center.
- 1 - (Enable) The users cannot see the display of the virus and threat protection area in Windows Defender Security Center.
-
-
+
+
+
Added in Windows 10, version 1709. Prevent users from making changes to the exploit protection settings area in the Windows Defender Security Center. If you disable or do not configure this setting, local users can make changes in the exploit protection settings area.
+
+
+Added in Windows 10, version 1709. Prevent users from making changes to the exploit protection settings area in the Windows Defender Security Center. If you disable or do not configure this setting, local users can make changes in the exploit protection settings area.
-
Value type is integer. Supported operations are Add, Get, Replace and Delete.Valid values:
+Value type is integer. Supported operations are Add, Get, Replace and Delete.
+
+
+
+The following list shows the supported values:
- 0 - (Disable) Local users are allowed to make changes in the exploit protection settings area.
- 1 - (Enable) Local users cannot make changes in the exploit protection settings area.
-
-
+
+
+
Added in Windows 10, version 1709. The email address that is displayed to users. The default mail application is used to initiate email actions. If you disable or do not configure this setting, or do not have EnableCustomizedToasts or EnableInAppCustomization enabled, then devices will not display contact options.
+
+
+Added in Windows 10, version 1709. The email address that is displayed to users. The default mail application is used to initiate email actions. If you disable or do not configure this setting, or do not have EnableCustomizedToasts or EnableInAppCustomization enabled, then devices will not display contact options.
-
Value type is string. Supported operations are Add, Get, Replace and Delete.
+Value type is string. Supported operations are Add, Get, Replace and Delete.
+
+
+
-
-
Added in Windows 10, version 1709. Enable this policy to display your company name and contact options in the notifications. If you disable or do not configure this setting, or do not provide CompanyName and a minimum of one contact method (Phone using Skype, Email, Help portal URL) Windows Defender Security Center will display a default notification text.
+
+
+Added in Windows 10, version 1709. Enable this policy to display your company name and contact options in the notifications. If you disable or do not configure this setting, or do not provide CompanyName and a minimum of one contact method (Phone using Skype, Email, Help portal URL) Windows Defender Security Center will display a default notification text.
-
Value type is integer. Supported operations are Add, Get, Replace, and Delete. Valid values:
+Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
+
+
+The following list shows the supported values:
- 0 - (Disable) Notifications contain a default notification text.
- 1 - (Enable) Notifications contain the company name and contact options.
-
-
+
+
+
Added in Windows 10, version 1709.Enable this policy to have your company name and contact options displayed in a contact card fly out in Windows Defender Security Center. If you disable or do not configure this setting, or do not provide CompanyName and a minimum of one contact method (Phone using Skype, Email, Help portal URL) Windows Defender Security Center will not display the contact card fly out notification.
+
+
+Added in Windows 10, version 1709. Enable this policy to have your company name and contact options displayed in a contact card fly out in Windows Defender Security Center. If you disable or do not configure this setting, or do not provide CompanyName and a minimum of one contact method (Phone using Skype, Email, Help portal URL) Windows Defender Security Center will not display the contact card fly out notification.
-
Value type is integer. Supported operations are Add, Get, Replace, and Delete. Valid values:
+Value type is integer. Supported operations are Add, Get, Replace, and Delete.
+
+
+
+The following list shows the supported values:
- 0 - (Disable) Do not display the company name and contact options in the card fly out notification.
- 1 - (Enable) Display the company name and contact options in the card fly out notification.
-
-
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Added in Windows 10, next major update. Use this policy setting to hide the Ransomware data recovery area in Windows Defender Security Center.
+
+
+
+Valid values:
+
+- 0 - (Disable or not configured) The Ransomware data recovery area will be visible.
+- 1 - (Enable) The Ransomware data recovery area is hidden.
+
+
+
+
+
+
+
+**WindowsDefenderSecurityCenter/HideSecureBoot**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Added in Windows 10, next major update. Use this policy to hide the Secure boot area in the Windows Defender Security Center.
+
+
+
+Valid values:
+
+- 0 - (Disable or not configured) The Secure boot area is displayed.
+- 1 - (Enable) The Secure boot area is hidden.
+
+
+
+
+
+
+
+**WindowsDefenderSecurityCenter/HideTPMTroubleshooting**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Added in Windows 10, next major update. Use this policy to hide the Security processor (TPM) troubleshooting area in the Windows Defender Security Center.
+
+
+
+Valid values:
+
+- 0 - (Disable or not configured) The Security processor (TPM) troubleshooting area is displayed.
+- 1 - (Enable) The Security processor (TPM) troubleshooting area is hidden.
+
+
+
+
+
+
+
**WindowsDefenderSecurityCenter/Phone**
-
+
Added in Windows 10, version 1709. The phone number or Skype ID that is displayed to users. Skype is used to initiate the call. If you disable or do not configure this setting, or do not have EnableCustomizedToasts or EnableInAppCustomization enabled, then devices will not display contact options.
+
+
+Added in Windows 10, version 1709. The phone number or Skype ID that is displayed to users. Skype is used to initiate the call. If you disable or do not configure this setting, or do not have EnableCustomizedToasts or EnableInAppCustomization enabled, then devices will not display contact options.
-
Value type is string. Supported operations are Add, Get, Replace, and Delete.
+Value type is string. Supported operations are Add, Get, Replace, and Delete.
+
+
+
-
-
Added in Windows 10, version 1709. The help portal URL this is displayed to users. The default browser is used to initiate this action. If you disable or do not configure this setting, or do not have EnableCustomizedToasts or EnableInAppCustomization enabled, then the device will not display contact options.
+
+
+Added in Windows 10, version 1709. The help portal URL this is displayed to users. The default browser is used to initiate this action. If you disable or do not configure this setting, or do not have EnableCustomizedToasts or EnableInAppCustomization enabled, then the device will not display contact options.
-
Value type is Value type is string. Supported operations are Add, Get, Replace, and Delete.
+Value type is Value type is string. Supported operations are Add, Get, Replace, and Delete.
-
-
+
+
Footnote:
@@ -706,5 +1041,5 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
diff --git a/windows/client-management/mdm/policy-csp-windowsinkworkspace.md b/windows/client-management/mdm/policy-csp-windowsinkworkspace.md
index f83331f02e..0b0a6104d4 100644
--- a/windows/client-management/mdm/policy-csp-windowsinkworkspace.md
+++ b/windows/client-management/mdm/policy-csp-windowsinkworkspace.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - WindowsInkWorkspace
@@ -15,7 +15,7 @@ ms.date: 11/01/2017
-
+
## WindowsInkWorkspace policies
Added in Windows 10, version 1607. Show recommended app suggestions in the ink workspace.
+
+
+Added in Windows 10, version 1607. Show recommended app suggestions in the ink workspace.
-
Value type is bool. The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 - app suggestions are not allowed.
- 1 (default) -allow app suggestions.
-
-
+
+
+
Added in Windows 10, version 1607. Specifies whether to allow the user to access the ink workspace.
+
+
+Added in Windows 10, version 1607. Specifies whether to allow the user to access the ink workspace.
-
Value type is int. The following list shows the supported values:
+
+
+Value type is int. The following list shows the supported values:
- 0 - access to ink workspace is disabled. The feature is turned off.
- 1 - ink workspace is enabled (feature is turned on), but the user cannot access it above the lock screen.
- 2 (default) - ink workspace is enabled (feature is turned on), and the user is allowed to use it above the lock screen.
-
-
+
+
Footnote:
@@ -128,5 +136,5 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
diff --git a/windows/client-management/mdm/policy-csp-windowslogon.md b/windows/client-management/mdm/policy-csp-windowslogon.md
index 07a008be66..513b783cee 100644
--- a/windows/client-management/mdm/policy-csp-windowslogon.md
+++ b/windows/client-management/mdm/policy-csp-windowslogon.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - WindowsLogon
@@ -15,7 +15,7 @@ ms.date: 11/01/2017
-
+
## WindowsLogon policies
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -65,15 +67,15 @@ ms.date: 11/01/2017
-
-
+
+
This policy setting allows you to prevent app notifications from appearing on the lock screen.
If you enable this policy setting, no app notifications are displayed on the lock screen.
If you disable or do not configure this policy setting, users can choose which apps display notifications on the lock screen.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -81,20 +83,22 @@ If you disable or do not configure this policy setting, users can choose which a
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Turn off app notifications on the lock screen*
- GP name: *DisableLockScreenAppNotifications*
- GP path: *System/Logon*
- GP ADMX file name: *logon.admx*
-
-
+
+
+
-
+
+
**WindowsLogon/DontDisplayNetworkSelectionUI**
-
+
Home
@@ -116,8 +120,8 @@ ADMX Info:
-
-
+
+
[Scope](./policy-configuration-service-provider.md#policy-scope):
> [!div class = "checklist"]
@@ -125,15 +129,15 @@ ADMX Info:
-
-
+
+
This policy setting allows you to control whether anyone can interact with available networks UI on the logon screen.
If you enable this policy setting, the PC's network connectivity state cannot be changed without signing into Windows.
If you disable or don't configure this policy setting, any user can disconnect the PC from the network or can connect the PC to other available networks without signing into Windows.
-
+
> [!TIP]
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
@@ -141,20 +145,22 @@ If you disable or don't configure this policy setting, any user can disconnect t
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
+
ADMX Info:
- GP English name: *Do not display network selection UI*
- GP name: *DontDisplayNetworkSelectionUI*
- GP path: *System/Logon*
- GP ADMX file name: *logon.admx*
-
-
+
+
+
-
+
+
**WindowsLogon/HideFastUserSwitching**
-
+
Added in Windows 10, version 1703. This policy setting allows you to hide the Switch account button on the sign-in screen, Start, and the Task Manager. If you enable this policy setting, the Switch account button is hidden from the user who is attempting to sign-in or is signed in to the computer that has this policy applied. If you disable or do not configure this policy setting, the Switch account button is accessible to the user in the three locations.
+
+
+Added in Windows 10, version 1703. This policy setting allows you to hide the Switch account button on the sign-in screen, Start, and the Task Manager. If you enable this policy setting, the Switch account button is hidden from the user who is attempting to sign-in or is signed in to the computer that has this policy applied. If you disable or do not configure this policy setting, the Switch account button is accessible to the user in the three locations.
-
Value type is int. The following list shows the supported values:
+
+
+The following list shows the supported values:
- 0 (default) - Disabled (visible).
- 1 - Enabled (hidden).
-
To validate on Desktop, do the following:
+
+
+To validate on Desktop, do the following:
1. Enable policy.
2. Verify that the Switch account button in Start is hidden.
-
-
+
+
Footnote:
@@ -209,5 +219,5 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
diff --git a/windows/client-management/mdm/policy-csp-wirelessdisplay.md b/windows/client-management/mdm/policy-csp-wirelessdisplay.md
index 5a32e0b066..5830a05aa4 100644
--- a/windows/client-management/mdm/policy-csp-wirelessdisplay.md
+++ b/windows/client-management/mdm/policy-csp-wirelessdisplay.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 01/30/2018
---
# Policy CSP - WirelessDisplay
@@ -15,7 +15,7 @@ ms.date: 11/01/2017
-
+
## WirelessDisplay policies
Added in Windows 10, version 1709. This policy setting allows you to turn off the Wireless Display multicast DNS service advertisement from a Wireless Display receiver. If the network administrator is concerned about network congestion, they may set this policy to 0, disabling mDNS advertisement.
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Added in Windows 10, version 1709. This policy setting allows you to turn off the Wireless Display multicast DNS service advertisement from a Wireless Display receiver. If the network administrator is concerned about network congestion, they may set this policy to 0, disabling mDNS advertisement.
+
+
+
+The following list shows the supported values:
- 0 - Do not allow
- 1 - Allow
-
-
+
+
+
-
+
+
**WirelessDisplay/AllowMdnsDiscovery**
-
+
Added in Windows 10, version 1709. This policy setting allows you to turn off discovering the display service advertised over multicast DNS by a Wireless Display receiver. If the network administrator is concerned about network congestion, they may set this policy to 0, disabling mDNS discovery.
+> [!div class = "checklist"]
+> * Device
-- 0 - Do not allow
-- 1 - Allow
-
-
-
-
+
+
+
+Added in Windows 10, version 1709. This policy setting allows you to turn off discovering the display service advertised over multicast DNS by a Wireless Display receiver. If the network administrator is concerned about network congestion, they may set this policy to 0, disabling mDNS discovery.
+
+
+
+The following list shows the supported values:
+
+- 0 - Do not allow
+- 1 - Allow
+
+
+
+
+
+
+
**WirelessDisplay/AllowProjectionFromPC**
-
+
Added in Windows 10, version 1703. This policy allows you to turn off projection from a PC.
+
+
+Added in Windows 10, version 1703. This policy allows you to turn off projection from a PC.
-- 0 - your PC cannot discover or project to other devices.
-- 1 - your PC can discover and project to other devices
+
+
+The following list shows the supported values:
+
+- 0 - your PC cannot discover or project to other devices.
+- 1 - your PC can discover and project to other devices
+
+
+
-
-
Added in Windows 10, version 1703. This policy allows you to turn off projection from a PC over infrastructure.
+
+
+Added in Windows 10, version 1703. This policy allows you to turn off projection from a PC over infrastructure.
-- 0 - your PC cannot discover or project to other infrastructure devices, although it is possible to discover and project over WiFi Direct.
-- 1 - your PC can discover and project to other devices over infrastructure.
+
+
+The following list shows the supported values:
+
+- 0 - your PC cannot discover or project to other infrastructure devices, although it is possible to discover and project over WiFi Direct.
+- 1 - your PC can discover and project to other devices over infrastructure.
+
+
+
-
-
Added in Windows 10, version 1607. Allow or disallow turning off the projection to a PC.
+
+
+Added in Windows 10, version 1607. Allow or disallow turning off the projection to a PC.
-
If you set it to 0 (zero), your PC is not discoverable and you cannot project to it. If you set it to 1, your PC is discoverable and you can project to it above the lock screen. The user has an option to turn it always on or always off except for manual launch. In PCs that support Miracast, after the policy is applied you can verify the setting from the user interface in **Settings** > **System** > **Projecting to this PC**.
+If you set it to 0 (zero), your PC is not discoverable and you cannot project to it. If you set it to 1, your PC is discoverable and you can project to it above the lock screen. The user has an option to turn it always on or always off except for manual launch. In PCs that support Miracast, after the policy is applied you can verify the setting from the user interface in **Settings** > **System** > **Projecting to this PC**.
-
Value type is integer. Valid value:
+Value type is integer.
+
+
+
+The following list shows the supported values:
- 0 - projection to PC is not allowed. Always off and the user cannot enable it.
- 1 (default) - projection to PC is allowed. Enabled only above the lock screen.
-
-
+
+
+
Added in Windows 10, version 1703. This policy setting allows you to turn off projection to a PC over infrastructure.
+
+
+Added in Windows 10, version 1703. This policy setting allows you to turn off projection to a PC over infrastructure.
-- 0 - your PC is not discoverable and other devices cannot project to it over infrastructure, although it is possible to project to it over WiFi Direct.
-- 1 - your PC is discoverable and other devices can project to it over infrastructure.
+
+
+The following list shows the supported values:
+
+- 0 - your PC is not discoverable and other devices cannot project to it over infrastructure, although it is possible to project to it over WiFi Direct.
+- 1 - your PC is discoverable and other devices can project to it over infrastructure.
+
+
+
-
-
Added in Windows 10, version 1703. Setting this policy controls whether or not the wireless display can send input—keyboard, mouse, pen, and touch input if the display supports it—back to the source device.
+
+
+Added in Windows 10, version 1703. Setting this policy controls whether or not the wireless display can send input—keyboard, mouse, pen, and touch input if the display supports it—back to the source device.
-
Added in Windows 10, version 1607. Allow or disallow requirement for a PIN for pairing.
+
+
+Added in Windows 10, version 1607. Allow or disallow requirement for a PIN for pairing.
-
If you turn this on, the pairing ceremony for new devices will always require a PIN. If you turn this off or do not configure it, a PIN is not required for pairing. In PCs that support Miracast, after the policy is applied you can verify the setting from the user interface in **Settings** > **System** > **Projecting to this PC**.
+If you turn this on, the pairing ceremony for new devices will always require a PIN. If you turn this off or do not configure it, a PIN is not required for pairing. In PCs that support Miracast, after the policy is applied you can verify the setting from the user interface in **Settings** > **System** > **Projecting to this PC**.
-
Value type is integer. Valid value:
+Value type is integer.
+
+
+
+The following list shows the supported values:
- 0 (default) - PIN is not required.
- 1 - PIN is required.
-
-
+
+
Footnote:
@@ -376,5 +438,5 @@ Footnote:
- 2 - Added in Windows 10, version 1703.
- 3 - Added in Windows 10, version 1709.
-
+
diff --git a/windows/client-management/mdm/policy-ddf-file.md b/windows/client-management/mdm/policy-ddf-file.md
index 0cdb6f8d7d..72cac2741a 100644
--- a/windows/client-management/mdm/policy-ddf-file.md
+++ b/windows/client-management/mdm/policy-ddf-file.md
@@ -7,7 +7,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 12/05/2017
---
# Policy DDF file
@@ -22,7 +22,7 @@ You can download the DDF files from the links below:
- [Download the Policy DDF file for Windows 10, version 1703](http://download.microsoft.com/download/7/2/C/72C36C37-20F9-41BF-8E23-721F6FFC253E/PolicyDDF_all.xml)
- [Download the Policy DDF file for Windows 10, version 1607](http://download.microsoft.com/download/6/1/C/61C022FD-6F5D-4F73-9047-17F630899DC4/PolicyDDF_all_version1607.xml)
- [Download the Policy DDF file for Windows 10, version 1607 release 8C](http://download.microsoft.com/download/6/1/C/61C022FD-6F5D-4F73-9047-17F630899DC4/PolicyDDF_all_version1607_8C.xml)
-- [Download all the DDF files for Windows 10, version 1607](http://download.microsoft.com/download/2/3/E/23E27D6B-6E23-4833-B143-915EDA3BDD44/Windows10_1607_DDF.zip)
+- [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download)
The XML below is the DDF for Windows 10, version 1709.
diff --git a/windows/client-management/mdm/provisioning-csp.md b/windows/client-management/mdm/provisioning-csp.md
index c7bdd31908..f2b9958913 100644
--- a/windows/client-management/mdm/provisioning-csp.md
+++ b/windows/client-management/mdm/provisioning-csp.md
@@ -7,7 +7,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 06/19/2017
+ms.date: 06/26/2017
---
# Provisioning CSP
diff --git a/windows/client-management/mdm/proxy-csp.md b/windows/client-management/mdm/proxy-csp.md
index c11b017912..0df779416e 100644
--- a/windows/client-management/mdm/proxy-csp.md
+++ b/windows/client-management/mdm/proxy-csp.md
@@ -7,7 +7,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 06/19/2017
+ms.date: 06/26/2017
---
# PROXY CSP
diff --git a/windows/client-management/mdm/push-notification-windows-mdm.md b/windows/client-management/mdm/push-notification-windows-mdm.md
index 4fbc202163..bfdd850a97 100644
--- a/windows/client-management/mdm/push-notification-windows-mdm.md
+++ b/windows/client-management/mdm/push-notification-windows-mdm.md
@@ -10,7 +10,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 06/19/2017
+ms.date: 09/22/2017
---
diff --git a/windows/client-management/mdm/pxlogical-csp.md b/windows/client-management/mdm/pxlogical-csp.md
index 0b92639559..a633f4a681 100644
--- a/windows/client-management/mdm/pxlogical-csp.md
+++ b/windows/client-management/mdm/pxlogical-csp.md
@@ -7,7 +7,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 06/19/2017
+ms.date: 06/26/2017
---
# PXLOGICAL configuration service provider
diff --git a/windows/client-management/mdm/reboot-csp.md b/windows/client-management/mdm/reboot-csp.md
index 92a4abfa6e..dba00c6cd5 100644
--- a/windows/client-management/mdm/reboot-csp.md
+++ b/windows/client-management/mdm/reboot-csp.md
@@ -7,7 +7,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 06/19/2017
+ms.date: 06/26/2017
---
# Reboot CSP
diff --git a/windows/client-management/mdm/reboot-ddf-file.md b/windows/client-management/mdm/reboot-ddf-file.md
index c6923c192a..2ba444f6f8 100644
--- a/windows/client-management/mdm/reboot-ddf-file.md
+++ b/windows/client-management/mdm/reboot-ddf-file.md
@@ -7,7 +7,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 06/19/2017
+ms.date: 12/05/2017
---
# Reboot DDF file
@@ -15,10 +15,7 @@ ms.date: 06/19/2017
This topic shows the OMA DM device description framework (DDF) for the **Reboot** configuration service provider. DDF files are used only with OMA DM provisioning XML.
-You can download the DDF files from the links below:
-
-- [Download all the DDF files for Windows 10, version 1703](http://download.microsoft.com/download/C/7/C/C7C94663-44CF-4221-ABCA-BC895F42B6C2/Windows10_1703_DDF_download.zip)
-- [Download all the DDF files for Windows 10, version 1607](http://download.microsoft.com/download/2/3/E/23E27D6B-6E23-4833-B143-915EDA3BDD44/Windows10_1607_DDF.zip)
+Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download).
The XML below is the current version for this CSP.
diff --git a/windows/client-management/mdm/reclaim-seat-from-user.md b/windows/client-management/mdm/reclaim-seat-from-user.md
index 1319338ddc..0f3aeb0558 100644
--- a/windows/client-management/mdm/reclaim-seat-from-user.md
+++ b/windows/client-management/mdm/reclaim-seat-from-user.md
@@ -7,7 +7,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 06/19/2017
+ms.date: 09/18/2017
---
# Reclaim seat from user
diff --git a/windows/client-management/mdm/register-your-free-azure-active-directory-subscription.md b/windows/client-management/mdm/register-your-free-azure-active-directory-subscription.md
index 05c7d4d468..6aef81069b 100644
--- a/windows/client-management/mdm/register-your-free-azure-active-directory-subscription.md
+++ b/windows/client-management/mdm/register-your-free-azure-active-directory-subscription.md
@@ -7,7 +7,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 06/19/2017
+ms.date: 06/26/2017
---
# Register your free Azure Active Directory subscription
diff --git a/windows/client-management/mdm/registry-csp.md b/windows/client-management/mdm/registry-csp.md
index 2ee3677a20..66f0960d0a 100644
--- a/windows/client-management/mdm/registry-csp.md
+++ b/windows/client-management/mdm/registry-csp.md
@@ -7,7 +7,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 06/19/2017
+ms.date: 06/26/2017
---
# Registry CSP
diff --git a/windows/client-management/mdm/registry-ddf-file.md b/windows/client-management/mdm/registry-ddf-file.md
index 9cc5db179a..77241d46ff 100644
--- a/windows/client-management/mdm/registry-ddf-file.md
+++ b/windows/client-management/mdm/registry-ddf-file.md
@@ -7,7 +7,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 06/19/2017
+ms.date: 06/26/2017
---
# Registry DDF file
diff --git a/windows/client-management/mdm/remotefind-csp.md b/windows/client-management/mdm/remotefind-csp.md
index c6c31e174c..caec581c7d 100644
--- a/windows/client-management/mdm/remotefind-csp.md
+++ b/windows/client-management/mdm/remotefind-csp.md
@@ -7,7 +7,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 06/19/2017
+ms.date: 06/26/2017
---
# RemoteFind CSP
diff --git a/windows/client-management/mdm/remotefind-ddf-file.md b/windows/client-management/mdm/remotefind-ddf-file.md
index 5041504af0..19cf44771f 100644
--- a/windows/client-management/mdm/remotefind-ddf-file.md
+++ b/windows/client-management/mdm/remotefind-ddf-file.md
@@ -7,7 +7,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 06/19/2017
+ms.date: 12/05/2017
---
# RemoteFind DDF file
@@ -15,10 +15,7 @@ ms.date: 06/19/2017
This topic shows the OMA DM device description framework (DDF) for the **RemoteFind** configuration service provider. DDF files are used only with OMA DM provisioning XML.
-You can download the DDF files from the links below:
-
-- [Download all the DDF files for Windows 10, version 1703](http://download.microsoft.com/download/C/7/C/C7C94663-44CF-4221-ABCA-BC895F42B6C2/Windows10_1703_DDF_download.zip)
-- [Download all the DDF files for Windows 10, version 1607](http://download.microsoft.com/download/2/3/E/23E27D6B-6E23-4833-B143-915EDA3BDD44/Windows10_1607_DDF.zip)
+Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download).
The XML below is the current version for this CSP.
diff --git a/windows/client-management/mdm/remotelock-csp.md b/windows/client-management/mdm/remotelock-csp.md
index 00c6da3d27..1daf39aa19 100644
--- a/windows/client-management/mdm/remotelock-csp.md
+++ b/windows/client-management/mdm/remotelock-csp.md
@@ -7,7 +7,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 06/19/2017
+ms.date: 06/26/2017
---
# RemoteLock CSP
diff --git a/windows/client-management/mdm/remotelock-ddf-file.md b/windows/client-management/mdm/remotelock-ddf-file.md
index 89485a5a6f..e41eeb9e38 100644
--- a/windows/client-management/mdm/remotelock-ddf-file.md
+++ b/windows/client-management/mdm/remotelock-ddf-file.md
@@ -7,7 +7,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 06/19/2017
+ms.date: 12/05/2017
---
# RemoteLock DDF file
@@ -15,10 +15,7 @@ ms.date: 06/19/2017
This topic shows the OMA DM device description framework (DDF) for the **RemoteLock** configuration service provider. DDF files are used only with OMA DM provisioning XML.
-You can download the DDF files from the links below:
-
-- [Download all the DDF files for Windows 10, version 1703](http://download.microsoft.com/download/C/7/C/C7C94663-44CF-4221-ABCA-BC895F42B6C2/Windows10_1703_DDF_download.zip)
-- [Download all the DDF files for Windows 10, version 1607](http://download.microsoft.com/download/2/3/E/23E27D6B-6E23-4833-B143-915EDA3BDD44/Windows10_1607_DDF.zip)
+Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download).
The XML below is the current version for this CSP.
diff --git a/windows/client-management/mdm/remotering-csp.md b/windows/client-management/mdm/remotering-csp.md
index ba6a4fd3a5..206e334ae8 100644
--- a/windows/client-management/mdm/remotering-csp.md
+++ b/windows/client-management/mdm/remotering-csp.md
@@ -7,7 +7,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 06/19/2017
+ms.date: 06/26/2017
---
# RemoteRing CSP
diff --git a/windows/client-management/mdm/remotering-ddf-file.md b/windows/client-management/mdm/remotering-ddf-file.md
index c0c46ea2c3..50d9bb92bb 100644
--- a/windows/client-management/mdm/remotering-ddf-file.md
+++ b/windows/client-management/mdm/remotering-ddf-file.md
@@ -7,7 +7,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 06/19/2017
+ms.date: 12/05/2017
---
# RemoteRing DDF file
@@ -15,10 +15,7 @@ ms.date: 06/19/2017
This topic shows the OMA DM device description framework (DDF) for the **RemoteRing** configuration service provider. DDF files are used only with OMA DM provisioning XML.
-You can download the DDF files from the links below:
-
-- [Download all the DDF files for Windows 10, version 1703](http://download.microsoft.com/download/C/7/C/C7C94663-44CF-4221-ABCA-BC895F42B6C2/Windows10_1703_DDF_download.zip)
-- [Download all the DDF files for Windows 10, version 1607](http://download.microsoft.com/download/2/3/E/23E27D6B-6E23-4833-B143-915EDA3BDD44/Windows10_1607_DDF.zip)
+Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download).
The XML below is the current version for this CSP.
diff --git a/windows/client-management/mdm/remotewipe-csp.md b/windows/client-management/mdm/remotewipe-csp.md
index 2a5bad77e5..96c6d01d65 100644
--- a/windows/client-management/mdm/remotewipe-csp.md
+++ b/windows/client-management/mdm/remotewipe-csp.md
@@ -7,7 +7,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 06/19/2017
+ms.date: 11/13/2017
---
# RemoteWipe CSP
diff --git a/windows/client-management/mdm/remotewipe-ddf-file.md b/windows/client-management/mdm/remotewipe-ddf-file.md
index 51f0a550f0..c85f6ef82b 100644
--- a/windows/client-management/mdm/remotewipe-ddf-file.md
+++ b/windows/client-management/mdm/remotewipe-ddf-file.md
@@ -7,7 +7,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 06/19/2017
+ms.date: 12/05/2017
---
# RemoteWipe DDF file
@@ -15,7 +15,7 @@ ms.date: 06/19/2017
This topic shows the OMA DM device description framework (DDF) for the **RemoteWipe** configuration service provider. DDF files are used only with OMA DM provisioning XML.
-You can download the Windows 10 version 1607 DDF files from [here](http://download.microsoft.com/download/2/3/E/23E27D6B-6E23-4833-B143-915EDA3BDD44/Windows10_1607_DDF.zip).
+Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download).
The XML below is the DDF for Windows 10, version 1709.
diff --git a/windows/client-management/mdm/reporting-csp.md b/windows/client-management/mdm/reporting-csp.md
index 373e3b1a86..8833a9d134 100644
--- a/windows/client-management/mdm/reporting-csp.md
+++ b/windows/client-management/mdm/reporting-csp.md
@@ -7,7 +7,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 06/19/2017
+ms.date: 06/26/2017
---
# Reporting CSP
diff --git a/windows/client-management/mdm/reporting-ddf-file.md b/windows/client-management/mdm/reporting-ddf-file.md
index accdf16912..616c065bdc 100644
--- a/windows/client-management/mdm/reporting-ddf-file.md
+++ b/windows/client-management/mdm/reporting-ddf-file.md
@@ -7,7 +7,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 06/19/2017
+ms.date: 12/05/2017
---
# Reporting DDF file
@@ -15,10 +15,7 @@ ms.date: 06/19/2017
This topic shows the OMA DM device description framework (DDF) for the Reporting configuration service provider. This CSP was added in Windows 10, version 1511. Support for desktop security auditing was added for the desktop in Windows 10, version 1607.
-You can download the DDF files from the links below:
-
-- [Download all the DDF files for Windows 10, version 1703](http://download.microsoft.com/download/C/7/C/C7C94663-44CF-4221-ABCA-BC895F42B6C2/Windows10_1703_DDF_download.zip)
-- [Download all the DDF files for Windows 10, version 1607](http://download.microsoft.com/download/2/3/E/23E27D6B-6E23-4833-B143-915EDA3BDD44/Windows10_1607_DDF.zip)
+Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download).
The XML below is the current version for the desktop CSP.
diff --git a/windows/client-management/mdm/rest-api-reference-windows-store-for-business.md b/windows/client-management/mdm/rest-api-reference-windows-store-for-business.md
index d64e4e1b4d..465bbd98f8 100644
--- a/windows/client-management/mdm/rest-api-reference-windows-store-for-business.md
+++ b/windows/client-management/mdm/rest-api-reference-windows-store-for-business.md
@@ -1,6 +1,6 @@
---
-title: REST API reference for Micosoft Store for Business
-description: REST API reference for Micosoft Store for Business
+title: REST API reference for Microsoft Store for Business
+description: REST API reference for Microsoft Store for Business
MS-HAID:
- 'p\_phdevicemgmt.business\_store\_portal\_management\_rest\_api\_reference'
- 'p\_phDeviceMgmt.rest\_api\_reference\_windows\_store\_for\_Business'
@@ -10,10 +10,10 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 06/19/2017
+ms.date: 09/18/2017
---
-# REST API reference for Micosoft Store for Business
+# REST API reference for Microsoft Store for Business
Here's the list of available operations:
diff --git a/windows/client-management/mdm/rootcacertificates-csp.md b/windows/client-management/mdm/rootcacertificates-csp.md
index 5ea5c96c90..8f5c11db9d 100644
--- a/windows/client-management/mdm/rootcacertificates-csp.md
+++ b/windows/client-management/mdm/rootcacertificates-csp.md
@@ -7,7 +7,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 06/19/2017
+ms.date: 06/26/2017
---
# RootCATrustedCertificates CSP
diff --git a/windows/client-management/mdm/rootcacertificates-ddf-file.md b/windows/client-management/mdm/rootcacertificates-ddf-file.md
index 127abe26aa..6e6492a240 100644
--- a/windows/client-management/mdm/rootcacertificates-ddf-file.md
+++ b/windows/client-management/mdm/rootcacertificates-ddf-file.md
@@ -7,7 +7,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 06/19/2017
+ms.date: 12/05/2017
---
# RootCATrustedCertificates DDF file
@@ -15,10 +15,7 @@ ms.date: 06/19/2017
This topic shows the OMA DM device description framework (DDF) for the **RootCACertificates** configuration service provider. DDF files are used only with OMA DM provisioning XML.
-You can download the DDF files from the links below:
-
-- [Download all the DDF files for Windows 10, version 1703](http://download.microsoft.com/download/C/7/C/C7C94663-44CF-4221-ABCA-BC895F42B6C2/Windows10_1703_DDF_download.zip)
-- [Download all the DDF files for Windows 10, version 1607](http://download.microsoft.com/download/2/3/E/23E27D6B-6E23-4833-B143-915EDA3BDD44/Windows10_1607_DDF.zip)
+Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download).
The XML below is the current version for this CSP.
diff --git a/windows/client-management/mdm/samples-for-writing-a-custom-configuration-service-provider.md b/windows/client-management/mdm/samples-for-writing-a-custom-configuration-service-provider.md
index 2e53cff44c..a1d1af99a2 100644
--- a/windows/client-management/mdm/samples-for-writing-a-custom-configuration-service-provider.md
+++ b/windows/client-management/mdm/samples-for-writing-a-custom-configuration-service-provider.md
@@ -7,7 +7,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 06/19/2017
+ms.date: 06/26/2017
---
# Samples for writing a custom configuration service provider
diff --git a/windows/client-management/mdm/secureassessment-csp.md b/windows/client-management/mdm/secureassessment-csp.md
index f0e98eee38..4357c5f176 100644
--- a/windows/client-management/mdm/secureassessment-csp.md
+++ b/windows/client-management/mdm/secureassessment-csp.md
@@ -7,7 +7,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 06/19/2017
+ms.date: 06/26/2017
---
# SecureAssessment CSP
diff --git a/windows/client-management/mdm/secureassessment-ddf-file.md b/windows/client-management/mdm/secureassessment-ddf-file.md
index 1d864dc5cc..598bdf0a98 100644
--- a/windows/client-management/mdm/secureassessment-ddf-file.md
+++ b/windows/client-management/mdm/secureassessment-ddf-file.md
@@ -7,17 +7,14 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 06/19/2017
+ms.date: 12/05/2017
---
# SecureAssessment DDF file
This topic shows the OMA DM device description framework (DDF) for the **SecureAssessment** configuration service provider. DDF files are used only with OMA DM provisioning XML.
-You can download the DDF files from the links below:
-
-- [Download all the DDF files for Windows 10, version 1703](http://download.microsoft.com/download/C/7/C/C7C94663-44CF-4221-ABCA-BC895F42B6C2/Windows10_1703_DDF_download.zip)
-- [Download all the DDF files for Windows 10, version 1607](http://download.microsoft.com/download/2/3/E/23E27D6B-6E23-4833-B143-915EDA3BDD44/Windows10_1607_DDF.zip)
+Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download).
The XML below is the current version for this CSP.
diff --git a/windows/client-management/mdm/securitypolicy-csp.md b/windows/client-management/mdm/securitypolicy-csp.md
index b65146a349..60851d4e87 100644
--- a/windows/client-management/mdm/securitypolicy-csp.md
+++ b/windows/client-management/mdm/securitypolicy-csp.md
@@ -7,7 +7,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 06/19/2017
+ms.date: 06/26/2017
---
# SecurityPolicy CSP
diff --git a/windows/client-management/mdm/server-requirements-windows-mdm.md b/windows/client-management/mdm/server-requirements-windows-mdm.md
index 33dac8d6ea..746e0a2ecc 100644
--- a/windows/client-management/mdm/server-requirements-windows-mdm.md
+++ b/windows/client-management/mdm/server-requirements-windows-mdm.md
@@ -10,7 +10,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 06/19/2017
+ms.date: 06/26/2017
---
# Server requirements for using OMA DM to manage Windows devices
diff --git a/windows/client-management/mdm/sharedpc-csp.md b/windows/client-management/mdm/sharedpc-csp.md
index 5740243acd..e55c31bcf5 100644
--- a/windows/client-management/mdm/sharedpc-csp.md
+++ b/windows/client-management/mdm/sharedpc-csp.md
@@ -7,7 +7,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 06/19/2017
+ms.date: 06/26/2017
---
# SharedPC CSP
diff --git a/windows/client-management/mdm/sharedpc-ddf-file.md b/windows/client-management/mdm/sharedpc-ddf-file.md
index dafab02cb4..bfa9d3d806 100644
--- a/windows/client-management/mdm/sharedpc-ddf-file.md
+++ b/windows/client-management/mdm/sharedpc-ddf-file.md
@@ -7,7 +7,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 06/19/2017
+ms.date: 12/05/2017
---
# SharedPC DDF file
@@ -15,10 +15,7 @@ ms.date: 06/19/2017
This topic shows the OMA DM device description framework (DDF) for the **SharedPC** configuration service provider. DDF files are used only with OMA DM provisioning XML.
-You can download the DDF files from the links below:
-
-- [Download all the DDF files for Windows 10, version 1703](http://download.microsoft.com/download/C/7/C/C7C94663-44CF-4221-ABCA-BC895F42B6C2/Windows10_1703_DDF_download.zip)
-- [Download all the DDF files for Windows 10, version 1607](http://download.microsoft.com/download/2/3/E/23E27D6B-6E23-4833-B143-915EDA3BDD44/Windows10_1607_DDF.zip)
+Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download).
The XML below is the DDF for Windows 10, version 1703.
diff --git a/windows/client-management/mdm/storage-csp.md b/windows/client-management/mdm/storage-csp.md
index ad20b4ebef..7f0638060a 100644
--- a/windows/client-management/mdm/storage-csp.md
+++ b/windows/client-management/mdm/storage-csp.md
@@ -7,7 +7,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 06/19/2017
+ms.date: 06/26/2017
---
# Storage CSP
diff --git a/windows/client-management/mdm/storage-ddf-file.md b/windows/client-management/mdm/storage-ddf-file.md
index f6f0bf77a2..fe440045c3 100644
--- a/windows/client-management/mdm/storage-ddf-file.md
+++ b/windows/client-management/mdm/storage-ddf-file.md
@@ -7,7 +7,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 06/19/2017
+ms.date: 12/05/2017
---
# Storage DDF file
@@ -15,10 +15,7 @@ ms.date: 06/19/2017
This topic shows the OMA DM device description framework (DDF) for the **Storage** configuration service provider. DDF files are used only with OMA DM provisioning XML.
-You can download the DDF files from the links below:
-
-- [Download all the DDF files for Windows 10, version 1703](http://download.microsoft.com/download/C/7/C/C7C94663-44CF-4221-ABCA-BC895F42B6C2/Windows10_1703_DDF_download.zip)
-- [Download all the DDF files for Windows 10, version 1607](http://download.microsoft.com/download/2/3/E/23E27D6B-6E23-4833-B143-915EDA3BDD44/Windows10_1607_DDF.zip)
+Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download).
The XML below is the current version for this CSP.
diff --git a/windows/client-management/mdm/structure-of-oma-dm-provisioning-files.md b/windows/client-management/mdm/structure-of-oma-dm-provisioning-files.md
index e7a23a8082..66e387b2ee 100644
--- a/windows/client-management/mdm/structure-of-oma-dm-provisioning-files.md
+++ b/windows/client-management/mdm/structure-of-oma-dm-provisioning-files.md
@@ -7,7 +7,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 06/19/2017
+ms.date: 06/26/2017
---
# Structure of OMA DM provisioning files
diff --git a/windows/client-management/mdm/supl-csp.md b/windows/client-management/mdm/supl-csp.md
index 1ccfabf81a..0265da462a 100644
--- a/windows/client-management/mdm/supl-csp.md
+++ b/windows/client-management/mdm/supl-csp.md
@@ -7,7 +7,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 06/19/2017
+ms.date: 06/26/2017
---
# SUPL CSP
diff --git a/windows/client-management/mdm/supl-ddf-file.md b/windows/client-management/mdm/supl-ddf-file.md
index 451d281251..927923512b 100644
--- a/windows/client-management/mdm/supl-ddf-file.md
+++ b/windows/client-management/mdm/supl-ddf-file.md
@@ -7,7 +7,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 06/19/2017
+ms.date: 12/05/2017
---
# SUPL DDF file
@@ -15,10 +15,7 @@ ms.date: 06/19/2017
This topic shows the OMA DM device description framework (DDF) for the **SUPL** configuration service provider.
-You can download the DDF files from the links below:
-
-- [Download all the DDF files for Windows 10, version 1703](http://download.microsoft.com/download/C/7/C/C7C94663-44CF-4221-ABCA-BC895F42B6C2/Windows10_1703_DDF_download.zip)
-- [Download all the DDF files for Windows 10, version 1607](http://download.microsoft.com/download/2/3/E/23E27D6B-6E23-4833-B143-915EDA3BDD44/Windows10_1607_DDF.zip)
+Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download).
The XML below is the current version for this CSP.
diff --git a/windows/client-management/mdm/surfacehub-ddf-file.md b/windows/client-management/mdm/surfacehub-ddf-file.md
index 6447431681..d465098263 100644
--- a/windows/client-management/mdm/surfacehub-ddf-file.md
+++ b/windows/client-management/mdm/surfacehub-ddf-file.md
@@ -7,17 +7,14 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 07/28/2017
+ms.date: 12/05/2017
---
# SurfaceHub DDF file
This topic shows the OMA DM device description framework (DDF) for the SurfaceHub configuration service provider. This CSP was added in Windows 10, version 1511.
-You can download the DDF files from the links below:
-
-- [Download all the DDF files for Windows 10, version 1703](http://download.microsoft.com/download/C/7/C/C7C94663-44CF-4221-ABCA-BC895F42B6C2/Windows10_1703_DDF_download.zip)
-- [Download all the DDF files for Windows 10, version 1607](http://download.microsoft.com/download/2/3/E/23E27D6B-6E23-4833-B143-915EDA3BDD44/Windows10_1607_DDF.zip)
+Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download).
The XML below is the current version for this CSP.
diff --git a/windows/client-management/mdm/tpmpolicy-csp.md b/windows/client-management/mdm/tpmpolicy-csp.md
index a86a8fef94..5fa0f29fa7 100644
--- a/windows/client-management/mdm/tpmpolicy-csp.md
+++ b/windows/client-management/mdm/tpmpolicy-csp.md
@@ -12,7 +12,7 @@ ms.date: 11/01/2017
# TPMPolicy CSP
-The TPMPolicy configuration service provider (CSP) provides a mechanism to enable zero exhaust configuration on a Windows device for TPM software components. Zero exhaust is defined as no network traffic (telemetry or otherwise, such as downloading background images, Windows Updates, etc.) from Windows and inbox applications to public IP addresses unless directly intended by the user. This allows the enterprise admin to configure devices where no network communication is initiated by the system without explicit approval.
+The TPMPolicy configuration service provider (CSP) provides a mechanism to enable zero exhaust configuration on a Windows device for TPM software components. Zero exhaust is defined as no network traffic (diagnostic data or otherwise, such as downloading background images, Windows Updates, etc.) from Windows and inbox applications to public IP addresses unless directly intended by the user. This allows the enterprise admin to configure devices where no network communication is initiated by the system without explicit approval.
The TPMPolicy CSP was added in Windows 10, version 1703.
@@ -30,7 +30,7 @@ The following diagram shows the TPMPolicy configuration service provider in tree
There should be no traffic when machine is on idle. When the user is not interacting with the system/device, no traffic is expected.
There should be no traffic during installation of Windows and first logon when local ID is used.
Launching and using a local app (Notepad, Paint, etc.) should not send any traffic. Similarly, performing common tasks (clicking on start menu, browsing folders, etc.) should not send any traffic.
-
Launching and using Internet enabled apps should not send any unexpected traffic (for maintenance, diagnostic, telemetry, etc.) to Microsoft.
+
Launching and using Internet enabled apps should not send any unexpected traffic (for maintenance, diagnostic data, etc.) to Microsoft.
Here is an example:
diff --git a/windows/client-management/mdm/tpmpolicy-ddf-file.md b/windows/client-management/mdm/tpmpolicy-ddf-file.md
index 36b0f3b280..21c7534a21 100644
--- a/windows/client-management/mdm/tpmpolicy-ddf-file.md
+++ b/windows/client-management/mdm/tpmpolicy-ddf-file.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 12/05/2017
---
# TPMPolicy DDF file
@@ -14,6 +14,8 @@ ms.date: 11/01/2017
This topic shows the OMA DM device description framework (DDF) for the **TPMPolicy** configuration service provider. The TPMPolicy CSP was added in Windows 10, version 1703.
+Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download).
+
The XML below is the current version for this CSP.
``` syntax
diff --git a/windows/client-management/mdm/understanding-admx-backed-policies.md b/windows/client-management/mdm/understanding-admx-backed-policies.md
index a1cd701480..f88849e2b1 100644
--- a/windows/client-management/mdm/understanding-admx-backed-policies.md
+++ b/windows/client-management/mdm/understanding-admx-backed-policies.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 06/19/2017
+ms.date: 08/11/2017
---
# Understanding ADMX-backed policies
@@ -131,6 +131,7 @@ The following SyncML examples describe how to set a MDM policy that is defined b
./Device/Vendor/MSFT/Policy/Config/AppVirtualization/PublishingAllowServer2
+
]]>
+
diff --git a/windows/client-management/mdm/unifiedwritefilter-csp.md b/windows/client-management/mdm/unifiedwritefilter-csp.md
index 91ba0a863c..2436883665 100644
--- a/windows/client-management/mdm/unifiedwritefilter-csp.md
+++ b/windows/client-management/mdm/unifiedwritefilter-csp.md
@@ -7,7 +7,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 06/19/2017
+ms.date: 06/26/2017
---
# UnifiedWriteFilter CSP
diff --git a/windows/client-management/mdm/unifiedwritefilter-ddf.md b/windows/client-management/mdm/unifiedwritefilter-ddf.md
index 8e78311b0a..417cff25cf 100644
--- a/windows/client-management/mdm/unifiedwritefilter-ddf.md
+++ b/windows/client-management/mdm/unifiedwritefilter-ddf.md
@@ -7,7 +7,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 06/19/2017
+ms.date: 12/05/2017
---
# UnifiedWriteFilter DDF File
@@ -15,6 +15,8 @@ ms.date: 06/19/2017
This topic shows the OMA DM device description framework (DDF) for the **UnifiedWriteFilter** configuration service provider. DDF files are used only with OMA DM provisioning XML.
+Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download).
+
``` syntax
Supported operations are Get and Replace.
**Configuration/TelemetryReportingFrequency**
-
Added in Windows 10, version 1703. Returns or sets the Windows Defender Advanced Threat Protection telemetry reporting frequency.
+
Added in Windows 10, version 1703. Returns or sets the Windows Defender Advanced Threat Protection diagnostic data reporting frequency.
The following list shows the supported values:
diff --git a/windows/client-management/mdm/windowsadvancedthreatprotection-ddf.md b/windows/client-management/mdm/windowsadvancedthreatprotection-ddf.md
index 429036de72..d475e14ee4 100644
--- a/windows/client-management/mdm/windowsadvancedthreatprotection-ddf.md
+++ b/windows/client-management/mdm/windowsadvancedthreatprotection-ddf.md
@@ -7,7 +7,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 12/05/2017
---
# WindowsAdvancedThreatProtection DDF file
@@ -15,10 +15,7 @@ ms.date: 11/01/2017
This topic shows the OMA DM device description framework (DDF) for the **WindowsAdvancedThreatProtection** configuration service provider. DDF files are used only with OMA DM provisioning XML.
-You can download the DDF files from the links below:
-
-- [Download all the DDF files for Windows 10, version 1703](http://download.microsoft.com/download/C/7/C/C7C94663-44CF-4221-ABCA-BC895F42B6C2/Windows10_1703_DDF_download.zip)
-- [Download all the DDF files for Windows 10, version 1607](http://download.microsoft.com/download/2/3/E/23E27D6B-6E23-4833-B143-915EDA3BDD44/Windows10_1607_DDF.zip)
+Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download).
The XML below is the current version for this CSP.
@@ -230,7 +227,7 @@ The XML below is the current version for this CSP.
1
- Return or set Windows Defender Advanced Threat Protection telemetry reporting frequency. Allowed values are: 1 - Normal, 2 - Expedite
+ Return or set Windows Defender Advanced Threat Protection diagnostic data reporting frequency. Allowed values are: 1 - Normal, 2 - Expedite
diff --git a/windows/client-management/mdm/windowsdefenderapplicationguard-ddf-file.md b/windows/client-management/mdm/windowsdefenderapplicationguard-ddf-file.md
index 12a77ad6e0..4cc13ab9e8 100644
--- a/windows/client-management/mdm/windowsdefenderapplicationguard-ddf-file.md
+++ b/windows/client-management/mdm/windowsdefenderapplicationguard-ddf-file.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 11/01/2017
+ms.date: 12/05/2017
---
# WindowsDefenderApplicationGuard DDF file
@@ -14,6 +14,8 @@ ms.date: 11/01/2017
This topic shows the OMA DM device description framework (DDF) for the **WindowsDefenderApplicationGuard** configuration service provider.
+Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download).
+
``` syntax
Manage telemetry
+### Manage diagnostic data
*Applies to: Corporate devices with Windows 10 Mobile Enterprise edition*
-Microsoft uses telemetry (diagnostics, performance, and usage data) from Windows devices to help inform decisions and focus efforts to provide the most robust and valuable platform for your business and the people who count on Windows to enable them to be as productive as possible. Telemetry helps keep Windows devices healthy, improve the operating system, and personalize features and services.
+Microsoft uses diagnostics, performance, and usage data from Windows devices to help inform decisions and focus efforts to provide the most robust and valuable platform for your business and the people who count on Windows to enable them to be as productive as possible. Diagnostic data helps keep Windows devices healthy, improve the operating system, and personalize features and services.
-You can control the level of data that telemetry systems collect. To configure devices, specify one of these levels in the Allow Telemetry setting with your MDM system.
+You can control the level of data that diagnostic data systems collect. To configure devices, specify one of these levels in the Allow Telemetry setting with your MDM system.
-For more information, see [Configure Windows telemetry in Your organization](/windows/configuration/configure-windows-telemetry-in-your-organization).
+For more information, see [Configure Windows diagnostic data in Your organization](/windows/configuration/configure-windows-diagnostic-data-in-your-organization).
->**Note:** Telemetry can only be managed when the device is upgraded to Windows 10 Mobile Enterprise edition.
+>**Note:** Diagnostic data can only be managed when the device is upgraded to Windows 10 Mobile Enterprise edition.
### Remote assistance
diff --git a/windows/client-management/windows-10-support-solutions.md b/windows/client-management/windows-10-support-solutions.md
index 2daf689b30..91abec238e 100644
--- a/windows/client-management/windows-10-support-solutions.md
+++ b/windows/client-management/windows-10-support-solutions.md
@@ -7,7 +7,7 @@ ms.sitesec: library
ms.author: elizapo
author: kaushika-msft
ms.localizationpriority: high
-ms.date: 08/30/2017
+ms.date: 11/08/2017
---
# Top support solutions for Windows 10
diff --git a/windows/client-management/windows-libraries.md b/windows/client-management/windows-libraries.md
index 0b4746f88d..a52e6a2d6f 100644
--- a/windows/client-management/windows-libraries.md
+++ b/windows/client-management/windows-libraries.md
@@ -8,6 +8,7 @@ ms.technology: storage
ms.topic: article
author: jasongerend
description: All about Windows Libraries, which are containers for users' content, such as Documents and Pictures.
+ms.date: 04/19/2017
---
# Windows libraries
diff --git a/windows/configuration/TOC.md b/windows/configuration/TOC.md
index cad65095b0..2542a03b63 100644
--- a/windows/configuration/TOC.md
+++ b/windows/configuration/TOC.md
@@ -1,11 +1,13 @@
# [Configure Windows 10](index.md)
-## [Configure Windows telemetry in your organization](configure-windows-telemetry-in-your-organization.md)
-## [Windows 10, version 1709 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1709.md)
-## [Windows 10, version 1709 enhanced telemetry events and fields used by Windows Analytics](EventName.md)
-## [Windows 10, version 1703 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields.md)
-## [Windows 10 diagnostic data for the Full telemetry level](windows-diagnostic-data.md)
+## [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md)
+## [Diagnostic Data Viewer Overview](diagnostic-data-viewer-overview.md)
+## [Windows 10, version 1709 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields.md)
+## [Windows 10, version 1709 enhanced diagnostic data events and fields used by Windows Analytics](enhanced-diagnostic-data-windows-analytics-events-and-fields.md)
+## [Windows 10, version 1703 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md)
+## [Windows 10 diagnostic data for the Full diagnostic data level](windows-diagnostic-data-1703.md)
## [Beginning your General Data Protection Regulation (GDPR) journey for Windows 10](gdpr-win10-whitepaper.md)
## [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md)
+## [Manage Windows 10 connection endpoints](manage-windows-endpoints-version-1709.md)
## [Manage Wi-Fi Sense in your company](manage-wifi-sense-in-enterprise.md)
## [Configure kiosk and shared devices running Windows 10 desktop editions](kiosk-shared-pc.md)
### [Set up a shared or guest PC with Windows 10](set-up-shared-or-guest-pc.md)
@@ -36,7 +38,7 @@
#### [Start layout XML for desktop editions of Windows 10 (reference)](start-layout-xml-desktop.md)
#### [Customize Windows 10 Start and taskbar with Group Policy](customize-windows-10-start-screens-by-using-group-policy.md)
#### [Customize Windows 10 Start and taskbar with provisioning packages](customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md)
-#### [Customize Windows 10 Start and tasbkar with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md)
+#### [Customize Windows 10 Start and taskbar with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md)
#### [Changes to Start policies in Windows 10](changes-to-start-policies-in-windows-10.md)
## [Cortana integration in your business or enterprise](cortana-at-work/cortana-at-work-overview.md)
### [Testing scenarios using Cortana in your business or organization](cortana-at-work/cortana-at-work-testing-scenarios.md)
@@ -54,6 +56,7 @@
### [Use Group Policy and mobile device management (MDM) settings to configure Cortana in your organization](cortana-at-work/cortana-at-work-policy-settings.md)
### [Send feedback about Cortana at work back to Microsoft](cortana-at-work/cortana-at-work-feedback.md)
## [Configure access to Microsoft Store](stop-employees-from-using-microsoft-store.md)
+## [Accessibility information for IT Pros](windows-10-accessibility-for-ITPros.md)
## [Provisioning packages for Windows 10](provisioning-packages/provisioning-packages.md)
### [How provisioning works in Windows 10](provisioning-packages/provisioning-how-it-works.md)
### [Introduction to configuration service providers (CSPs)](provisioning-packages/how-it-pros-can-use-configuration-service-providers.md)
diff --git a/windows/configuration/basic-level-windows-diagnostic-events-and-fields-1709.md b/windows/configuration/basic-level-windows-diagnostic-events-and-fields-1703.md
similarity index 83%
rename from windows/configuration/basic-level-windows-diagnostic-events-and-fields-1709.md
rename to windows/configuration/basic-level-windows-diagnostic-events-and-fields-1703.md
index 26ff07ae44..d6c2534f87 100644
--- a/windows/configuration/basic-level-windows-diagnostic-events-and-fields-1709.md
+++ b/windows/configuration/basic-level-windows-diagnostic-events-and-fields-1703.md
@@ -1,47 +1,38 @@
---
description: Use this article to learn more about what Windows diagnostic data is gathered at the basic level.
-title: Windows 10, version 1709 basic diagnostic events and fields (Windows 10)
-keywords: privacy, telemetry
+title: Windows 10, version 1703 basic diagnostic events and fields (Windows 10)
+keywords: privacy, diagnostic data
ms.prod: w10
ms.mktglfcycl: manage
ms.sitesec: library
ms.pagetype: security
-localizationpriority: high
+ms.localizationpriority: high
author: eross-msft
ms.author: lizross
-ms.date: 10/17/2017
+ms.date: 04/05/2017
---
-# Windows 10, version 1709 basic level Windows diagnostic events and fields
-
+# Windows 10, version 1703 basic level Windows diagnostic events and fields
**Applies to**
-- Windows 10, version 1709
+- Windows 10, version 1703
+The Basic level gathers a limited set of information that is critical for understanding the device and its configuration including: basic device information, quality-related information, app compatibility, and Microsoft Store. When the level is set to Basic, it also includes the Security level information. The Basic level also helps to identify problems that can occur on a particular device hardware or software configuration. For example, it can help determine if crashes are more frequent on devices with a specific amount of memory or that are running a particular driver version. This helps Microsoft fix operating system or app problems.
-The Basic level gathers a limited set of information that is critical for understanding the device and its configuration including: basic device information, quality-related information, app compatibility, and Windows Store. When the level is set to Basic, it also includes the Security level information.
+Use this article to learn about diagnostic events, grouped by event area, and the fields within each event. A brief description is provided for each field. Every event generated includes common data, which collects device data. You can learn more about Windows functional and diagnostic data through these articles:
-The Basic level helps to identify problems that can occur on a particular device hardware or software configuration. For example, it can help determine if crashes are more frequent on devices with a specific amount of memory or that are running a particular driver version. This helps Microsoft fix operating system or app problems.
-
-Use this article to learn about diagnostic events, grouped by event area, and the fields within each event. A brief description is provided for each field. Every event generated includes common data, which collects device data.
-
-You can learn more about Windows functional and diagnostic data through these articles:
-
-
-- [Windows 10, version 1703 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields.md)
- [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md)
-- [Configure Windows telemetry in your organization](configure-windows-telemetry-in-your-organization.md)
+- [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md)
+>[!Note]
+>Updated November 2017 to document new and modified events. We’ve added some new events and also added new fields to existing events to prepare for upgrades to the next release of Windows.
-
-# Common data extensions
+## Common data extensions
### Common Data Extensions.App
-
-
The following fields are available:
- **expId** Associates a flight, such as an OS flight, or an experiment, such as a web site UX experiment, with an event.
@@ -52,8 +43,6 @@ The following fields are available:
### Common Data Extensions.CS
-
-
The following fields are available:
- **sig** A common schema signature that identifies new and modified event schemas.
@@ -61,8 +50,6 @@ The following fields are available:
### Common Data Extensions.CUET
-
-
The following fields are available:
- **stId** Represents the Scenario Entry Point ID. This is a unique GUID for each event in a diagnostic scenario. This used to be Scenario Trigger ID.
@@ -101,12 +88,12 @@ The following fields are available:
- **epoch** Represents the epoch and seqNum fields, which help track how many events were fired and how many events were uploaded, and enables identification of data lost during upload and de-duplication of events on the ingress server.
- **seqNum** Represents the sequence field used to track absolute order of uploaded events. It is an incrementing identifier for each event added to the upload queue. The Sequence helps track how many events were fired and how many events were uploaded and enables identification of data lost during upload and de-duplication of events on the ingress server.
- **iKey** Represents an ID for applications or other logical groupings of events.
-- **flags** Represents a collection of bits that describe how the event should be processed by the Connected User Experience and Telemetry component pipeline. The lowest-order byte is the event persistence. The next byte is the event latency.
+- **flags** Represents a collection of bits that describe how the event should be processed by the Connected User Experiences and Telemetry component pipeline. The lowest-order byte is the event persistence. The next byte is the event latency.
- **os** Represents the operating system name.
- **osVer** Represents the OS version, and its format is OS dependent.
- **appId** Represents a unique identifier of the client application currently loaded in the process producing the event; and is used to group events together and understand usage pattern, errors by application.
- **appVer** Represents the version number of the application. Used to understand errors by Version, Usage by Version across an app.
-- **cV** Represents the Correlation Vector: A single field for tracking partial order of related telemetry events across component boundaries.
+- **cV** Represents the Correlation Vector: A single field for tracking partial order of related diagnostic data events across component boundaries.
### Common Data Extensions.OS
@@ -148,7 +135,7 @@ The following fields are available:
### Common Data Extensions.Consent UI Event
-This User Account Control (UAC) telemetry point collects information on elevations that originate from low integrity levels. This occurs when a process running at low integrity level (IL) requires higher (administrator) privileges, and therefore requests for elevation via UAC (consent.exe). By better understanding the processes requesting these elevations, Microsoft can in turn improve the detection and handling of potentially malicious behavior in this path.
+This User Account Control (UAC) diagnostic data point collects information on elevations that originate from low integrity levels. This occurs when a process running at low integrity level (IL) requires higher (administrator) privileges, and therefore requests for elevation via UAC (consent.exe). By better understanding the processes requesting these elevations, Microsoft can in turn improve the detection and handling of potentially malicious behavior in this path.
The following fields are available:
@@ -211,7 +198,7 @@ The following fields are available:
- **HKCU_FlipAhead.HRESULT** The error code returned when trying to query Flip Ahead for the current user.
- **HKLM_TailoredExperiences.TailoredExperiencesWithDiagnosticDataEnabled** Is Tailored Experiences with Diagnostics Data enabled for the current user after the feature update had completed?
- **HKCU_TailoredExperiences.HRESULT** The error code returned when trying to query Tailored Experiences with Diagnostics Data for the current user.
-- **HKLM_AdvertisingID.Enabled** Is the adveristing ID enabled for the device?
+- **HKLM_AdvertisingID.Enabled** Is the adverising ID enabled for the device?
- **HKLM_AdvertisingID.HRESULT** The error code returned when trying to query the state of the advertising ID for the device.
- **HKCU_AdvertisingID.Enabled** Is the adveristing ID enabled for the current user?
- **HKCU_AdvertisingID.HRESULT** The error code returned when trying to query the state of the advertising ID for the user.
@@ -253,84 +240,291 @@ The following fields are available:
## Appraiser events
-### Microsoft.Windows.Appraiser.General.RunContext
+### Microsoft.Windows.Appraiser.General.ChecksumTotalPictureCount
-"This event indicates what should be expected in the data payload. "
+This event lists the types of objects and how many of each exist on the client device. This allows for a quick way to ensure that the records present on the server match what is present on the client.
The following fields are available:
-- **AppraiserBranch** The source branch in which the currently running version of Appraiser was built.
-- **AppraiserProcess** The name of the process that launched Appraiser.
-- **AppraiserVersion** The version of the Appraiser file generating the events.
-- **Context** Indicates what mode Appraiser is running in. Example: Setup or Telemetry.
-- **PCFP** An ID for the system calculated by hashing hardware identifiers.
-- **Time** The client time of the event.
+- **DatasourceApplicationFile_RS3** The total DecisionApplicationFile objects targeting the next release of Windows on this device. on this device.
+- **DatasourceDevicePnp_RS3** The total DatasourceDevicePnp objects targeting the next release of Windows on this device.
+- **DatasourceDriverPackage_RS3** The total DatasourceDriverPackage objects targeting the next release of Windows on this device.
+- **DataSourceMatchingInfoBlock_RS3** The total DataSourceMatchingInfoBlock objects targeting the next release of Windows on this device.
+- **DataSourceMatchingInfoPassive_RS3** The total DataSourceMatchingInfoPassive objects targeting the next release of Windows on this device.
+- **DataSourceMatchingInfoPostUpgrade_RS3** The total DataSourceMatchingInfoPostUpgrade objects targeting the next release of Windows on this device.
+- **DatasourceSystemBios_RS3** The total DatasourceSystemBios objects targeting the next release of Windows on this device.
+- **DecisionApplicationFile_RS3** The total DecisionApplicationFile objects targeting the next release of Windows on this device.
+- **DecisionDevicePnp_RS3** The total DecisionDevicePnp objects targeting the next release of Windows on this device.
+- **DecisionDriverPackage_RS3** The total DecisionDriverPackage objects targeting the next release of Windows on this device.
+- **DecisionMatchingInfoBlock_RS3** The total DecisionMatchingInfoBlock objects targeting the next release of Windows on this device.
+- **DecisionMatchingInfoPassive_RS3** The total DataSourceMatchingInfoPostUpgrade objects targeting the next release of Windows on this device.
+- **DecisionMatchingInfoPostUpgrade_RS3** The total DecisionMatchingInfoPostUpgrade objects targeting the next release of Windows on this device.
+- **DecisionMediaCenter_RS3** The total DecisionMediaCenter objects targeting the next release of Windows on this device.
+- **DecisionSystemBios_RS3** The total DecisionSystemBios objects targeting the next release of Windows on this device.
+- **PCFP** An ID for the system that is calculated by hashing hardware identifiers.
+- **InventoryApplicationFile** The total InventoryApplicationFile objects that are present on this device.
+- **InventoryMediaCenter** The total InventoryMediaCenter objects that are present on this device.
+- **InventoryLanguagePack** The total InventoryLanguagePack objects that are present on this device.
+- **InventoryUplevelDriverPackage** The total InventoryUplevelDriverPackage objects that are present on this device.
+- **InventorySystemBios** The total InventorySystemBios objects that are present on this device.
+- **SystemProcessorCompareExchange** The total SystemProcessorCompareExchange objects that are present on this device.
+- **SystemProcessorLahfSahf** The total SystemProcessorLahfSahf objects that are present on this device.
+- **SystemMemory** The total SystemMemory objects that are present on this device.
+- **SystemProcessorPrefetchW** The total SystemProcessorPrefetchW objects that are present on this device.
+- **SystemProcessorSse2** The total SystemProcessorSse2 objects that are present on this device.
+- **SystemProcessorNx** The total SystemProcessorNx objects that are present on this device.
+- **SystemWlan** The total SystemWlan objects that are present on this device.
+- **SystemWim** The total SystemWim objects that are present on this device
+- **SystemTouch** The total SystemTouch objects that are present on this device.
+- **SystemWindowsActivationStatus** The total SystemWindowsActivationStatus objects that are present on this device.
+- **Wmdrm_RS3** The total Wmdrm objects targeting the next release of Windows on this device.
-### Microsoft.Windows.Appraiser.General.TelemetryRunHealth
+### Microsoft.Windows.Appraiser.General.ChecksumTotalPictureIdHashSha256
-A summary event indicating the parameters and result of a telemetry run. This allows the rest of the data sent over the course of the run to be properly contextualized and understood, which is then used to keep Windows up-to-date.
+This event lists the types of objects and the hashed values of all the identifiers for each one. This allows for a more in-depth way to ensure that the records present on the server match what is present on the client.
The following fields are available:
-- **AppraiserBranch** The source branch in which the version of Appraiser that is running was built.
-- **AppraiserDataVersion** The version of the data files being used by the Appraiser telemetry run.
-- **AppraiserProcess** The name of the process that launched Appraiser.
-- **AppraiserVersion** The file version (major, minor and build) of the Appraiser DLL, concatenated without dots.
-- **AuxFinal** Obsolete, always set to false
-- **AuxInitial** Obsolete, indicates if Appraiser is writing data files to be read by the Get Windows 10 app.
-- **DeadlineDate** A timestamp representing the deadline date, which is the time until which appraiser will wait to do a full scan.
-- **EnterpriseRun** Indicates if the telemetry run is an enterprise run, which means appraiser was run from the command line with an extra enterprise parameter.
-- **FullSync** Indicates if Appraiser is performing a full sync, which means that full set of events representing the state of the machine are sent. Otherwise, only the changes from the previous run are sent.
-- **InventoryFullSync** Indicates if inventory is performing a full sync, which means that the full set of events representing the inventory of machine are sent.
-- **PCFP** An ID for the system calculated by hashing hardware identifiers.
-- **PerfBackoff** Indicates if the run was invoked with logic to stop running when a user is present. Helps to understand why a run may have a longer elapsed time than normal.
-- **PerfBackoffInsurance** Indicates if appraiser is running without performance backoff because it has run with perf backoff and failed to complete several times in a row.
-- **RunAppraiser** Indicates if Appraiser was set to run at all. If this if false, it is understood that data events will not be received from this device.
-- **RunDate** The date that the telemetry run was stated, expressed as a filetime.
-- **RunGeneralTel** Indicates if the generaltel.dll component was run. Generaltel collects additional telemetry on an infrequent schedule and only from machines at telemetry levels higher than Basic.
-- **RunOnline** Indicates if appraiser was able to connect to Windows Update and theefore is making decisions using up-to-date driver coverage information.
-- **RunResult** The hresult of the Appraiser telemetry run.
-- **SendingUtc** Indicates if the Appraiser client is sending events during the current telemetry run.
-- **StoreHandleIsNotNull** Obsolete, always set to false
-- **TelementrySent** Indicates if telemetry was successfully sent.
-- **ThrottlingUtc** Indicates if the Appraiser client is throttling its output of CUET events to avoid being disabled. This increases runtime but also telemetry reliability.
-- **Time** The client time of the event.
-- **VerboseMode** Indicates if appraiser ran in Verbose mode, which is a test-only mode with extra logging.
-- **WhyFullSyncWithoutTablePrefix** Indicates the reason or reasons that a full sync was generated.
+- **DatasourceApplicationFile_RS3** The total DatasourceApplicationFile objects targeting the next release of Windows on this device.
+- **DatasourceDevicePnp_RS3** The total DatasourceDevicePnp objects targeting the next release of Windows on this device.
+- **DatasourceDriverPackage_RS3** The total DatasourceDriverPackage objects targeting the next release of Windows on this device.
+- **DataSourceMatchingInfoBlock_RS3** The total DataSourceMatchingInfoBlock objects targeting the next release of Windows on this device.
+- **DataSourceMatchingInfoPassive_RS3** The total DataSourceMatchingInfoPassive objects targeting the next release of Windows on this device.
+- **DataSourceMatchingInfoPostUpgrade_RS3** The total DataSourceMatchingInfoPostUpgrade objects targeting the next release of Windows on this device.
+- **DatasourceSystemBios_RS3** The total DatasourceSystemBios objects targeting the next release of Windows on this device.
+- **DecisionApplicationFile_RS3** The total DecisionApplicationFile objects targeting the next release of Windows on this device.
+- **DecisionDevicePnp_RS3** The total DecisionDevicePnp objects targeting the next release of Windows on this device.
+- **DecisionDriverPackage_RS3** The total DecisionDriverPackage objects targeting the next release of Windows on this device.
+- **DecisionMatchingInfoBlock_RS3** The total DecisionMatchingInfoBlock objects targeting the next release of Windows on this device.
+- **DecisionMatchingInfoPassive_RS3** The total DataSourceMatchingInfoPostUpgrade objects targeting the next release of Windows on this device.
+- **DecisionMatchingInfoPostUpgrade_RS3** The total DecisionMatchingInfoPostUpgrade objects targeting the next release of Windows on this device.
+- **DecisionMediaCenter_RS3** The total DecisionMediaCenter objects targeting the next release of Windows on this device.
+- **DecisionSystemBios_RS3** The total DecisionSystemBios objects targeting the next release of Windows on this device.
+- **PCFP** An ID for the system that is calculated by hashing hardware identifiers.
+- **InventoryApplicationFile** The SHA256 hash of InventoryApplicationFile objects that are present on this device.
+- **InventoryMediaCenter** The SHA256 hash of InventoryMediaCenter objects that are present on this device.
+- **InventoryLanguagePack** The SHA256 hash of InventoryLanguagePack objects that are present on this device.
+- **InventoryUplevelDriverPackage** The SHA256 hash of InventoryUplevelDriverPackage objects that are present on this device.
+- **InventorySystemBios** The SHA256 hash of InventorySystemBios objects that are present on this device.
+- **SystemProcessorCompareExchange** The SHA256 hash of SystemProcessorCompareExchange objects that are present on this device.
+- **SystemProcessorLahfSahf** The SHA256 hash of SystemProcessorLahfSahf objects that are present on this device.
+- **SystemMemory** The SHA256 hash of SystemMemory objects that are present on this device.
+- **SystemProcessorPrefetchW** The SHA256 hash of SystemProcessorPrefetchW objects that are present on this device.
+- **SystemProcessorSse2** The SHA256 hash of SystemProcessorSse2 objects that are present on this device.
+- **SystemProcessorNx** The SHA256 hash of SystemProcessorNx objects that are present on this device.
+- **SystemWlan** The SHA256 hash of SystemWlan objects that are present on this device.
+- **SystemWim** The SHA256 hash of SystemWim objects that are present on this device.
+- **SystemTouch** The SHA256 hash of SystemTouch objects that are present on this device.
+- **SystemWindowsActivationStatus** The SHA256 hash of SystemWindowsActivationStatus objects that are present on this device.
+- **Wmdrm_RS3** The total Wmdrm objects targeting the next release of Windows on this device.
-### Microsoft.Windows.Appraiser.General.EnterpriseScenarioWithDiagTrackServiceRunning
+### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileAdd
-The event that indicates that Appraiser has been triggered to run an enterprise scenario while the DiagTrack service is installed. This event can only be sent if a special flag is used to trigger the enterprise scenario.
+This event sends compatibility information about a file to help keep Windows up-to-date.
The following fields are available:
-- **PCFP** An ID for the system calculated by hashing hardware identifiers.
-- **Time** The client time of the event.
+- **AppraiserVersion** The version of the appraiser file that is generating the events.
+- **AvDisplayName** If it is an anti-virus app, this is its display name.
+- **CompatModelIndex** The compatibility prediction for this file.
+- **HasCitData** Is the file present in CIT data?
+- **HasUpgradeExe** Does the anti-virus app have an upgrade.exe file?
+- **IsAv** Is the file an anti-virus reporting EXE?
+- **ResolveAttempted** This will always be an empty string when sending diagnostic data.
+- **SdbEntries** An array of fields that indicates the SDB entries that apply to this file.
-### Microsoft.Windows.Appraiser.General.InventoryApplicationFileAdd
+### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileRemove
-This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or are part of an anti-virus program.
+This event indicates that the DatasourceApplicationFile object is no longer present.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileStartSync
+
+This event indicates that a new set of DatasourceApplicationFileAdd events will be sent.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpAdd
+
+This event sends compatibility data for a PNP device, to help keep Windows up-to-date.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the appraiser file generating the events.
+- **ActiveNetworkConnection** Is the device an active network device?
+- **IsBootCritical** Is the device boot critical?
+- **SdbEntries** An array of fields indicating the SDB entries that apply to this device.
+- **WuDriverCoverage** Is there a driver uplevel for this device according to Windows Update?
+- **WuDriverUpdateID** The Windows Update ID of the applicable uplevel driver.
+- **WuPopulatedFromID** The expected uplevel driver matching ID based on driver coverage from Windows Update.
+
+
+### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpRemove
+
+This event indicates that the DatasourceDevicePnp object is no longer present.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpStartSync
+
+This event indicates that a new set of DatasourceDevicePnpAdd events will be sent.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageAdd
+
+This event sends compatibility database data about driver packages to help keep Windows up-to-date.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the appraiser file generating the events.
+- **SdbEntries** An array of fields indicating the SDB entries that apply to this driver package.
+
+
+### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageRemove
+
+This event indicates that the DatasourceDriverPackage object is no longer present.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageStartSync
+
+This event indicates that a new set of DatasourceDriverPackageAdd events will be sent.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockAdd
+
+This event sends blocking data about any compatibility blocking entries hit on the system that are not directly related to specific applications or devices, to help keep Windows up-to-date.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the appraiser file generating the events.
+- **SdbEntries** An array of fields indicating the SDB entries that apply to this file.
+
+
+### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockRemove
+
+This event indicates that the DataSourceMatchingInfoBlock object is no longer present.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockStartSync
+
+This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events have been sent.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveAdd
+
+This event sends compatibility database information about non-blocking compatibility entries on the system that are not keyed by either applications or devices, to help keep Windows up-to-date.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the appraiser file generating the events.
+- **SdbEntries** An array of fields indicating the SDB entries that apply to this file.
+
+
+### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveRemove
+
+This event indicates that the DataSourceMatchingInfoPassive object is no longer present.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveStartSync
+
+This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeAdd
+
+This event sends compatibility database information about entries requiring reinstallation after an upgrade on the system that are not keyed by either applications or devices, to help keep Windows up-to-date.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the appraiser file generating the events.
+- **SdbEntries** An array of fields indicating the SDB entries that apply to this file.
+
+
+### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeRemove
+
+This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeStartSync
+
+This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosAdd
+
+This event sends compatibility database information about the BIOS to help keep Windows up-to-date.
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file generating the events.
-- **BinaryType** A binary type. Example: UNINITIALIZED, ZERO_BYTE, DATA_ONLY, DOS_MODULE, NE16_MODULE, PE32_UNKNOWN, PE32_I386, PE32_ARM, PE64_UNKNOWN, PE64_AMD64, PE64_ARM64, PE64_IA64, PE32_CLR_32, PE32_CLR_IL, PE32_CLR_IL_PREFER32, PE64_CLR_64
-- **BinFileVersion** An attempt to clean up FileVersion at the client that tries to place the version into 4 octets.
-- **BinProductVersion** An attempt to clean up ProductVersion at the client that tries to place the version into 4 octets.
-- **BoeProgramId** If there is no entry in Add/Remove Programs, this is the ProgramID that is generated from the file metadata.
-- **CompanyName** The company name of the vendor who developed this file.
-- **FileId** A hash that uniquely identifies a file.
-- **FileVersion** The File version field from the file metadata under Properties -> Details.
-- **LinkDate** The date and time that this file was linked on.
-- **LowerCaseLongPath** The full file path to the file that was inventoried on the device.
-- **Name** The name of the file that was inventoried.
-- **ProductName** The Product name field from the file metadata under Properties -> Details.
-- **ProductVersion** The Product version field from the file metadata under Properties -> Details.
-- **ProgramId** A hash of the Name, Version, Publisher, and Language of an application used to identify it.
-- **Size** The size of the file (in hexadecimal bytes).
+- **SdbEntries** An array of fields indicating the SDB entries that apply to this BIOS.
+
+
+### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosRemove
+
+This event indicates that the DatasourceSystemBios object is no longer present.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosStartSync
+
+This event indicates that a new set of DatasourceSystemBiosAdd events will be sent.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
### Microsoft.Windows.Appraiser.General.DecisionApplicationFileAdd
@@ -359,13 +553,98 @@ The following fields are available:
- **SdbReinstallUpgradeWarn** The file is tagged as needing to be reinstalled after upgrade with a warning in the SDB. It does not block upgrade.
- **SoftBlock** The file is softblocked in the SDB and has a warning.
-### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockAdd
-This event sends blocking data about any compatibility blocking entries hit on the system that are not directly related to specific applications or devices, to help keep Windows up-to-date.
+### Microsoft.Windows.Appraiser.General.DecisionApplicationFileRemove
+
+This event indicates Indicates that the DecisionApplicationFile object is no longer present.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DecisionApplicationFileStartSync
+
+This event indicates that a new set of DecisionApplicationFileAdd events will be sent.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DecisionDevicePnpAdd
+
+This event sends compatibility decision data about a PNP device to help keep Windows up-to-date.
The following fields are available:
- **AppraiserVersion** The version of the appraiser file generating the events.
+- **AssociatedDriverIsBlocked** Is the driver associated with this PNP device blocked?
+- **BlockAssociatedDriver** Should the driver associated with this PNP device be blocked?
+- **BlockUpgradeIfDriverBlocked** Is the PNP device both boot critical and does not have a driver included with the OS?
+- **BlockUpgradeIfDriverBlockedAndOnlyActiveNetwork** Is this PNP device the only active network device?
+- **BlockingDevice** Is this PNP device blocking upgrade?
+- **DisplayGenericMessage** Will a generic message be shown during Setup for this PNP device?
+- **DriverAvailableInbox** Is a driver included with the operating system for this PNP device?
+- **DriverAvailableOnline** Is there a driver for this PNP device on Windows Update?
+- **DriverAvailableUplevel** Is there a driver on Windows Update or included with the operating system for this PNP device?
+- **DriverBlockOverridden** Is there is a driver block on the device that has been overridden?
+- **NeedsDismissAction** Will the user would need to dismiss a warning during Setup for this device?
+- **NotRegressed** Does the device have a problem code on the source OS that is no better than the one it would have on the target OS?
+- **SdbDeviceBlockUpgrade** Is there an SDB block on the PNP device that blocks upgrade?
+- **SdbDriverBlockOverridden** Is there an SDB block on the PNP device that blocks upgrade, but that block was overridden?
+- **AssociatedDriverWillNotMigrate** Will the driver associated with this plug-and-play device migrate?
+
+
+### Microsoft.Windows.Appraiser.General.DecisionDevicePnpRemove
+
+This event indicates that the DecisionDevicePnp object is no longer present.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DecisionDevicePnpStartSync
+
+This event indicates that the DecisionDevicePnp object is no longer present.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DecisionDriverPackageAdd
+
+This event sends decision data about driver package compatibility to help keep Windows up-to-date.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the appraiser file generating the events.
+- **DriverBlockOverridden** Does the driver package have an SDB block that blocks it from migrating, but that block has been overridden?
+- **DriverIsDeviceBlocked** Was the driver package was blocked because of a device block?
+- **DriverIsDriverBlocked** Is the driver package blocked because of a driver block?
+- **DriverShouldNotMigrate** Should the driver package be migrated during upgrade?
+- **SdbDriverBlockOverridden** Does the driver package have an SDB block that blocks it from migrating, but that block has been overridden?
+
+
+### Microsoft.Windows.Appraiser.General.DecisionDriverPackageRemove
+
+This event indicates that the DecisionDriverPackage object is no longer present.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DecisionDriverPackageStartSync
+
+This event indicates that a new set of DecisionDriverPackageAdd events will be sent.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockAdd
@@ -382,13 +661,23 @@ The following fields are available:
- **SdbBlockUpgradeUntilUpdate** Is a matching info block blocking upgrade but has the until update tag?
-### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveAdd
+### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockRemove
-This event sends compatibility database information about non-blocking compatibility entries on the system that are not keyed by either applications or devices, to help keep Windows up-to-date.
+This event indicates that the DecisionMatchingInfoBlock object is no longer present.
The following fields are available:
-- **AppraiserVersion** The version of the appraiser file generating the events.
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockStartSync
+
+This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveAdd
@@ -401,13 +690,22 @@ The following fields are available:
- **MigApplication** Is there a matching info block with a mig for the current mode of upgrade?
-### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeAdd
+### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveRemove
-This event sends compatibility database information about entries requiring reinstallation after an upgrade on the system that are not keyed by either applications or devices, to help keep Windows up-to-date.
+This event Indicates that the DecisionMatchingInfoPassive object is no longer present.
The following fields are available:
-- **AppraiserVersion** The version of the appraiser file generating the events.
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveStartSync
+
+This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeAdd
@@ -423,93 +721,55 @@ The following fields are available:
- **SdbReinstallUpgrade** The file is tagged as needing to be reinstalled after upgrade in the compatibility database (but is not blocking upgrade).
-### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpAdd
+### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeRemove
-This event sends compatibility data for a PNP device, to help keep Windows up-to-date.
-
-The following fields are available:
-
-- **ActiveNetworkConnection** Is the device an active network device?
-- **AppraiserVersion** The version of the appraiser file generating the events.
-- **IsBootCritical** Is the device boot critical?
-- **WuDriverCoverage** Is there a driver uplevel for this device according to Windows Update?
-- **WuDriverUpdateId** The Windows Update ID of the applicable uplevel driver.
-- **WuPopulatedFromId** The expected uplevel driver matching ID based on driver coverage from Windows Update.
-
-
-### Microsoft.Windows.Appraiser.General.DecisionDevicePnpAdd
-
-This event sends compatibility decision data about a PNP device to help keep Windows up-to-date.
-
-The following fields are available:
-
-- **AssociatedDriverWillNotMigrate** Will the driver associated with this plug-and-play device migrate?
-- **AppraiserVersion** The version of the appraiser file generating the events.
-- **AssociatedDriverIsBlocked** Is the driver associated with this PNP device blocked?
-- **BlockAssociatedDriver** Should the driver associated with this PNP device be blocked?
-- **BlockingDevice** Is this PNP device blocking upgrade?
-- **BlockUpgradeIfDriverBlocked** Is the PNP device both boot critical and does not have a driver included with the OS?
-- **BlockUpgradeIfDriverBlockedAndOnlyActiveNetwork** Is this PNP device the only active network device?
-- **DisplayGenericMessage** Will a generic message be shown during Setup for this PNP device?
-- **DriverAvailableInbox** Is a driver included with the operating system for this PNP device?
-- **DriverAvailableOnline** Is there a driver for this PNP device on Windows Update?
-- **DriverAvailableUplevel** Is there a driver on Windows Update or included with the operating system for this PNP device?
-- **DriverBlockOverridden** Is there is a driver block on the device that has been overridden?
-- **NeedsDismissAction** Will the user would need to dismiss a warning during Setup for this device?
-- **NotRegressed** Does the device have a problem code on the source OS that is no better than the one it would have on the target OS?
-- **SdbDeviceBlockUpgrade** Is there an SDB block on the PNP device that blocks upgrade?
-- **SdbDriverBlockOverridden** Is there an SDB block on the PNP device that blocks upgrade, but that block was overridden?
-
-
-### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageAdd
-
-This event sends compatibility database data about driver packages to help keep Windows up-to-date.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the appraiser file generating the events.
-
-### Microsoft.Windows.Appraiser.General.DecisionDriverPackageAdd
-
-This event sends decision data about driver package compatibility to help keep Windows up-to-date.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the appraiser file generating the events.
-- **DriverBlockOverridden** Does the driver package have an SDB block that blocks it from migrating, but that block has been overridden?
-- **DriverIsDeviceBlocked** Was the driver package was blocked because of a device block?
-- **DriverIsDriverBlocked** Is the driver package blocked because of a driver block?
-- **DriverShouldNotMigrate** Should the driver package be migrated during upgrade?
-- **SdbDriverBlockOverridden** Does the driver package have an SDB block that blocks it from migrating, but that block has been overridden?
-
-
-### Microsoft.Windows.Appraiser.General.InventorySystemBiosAdd
-
-This event sends basic metadata about the BIOS to determine whether it has a compatibility block.
+This event indicates that the DecisionMatchingInfoPostUpgrade object is no longer present.
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-- **BiosDate** The release date of the BIOS in UTC format.
-- **BiosName** The name field from Win32_BIOS.
-- **Manufacturer** The manufacturer field from Win32_ComputerSystem.
-- **Model** The model field from Win32_ComputerSystem.
-### Microsoft.Windows.Appraiser.General.SystemMemoryAdd
+### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeStartSync
-This event sends data on the amount of memory on the system and whether it meets requirements, to help keep Windows up-to-date.
+This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DecisionMediaCenterAdd
+
+This event sends decision data about the presence of Windows Media Center, to help keep Windows up-to-date.
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file generating the events.
-- **Blocking** Is the device from upgrade due to memory restrictions?
-- **MemoryRequirementViolated** Was a memory requirement violated?
-- **pageFile** The current committed memory limit for the system or the current process, whichever is smaller (in bytes).
-- **ram** The amount of memory on the device.
-- **ramKB** The amount of memory (in KB).
-- **virtual** The size of the user-mode portion of the virtual address space of the calling process (in bytes).
-- **virtualKB** The amount of virtual memory (in KB).
+- **BlockingApplication** Is there any application issues that interfere with upgrade due to Windows Media Center?
+- **MediaCenterActivelyUsed** If Windows Media Center is supported on the edition, has it been run at least once and are the MediaCenterIndicators are true?
+- **MediaCenterInUse** Is Windows Media Center actively being used?
+- **MediaCenterIndicators** Do any indicators imply that Windows Media Center is in active use?
+- **MediaCenterPaidOrActivelyUsed** Is Windows Media Center actively being used or is it running on a supported edition?
+- **NeedsDismissAction** Are there any actions that can be dismissed coming from Windows Media Center?
+
+
+### Microsoft.Windows.Appraiser.General.DecisionMediaCenterRemove
+
+This event indicates that the DecisionMediaCenter object is no longer present.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DecisionMediaCenterStartSync
+
+This event indicates that a new set of DecisionMediaCenterAdd events will be sent.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
### Microsoft.Windows.Appraiser.General.DecisionSystemBiosAdd
@@ -523,101 +783,87 @@ The following fields are available:
- **HasBiosBlock** Does the device have a BIOS block?
-### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosAdd
+### Microsoft.Windows.Appraiser.General.DecisionSystemBiosRemove
-This event sends compatibility database information about the BIOS to help keep Windows up-to-date.
+This event indicates that the DecisionSystemBios object is no longer present.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DecisionSystemBiosStartSync
+
+This event indicates that a new set of DecisionSystemBiosAdd events will be sent.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.EnterpriseScenarioWithDiagTrackServiceRunning
+
+The event that indicates that Appraiser has been triggered to run an enterprise scenario while the DiagTrack service is installed. This event can only be sent if a special flag is used to trigger the enterprise scenario.
+
+The following fields are available:
+
+- **Time** The client time of the event.
+- **PCFP** An ID for the system calculated by hashing hardware identifiers.
+
+
+### Microsoft.Windows.Appraiser.General.GatedRegChange
+
+This event sends data about the results of running a set of quick-blocking instructions, to help keep Windows up to date.
+
+The following fields are available:
+
+- **Time** The client time of the event.
+- **PCFP** An ID for the system calculated by hashing hardware identifiers.
+- **RegKey** The registry key name for which a result is being sent.
+- **RegValue** The registry value for which a result is being sent.
+- **OldData** The previous data in the registry value before the scan ran.
+- **NewData** The data in the registry value after the scan completed.
+
+
+### Microsoft.Windows.Appraiser.General.InventoryApplicationFileAdd
+
+This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or are part of an anti-virus program.
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file generating the events.
-- **SdbEntries** An array of fields indicating the SDB entries that apply to this BIOS.
-
-### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeAdd
-
-This event sends data indicating whether the system supports the CompareExchange128 CPU requirement, to help keep Windows up to date.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file generating the events.
-- **Blocking** Is the upgrade blocked due to the processor?
-- **CompareExchange128Support** Does the CPU support CompareExchange128?
+- **BinFileVersion** An attempt to clean up FileVersion at the client that tries to place the version into 4 octets.
+- **BinProductVersion** An attempt to clean up ProductVersion at the client that tries to place the version into 4 octets.
+- **BinaryType** A binary type. Example: UNINITIALIZED, ZERO_BYTE, DATA_ONLY, DOS_MODULE, NE16_MODULE, PE32_UNKNOWN, PE32_I386, PE32_ARM, PE64_UNKNOWN, PE64_AMD64, PE64_ARM64, PE64_IA64, PE32_CLR_32, PE32_CLR_IL, PE32_CLR_IL_PREFER32, PE64_CLR_64
+- **BoeProgramId** If there is no entry in Add/Remove Programs, this is the ProgramID that is generated from the file metadata.
+- **CompanyName** The company name of the vendor who developed this file.
+- **FileId** A hash that uniquely identifies a file.
+- **FileVersion** The File version field from the file metadata under Properties -> Details.
+- **LinkDate** The date and time that this file was linked on.
+- **LowerCaseLongPath** The full file path to the file that was inventoried on the device.
+- **Name** The name of the file that was inventoried.
+- **ProductName** The Product name field from the file metadata under Properties -> Details.
+- **ProductVersion** The Product version field from the file metadata under Properties -> Details.
+- **ProgramId** A hash of the Name, Version, Publisher, and Language of an application used to identify it.
+- **Size** The size of the file (in hexadecimal bytes).
-### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfAdd
+### Microsoft.Windows.Appraiser.General.InventoryApplicationFileRemove
-This event sends data indicating whether the system supports the LahfSahf CPU requirement, to help keep Windows up-to-date.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file generating the events.
-- **Blocking** Is the upgrade blocked due to the processor?
-- **LahfSahfSupport** Does the CPU support LAHF/SAHF?
-
-### Microsoft.Windows.Appraiser.General.SystemProcessorNxAdd
-
-This event sends data indicating whether the system supports the NX CPU requirement, to help keep Windows up-to-date.
+This event indicates that the InventoryApplicationFile object is no longer present.
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-- **Blocking** Is the upgrade blocked due to the processor?
-- **NXDriverResult** The result of the driver used to do a non-deterministic check for NX support.
-- **NXProcessorSupport** Does the processor support NX?
-### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWAdd
+### Microsoft.Windows.Appraiser.General.InventoryApplicationFileStartSync
-This event sends data indicating whether the system supports the PrefetchW CPU requirement, to help keep Windows up-to-date.
+This event indicates indicates that a new set of InventoryApplicationFileAdd events will be sent.
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-- **Blocking** Is the upgrade blocked due to the processor?
-- **PrefetchWSupport** Does the processor support PrefetchW?
-
-
-### Microsoft.Windows.Appraiser.General.SystemProcessorSse2Add
-
-This event sends data indicating whether the system supports the SSE2 CPU requirement, to help keep Windows up-to-date.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-- **Blocking** Is the upgrade blocked due to the processor?
-- **SSE2ProcessorSupport** Does the processor support SSE2?
-
-
-### Microsoft.Windows.Appraiser.General.SystemWimAdd
-
-This event sends data indicating whether the operating system is running from a compressed WIM file, to help keep Windows up-to-date.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-- **IsWimBoot** Is the current operating system running from a compressed WIM file?
-- **RegistryWimBootValue** The raw value from the registry that is used to indicate if the device is running from a WIM.
-
-
-### Microsoft.Windows.Appraiser.General.SystemTouchAdd
-
-This event sends data indicating whether the system supports touch, to help keep Windows up-to-date.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-- **IntegratedTouchDigitizerPresent** Is there an integrated touch digitizer?
-- **MaximumTouches** The maximum number of touch points supported by the device hardware.
-
-
-### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusAdd
-
-This event sends data indicating whether the current operating system is activated, to help keep Windows up-to-date.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-- **WindowsIsLicensedApiValue** The result from the API that's used to indicate if operating system is activated.
-- **WindowsNotActivatedDecision** Is the current operating system activated?
### Microsoft.Windows.Appraiser.General.InventoryLanguagePackAdd
@@ -631,19 +877,22 @@ The following fields are available:
- **LanguagePackCount** How many language packs are installed?
-### Microsoft.Windows.Appraiser.General.SystemWlanAdd
+### Microsoft.Windows.Appraiser.General.InventoryLanguagePackRemove
-This event sends data indicating whether the system has WLAN, and if so, whether it uses an emulated driver that could block an upgrade, to help keep Windows up-to-date.
+This event indicates that the InventoryLanguagePack object is no longer present.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.InventoryLanguagePackStartSync
+
+This event indicates that a new set of InventoryLanguagePackAdd events will be sent.
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-- **Blocking** Is the upgrade blocked because of an emulated WLAN driver?
-- **HasWlanBlock** Does the emulated WLAN driver have an upgrade block?
-- **WlanEmulatedDriver** Does the device have an emulated WLAN driver?
-- **WlanExists** Does the device support WLAN at all?
-- **WlanModulePresent** Are any WLAN modules present?
-- **WlanNativeDriver** Does the device have a non-emulated WLAN driver?
### Microsoft.Windows.Appraiser.General.InventoryMediaCenterAdd
@@ -662,75 +911,85 @@ The following fields are available:
- **IsSupported** Does the running OS support Windows Media Center?
-### Microsoft.Windows.Appraiser.General.DecisionMediaCenterAdd
+### Microsoft.Windows.Appraiser.General.InventoryMediaCenterRemove
-This event sends decision data about the presence of Windows Media Center, to help keep Windows up-to-date.
+This event indicates that the InventoryMediaCenter object is no longer present.
The following fields are available:
-- **AppraiserVersion** The version of the Appraiser file generating the events.
-- **BlockingApplication** Is there any application issues that interfere with upgrade due to Windows Media Center?
-- **MediaCenterActivelyUsed** If Windows Media Center is supported on the edition, has it been run at least once and are the MediaCenterIndicators are true?
-- **MediaCenterIndicators** Do any indicators imply that Windows Media Center is in active use?
-- **MediaCenterInUse** Is Windows Media Center actively being used?
-- **MediaCenterPaidOrActivelyUsed** Is Windows Media Center actively being used or is it running on a supported edition?
-- **NeedsDismissAction** Are there any actions that can be dismissed coming from Windows Media Center?
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-### Microsoft.Windows.Appraiser.General.ChecksumTotalPictureCount
+### Microsoft.Windows.Appraiser.General.InventoryMediaCenterStartSync
-This event lists the types of objects and how many of each exist on the client device. This allows for a quick way to ensure that the records present on the server match what is present on the client.
+This event indicates that a new set of InventoryMediaCenterAdd events will be sent.
The following fields are available:
-- **DatasourceApplicationFile_RS2** The total DatasourceApplicationFile objects targeting Windows 10 version 1703 present on this device.
-- **DatasourceDevicePnp_RS2** The total DatasourceDevicePnp objects targeting Windows 10 version 1703 present on this device.
-- **DatasourceDriverPackage_RS2** The total DatasourceDriverPackage objects targeting Windows 10 version 1703 present on this device.
-- **DataSourceMatchingInfoBlock_RS2** The total DataSourceMatchingInfoBlock objects targeting Windows 10 version 1703 present on this device.
-- **DataSourceMatchingInfoPassive_RS2** The total DataSourceMatchingInfoPassive objects targeting Windows 10 version 1703 present on this device.
-- **DataSourceMatchingInfoPostUpgrade_RS2** The total DataSourceMatchingInfoPostUpgrade objects targeting Windows 10 version 1703 present on this device.
-- **DatasourceSystemBios_RS2** The total DatasourceSystemBios objects targeting Windows 10 version 1703 present on this device.
-- **DecisionApplicationFile_RS2** The total DecisionApplicationFile objects targeting Windows 10 version 1703 present on this device.
-- **DecisionDevicePnp_RS2** The total DecisionDevicePnp objects targeting Windows 10 version 1703 present on this device.
-- **DecisionDriverPackage_RS2** The total DecisionDriverPackage objects targeting Windows 10 version 1703 present on this device.
-- **DecisionMatchingInfoBlock_RS2** The total DecisionMatchingInfoBlock objects targeting Windows 10 version 1703 present on this device.
-- **DecisionMatchingInfoPassive_RS2** The total DecisionMatchingInfoPassive objects targeting Windows 10 version 1703 present on this device.
-- **DecisionMatchingInfoPostUpgrade_RS2** The total DecisionMatchingInfoPostUpgrade objects targeting Windows 10 version 1703 present on this device.
-- **DecisionMediaCenter_RS2** The total DecisionMediaCenter objects targeting Windows 10 version 1703 present on this device.
-- **DecisionSystemBios_RS2** The total DecisionSystemBios objects targeting Windows 10 version 1703 present on this device.
-- **InventoryApplicationFile** The total InventoryApplicationFile objects that are present on this device.
-- **InventoryLanguagePack** The total InventoryLanguagePack objects that are present on this device.
-- **InventoryMediaCenter** The total InventoryMediaCenter objects that are present on this device.
-- **InventorySystemBios** The total InventorySystemBios objects that are present on this device.
-- **InventoryUplevelDriverPackage** The total InventoryUplevelDriverPackage objects that are present on this device.
-- **PCFP** An ID for the system that is calculated by hashing hardware identifiers.
-- **SystemMemory** The total SystemMemory objects that are present on this device.
-- **SystemProcessorCompareExchange** The total SystemProcessorCompareExchange objects that are present on this device.
-- **SystemProcessorLahfSahf** The total SystemProcessorLahfSahf objects that are present on this device.
-- **SystemProcessorNx** The total SystemProcessorNx objects that are present on this device.
-- **SystemProcessorPrefetchW** The total SystemProcessorPrefetchW objects that are present on this device.
-- **SystemProcessorSse2** The total SystemProcessorSse2 objects that are present on this device.
-- **SystemTouch** The total SystemTouch objects that are present on this device.
-- **SystemWim** The total SystemWim objects that are present on this device
-- **SystemWindowsActivationStatus** The total SystemWindowsActivationStatus objects that are present on this device.
-- **SystemWlan** The total SystemWlan objects that are present on this device.
-- **Wmdrm_RS2** The total Wmdrm objects targeting Windows 10 version 1703 present on this device.
-- **DatasourceApplicationFile_RS3** "The total DecisionApplicationFile objects targeting the next release of Windows on this device. "
-- **DatasourceDevicePnp_RS3** The total DatasourceDevicePnp objects targeting the next release of Windows on this device.
-- **DatasourceDriverPackage_RS3** The total DatasourceDriverPackage objects targeting the next release of Windows on this device.
-- **DataSourceMatchingInfoBlock_RS3** The total DataSourceMatchingInfoBlock objects targeting the next release of Windows on this device.
-- **DataSourceMatchingInfoPassive_RS3** The total DataSourceMatchingInfoPassive objects targeting the next release of Windows on this device.
-- **DataSourceMatchingInfoPostUpgrade_RS3** The total DataSourceMatchingInfoPostUpgrade objects targeting the next release of Windows on this device.
-- **DatasourceSystemBios_RS3** The total DatasourceSystemBios objects targeting the next release of Windows on this device.
-- **DecisionApplicationFile_RS3** The total DecisionApplicationFile objects targeting the next release of Windows on this device.
-- **DecisionDevicePnp_RS3** The total DecisionDevicePnp objects targeting the next release of Windows on this device.
-- **DecisionDriverPackage_RS3** The total DecisionDriverPackage objects targeting the next release of Windows on this device.
-- **DecisionMatchingInfoBlock_RS3** The total DecisionMatchingInfoBlock objects targeting the next release of Windows on this device.
-- **DecisionMatchingInfoPassive_RS3** The total DataSourceMatchingInfoPassive objects targeting the next release of Windows on this device.
-- **DecisionMatchingInfoPostUpgrade_RS3** The total DecisionMatchingInfoPostUpgrade objects targeting the next release of Windows on this device.
-- **DecisionMediaCenter_RS3** The total DecisionMediaCenter objects targeting the next release of Windows on this device.
-- **DecisionSystemBios_RS3** The total DecisionSystemBios objects targeting the next release of Windows on this device.
-- **Wmdrm_RS3** The total Wmdrm objects targeting the next release of Windows on this device.
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.InventorySystemBiosAdd
+
+This event sends basic metadata about the BIOS to determine whether it has a compatibility block.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+- **BiosDate** The release date of the BIOS in UTC format.
+- **BiosName** The name field from Win32_BIOS.
+- **Manufacturer** The manufacturer field from Win32_ComputerSystem.
+- **Model** The model field from Win32_ComputerSystem.
+
+
+### Microsoft.Windows.Appraiser.General.InventorySystemBiosRemove
+
+This event indicates that the InventorySystemBios object is no longer present.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.InventorySystemBiosStartSync
+
+This event indicates that a new set of InventorySystemBiosAdd events will be sent.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageAdd
+
+This event is only runs during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. Is critical to understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+- **BootCritical** Is the driver package marked as boot critical?
+- **Build** The build value from the driver package.
+- **CatalogFile** The name of the catalog file within the driver package.
+- **ClassGuid** The device class GUID from the driver package.
+- **Class** The device class from the driver package.
+- **Date** The date from the driver package.
+- **SignatureStatus** Indicates if the driver package is signed. Unknown:0, Unsigned:1, Signed: 2
+- **Inbox** Is the driver package of a driver that is included with Windows?
+- **VersionMajor** The major version of the driver package.
+- **VersionMinor** The minor version of the driver package.
+- **OriginalName** The original name of the INF file before it was renamed. Generally a path under $WINDOWS.~BT\Drivers\DU
+- **Provider** The provider of the driver package.
+- **PublishedName** The name of the INF file, post-rename.
+- **Revision** The revision of the driver package.
+
+
+### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageRemove
+
+This event indicates that the InventoryUplevelDriverPackage object is no longer present.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageStartSync
@@ -742,6 +1001,140 @@ The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+### Microsoft.Windows.Appraiser.General.IsOnlineTelemetryOutputter
+
+This event indicates if Appraiser was able to connect successfully to Windows Update to get driver availability information.
+
+The following fields are available:
+
+- **Time** The client time of the event.
+- **PCFP** A unique hardware identifier that is calculated by hashing hardware identifiers.
+- **IsOnlineRun** Was the device able to connect to Windows Update to get driver availability information?
+
+
+### Microsoft.Windows.Appraiser.General.IsOnlineWuDriverDataSource
+
+This event indicates if Appraiser was able to connect to Windows Update to gather driver coverage information.
+
+The following fields are available:
+
+- **Time** The client time of the event.
+- **PCFP** A unique hardware identifier that is calculated by hashing hardware identifiers.
+- **IsOnlineRun** Was the device able to connect to Windows Update to get driver availability information?
+- **TargetVersion** The abbreviated name for the OS version against which Windows Update was queried.
+
+
+### Microsoft.Windows.Appraiser.General.RunContext
+
+This event indicates what should be expected in the data payload.
+
+The following fields are available:
+
+- **AppraiserBranch** The source branch in which the currently running version of Appraiser was built.
+- **AppraiserVersion** The version of the Appraiser file generating the events.
+- **Context** Indicates what mode Appraiser is running in. Example: Setup or Diagnostic Data.
+- **Time** The client time of the event.
+- **AppraiserProcess** The name of the process that launched Appraiser.
+- **PCFP** An ID for the system calculated by hashing hardware identifiers.
+
+
+### Microsoft.Windows.Appraiser.General.SetupAdlStatus
+
+This event indicates if Appraiser used data files from the setup image or more up-to-date data files downloaded from a Microsoft server.
+
+The following fields are available:
+
+- **Time** The client time of the event.
+- **PCFP** An ID for the system calculated by hashing hardware identifiers.
+- **Result** The last result of the operation to determine if there is a data file to download.
+- **OneSettingsInitialized** Was the query to OneSettings, where the information is stored on if there is a data file to download, initialized?
+- **Url** The URL of the data file to download. This will be an empty string if there is no data file to download.
+- **UsingAlternateData** Is the client using alternate data file or using the data file in the setup image?
+
+
+### Microsoft.Windows.Appraiser.General.SystemMemoryAdd
+
+This event sends data on the amount of memory on the system and whether it meets requirements, to help keep Windows up-to-date.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file generating the events.
+- **Blocking** Is the device from upgrade due to memory restrictions?
+- **MemoryRequirementViolated** Was a memory requirement violated?
+- **pageFile** The current committed memory limit for the system or the current process, whichever is smaller (in bytes).
+- **ram** The amount of memory on the device.
+- **ramKB** The amount of memory (in KB).
+- **virtual** The size of the user-mode portion of the virtual address space of the calling process (in bytes).
+- **virtualKB** The amount of virtual memory (in KB).
+
+
+### Microsoft.Windows.Appraiser.General.SystemMemoryRemove
+
+This event that the SystemMemory object is no longer present.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.SystemMemoryStartSync
+
+This event indicates that a new set of SystemMemoryAdd events will be sent.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeAdd
+
+This event sends data indicating whether the system supports the CompareExchange128 CPU requirement, to help keep Windows up to date.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file generating the events.
+- **Blocking** Is the upgrade blocked due to the processor?
+- **CompareExchange128Support** Does the CPU support CompareExchange128?
+
+
+### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeRemove
+
+This event indicates that the SystemProcessorCompareExchange object is no longer present.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeStartSync
+
+This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfAdd
+
+This event sends data indicating whether the system supports the LahfSahf CPU requirement, to help keep Windows up-to-date.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file generating the events.
+- **Blocking** Is the upgrade blocked due to the processor?
+- **LahfSahfSupport** Does the CPU support LAHF/SAHF?
+
+
+### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfRemove
+
+This event indicates that the SystemProcessorLahfSahf object is no longer present.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfStartSync
This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent.
@@ -751,48 +1144,27 @@ The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-### Microsoft.Windows.Appraiser.General.SystemProcessorSse2StartSync
+### Microsoft.Windows.Appraiser.General.SystemProcessorNxAdd
-This event indicates that a new set of SystemProcessorSse2Add events will be sent.
+This event sends data indicating whether the system supports the NX CPU requirement, to help keep Windows up-to-date.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+- **Blocking** Is the upgrade blocked due to the processor?
+- **NXDriverResult** The result of the driver used to do a non-deterministic check for NX support.
+- **NXProcessorSupport** Does the processor support NX?
+
+
+### Microsoft.Windows.Appraiser.General.SystemProcessorNxRemove
+
+This event indicates that the SystemProcessorNx object is no longer present.
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-### Microsoft.Windows.Appraiser.General.InventorySystemBiosStartSync
-
-This event indicates that a new set of InventorySystemBiosAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-### Microsoft.Windows.Appraiser.General.DecisionSystemBiosStartSync
-
-This event indicates that a new set of DecisionSystemBiosAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.SystemMemoryStartSync
-
-This event indicates that a new set of SystemMemoryAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeStartSync
-
-This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
### Microsoft.Windows.Appraiser.General.SystemProcessorNxStartSync
This event indicates that a new set of SystemProcessorNxAdd events will be sent.
@@ -802,6 +1174,26 @@ The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWAdd
+
+This event sends data indicating whether the system supports the PrefetchW CPU requirement, to help keep Windows up-to-date.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+- **Blocking** Is the upgrade blocked due to the processor?
+- **PrefetchWSupport** Does the processor support PrefetchW?
+
+
+### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWRemove
+
+This event indicates that the SystemProcessorPrefetchW object is no longer present.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWStartSync
This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent.
@@ -811,18 +1203,49 @@ The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-### Microsoft.Windows.Appraiser.General.SystemWimStartSync
+### Microsoft.Windows.Appraiser.General.SystemProcessorSse2Add
-This event indicates that a new set of SystemWimAdd events will be sent.
+This event sends data indicating whether the system supports the SSE2 CPU requirement, to help keep Windows up-to-date.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+- **Blocking** Is the upgrade blocked due to the processor?
+- **SSE2ProcessorSupport** Does the processor support SSE2?
+
+
+### Microsoft.Windows.Appraiser.General.SystemProcessorSse2Remove
+
+This event indicates that the SystemProcessorSse2 object is no longer present.
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosStartSync
+### Microsoft.Windows.Appraiser.General.SystemProcessorSse2StartSync
-This event indicates that a new set of DatasourceSystemBiosAdd events will be sent.
+This event indicates that a new set of SystemProcessorSse2Add events will be sent.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.SystemTouchAdd
+
+This event sends data indicating whether the system supports touch, to help keep Windows up-to-date.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+- **IntegratedTouchDigitizerPresent** Is there an integrated touch digitizer?
+- **MaximumTouches** The maximum number of touch points supported by the device hardware.
+
+
+### Microsoft.Windows.Appraiser.General.SystemTouchRemove
+
+This event indicates that the SystemTouch object is no longer present.
The following fields are available:
@@ -838,9 +1261,82 @@ The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageEndSync
+### Microsoft.Windows.Appraiser.General.SystemWimAdd
-This event indicates that a full set of DatasourceDriverPackageAdd events has been sent.
+This event sends data indicating whether the operating system is running from a compressed WIM file, to help keep Windows up-to-date.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+- **IsWimBoot** Is the current operating system running from a compressed WIM file?
+- **RegistryWimBootValue** The raw value from the registry that is used to indicate if the device is running from a WIM.
+
+
+### Microsoft.Windows.Appraiser.General.SystemWimRemove
+
+This event indicates that the SystemWim object is no longer present.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.SystemWimStartSync
+
+This event indicates that a new set of SystemWimAdd events will be sent.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusAdd
+
+This event sends data indicating whether the current operating system is activated, to help keep Windows up-to-date.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+- **WindowsIsLicensedApiValue** The result from the API that's used to indicate if operating system is activated.
+- **WindowsNotActivatedDecision** Is the current operating system activated?
+
+
+### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusRemove
+
+This event indicates that the SystemWindowsActivationStatus object is no longer present.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusStartSync
+
+This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.SystemWlanAdd
+
+This event sends data indicating whether the system has WLAN, and if so, whether it uses an emulated driver that could block an upgrade, to help keep Windows up-to-date.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+- **Blocking** Is the upgrade blocked because of an emulated WLAN driver?
+- **HasWlanBlock** Does the emulated WLAN driver have an upgrade block?
+- **WlanEmulatedDriver** Does the device have an emulated WLAN driver?
+- **WlanExists** Does the device support WLAN at all?
+- **WlanModulePresent** Are any WLAN modules present?
+- **WlanNativeDriver** Does the device have a non-emulated WLAN driver?
+
+
+### Microsoft.Windows.Appraiser.General.SystemWlanRemove
+
+This event indicates that the SystemWlan object is no longer present.
The following fields are available:
@@ -855,62 +1351,60 @@ The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusStartSync
-This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent.
+### Microsoft.Windows.Appraiser.General.TelemetryRunHealth
+
+A summary event indicating the parameters and result of a diagnostic data run. This allows the rest of the data sent over the course of the run to be properly contextualized and understood, which is then used to keep Windows up-to-date.
+
+The following fields are available:
+
+- **PerfBackoff** Indicates if the run was invoked with logic to stop running when a user is present. Helps to understand why a run may have a longer elapsed time than normal.
+- **RunAppraiser** Indicates if Appraiser was set to run at all. If this if false, it is understood that data events will not be received from this device.
+- **ThrottlingUtc** Indicates if the Appraiser client is throttling its output of CUET events to avoid being disabled. This increases runtime but also diagnostic data reliability.
+- **AuxInitial** Obsolete, indicates if Appraiser is writing data files to be read by the Get Windows 10 app.
+- **Time** The client time of the event.
+- **RunDate** The date that the diagnostic data run was stated, expressed as a filetime.
+- **AppraiserProcess** The name of the process that launched Appraiser.
+- **AppraiserVersion** The file version (major, minor and build) of the Appraiser DLL, concatenated without dots.
+- **SendingUtc** Indicates if the Appraiser client is sending events during the current diagnostic data run.
+- **DeadlineDate** A timestamp representing the deadline date, which is the time until which appraiser will wait to do a full scan.
+- **AppraiserBranch** The source branch in which the version of Appraiser that is running was built.
+- **EnterpriseRun** Indicates if the diagnostic data run is an enterprise run, which means appraiser was run from the command line with an extra enterprise parameter.
+- **RunGeneralTel** Indicates if the generaltel.dll component was run. Generaltel collects additional diagnostic data on an infrequent schedule and only from machines at diagnostic data levels higher than Basic.
+- **PerfBackoffInsurance** Indicates if appraiser is running without performance backoff because it has run with perf backoff and failed to complete several times in a row.
+- **AuxFinal** Obsolete, always set to false
+- **StoreHandleIsNotNull** Obsolete, always set to false
+- **VerboseMode** Indicates if appraiser ran in Verbose mode, which is a test-only mode with extra logging.
+- **AppraiserDataVersion** The version of the data files being used by the Appraiser diagnostic data run.
+- **FullSync** Indicates if Appraiser is performing a full sync, which means that full set of events representing the state of the machine are sent. Otherwise, only the changes from the previous run are sent.
+- **InventoryFullSync** Indicates if inventory is performing a full sync, which means that the full set of events representing the inventory of machine are sent.
+- **PCFP** An ID for the system calculated by hashing hardware identifiers.
+- **RunOnline** Indicates if appraiser was able to connect to Windows Update and theefore is making decisions using up-to-date driver coverage information.
+- **TelementrySent** Indicates if diagnostic data was successfully sent.
+- **WhyFullSyncWithoutTablePrefix** Indicates the reason or reasons that a full sync was generated.
+- **RunResult** The hresult of the Appraiser diagnostic data run.
+
+
+### Microsoft.Windows.Appraiser.General.WmdrmAdd
+
+This event sends data about the usage of older digital rights management on the system, to help keep Windows up to date. This data does not indicate the details of the media using the digital rights management, only whether any such files exist. Collecting this data was critical to ensuring the correct mitigation for customers, and should be able to be removed once all mitigations are in place.
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+- **WmdrmCdRipped** Indicates if the system has any files encrypted with personal DRM, which was used for ripped CDs.
+- **WmdrmNonPermanent** Indicates if the system has any files with non-permanent licenses.
+- **WmdrmPurchased** Indicates if the system has any files with permanent licenses.
+- **WmdrmApiResult** Raw value of the API used to gather DRM state.
+- **WmdrmInUse** WmdrmIndicators AND dismissible block in setup was not dismissed.
+- **WmdrmIndicators** WmdrmCdRipped OR WmdrmPurchased
+- **NeedsDismissAction** Indicates if a dismissible message is needed to warn the user about a potential loss of data due to DRM deprecation.
+- **BlockingApplication** Same as NeedsDismissAction
-### Microsoft.Windows.Appraiser.General.DecisionMediaCenterStartSync
+### Microsoft.Windows.Appraiser.General.WmdrmRemove
-This event indicates that a new set of DecisionMediaCenterAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.InventoryMediaCenterStartSync
-
-This event indicates that a new set of InventoryMediaCenterAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveStartSync
-
-This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveStartSync
-
-This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.InventoryApplicationFileStartSync
-
-This event indicates indicates that a new set of InventoryApplicationFileAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeStartSync
-
-This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent.
+This event indicates that the Wmdrm object is no longer present.
The following fields are available:
@@ -925,444 +1419,19 @@ The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveEndSync
-
-This event indicates that a full set of DataSourceMatchingInfoPassiveAdd events have been sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockStartSync
-
-This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileStartSync
-
-This event indicates that a new set of DatasourceApplicationFileAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpStartSync
-
-This event indicates that a new set of DatasourceDevicePnpAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockStartSync
-
-This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events have been sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DecisionApplicationFileStartSync
-
-This event indicates that a new set of DecisionApplicationFileAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.InventoryLanguagePackStartSync
-
-This event indicates that a new set of InventoryLanguagePackAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeStartSync
-
-This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-### Microsoft.Windows.Appraiser.General.DecisionDevicePnpStartSync
-
-This event indicates that the DecisionDevicePnp object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageStartSync
-
-This event indicates that a new set of DatasourceDriverPackageAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DecisionDriverPackageStartSync
-
-This event indicates that a new set of DecisionDriverPackageAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.WmdrmAdd
-
-This event sends data about the usage of older digital rights management on the system, to help keep Windows up to date. This data does not indicate the details of the media using the digital rights management, only whether any such files exist. Collecting this data was critical to ensuring the correct mitigation for customers, and should be able to be removed once all mitigations are in place.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-- **BlockingApplication** Same as NeedsDismissAction
-- **NeedsDismissAction** Indicates if a dismissible message is needed to warn the user about a potential loss of data due to DRM deprecation.
-- **WmdrmApiResult** Raw value of the API used to gather DRM state.
-- **WmdrmCdRipped** Indicates if the system has any files encrypted with personal DRM, which was used for ripped CDs.
-- **WmdrmIndicators** WmdrmCdRipped OR WmdrmPurchased
-- **WmdrmInUse** WmdrmIndicators AND dismissible block in setup was not dismissed.
-- **WmdrmNonPermanent** Indicates if the system has any files with non-permanent licenses.
-- **WmdrmPurchased** Indicates if the system has any files with permanent licenses.
-
-### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageAdd
-
-This event is only runs during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. Is critical to understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-- **BootCritical** Is the driver package marked as boot critical?
-- **Build** The build value from the driver package.
-- **CatalogFile** The name of the catalog file within the driver package.
-- **Class** The device class from the driver package.
-- **ClassGuid** The device class GUID from the driver package.
-- **Date** The date from the driver package.
-- **Inbox** Is the driver package of a driver that is included with Windows?
-- **OriginalName** The original name of the INF file before it was renamed. Generally a path under $WINDOWS.~BT\Drivers\DU
-- **Provider** The provider of the driver package.
-- **PublishedName** The name of the INF file, post-rename.
-- **Revision** The revision of the driver package.
-- **SignatureStatus** Indicates if the driver package is signed. Unknown:0, Unsigned:1, Signed: 2
-- **VersionMajor** The major version of the driver package.
-- **VersionMinor** The minor version of the driver package.
-
-### Microsoft.Windows.Appraiser.General.GatedRegChange
-
-This event sends data about the results of running a set of quick-blocking instructions, to help keep Windows up to date.
-
-The following fields are available:
-
-- **NewData** The data in the registry value after the scan completed.
-- **OldData** The previous data in the registry value before the scan ran.
-- **PCFP** An ID for the system calculated by hashing hardware identifiers.
-- **RegKey** The registry key name for which a result is being sent.
-- **RegValue** The registry value for which a result is being sent.
-- **Time** The client time of the event.
-
-
-### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileRemove
-
-This event indicates that the DatasourceApplicationFile object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpRemove
-
-This event indicates that the DatasourceDevicePnp object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageRemove
-
-This event indicates that the DatasourceDriverPackage object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.SystemProcessorSse2Remove
-
-This event indicates that the SystemProcessorSse2 object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageRemove
-
-This event indicates that the InventoryUplevelDriverPackage object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DecisionMediaCenterRemove
-
-This event indicates that the DecisionMediaCenter object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.InventoryMediaCenterRemove
-
-This event indicates that the InventoryMediaCenter object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosRemove
-
-This event indicates that the DatasourceSystemBios object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DecisionApplicationFileRemove
-
-This event indicates Indicates that the DecisionApplicationFile object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeRemove
-
-This event indicates that the DecisionMatchingInfoPostUpgrade object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.SystemTouchRemove
-
-"This event indicates that the SystemTouch object is no longer present. "
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusRemove
-
-This event indicates that the SystemWindowsActivationStatus object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.SystemWlanRemove
-
-"This event indicates that the SystemWlan object is no longer present. "
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeRemove
-
-This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.SystemProcessorNxRemove
-
-This event indicates that the SystemProcessorNx object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockRemove
-
-This event indicates that the DataSourceMatchingInfoBlock object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DecisionDevicePnpRemove
-
-This event indicates that the DecisionDevicePnp object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveRemove
-
-This event Indicates that the DecisionMatchingInfoPassive object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.SystemMemoryRemove
-
-This event that the SystemMemory object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockRemove
-
-This event indicates that the DecisionMatchingInfoBlock object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveRemove
-
-This event indicates that the DataSourceMatchingInfoPassive object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.InventoryApplicationFileRemove
-
-This event indicates that the InventoryApplicationFile object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.SystemWimRemove
-
-"This event indicates that the SystemWim object is no longer present. "
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.InventorySystemBiosRemove
-
-"This event indicates that the InventorySystemBios object is no longer present. "
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.WmdrmRemove
-
-This event indicates that the Wmdrm object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfRemove
-
-"This event indicates that the SystemProcessorLahfSahf object is no longer present. "
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.InventoryLanguagePackRemove
-
-This event indicates that the InventoryLanguagePack object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DecisionDriverPackageRemove
-
-This event indicates that the DecisionDriverPackage object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DecisionSystemBiosRemove
-
-This event indicates that the DecisionSystemBios object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeRemove
-
-"This event indicates that the SystemProcessorCompareExchange object is no longer present. "
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWRemove
-
-This event indicates that the SystemProcessorPrefetchW object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.InventoryDriverBinaryEndSync
-
-This event indicates that a full set of InventoryDriverBinaryAdd events has been sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
## Census events
+### Census.App
+
+This event sends version data about the Apps running on this device, to help keep Windows up to date.
+
+The following fields are available:
+
+- **IEVersion** Retrieves which version of Internet Explorer is running on this device.
+- **CensusVersion** The version of Census that generated the current data for this device.
+
+
### Census.Battery
This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use, type to help keep Windows up to date.
@@ -1372,43 +1441,8 @@ The following fields are available:
- **InternalBatteryCapablities** Represents information about what the battery is capable of doing.
- **InternalBatteryCapacityCurrent** Represents the battery's current fully charged capacity in mWh (or relative). Compare this value to DesignedCapacity to estimate the battery's wear.
- **InternalBatteryCapacityDesign** Represents the theoretical capacity of the battery when new, in mWh.
-- **InternalBatteryNumberOfCharges** Provides the number of battery charges. This is used when creating new products and validating that existing products meets targeted functionality performance.
- **IsAlwaysOnAlwaysConnectedCapable** Represents whether the battery enables the device to be AlwaysOnAlwaysConnected . Boolean value.
-
-
-### Census.Enterprise
-
-This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment.
-
-The following fields are available:
-
-- **AzureOSIDPresent** Represents the field used to identify an Azure machine.
-- **AzureVMType** Represents whether the instance is Azure VM PAAS, Azure VM IAAS or any other VMs.
-- **CDJType** Represents the type of cloud domain joined for the machine.
-- **CommercialId** Represents the GUID for the commercial entity which the device is a member of. Will be used to reflect insights back to customers.
-- **ContainerType** The type of container, such as process or virtual machine hosted.
-- **EnrollmentType** Represents the type of enrollment, such as MDM or Intune, for a particular device.
-- **HashedDomain** The hashed representation of the user domain used for login.
-- **IsCloudDomainJoined** Is this device joined to an Azure Active Directory (AAD) tenant? true/false
-- **IsDERequirementMet** Represents if the device can do device encryption.
-- **IsDeviceProtected** Represents if Device protected by BitLocker/Device Encryption
-- **IsDomainJoined** Indicates whether a machine is joined to a domain.
-- **IsEDPEnabled** Represents if Enterprise data protected on the device.
-- **IsMDMEnrolled** Whether the device has been MDM Enrolled or not.
-- **MPNId** Returns the Partner ID/MPN ID from Regkey. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\DeployID
-- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in an Enterprise SCCM environment.
-- **ServerFeatures** Represents the features installed on a Windows Server. This can be used by developers and administrators who need to automate the process of determining the features installed on a set of server computers.
-- **SystemCenterID** The SCCM ID is an anonymized one-way hash of the Active Directory Organization identifier
-
-
-### Census.App
-
-This event sends version data about the Apps running on this device, to help keep Windows up to date.
-
-The following fields are available:
-
-- **CensusVersion** The version of Census that generated the current data for this device.
-- **IEVersion** Retrieves which version of Internet Explorer is running on this device.
+- **InternalBatteryNumberOfCharges** Provides the number of battery charges. This is used when creating new products and validating that existing products meets targeted functionality performance.
### Census.Camera
@@ -1421,26 +1455,29 @@ The following fields are available:
- **RearFacingCameraResolution** Represents the resolution of the rear facing camera in megapixels. If a rear facing camera does not exist, then the value is 0.
-### Census.UserDisplay
+### Census.Enterprise
-This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system, to help keep Windows up to date.
+This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment.
The following fields are available:
-- **InternalPrimaryDisplayLogicalDPIX** Retrieves the logical DPI in the x-direction of the internal display.
-- **InternalPrimaryDisplayLogicalDPIY** Retrieves the logical DPI in the y-direction of the internal display.
-- **InternalPrimaryDisplayPhysicalDPIX** Retrieves the physical DPI in the x-direction of the internal display.
-- **InternalPrimaryDisplayPhysicalDPIY** Retrieves the physical DPI in the y-direction of the internal display.
-- **InternalPrimaryDisplayResolutionHorizontal** Retrieves the number of pixels in the horizontal direction of the internal display.
-- **InternalPrimaryDisplayResolutionVertical** Retrieves the number of pixels in the vertical direction of the internal display.
-- **InternalPrimaryDisplaySizePhysicalH** Retrieves the physical horizontal length of the display in mm. Used for calculating the diagonal length in inches .
-- **InternalPrimaryDisplaySizePhysicalY** Retrieves the physical vertical length of the display in mm. Used for calculating the diagonal length in inches
-- **InternalPrimaryDisplayType** Represents the type of technology used in the monitor, such as Plasma, LED, LCOS, etc.
-- **NumberofExternalDisplays** Retrieves the number of external displays connected to the machine
-- **NumberofInternalDisplays** Retrieves the number of internal displays in a machine.
-- **VRAMDedicated** Retrieves the video RAM in MB.
-- **VRAMDedicatedSystem** Retrieves the amount of memory on the dedicated video card.
-- **VRAMSharedSystem** Retrieves the amount of RAM memory that the video card can use.
+- **IsCloudDomainJoined** Is this device joined to an Azure Active Directory (AAD) tenant? true/false
+- **IsMDMEnrolled** Whether the device has been MDM Enrolled or not.
+- **ServerFeatures** Represents the features installed on a Windows Server. This can be used by developers and administrators who need to automate the process of determining the features installed on a set of server computers.
+- **CommercialId** Represents the GUID for the commercial entity which the device is a member of. Will be used to reflect insights back to customers.
+- **AzureVMType** Represents whether the instance is Azure VM PAAS, Azure VM IAAS or any other VMs.
+- **AzureOSIDPresent** Represents the field used to identify an Azure machine.
+- **IsDomainJoined** Indicates whether a machine is joined to a domain.
+- **HashedDomain** The hashed representation of the user domain used for login.
+- **SystemCenterID** The SCCM ID is an anonymized one-way hash of the Active Directory Organization identifier
+- **MPNId** Returns the Partner ID/MPN ID from Regkey. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\DeployID
+- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in an Enterprise SCCM environment.
+- **CDJType** Represents the type of cloud domain joined for the machine.
+- **IsDeviceProtected** Represents if Device protected by BitLocker/Device Encryption
+- **IsDERequirementMet** Represents if the device can do device encryption.
+- **IsEDPEnabled** Represents if Enterprise data protected on the device.
+- **ContainerType** The type of container, such as process or virtual machine hosted.
+- **EnrollmentType** Represents the type of enrollment, such as MDM or Intune, for a particular device.
### Census.Firmware
@@ -1461,55 +1498,54 @@ This event sends Windows Insider data from customers participating in improvemen
The following fields are available:
-- **DeviceSampleRate** The telemetry sample rate assigned to the device.
-- **EnablePreviewBuilds** Used to enable Windows Insider builds on a device.
- **FlightIds** A list of the different Windows Insider builds on this device.
-- **FlightingBranchName** The name of the Windows Insider branch currently used by the device.
-- **IsFlightsDisabled** Represents if the device is participating in the Windows Insider program.
- **MSA_Accounts** Represents a list of hashed IDs of the Microsoft Accounts that are flighting (pre-release builds) on this device.
+- **IsFlightsDisabled** Represents if the device is participating in the Windows Insider program.
+- **FlightingBranchName** The name of the Windows Insider branch currently used by the device.
+- **DeviceSampleRate** The diagnostic data sample rate assigned to the device.
+- **EnablePreviewBuilds** Used to enable Windows Insider builds on a device.
- **SSRK** Retrieves the mobile targeting settings.
### Census.Hardware
-This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support, to help keep Windows up-to-date.
+This event sends data about the device, including hardware type, OEM brand, model line, model, diagnostic data level setting, and TPM support, to help keep Windows up-to-date.
The following fields are available:
-- **ActiveMicCount** The number of active microphones attached to the device.
- **ChassisType** Represents the type of device chassis, such as desktop or low profile desktop. The possible values can range between 1 - 36.
- **ComputerHardwareID** Identifies a device class that is represented by a hash of different SMBIOS fields.
-- **D3DMaxFeatureLevel** The supported Direct3D version.
- **DeviceColor** Indicates a color of the device.
-- **DeviceForm** Indicates the form as per the device classification.
- **DeviceName** The device name that is set by the user.
-- **DigitizerSupport** Is a digitizer supported?
-- **DUID** The device unique ID.
-- **Gyroscope** Indicates whether the device has a gyroscope.
-- **InventoryId** The device ID used for compatibility testing.
-- **Magnetometer** Indicates whether the device has a magnetometer.
-- **NFCProximity** Indicates whether the device supports NFC.
- **OEMDigitalMarkerFileName** The name of the file placed in the \Windows\system32\drivers directory that specifies the OEM and model name of the device.
- **OEMManufacturerName** The device manufacturer name. The OEMName for an inactive device is not reprocessed even if the clean OEM name is changed at a later date.
-- **OEMModelBaseBoard** The baseboard model used by the OEM.
-- **OEMModelBaseBoardVersion** Differentiates between developer and retail devices.
-- **OEMModelName** The device model name.
- **OEMModelNumber** The device model number.
+- **OEMModelName** The device model name.
- **OEMModelSKU** The device edition that is defined by the manufacturer.
-- **OEMModelSystemFamily** The system family set on the device by an OEM.
-- **OEMModelSystemVersion** The system model version set on the device by the OEM.
- **OEMOptionalIdentifier** A Microsoft assigned value that represents a specific OEM subsidiary.
- **OEMSerialNumber** The serial number of the device that is set by the manufacturer.
- **PhoneManufacturer** The friendly name of the phone manufacturer.
-- **PowerPlatformRole** The OEM preferred power management profile. It's used to help to identify the basic form factor of the device.
- **SoCName** The firmware manufacturer of the device.
-- **StudyID** Used to identify retail and non-retail device.
-- **TelemetryLevel** The telemetry level the user has opted into, such as Basic or Enhanced.
-- **TelemetryLevelLimitEnhanced** The telemetry level for Windows Analytics-based solutions.
-- **TelemetrySettingAuthority** Determines who set the telemetry level, such as GP, MDM, or the user.
-- **TPMVersion** The supported Trusted Platform Module (TPM) on the device. If no TPM is present, the value is 0.
+- **DUID** The device unique ID.
+- **InventoryId** The device ID used for compatibility testing.
- **VoiceSupported** Does the device have a cellular radio capable of making voice calls?
-
+- **PowerPlatformRole** The OEM preferred power management profile. It's used to help to identify the basic form factor of the device.
+- **TPMVersion** The supported Trusted Platform Module (TPM) on the device. If no TPM is present, the value is 0.
+- **StudyID** Used to identify retail and non-retail device.
+- **TelemetryLevel** The diagnostic data level the user has opted into, such as Basic or Enhanced.
+- **TelemetrySettingAuthority** Determines who set the diagnostic data level, such as GP, MDM, or the user.
+- **DeviceForm** Indicates the form as per the device classification.
+- **DigitizerSupport** Is a digitizer supported?
+- **OEMModelBaseBoard** The baseboard model used by the OEM.
+- **OEMModelSystemFamily** The system family set on the device by an OEM.
+- **OEMModelBaseBoardVersion** Differentiates between developer and retail devices.
+- **ActiveMicCount** The number of active microphones attached to the device.
+- **OEMModelSystemVersion** The system model version set on the device by the OEM.
+- **D3DMaxFeatureLevel** The supported Direct3D version.
+- **Gyroscope** Indicates whether the device has a gyroscope.
+- **Magnetometer** Indicates whether the device has a magnetometer.
+- **NFCProximity** Indicates whether the device supports NFC.
+- **TelemetryLevelLimitEnhanced** The diagnostic data level for Windows Analytics-based solutions.
### Census.Memory
@@ -1527,21 +1563,21 @@ This event sends data about the mobile and cellular network used by the device (
The following fields are available:
-- **IMEI0** Represents the International Mobile Station Equipment Identity. This number is usually unique and used by the mobile operator to distinguish different phone hardware. Microsoft does not have access to mobile operator billing data so collecting this data does not expose or identify the user. The two fields represent phone with dual sim coverage.
-- **IMEI1** Represents the International Mobile Station Equipment Identity. This number is usually unique and used by the mobile operator to distinguish different phone hardware. Microsoft does not have access to mobile operator billing data so collecting this data does not expose or identify the user. The two fields represent phone with dual sim coverage.
-- **MCC0** Represents the Mobile Country Code (MCC). It used with the Mobile Network Code (MNC) to uniquely identify a mobile network operator. The two fields represent phone with dual sim coverage.
-- **MCC1** Represents the Mobile Country Code (MCC). It used with the Mobile Network Code (MNC) to uniquely identify a mobile network operator. The two fields represent phone with dual sim coverage.
-- **MEID** Represents the Mobile Equipment Identity (MEID). MEID is a worldwide unique phone ID assigned to CDMA phones. MEID replaces electronic serial number (ESN), and is equivalent to IMEI for GSM and WCDMA phones. Microsoft does not have access to mobile operator billing data so collecting this data does not expose or identify the user.
-- **MNC0** Retrieves the Mobile Network Code (MNC). It used with the Mobile Country Code (MCC) to uniquely identify a mobile network operator. The two fields represent phone with dual sim coverage.
-- **MNC1** Retrieves the Mobile Network Code (MNC). It used with the Mobile Country Code (MCC) to uniquely identify a mobile network operator. The two fields represent phone with dual sim coverage.
- **MobileOperatorBilling** Represents the telephone company that provides services for mobile phone users.
- **MobileOperatorCommercialized** Represents which reseller and geography the phone is commercialized for. This is the set of values on the phone for who and where it was intended to be used. For example, the commercialized mobile operator code AT&T in the US would be ATT-US.
-- **MobileOperatorNetwork0** Represents the operator of the current mobile network that the device is used on. (AT&T, T-Mobile, Vodafone). The two fields represent phone with dual sim coverage.
-- **MobileOperatorNetwork1** Represents the operator of the current mobile network that the device is used on. (AT&T, T-Mobile, Vodafone). The two fields represent phone with dual sim coverage.
-- **NetworkAdapterGUID** The GUID of the primary network adapter.
- **NetworkCost** Represents the network cost associated with a connection.
+- **IMEI0** Represents the International Mobile Station Equipment Identity. This number is usually unique and used by the mobile operator to distinguish different phone hardware. Microsoft does not have access to mobile operator billing data so collecting this data does not expose or identify the user. The two fields represent phone with dual sim coverage.
- **SPN0** Retrieves the Service Provider Name (SPN). For example, these might be AT&T, Sprint, T-Mobile, or Verizon. The two fields represent phone with dual sim coverage.
+- **MobileOperatorNetwork0** Represents the operator of the current mobile network that the device is used on. (AT&T, T-Mobile, Vodafone). The two fields represent phone with dual sim coverage.
+- **MCC0** Represents the Mobile Country Code (MCC). It used with the Mobile Network Code (MNC) to uniquely identify a mobile network operator. The two fields represent phone with dual sim coverage.
+- **MNC0** Retrieves the Mobile Network Code (MNC). It used with the Mobile Country Code (MCC) to uniquely identify a mobile network operator. The two fields represent phone with dual sim coverage.
+- **IMEI1** Represents the International Mobile Station Equipment Identity. This number is usually unique and used by the mobile operator to distinguish different phone hardware. Microsoft does not have access to mobile operator billing data so collecting this data does not expose or identify the user. The two fields represent phone with dual sim coverage.
- **SPN1** Retrieves the Service Provider Name (SPN). For example, these might be AT&T, Sprint, T-Mobile, or Verizon. The two fields represent phone with dual sim coverage.
+- **MobileOperatorNetwork1** Represents the operator of the current mobile network that the device is used on. (AT&T, T-Mobile, Vodafone). The two fields represent phone with dual sim coverage.
+- **MCC1** Represents the Mobile Country Code (MCC). It used with the Mobile Network Code (MNC) to uniquely identify a mobile network operator. The two fields represent phone with dual sim coverage.
+- **MNC1** Retrieves the Mobile Network Code (MNC). It used with the Mobile Country Code (MCC) to uniquely identify a mobile network operator. The two fields represent phone with dual sim coverage.
+- **MEID** Represents the Mobile Equipment Identity (MEID). MEID is a worldwide unique phone ID assigned to CDMA phones. MEID replaces electronic serial number (ESN), and is equivalent to IMEI for GSM and WCDMA phones. Microsoft does not have access to mobile operator billing data so collecting this data does not expose or identify the user.
+- **NetworkAdapterGUID** The GUID of the primary network adapter.
### Census.OS
@@ -1550,41 +1586,40 @@ This event sends data about the operating system such as the version, locale, up
The following fields are available:
-- **ActivationChannel** Retrieves the retail license key or Volume license key for a machine.
-- **AssignedAccessStatus** The kiosk configuration mode.
-- **CompactOS** Indicates if the Compact OS feature from Win10 is enabled.
-- **DeveloperUnlockStatus** "Represents if a device has been developer unlocked by the user or Group Policy. "
-- **DeviceTimeZone** The time zone that is set on the device. Example: Pacific Standard Time
- **GenuineState** Retrieves the ID Value specifying the OS Genuine check.
-- **InstallationType** Retrieves the type of OS installation. (Clean, Upgrade, Reset, Refresh, Update).
-- **InstallLanguage** The first language installed on the user machine.
-- **IsDeviceRetailDemo** Retrieves if the device is running in demo mode.
-- **IsEduData** Returns Boolean if the education data policy is enabled.
- **IsPortableOperatingSystem** Retrieves whether OS is running Windows-To-Go
- **IsSecureBootEnabled** Retrieves whether Boot chain is signed under UEFI.
-- **LanguagePacks** The list of language packages installed on the device.
-- **LicenseStateReason** Retrieves why (or how) a system is licensed or unlicensed. The HRESULT may indicate an error code that indicates a key blocked error, or it may indicate that we are running an OS License granted by the MS store.
-- **OA3xOriginalProductKey** Retrieves the License key stamped by the OEM to the machine.
-- **OSEdition** Retrieves the version of the current OS.
-- **OSInstallDateTime** Retrieves the date the OS was installed using ISO 8601 (Date part) == yyyy-mm-dd
+- **InstallationType** Retrieves the type of OS installation. (Clean, Upgrade, Reset, Refresh, Update).
- **OSInstallType** Retrieves a numeric description of what install was used on the device i.e. clean, upgrade, refresh, reset, etc
- **OSOOBEDateTime** Retrieves Out of Box Experience (OOBE) Date in Coordinated Universal Time (UTC).
- **OSSKU** Retrieves the Friendly Name of OS Edition.
-- **OSSubscriptionStatus** Represents the existing status for enterprise subscription feature for PRO machines.
-- **OSSubscriptionTypeId** Returns boolean for enterprise subscription feature for selected PRO machines.
- **OSTimeZoneBiasInMins** Retrieves the time zone set on machine.
- **OSUILocale** Retrieves the locale of the UI that is currently used by the OS.
-- **ProductActivationResult** Returns Boolean if the OS Activation was successful.
-- **ProductActivationTime** Returns the OS Activation time for tracking piracy issues.
-- **ProductKeyID2** Retrieves the License key if the machine is updated with a new license key.
- **RACw7Id** Retrieves the Microsoft Reliability Analysis Component (RAC) Win7 Identifier. RAC is used to monitor and analyze system usage and reliability.
-- **ServiceMachineIP** Retrieves the IP address of the KMS host used for anti-piracy.
-- **ServiceMachinePort** Retrieves the port of the KMS host used for anti-piracy.
-- **ServiceProductKeyID** Retrieves the License key of the KMS
-- **SharedPCMode** Returns Boolean for education devices used as shared cart
+- **CompactOS** Indicates if the Compact OS feature from Win10 is enabled.
- **Signature** Retrieves if it is a signature machine sold by Microsoft store.
-- **SLICStatus** Whether a SLIC table exists on the device.
+- **IsDeviceRetailDemo** Retrieves if the device is running in demo mode.
+- **ActivationChannel** Retrieves the retail license key or Volume license key for a machine.
+- **LicenseStateReason** Retrieves why (or how) a system is licensed or unlicensed. The HRESULT may indicate an error code that indicates a key blocked error, or it may indicate that we are running an OS License granted by the MS store.
+- **OA3xOriginalProductKey** Retrieves the License key stamped by the OEM to the machine.
+- **ProductKeyID2** Retrieves the License key if the machine is updated with a new license key.
+- **ServiceMachineIP** Retrieves the IP address of the KMS host used for anti-piracy.
+- **ServiceProductKeyID** Retrieves the License key of the KMS
+- **LanguagePacks** The list of language packages installed on the device.
+- **InstallLanguage** The first language installed on the user machine.
+- **IsEduData** Returns Boolean if the education data policy is enabled.
+- **SharedPCMode** Returns Boolean for education devices used as shared cart
- **SLICVersion** Returns OS type/version from SLIC table.
+- **SLICStatus** Whether a SLIC table exists on the device.
+- **OSEdition** Retrieves the version of the current OS.
+- **ProductActivationTime** Returns the OS Activation time for tracking piracy issues.
+- **ProductActivationResult** Returns Boolean if the OS Activation was successful.
+- **OSSubscriptionTypeId** Returns boolean for enterprise subscription feature for selected PRO machines.
+- **OSSubscriptionStatus** Represents the existing status for enterprise subscription feature for PRO machines.
+- **ServiceMachinePort** Retrieves the port of the KMS host used for anti-piracy.
+- **DeviceTimeZone** The time zone that is set on the device. Example: Pacific Standard Time
+- **DeveloperUnlockStatus** Represents if a device has been developer unlocked by the user or Group Policy.
+- **AssignedAccessStatus** The kiosk configuration mode.
### Census.Processor
@@ -1593,15 +1628,32 @@ This event sends data about the processor (architecture, speed, number of cores,
The following fields are available:
+- **ProcessorCores** Retrieves the number of cores in the processor.
+- **ProcessorPhysicalCores** Number of physical cores in the processor.
- **ProcessorArchitecture** Retrieves the processor architecture of the installed operating system. The complete list of values can be found in DimProcessorArchitecture.
- **ProcessorClockSpeed** Retrieves the clock speed of the processor in MHz.
-- **ProcessorCores** Retrieves the number of cores in the processor.
-- **ProcessorIdentifier** The processor identifier of a manufacturer.
- **ProcessorManufacturer** Retrieves the name of the processor's manufacturer.
- **ProcessorModel** Retrieves the name of the processor model.
-- **ProcessorPhysicalCores** Number of physical cores in the processor.
-- **ProcessorUpdateRevision** The microcode version.
- **SocketCount** Number of physical CPU sockets of the machine.
+- **ProcessorIdentifier** The processor identifier of a manufacturer.
+- **ProcessorUpdateRevision** The microcode version.
+
+
+### Census.Speech
+
+This event is used to gather basic speech settings on the device.
+
+The following fields are available:
+
+- **AboveLockEnabled** Cortana setting that represents if Cortana can be invoked when the device is locked.
+- **GPAllowInputPersonalization** Indicates if a Group Policy setting has enabled speech functionalities.
+- **HolographicSpeechInputDisabled** Holographic setting that represents if the attached HMD devices have speech functionality disabled by the user.
+- **HolographicSpeechInputDisabledRemote** Indicates if a remote policy has disabled speech functionalities for the HMD devices.
+- **KWSEnabled** Cortana setting that represents if a user has enabled the "Hey Cortana" keyword spotter (KWS).
+- **MDMAllowInputPersonalization** Indicates if an MDM policy has enabled speech functionalities.
+- **RemotelyManaged** Indicates if the device is being controlled by a remote administrator (MDM or Group Policy) in the context of speech functionalities.
+- **SpeakerIdEnabled** Cortana setting that represents if keyword detection has been trained to try to respond to a single user's voice.
+- **SpeechServicesEnabled** Windows setting that represents whether a user is opted-in for speech services on the device.
### Census.Storage
@@ -1611,35 +1663,8 @@ This event sends data about the total capacity of the system volume and primary
The following fields are available:
- **PrimaryDiskTotalCapacity** Retrieves the amount of disk space on the primary disk of the device in MB.
-- **PrimaryDiskType** Retrieves an enumerator value of type STORAGE_BUS_TYPE that indicates the type of bus to which the device is connected. This should be used to interpret the raw device properties at the end of this structure (if any).
- **SystemVolumeTotalCapacity** Retrieves the size of the partition that the System volume is installed on in MB.
-
-
-### Census.VM
-
-This event sends data indicating whether virtualization is enabled on the device, and its various characteristics, to help keep Windows up to date.
-
-The following fields are available:
-
-- **CloudService** Indicates which cloud service, if any, that this virtual machine is running within.
-- **HyperVisor** Retrieves whether the current OS is running on top of a Hypervisor.
-- **IOMMUPresent** Represents if an input/output memory management unit (IOMMU) is present.
-- **isVDI** Is the device using Virtual Desktop Infrastructure?
-- **IsVirtualDevice** Retrieves that when the Hypervisor is Microsoft's Hyper-V Hypervisor or other Hv#HASH#1 Hypervisor, this field will be set to FALSE for the Hyper-V host OS and TRUE for any guest OS's. This field should not be relied upon for non-Hv#HASH#1 Hypervisors.
-- **SLATSupported** Represents whether Second Level Address Translation (SLAT) is supported by the hardware.
-- **VirtualizationFirmwareEnabled** Represents whether virtualization is enabled in the firmware.
-
-
-### Census.Xbox
-
-This event sends data about the Xbox Console, such as Serial Number and DeviceId, to help keep Windows up to date.
-
-The following fields are available:
-
-- **XboxConsolePreferredLanguage** Retrieves the preferred language selected by the user on Xbox console.
-- **XboxConsoleSerialNumber** Retrieves the serial number of the Xbox console.
-- **XboxLiveDeviceId** Retrieves the unique device id of the console.
-- **XboxLiveSandboxId** Retrieves the developer sandbox id if the device is internal to MS.
+- **PrimaryDiskType** Retrieves an enumerator value of type STORAGE_BUS_TYPE that indicates the type of bus to which the device is connected. This should be used to interpret the raw device properties at the end of this structure (if any).
### Census.Userdefault
@@ -1648,8 +1673,29 @@ This event sends data about the current user's default preferences for browser a
The following fields are available:
-- **DefaultApp** The current uer's default program selected for the following extension or protocol: .html,.htm,.jpg,.jpeg,.png,.mp3,.mp4, .mov,.pdf
- **DefaultBrowserProgId** The ProgramId of the current user's default browser
+- **DefaultApp** The current uer's default program selected for the following extension or protocol: .html,.htm,.jpg,.jpeg,.png,.mp3,.mp4, .mov,.pdf
+
+
+### Census.UserDisplay
+
+This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system, to help keep Windows up to date.
+
+The following fields are available:
+
+- **InternalPrimaryDisplayLogicalDPIX** Retrieves the logical DPI in the x-direction of the internal display.
+- **InternalPrimaryDisplayLogicalDPIY** Retrieves the logical DPI in the y-direction of the internal display.
+- **InternalPrimaryDisplayPhysicalDPIX** Retrieves the physical DPI in the x-direction of the internal display.
+- **InternalPrimaryDisplayPhysicalDPIY** Retrieves the physical DPI in the y-direction of the internal display.
+- **InternalPrimaryDisplayResolutionHorizontal** Retrieves the number of pixels in the horizontal direction of the internal display.
+- **InternalPrimaryDisplayResolutionVertical** Retrieves the number of pixels in the vertical direction of the internal display.
+- **InternalPrimaryDisplaySizePhysicalH** Retrieves the physical horizontal length of the display in mm. Used for calculating the diagonal length in inches .
+- **InternalPrimaryDisplaySizePhysicalY** Retrieves the physical vertical length of the display in mm. Used for calculating the diagonal length in inches
+- **NumberofInternalDisplays** Retrieves the number of internal displays in a machine.
+- **NumberofExternalDisplays** Retrieves the number of external displays connected to the machine
+- **VRAMDedicated** Retrieves the video RAM in MB.
+- **VRAMDedicatedSystem** Retrieves the amount of memory on the dedicated video card.
+- **VRAMSharedSystem** Retrieves the amount of RAM memory that the video card can use.
### Census.UserNLS
@@ -1659,10 +1705,25 @@ This event sends data about the default app language, input, and display languag
The following fields are available:
- **DefaultAppLanguage** The current user Default App Language.
-- **DisplayLanguage** The current user preferred Windows Display Language.
- **HomeLocation** The current user location, which is populated using GetUserGeoId() function.
-- **KeyboardInputLanguages** The Keyboard input languages installed on the device.
+- **DisplayLanguage** The current user preferred Windows Display Language.
- **SpeechInputLanguages** The Speech Input languages installed on the device.
+- **KeyboardInputLanguages** The Keyboard input languages installed on the device.
+
+
+### Census.VM
+
+This event sends data indicating whether virtualization is enabled on the device, and its various characteristics, to help keep Windows up to date.
+
+The following fields are available:
+
+- **VirtualizationFirmwareEnabled** Represents whether virtualization is enabled in the firmware.
+- **SLATSupported** Represents whether Second Level Address Translation (SLAT) is supported by the hardware.
+- **IOMMUPresent** Represents if an input/output memory management unit (IOMMU) is present.
+- **IsVirtualDevice** Retrieves that when the Hypervisor is Microsoft's Hyper-V Hypervisor or other Hv#1 Hypervisor, this field will be set to FALSE for the Hyper-V host OS and TRUE for any guest OS's. This field should not be relied upon for non-Hv#1 Hypervisors.
+- **HyperVisor** Retrieves whether the current OS is running on top of a Hypervisor.
+- **CloudService** Indicates which cloud service, if any, that this virtual machine is running within.
+- **isVDI** Is the device using Virtual Desktop Infrastructure?
### Census.WU
@@ -1671,46 +1732,41 @@ This event sends data about the Windows update server and other App store polici
The following fields are available:
-- **AppraiserGatedStatus** Indicates whether a device has been gated for upgrading.
+- **WUMachineId** Retrieves the Windows Update (WU) Machine Identifier.
+- **WUServer** Retrieves the HTTP(S) URL of the WSUS server that is used by Automatic Updates and API callers (by default).
+- **WUDODownloadMode** Retrieves whether DO is turned on and how to acquire/distribute updates Delivery Optimization (DO) allows users to deploy previously downloaded WU updates to other devices on the same network.
+- **OSWUAutoUpdateOptions** Retrieves the auto update settings on the device.
- **AppStoreAutoUpdate** Retrieves the Appstore settings for auto upgrade. (Enable/Disabled).
+- **AppStoreAutoUpdatePolicy** Retrieves the Microsoft Store App Auto Update group policy setting
- **AppStoreAutoUpdateMDM** Retrieves the App Auto Update value for MDM: 0 - Disallowed. 1 - Allowed. 2 - Not configured. Default: [2] Not configured
-- **AppStoreAutoUpdatePolicy** Retrieves the Windows Store App Auto Update group policy setting
- **DelayUpgrade** Retrieves the Windows upgrade flag for delaying upgrades.
+- **UpdateServiceURLConfigured** Retrieves if the device is managed by Windows Server Update Services (WSUS).
+- **WUDeferUpgradePeriod** Retrieves if deferral is set for Upgrades
+- **WUDeferUpdatePeriod** Retrieves if deferral is set for Updates
+- **WUPauseState** Retrieves WU setting to determine if updates are paused
+- **OSUninstalled** A flag that represents when a feature update is uninstalled on a device .
+- **OSRolledBack** A flag that represents when a feature update has rolled back during setup.
+- **OSRollbackCount** The number of times feature updates have rolled back on the device.
+- **UninstallActive** A flag that represents when a device has uninstalled a previous upgrade recently.
+- **AppraiserGatedStatus** Indicates whether a device has been gated for upgrading.
- **OSAssessmentFeatureOutOfDate** How many days has it been since a the last feature update was released but the device did not install it?
- **OSAssessmentForFeatureUpdate** Is the device is on the latest feature update?
- **OSAssessmentForQualityUpdate** Is the device on the latest quality update?
- **OSAssessmentForSecurityUpdate** Is the device on the latest security update?
- **OSAssessmentQualityOutOfDate** How many days has it been since a the last quality update was released but the device did not install it?
- **OSAssessmentReleaseInfoTime** The freshness of release information used to perform an assessment.
-- **OSRollbackCount** The number of times feature updates have rolled back on the device.
-- **OSRolledBack** A flag that represents when a feature update has rolled back during setup.
-- **OSUninstalled** A flag that represents when a feature update is uninstalled on a device .
-- **OSWUAutoUpdateOptions** Retrieves the auto update settings on the device.
-- **UninstallActive** A flag that represents when a device has uninstalled a previous upgrade recently.
-- **UpdateServiceURLConfigured** Retrieves if the device is managed by Windows Server Update Services (WSUS).
-- **WUDeferUpdatePeriod** Retrieves if deferral is set for Updates
-- **WUDeferUpgradePeriod** Retrieves if deferral is set for Upgrades
-- **WUDODownloadMode** Retrieves whether DO is turned on and how to acquire/distribute updates Delivery Optimization (DO) allows users to deploy previously downloaded WU updates to other devices on the same network.
-- **WUMachineId** Retrieves the Windows Update (WU) Machine Identifier.
-- **WUPauseState** Retrieves WU setting to determine if updates are paused
-- **WUServer** Retrieves the HTTP(S) URL of the WSUS server that is used by Automatic Updates and API callers (by default).
-### Census.Speech
+### Census.Xbox
-This event is used to gather basic speech settings on the device.
+This event sends data about the Xbox Console, such as Serial Number and DeviceId, to help keep Windows up to date.
The following fields are available:
-- **AboveLockEnabled** Cortana setting that represents if Cortana can be invoked when the device is locked.
-- **GPAllowInputPersonalization** Indicates if a Group Policy setting has enabled speech functionalities.
-- **HolographicSpeechInputDisabled** Holographic setting that represents if the attached HMD devices have speech functionality disabled by the user.
-- **HolographicSpeechInputDisabledRemote** Indicates if a remote policy has disabled speech functionalities for the HMD devices.
-- **KWSEnabled** "Cortana setting that represents if a user has enabled the ""Hey Cortana"" keyword spotter (KWS)."
-- **MDMAllowInputPersonalization** Indicates if an MDM policy has enabled speech functionalities.
-- **RemotelyManaged** Indicates if the device is being controlled by a remote admininistrator (MDM or Group Policy) in the context of speech functionalities.
-- **SpeakerIdEnabled** Cortana setting that represents if keyword detection has been trained to try to respond to a single user's voice.
-- **SpeechServicesEnabled** Windows setting that represents whether a user is opted-in for speech services on the device.
+- **XboxLiveDeviceId** Retrieves the unique device id of the console.
+- **XboxConsoleSerialNumber** Retrieves the serial number of the Xbox console.
+- **XboxLiveSandboxId** Retrieves the developer sandbox id if the device is internal to MS.
+- **XboxConsolePreferredLanguage** Retrieves the preferred language selected by the user on Xbox console.
### Census.Security
@@ -1724,50 +1780,49 @@ This event provides information on about security settings used to help keep Win
- **SecureBootCapable** Is this device capable of running Secure Boot?
- **VBSState** Is virtualization-based security enabled, disabled, or running?
-
## Diagnostic data events
-### TelClientSynthetic.AuthorizationInfo_Startup
-
-This event sends data indicating that a device has undergone a change of telemetry opt-in level detected at UTC startup, to help keep Windows up to date.
-
-The following fields are available:
-
-- **CanAddMsaToMsTelemetry** True if UTC is allowed to add MSA user identity onto telemetry from the OS provider groups.
-- **CanCollectAnyTelemetry** True if UTC is allowed to collect non-OS telemetry. Non-OS telemetry is responsible for providing its own opt-in mechanism.
-- **CanCollectCoreTelemetry** True if UTC is allowed to collect data which is tagged with both MICROSOFT_KEYWORD_CRITICAL_DATA and MICROSOFT_EVENTTAG_CORE_DATA.
-- **CanCollectHeartbeats** True if UTC is allowed to collect heartbeats.
-- **CanCollectOsTelemetry** True if UTC is allowed to collect telemetry from the OS provider groups (often called Microsoft Telemetry).
-- **CanPerformDiagnosticEscalations** True if UTC is allowed to perform all scenario escalations.
-- **CanPerformScripting** True if UTC is allowed to perform scripting.
-- **CanPerformTraceEscalations** True if UTC is allowed to perform scenario escalations with tracing actions.
-- **CanReportScenarios** True if UTC is allowed to load and report scenario completion, failure, and cancellation events.
-- **PreviousPermissions** Bitmask representing the previously configured permissions since the telemetry client was last started.
-- **TransitionFromEverythingOff** True if this transition is moving from not allowing core telemetry to allowing core telemetry.
-
-
### TelClientSynthetic.AuthorizationInfo_RuntimeTransition
-This event sends data indicating that a device has undergone a change of telemetry opt-in level during the runtime of the device (not at UTC boot or offline), to help keep Windows up to date.
+This event sends data indicating that a device has undergone a change of diagnostic data opt-in level during the runtime of the device (not at UTC boot or offline), to help keep Windows up to date.
The following fields are available:
-- **CanAddMsaToMsTelemetry** True if UTC is allowed to add MSA user identity onto telemetry from the OS provider groups.
-- **CanCollectAnyTelemetry** True if UTC is allowed to collect non-OS telemetry. Non-OS telemetry is responsible for providing its own opt-in mechanism.
+- **CanAddMsaToMsTelemetry** True if UTC is allowed to add MSA user identity onto diagnostic data from the OS provider groups.
+- **CanCollectAnyTelemetry** True if UTC is allowed to collect non-OS diagnostic data. Non-OS diagnostic data is responsible for providing its own opt-in mechanism.
- **CanCollectCoreTelemetry** True if UTC is allowed to collect data which is tagged with both MICROSOFT_KEYWORD_CRITICAL_DATA and MICROSOFT_EVENTTAG_CORE_DATA.
- **CanCollectHeartbeats** True if UTC is allowed to collect heartbeats.
-- **CanCollectOsTelemetry** True if UTC is allowed to collect telemetry from the OS provider groups (often called Microsoft Telemetry).
+- **CanCollectOsTelemetry** True if UTC is allowed to collect diagnostic data from the OS provider groups.
- **CanPerformDiagnosticEscalations** True if UTC is allowed to perform all scenario escalations.
- **CanPerformScripting** True if UTC is allowed to perform scripting.
- **CanPerformTraceEscalations** True if UTC is allowed to perform scenario escalations with tracing actions.
- **CanReportScenarios** True if UTC is allowed to load and report scenario completion, failure, and cancellation events.
-- **PreviousPermissions** Bitmask representing the previously configured permissions since the telemetry opt-in level was last changed.
-- **TransitionFromEverythingOff** True if this transition is moving from not allowing core telemetry to allowing core telemetry.
+- **TransitionFromEverythingOff** True if this transition is moving from not allowing core diagnostic data to allowing core diagnostic data.
+- **PreviousPermissions** Bitmask representing the previously configured permissions since the diagnostic data opt-in level was last changed.
+
+
+### TelClientSynthetic.AuthorizationInfo_Startup
+
+This event sends data indicating that a device has undergone a change of diagnostic data opt-in level detected at UTC startup, to help keep Windows up to date.
+
+The following fields are available:
+
+- **TransitionFromEverythingOff** True if this transition is moving from not allowing core diagnostic data to allowing core diagnostic data.
+- **CanCollectAnyTelemetry** True if UTC is allowed to collect non-OS diagnostic data. Non-OS diagnostic data is responsible for providing its own opt-in mechanism.
+- **CanCollectHeartbeats** True if UTC is allowed to collect heartbeats.
+- **CanCollectCoreTelemetry** True if UTC is allowed to collect data which is tagged with both MICROSOFT_KEYWORD_CRITICAL_DATA and MICROSOFT_EVENTTAG_CORE_DATA.
+- **CanCollectOsTelemetry** True if UTC is allowed to collect diagnostic data from the OS provider groups.
+- **CanReportScenarios** True if UTC is allowed to load and report scenario completion, failure, and cancellation events.
+- **CanAddMsaToMsTelemetry** True if UTC is allowed to add MSA user identity onto diagnostic data from the OS provider groups.
+- **CanPerformTraceEscalations** True if UTC is allowed to perform scenario escalations with tracing actions.
+- **CanPerformDiagnosticEscalations** True if UTC is allowed to perform all scenario escalations.
+- **CanPerformScripting** True if UTC is allowed to perform scripting.
+- **PreviousPermissions** Bitmask representing the previously configured permissions since the diagnostic data client was last started.
### TelClientSynthetic.ConnectivityHeartBeat_0
-This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it fires an event. A Connectivity Heartbeat event also fires when a device recovers from costed network to free network.
+This event sends data about the connectivity status of the Connected User Experiences and Telemetry component that uploads diagnostic data events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it fires an event. A Connectivity Heartbeat event also fires when a device recovers from costed network to free network.
The following fields are available:
@@ -1775,53 +1830,53 @@ The following fields are available:
- **CensusStartTime** Returns timestamp corresponding to last successful census run.
- **CensusTaskEnabled** Returns Boolean value for the census task (Enable/Disable) on client machine.
- **LastConnectivityLossTime** Retrieves the last time the device lost free network.
-- **LastConntectivityLossTime** Retrieves the last time the device lost free network.
- **NetworkState** Retrieves the network state: 0 = No network. 1 = Restricted network. 2 = Free network.
- **NoNetworkTime** Retrieves the time spent with no network (since the last time) in seconds.
- **RestrictedNetworkTime** Retrieves the time spent on a metered (cost restricted) network in seconds.
+- **LastConntectivityLossTime** Retrieves the last time the device lost free network.
### TelClientSynthetic.HeartBeat_5
-This event sends data about the health and quality of the telemetry data from the given device, to help keep Windows up to date. It also enables data analysts to determine how 'trusted' the data is from a given device.
+This event sends data about the health and quality of the diagnostic data data from the given device, to help keep Windows up to date. It also enables data analysts to determine how 'trusted' the data is from a given device.
The following fields are available:
-- **AgentConnectionErrorsCount** The number of non-timeout errors associated with the host/agent channel.
-- **CensusExitCode** The last exit code of the Census task.
-- **CensusStartTime** The time of the last Census run.
-- **CensusTaskEnabled** Indicates whether Census is enabled.
-- **ConsumerDroppedCount** The number of events dropped by the consumer layer of the telemetry client.
-- **CriticalDataDbDroppedCount** The number of critical data sampled events that were dropped at the database layer.
-- **CriticalDataThrottleDroppedCount** The number of critical data sampled events that were dropped because of throttling.
-- **CriticalOverflowEntersCounter** The number of times a critical overflow mode was entered into the event database.
-- **DbCriticalDroppedCount** The total number of dropped critical events in the event database.
-- **DbDroppedCount** The number of events that were dropped because the database was full.
+- **PreviousHeartBeatTime** The time of last heartbeat event. This allows chaining of events.
+- **EtwDroppedCount** The number of events dropped by the ETW layer of the diagnostic data client.
+- **ConsumerDroppedCount** The number of events dropped by the consumer layer of the diagnostic data client.
- **DecodingDroppedCount** The number of events dropped because of decoding failures.
-- **EnteringCriticalOverflowDroppedCounter** The number of events that was dropped because a critical overflow mode was initiated.
-- **EtwDroppedBufferCount** The number of buffers dropped in the CUET ETW session.
-- **EtwDroppedCount** The number of events dropped by the ETW layer of the telemetry client.
+- **ThrottledDroppedCount** The number of events dropped due to throttling of noisy providers.
+- **DbDroppedCount** The number of events that were dropped because the database was full.
- **EventSubStoreResetCounter** The number of times the event database was reset.
- **EventSubStoreResetSizeSum** The total size of the event database across all resets reports in this instance.
-- **EventsUploaded** The number of events that have been uploaded.
-- **Flags** Flags that indicate device state, such as network, battery, and opt-in state.
-- **FullTriggerBufferDroppedCount** The number of events that were dropped because the trigger buffer was full.
-- **HeartBeatSequenceNumber** A monotonically increasing heartbeat counter.
+- **CriticalOverflowEntersCounter** The number of times a critical overflow mode was entered into the event database.
+- **EnteringCriticalOverflowDroppedCounter** The number of events that was dropped because a critical overflow mode was initiated.
+- **UploaderDroppedCount** The number of events dropped by the uploader layer of the diagnostic data client.
- **InvalidHttpCodeCount** The number of invalid HTTP codes received from Vortex.
-- **LastAgentConnectionError** The last non-timeout error that happened in the host/agent channel.
-- **LastEventSizeOffender** The name of the last event that exceeded the maximum event size.
- **LastInvalidHttpCode** The last invalid HTTP code received from Vortex.
-- **MaxActiveAgentConnectionCount** The maximum number of active agents during this heartbeat timeframe.
-- **MaxInUseScenarioCounter** The soft maximum number of scenarios loaded by the Connected User Experience and Telemetry component.
-- **PreviousHeartBeatTime** The time of last heartbeat event. This allows chaining of events.
+- **MaxInUseScenarioCounter** The soft maximum number of scenarios loaded by the Connected User Experiences and Telemetry component.
+- **LastEventSizeOffender** The name of the last event that exceeded the maximum event size.
- **SettingsHttpAttempts** The number of attempts to contact the OneSettings service.
- **SettingsHttpFailures** The number of failures from contacting the OneSettings service.
-- **ThrottledDroppedCount** The number of events dropped due to throttling of noisy providers.
-- **UploaderDroppedCount** The number of events dropped by the uploader layer of the telemetry client.
-- **VortexFailuresTimeout** The number of timeout failures received from Vortex.
- **VortexHttpAttempts** The number of attempts to contact the Vortex service.
+- **EventsUploaded** The number of events that have been uploaded.
+- **DbCriticalDroppedCount** The total number of dropped critical events in the event database.
- **VortexHttpFailures4xx** The number of 400-499 error codes received from Vortex.
- **VortexHttpFailures5xx** The number of 500-599 error codes received from Vortex.
+- **VortexFailuresTimeout** The number of timeout failures received from Vortex.
+- **HeartBeatSequenceNumber** A monotonically increasing heartbeat counter.
+- **EtwDroppedBufferCount** The number of buffers dropped in the CUET ETW session.
+- **FullTriggerBufferDroppedCount** The number of events that were dropped because the trigger buffer was full.
+- **CriticalDataThrottleDroppedCount** The number of critical data sampled events that were dropped because of throttling.
+- **CriticalDataDbDroppedCount** The number of critical data sampled events that were dropped at the database layer.
+- **MaxActiveAgentConnectionCount** The maximum number of active agents during this heartbeat timeframe.
+- **AgentConnectionErrorsCount** The number of non-timeout errors associated with the host/agent channel.
+- **LastAgentConnectionError** The last non-timeout error that happened in the host/agent channel.
+- **Flags** Flags that indicate device state, such as network, battery, and opt-in state.
+- **CensusTaskEnabled** Indicates whether Census is enabled.
+- **CensusExitCode** The last exit code of the Census task.
+- **CensusStartTime** The time of the last Census run.
### TelClientSynthetic.PrivacySettingsAfterCreatorsUpdate
@@ -1842,39 +1897,39 @@ This event sends basic GPU and display driver information to keep Windows and di
The following fields are available:
-- **aiSeqId** The event sequence ID.
+- **version** The event version.
- **bootId** The system boot ID.
-- **ComputePreemptionLevel** The maximum preemption level supported by GPU for compute payload.
-- **DedicatedSystemMemoryB** The amount of system memory dedicated for GPU use (in bytes).
-- **DedicatedVideoMemoryB** The amount of dedicated VRAM of the GPU (in bytes).
-- **DisplayAdapterLuid** The display adapter LUID.
+- **aiSeqId** The event sequence ID.
+- **MeasureEnabled** Is the device listening to MICROSOFT_KEYWORD_MEASURES?
+- **TelemetryEnabled** Is the device listening to MICROSOFT_KEYWORD_TELEMETRY?
+- **InterfaceId** The GPU interface ID.
+- **GPUVendorID** The GPU vendor ID.
+- **GPUDeviceID** The GPU device ID.
+- **SubVendorID** The GPU sub vendor ID.
+- **SubSystemID** The subsystem ID.
+- **GPURevisionID** The GPU revision ID.
+- **DriverVersion** The display driver version.
- **DriverDate** The date of the display driver.
- **DriverRank** The rank of the display driver.
-- **DriverVersion** The display driver version.
-- **GPUDeviceID** The GPU device ID.
-- **GPUPreemptionLevel** The maximum preemption level supported by GPU for graphics payload.
-- **GPURevisionID** The GPU revision ID.
-- **GPUVendorID** The GPU vendor ID.
-- **InterfaceId** The GPU interface ID.
-- **IsDisplayDevice** Does the GPU have displaying capabilities?
+- **IsMiracastSupported** Does the GPU support Miracast?
+- **IsMsMiracastSupported** Are the GPU Miracast capabilities driven by a Microsoft solution?
- **IsHybridDiscrete** Does the GPU have discrete GPU capabilities in a hybrid device?
- **IsHybridIntegrated** Does the GPU have integrated GPU capabilities in a hybrid device?
-- **IsLDA** Is the GPU comprised of Linked Display Adapters?
-- **IsMiracastSupported** Does the GPU support Miracast?
-- **IsMismatchLDA** Is at least one device in the Linked Display Adapters chain from a different vendor?
- **IsMPOSupported** Does the GPU support Multi-Plane Overlays?
-- **IsMsMiracastSupported** Are the GPU Miracast capabilities driven by a Microsoft solution?
+- **IsLDA** Is the GPU comprised of Linked Display Adapters?
+- **IsMismatchLDA** Is at least one device in the Linked Display Adapters chain from a different vendor?
- **IsPostAdapter** Is this GPU the POST GPU in the device?
-- **IsRenderDevice** Does the GPU have rendering capabilities?
- **IsSoftwareDevice** Is this a software implementation of the GPU?
-- **MeasureEnabled** Is the device listening to MICROSOFT_KEYWORD_MEASURES?
-- **SharedSystemMemoryB** The amount of system memory shared by GPU and CPU (in bytes).
-- **SubSystemID** The subsystem ID.
-- **SubVendorID** The GPU sub vendor ID.
-- **TelemetryEnabled** Is the device listening to MICROSOFT_KEYWORD_TELEMETRY?
-- **TelInvEvntTrigger** What triggered this event to be logged? Example: 0 (GPU enumeration) or 1 (DxgKrnlTelemetry provider toggling)
-- **version** The event version.
+- **IsRenderDevice** Does the GPU have rendering capabilities?
+- **IsDisplayDevice** Does the GPU have displaying capabilities?
- **WDDMVersion** The Windows Display Driver Model version.
+- **DisplayAdapterLuid** The display adapter LUID.
+- **GPUPreemptionLevel** The maximum preemption level supported by GPU for graphics payload.
+- **ComputePreemptionLevel** The maximum preemption level supported by GPU for compute payload.
+- **TelInvEvntTrigger** What triggered this event to be logged? Example: 0 (GPU enumeration) or 1 (DxgKrnlTelemetry provider toggling)
+- **DedicatedVideoMemoryB** The amount of dedicated VRAM of the GPU (in bytes).
+- **DedicatedSystemMemoryB** The amount of system memory dedicated for GPU use (in bytes).
+- **SharedSystemMemoryB** The amount of system memory shared by GPU and CPU (in bytes).
- **NumVidPnSources** The number of supported display output sources.
- **NumVidPnTargets** The number of supported display output targets.
@@ -1883,52 +1938,31 @@ The following fields are available:
### Microsoft.Windows.FaultReporting.AppCrashEvent
-"This event sends data about crashes for both native and managed applications, to help keep Windows up to date. The data includes information about the crashing process and a summary of its exception record. It does not contain any Watson bucketing information. The bucketing information is recorded in a Windows Error Reporting (WER) event that is generated when the WER client reports the crash to the Watson service, and the WER event will contain the same ReportID (see field 14 of crash event, field 19 of WER event) as the crash event for the crash being reported. AppCrash is emitted once for each crash handled by WER (e.g. from an unhandled exception or FailFast or ReportException). Note that Generic Watson event types (e.g. from PLM) that may be considered crashes"" by a user DO NOT emit this event."
+This event sends data about crashes for both native and managed applications, to help keep Windows up to date. The data includes information about the crashing process and a summary of its exception record. It does not contain any Watson bucketing information. The bucketing information is recorded in a Windows Error Reporting (WER) event that is generated when the WER client reports the crash to the Watson service, and the WER event will contain the same ReportID (see field 14 of crash event, field 19 of WER event) as the crash event for the crash being reported. AppCrash is emitted once for each crash handled by WER (e.g. from an unhandled exception or FailFast or ReportException). Note that Generic Watson event types (e.g. from PLM) that may be considered crashes" by a user DO NOT emit this event.
The following fields are available:
-- **AppName** The name of the app that has crashed.
-- **AppSessionGuid** GUID made up of process ID and is used as a correlation vector for process instances in the telemetry backend.
-- **AppTimeStamp** The date/time stamp of the app.
-- **AppVersion** The version of the app that has crashed.
+- **ProcessId** The ID of the process that has crashed.
+- **ProcessCreateTime** The time of creation of the process that has crashed.
- **ExceptionCode** The exception code returned by the process that has crashed.
- **ExceptionOffset** The address where the exception had occurred.
-- **Flags** "Flags indicating how reporting is done. For example, queue the report, do not offer JIT debugging, or do not terminate the process after reporting. "
+- **AppName** The name of the app that has crashed.
+- **AppVersion** The version of the app that has crashed.
+- **AppTimeStamp** The date/time stamp of the app.
- **ModName** Exception module name (e.g. bar.dll).
-- **ModTimeStamp** The date/time stamp of the module.
- **ModVersion** The version of the module that has crashed.
+- **ModTimeStamp** The date/time stamp of the module.
- **PackageFullName** Store application identity.
- **PackageRelativeAppId** Store application identity.
- **ProcessArchitecture** Architecture of the crashing process, as one of the PROCESSOR_ARCHITECTURE_* constants: 0: PROCESSOR_ARCHITECTURE_INTEL. 5: PROCESSOR_ARCHITECTURE_ARM. 9: PROCESSOR_ARCHITECTURE_AMD64. 12: PROCESSOR_ARCHITECTURE_ARM64.
-- **ProcessCreateTime** The time of creation of the process that has crashed.
-- **ProcessId** The ID of the process that has crashed.
- **ReportId** A GUID used to identify the report. This can used to track the report across Watson.
+- **Flags** Flags indicating how reporting is done. For example, queue the report, do not offer JIT debugging, or do not terminate the process after reporting.
+- **AppSessionGuid** GUID made up of process ID and is used as a correlation vector for process instances in the diagnostic data backend.
- **TargetAppId** The kernel reported AppId of the application being reported.
- **TargetAppVer** The specific version of the application being reported
- **TargetAsId** The sequence number for the hanging process.
-## Feature update events
-
-### Microsoft.Windows.Upgrade.Uninstall.UninstallFailed
-
-This event sends diagnostic data about failures when uninstalling a feature update, to help resolve any issues preventing customers from reverting to a known state
-
-The following fields are available:
-
-- **failureReason** Provides data about the uninstall initialization operation failure
-- **hr** Provides the Win32 error code for the operation failure
-
-
-### Microsoft.Windows.Upgrade.Uninstall.UninstallFinalizedAndRebootTriggered
-
-Indicates that the uninstall was properly configured and that a system reboot was initiated
-
-The following fields are available:
-
-- **name** Name of the event
-
-
## Hang Reporting events
### Microsoft.Windows.HangReporting.AppHangEvent
@@ -1938,26 +1972,63 @@ This event sends data about hangs for both native and managed applications, to h
The following fields are available:
- **AppName** The name of the app that has hung.
-- **AppSessionGuid** GUID made up of process id used as a correlation vector for process instances in the telemetry backend.
-- **AppVersion** The version of the app that has hung.
-- **PackageFullName** Store application identity.
+- **TypeCode** Bitmap describing the hang type.
+- **ProcessId** The ID of the process that has hung.
+- **UTCReplace_TargetAppId** The kernel reported AppId of the application being reported.
+- **ProcessCreateTime** The time of creation of the process that has hung.
+- **UTCReplace_TargetAppVer** The specific version of the application being reported.
+- **WaitingOnAppName** If this is a cross process hang waiting for an application, this has the name of the application.
- **PackageRelativeAppId** Store application identity.
- **ProcessArchitecture** Architecture of the hung process, as one of the PROCESSOR_ARCHITECTURE_* constants: 0: PROCESSOR_ARCHITECTURE_INTEL. 5: PROCESSOR_ARCHITECTURE_ARM. 9: PROCESSOR_ARCHITECTURE_AMD64. 12: PROCESSOR_ARCHITECTURE_ARM64.
-- **ProcessCreateTime** The time of creation of the process that has hung.
-- **ProcessId** The ID of the process that has hung.
+- **WaitingOnPackageRelativeAppId** If this is a cross process hang waiting for a package, this has the relative application id of the package.
+- **WaitingOnAppVersion** If this is a cross process hang, this has the version of the application for which it is waiting.
+- **AppSessionGuid** GUID made up of process id used as a correlation vector for process instances in the diagnostic data backend.
+- **WaitingOnPackageFullName** If this is a cross process hang waiting for a package, this has the full name of the package for which it is waiting.
+- **PackageFullName** Store application identity.
+- **AppVersion** The version of the app that has hung.
- **ReportId** A GUID used to identify the report. This can used to track the report across Watson.
- **TargetAppId** The kernel reported AppId of the application being reported.
- **TargetAppVer** The specific version of the application being reported.
- **TargetAsId** The sequence number for the hanging process.
-- **TypeCode** Bitmap describing the hang type.
-- **WaitingOnAppName** If this is a cross process hang waiting for an application, this has the name of the application.
-- **WaitingOnAppVersion** If this is a cross process hang, this has the version of the application for which it is waiting.
-- **WaitingOnPackageFullName** If this is a cross process hang waiting for a package, this has the full name of the package for which it is waiting.
-- **WaitingOnPackageRelativeAppId** If this is a cross process hang waiting for a package, this has the relative application id of the package.
## Inventory events
+### Microsoft.Windows.Inventory.Core.AmiTelCacheChecksum
+
+This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object.
+
+The following fields are available:
+
+- **Device** A count of device objects in cache
+- **DeviceCensus** A count of devicecensus objects in cache
+- **DriverPackageExtended** A count of driverpackageextended objects in cache
+- **File** A count of file objects in cache
+- **Generic** A count of generic objects in cache
+- **HwItem** A count of hwitem objects in cache
+- **InventoryApplication** A count of application objects in cache
+- **InventoryApplicationFile** A count of application file objects in cache
+- **InventoryDeviceContainer** A count of device container objects in cache
+- **InventoryDeviceMediaClass** A count of device media objects in cache
+- **InventoryDevicePnp** A count of devicepnp objects in cache
+- **InventoryDriverBinary** A count of driver binary objects in cache
+- **InventoryDriverPackage** A count of device objects in cache
+- **Metadata** A count of metadata objects in cache
+- **Orphan** A count of orphan file objects in cache
+- **Programs** A count of program objects in cache
+- **FileSigningInfo** A count of file signing info objects in cache.
+- **InventoryDeviceInterface** A count of inventory device interface objects in cache.
+
+
+### Microsoft.Windows.Inventory.Core.AmiTelCacheVersions
+
+This event sends inventory component versions for the Device Inventory data.
+
+The following fields are available:
+
+- **aeinv** The version of the App inventory component.
+- **devinv** The file version of the Device inventory component.
+
### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassStartSync
This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent
@@ -1965,8 +2036,7 @@ This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will
The following fields are available:
- **InventoryVersion** The version of the inventory file generating the events
-
-
+-
### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassAdd
This event sends basic metadata about the USB hubs on the device
@@ -1976,36 +2046,319 @@ The following fields are available:
- **InventoryVersion** The version of the inventory file generating the events
- **TotalUserConnectablePorts** Total number of connectable USB ports
- **TotalUserConnectableTypeCPorts** Total number of connectable USB Type C ports
+-
+### Microsoft.Windows.Inventory.Core.InventoryApplicationAdd
-
-### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsAdd
-
-This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule
+This event sends basic metadata about an application on the system to help keep Windows up to date.
The following fields are available:
-- **Count** Count of total Microsoft Office VBA rule violations
+- **ProgramInstanceId** A hash of the file IDs in an app.
+- **Name** The name of the application. Location pulled from depends on 'Source' field.
+- **Type** One of ("Application", "Hotfix", "BOE", "Service", "Unknown"). Application indicates Win32 or Appx app, Hotfix indicates app updates (KBs), BOE indicates it's an app with no ARP or MSI entry, Service indicates that it is a service. Application and BOE are the ones most likely seen.
+- **Publisher** The Publisher of the application. Location pulled from depends on the 'Source' field.
+- **Version** The version number of the program.
+- **Language** The language code of the program.
+- **Source** How the program was installed (ARP, MSI, Appx, etc...)
+- **MsiProductCode** A GUID that describe the MSI Product.
+- **MsiPackageCode** A GUID that describes the MSI Package. Multiple 'Products' (apps) can make up an MsiPackage.
+- **HiddenArp** Indicates whether a program hides itself from showing up in ARP.
+- **OSVersionAtInstallTime** The four octets from the OS version at the time of the application's install.
+- **RootDirPath** The path to the root directory where the program was installed.
+- **InstallDate** The date the application was installed (a best guess based on folder creation date heuristics)
+- **InstallDateMsi** The install date if the application was installed via MSI. Passed as an array.
+- **InstallDateFromLinkFile** The estimated date of install based on the links to the files. Passed as an array.
+- **InstallDateArpLastModified** The date of the registry ARP key for a given application. Hints at install date but not always accurate. Passed as an array.
+- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
+- **objectInstanceId** ProgramId (a hash of Name, Version, Publisher, and Language of an application used to identify it).
+- **PackageFullName** The package full name for a Store application.
+- **InventoryVersion** The version of the inventory file generating the events.
+- **StoreAppType** A sub-classification for the type of Microsoft Store app, such as UWP or Win8StoreApp.
-### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInAdd
-This event provides data on the installed Office Add-ins.
+### Microsoft.Windows.Inventory.Core.InventoryApplicationRemove
-- **AddInCLSID** The CLSID key office the Office addin.
-- **AddInId** The ID of the Office addin.
-- **BinFileTimestamp** The timestamp of the Office addin.
-- **BinFileVersion** The version of the Office addin.
-- **Description** The description of the Office addin.
-- **FileId** The file ID of the Office addin.
-- **FriendlyName** The friendly name of the Office addin.
-- **FullPath** The full path to the Office addin.
-- **LoadBehavior** A Uint32 that describes the load behavior.
-- **LoadTime** The load time for the Office addin.
-- **OfficeApplication** The OIffice application for this addin.
-- **OfficeArchitecture** The architecture of the addin.
-- **OfficeVersion** The Office version for this addin.
-- **OutlookCrashingAddin** A boolean value that indicates if crashes have been found for this addin.
-- **Provider** The provider name for this addin.
+This event indicates that a new set of InventoryDevicePnpAdd events will be sent.
+The following fields are available:
+
+- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
+- **InventoryVersion** The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryApplicationStartSync
+
+This event indicates that a new set of InventoryApplicationAdd events will be sent.
+
+The following fields are available:
+
+- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
+- **InventoryVersion** The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerAdd
+
+This event sends basic metadata about a device container (such as a monitor or printer as opposed to a PNP device) to help keep Windows up-to-date.
+
+The following fields are available:
+
+- **ModelName** The model name.
+- **ModelId** A model GUID.
+- **PrimaryCategory** The primary category for the device container.
+- **Categories** A comma separated list of functional categories in which the container belongs.
+- **IsConnected** For a physically attached device, this value is the same as IsPresent. For wireless a device, this value represents a communication link.
+- **IsActive** Is the device connected, or has it been seen in the last 14 days?
+- **IsPaired** Does the device container require pairing?
+- **IsNetworked** Is this a networked device?
+- **IsMachineContainer** Is the container the root device itself?
+- **FriendlyName** The name of the device container.
+- **DiscoveryMethod** The discovery method for the device container.
+- **ModelNumber** The model number for the device container.
+- **Manufacturer** The manufacturer name for the device container.
+- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
+- **objectInstanceId** ContainerId
+- **InventoryVersion** The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerRemove
+
+This event indicates that the InventoryDeviceContainer object is no longer present.
+
+The following fields are available:
+
+- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
+- **InventoryVersion** The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerStartSync
+
+This event indicates that a new set of InventoryDeviceContainerAdd events will be sent.
+
+The following fields are available:
+
+- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
+- **InventoryVersion** The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceAdd
+
+This event retrieves information about what sensor interfaces are available on the device.
+
+The following fields are available:
+
+- **InventoryVersion** The version of the inventory file generating the events.
+- **Accelerometer3D** Indicates if an Accelerator3D sensor is found.
+- **ActivityDetection** Indicates if an Activity Detection sensor is found.
+- **AmbientLight** Indicates if an Ambient Light sensor is found.
+- **Barometer** Indicates if a Barometer sensor is found.
+- **Custom** Indicates if a Custom sensor is found.
+- **FloorElevation** Indicates if a Floor Elevation sensor is found.
+- **GeomagneticOrientation** Indicates if a Geo Magnetic Orientation sensor is found.
+- **GravityVector** Indicates if a Gravity Detector sensor is found.
+- **Gyrometer3D** Indicates if a Gyrometer3D sensor is found.
+- **Humidity** Indicates if a Humidity sensor is found.
+- **LinearAccelerometer** Indicates if a Linear Accelerometer sensor is found.
+- **Magnetometer3D** Indicates if a Magnetometer3D sensor is found.
+- **Orientation** Indicates if an Orientation sensor is found.
+- **Pedometer** Indicates if a Pedometer sensor is found.
+- **Proximity** Indicates if a Proximity sensor is found.
+- **RelativeOrientation** Indicates if a Relative Orientation sensor is found.
+- **SimpleDeviceOrientation** Indicates if a Simple Device Orientation sensor is found.
+- **Temperature** Indicates if a Temperature sensor is found.
+- **EnergyMeter** Indicates if an Energy sensor is found.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceStartSync
+
+This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent.
+
+The following fields are available:
+
+- **InventoryVersion** The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassAdd
+
+This event sends additional metadata about a PNP device that is specific to a particular class of devices to help keep Windows up to date while reducing overall size of data payload.
+
+The following fields are available:
+
+- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
+- **InventoryVersion** The version of the inventory file generating the events.
+- **Audio_CaptureDriver** The Audio device capture driver endpoint.
+- **Audio_RenderDriver** The Audio device render driver endpoint.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassRemove
+
+This event indicates that the InventoryDeviceMediaClassRemove object is no longer present.
+
+The following fields are available:
+
+- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
+- **InventoryVersion** The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassStartSync
+
+This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent.
+
+The following fields are available:
+
+- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
+- **InventoryVersion** The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDevicePnpAdd
+
+This event sends basic metadata about a PNP device and its associated driver to help keep Windows up-to-date.
+
+The following fields are available:
+
+- **HWID** A JSON array that provides the value and order of the HWID tree for the device.
+- **COMPID** A JSON array the provides the value and order of the compatible ID tree for the device.
+- **InstallState** The device installation state. One of these values: https://msdn.microsoft.com/en-us/library/windows/hardware/ff543130.aspx
+- **Enumerator** The bus that enumerated the device.
+- **ContainerId** A system-supplied GUID that uniquely groups the functional devices associated with a single-function or multifunction device installed in the device.
+- **DeviceState** DeviceState is a bitmask of the following: DEVICE_IS_CONNECTED 0x0001 (currently only for container). DEVICE_IS_NETWORK_DEVICE 0x0002 (currently only for container). DEVICE_IS_PAIRED 0x0004 (currently only for container). DEVICE_IS_ACTIVE 0x0008 (currently never set). DEVICE_IS_MACHINE 0x0010 (currently only for container). DEVICE_IS_PRESENT 0x0020 (currently always set). DEVICE_IS_HIDDEN 0x0040. DEVICE_IS_PRINTER 0x0080 (currently only for container). DEVICE_IS_WIRELESS 0x0100. DEVICE_IS_WIRELESS_FAT 0x0200. The most common values are therefore: 32 (0x20)= device is present. 96 (0x60)= device is present but hidden. 288 (0x120)= device is a wireless device that is present.
+- **ParentId** Device instance id of the parent of the device.
+- **STACKID** A JSON array that provides the value and order of the STACKID tree for the device.
+- **Description** The device description.
+- **MatchingID** Represents the hardware ID or compatible ID that Windows uses to install a device instance.
+- **Class** The device setup class of the driver loaded for the device.
+- **ClassGuid** The device setup class guid of the driver loaded for the device.
+- **Manufacturer** The device manufacturer.
+- **Model** The device model.
+- **Inf** The INF file name.
+- **DriverVerVersion** The version of the driver loaded for the device.
+- **DriverVerDate** The date of the driver loaded for the device.
+- **Provider** The device provider.
+- **DriverPackageStrongName** The immediate parent directory name in the Directory field of InventoryDriverPackage.
+- **Service** The device service name.
+- **LowerClassFilters** Lower filter class drivers IDs installed for the device.
+- **LowerFilters** Lower filter drivers IDs installed for the device.
+- **UpperClassFilters** Upper filter class drivers IDs installed for the device.
+- **UpperFilters** Upper filter drivers IDs installed for the device.
+- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
+- **DriverId** A unique identifier for the installed device.
+- **DriverName** The name of the driver image file.
+- **InventoryVersion** The version of the inventory file generating the events.
+- **ProblemCode** The current error code for the device.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDevicePnpRemove
+
+This event indicates that the InventoryDevicePnpRemove object is no longer present.
+
+The following fields are available:
+
+- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
+- **InventoryVersion** The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDevicePnpStartSync
+
+This event indicates that a new set of InventoryDevicePnpAdd events will be sent.
+
+The following fields are available:
+
+- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
+- **InventoryVersion** The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryAdd
+
+This event sends basic metadata about driver files running on the system to help keep Windows up-to-date.
+
+The following fields are available:
+
+- **DriverName** The file name of the driver.
+- **Inf** The name of the INF file.
+- **DriverPackageStrongName** The strong name of the driver package.
+- **DriverCompany** The company name that developed the driver.
+- **DriverCheckSum** The checksum of the driver file.
+- **DriverTimeStamp** The low 32 bits of the time stamp of the driver file.
+- **DriverType** A bitfield of driver attributes: 1. define DRIVER_MAP_DRIVER_TYPE_PRINTER 0x0001. 2. define DRIVER_MAP_DRIVER_TYPE_KERNEL 0x0002. 3. define DRIVER_MAP_DRIVER_TYPE_USER 0x0004. 4. define DRIVER_MAP_DRIVER_IS_SIGNED 0x0008. 5. define DRIVER_MAP_DRIVER_IS_INBOX 0x0010. 6. define DRIVER_MAP_DRIVER_IS_WINQUAL 0x0040. 7. define DRIVER_MAP_DRIVER_IS_SELF_SIGNED 0x0020. 8. define DRIVER_MAP_DRIVER_IS_CI_SIGNED 0x0080. 9. define DRIVER_MAP_DRIVER_HAS_BOOT_SERVICE 0x0100. 10. define DRIVER_MAP_DRIVER_TYPE_I386 0x10000. 11. define DRIVER_MAP_DRIVER_TYPE_IA64 0x20000. 12. define DRIVER_MAP_DRIVER_TYPE_AMD64 0x40000. 13. define DRIVER_MAP_DRIVER_TYPE_ARM 0x100000. 14. define DRIVER_MAP_DRIVER_TYPE_THUMB 0x200000. 15. define DRIVER_MAP_DRIVER_TYPE_ARMNT 0x400000. 16. define DRIVER_MAP_DRIVER_IS_TIME_STAMPED 0x800000.
+- **DriverInBox** Is the driver included with the operating system?
+- **DriverSigned** Is the driver signed?
+- **DriverIsKernelMode** Is it a kernel mode driver?
+- **DriverVersion** The version of the driver file.
+- **ImageSize** The size of the driver file.
+- **Product** The product name that is included in the driver file.
+- **ProductVersion** The product version that is included in the driver file.
+- **WdfVersion** The Windows Driver Framework version.
+- **Service** The name of the service that is installed for the device.
+- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
+- **InventoryVersion** The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryRemove
+
+This event indicates that the InventoryDriverBinary object is no longer present.
+
+The following fields are available:
+
+- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
+- **InventoryVersion** The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryStartSync
+
+This event indicates that a new set of InventoryDriverBinaryAdd events will be sent.
+
+The following fields are available:
+
+- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
+- **InventoryVersion** The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDriverPackageAdd
+
+This event sends basic metadata about drive packages installed on the system to help keep Windows up-to-date.
+
+The following fields are available:
+
+- **Inf** The INF name of the driver package.
+- **ClassGuid** The class GUID for the device driver.
+- **Class** The class name for the device driver.
+- **Directory** The path to the driver package.
+- **Date** The driver package date.
+- **Version** The version of the driver package.
+- **Provider** The provider for the driver package.
+- **SubmissionId** The HLK submission ID for the driver package.
+- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
+- **InventoryVersion** The version of the inventory file generating the events.
+- **DriverInBox** Is the driver included with the operating system?
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDriverPackageRemove
+
+This event indicates that the InventoryDriverPackageRemove object is no longer present.
+
+The following fields are available:
+
+- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
+- **InventoryVersion** The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDriverPackageStartSync
+
+This event indicates that a new set of InventoryDriverPackageAdd events will be sent.
+
+The following fields are available:
+
+- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
+- **InventoryVersion** The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Indicators.Checksum
+
+This event summarizes the counts for the InventoryMiscellaneousUexIndicatorAdd events.
+
+The following fields are available:
+
+- **ChecksumDictionary** A count of each operating system indicator.
+- **PCFP** Equivalent to the InventoryId field that is found in other core events.
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAAdd
@@ -2035,7 +2388,6 @@ The following fields are available:
- **Validation** Count of files that require additional manual validation
- **Validation_x64** Count of files that require additional manual validation for 64-bit issues
-
### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkStartSync
This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent
@@ -2044,7 +2396,6 @@ The following fields are available:
- **InventoryVersion** The version of the inventory file generating the events
-
### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkAdd
This event provides the basic metadata about the frameworks an application may depend on
@@ -2063,354 +2414,8 @@ These events represent the basic metadata about the OS indicators installed on t
The following fields are available:
+- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
- **IndicatorValue** The indicator value
-- **Value** Describes an operating system indicator that may be relevant for the device upgrade.
-
-
-### Microsoft.Windows.Inventory.Indicators.Checksum
-
-This event summarizes the counts for the InventoryMiscellaneousUexIndicatorAdd events.
-
-The following fields are available:
-
-- **ChecksumDictionary** A count of each operating system indicator.
-- **PCFP** Equivalent to the InventoryId field that is found in other core events.
-
-
-### Microsoft.Windows.Inventory.Core.InventoryApplicationAdd
-
-This event sends basic metadata about an application on the system to help keep Windows up to date.
-
-The following fields are available:
-
-- **HiddenArp** Indicates whether a program hides itself from showing up in ARP.
-- **InstallDate** The date the application was installed (a best guess based on folder creation date heuristics).
-- **InstallDateArpLastModified** The date of the registry ARP key for a given application. Hints at install date but not always accurate. Passed as an array. Example: 4/11/2015 00:00:00
-- **InstallDateFromLinkFile** The estimated date of install based on the links to the files. Passed as an array.
-- **InstallDateMsi** The install date if the application was installed via MSI. Passed as an array.
-- **InventoryVersion** The version of the inventory file generating the events.
-- **Language** The language code of the program.
-- **MsiPackageCode** A GUID that describes the MSI Package. Multiple 'Products' (apps) can make up an MsiPackage.
-- **MsiProductCode** A GUID that describe the MSI Product.
-- **Name** The name of the application
-- **OSVersionAtInstallTime** The four octets from the OS version at the time of the application's install.
-- **PackageFullName** The package full name for a Store application.
-- **ProgramInstanceId** A hash of the file IDs in an app.
-- **Publisher** The Publisher of the application. Location pulled from depends on the 'Source' field.
-- **RootDirPath** The path to the root directory where the program was installed.
-- **Source** How the program was installed (ARP, MSI, Appx, etc...)
-- **StoreAppType** A sub-classification for the type of Windows Store app, such as UWP or Win8StoreApp.
-- **Type** "One of (""Application"", ""Hotfix"", ""BOE"", ""Service"", ""Unknown""). Application indicates Win32 or Appx app, Hotfix indicates app updates (KBs), BOE indicates it's an app with no ARP or MSI entry, Service indicates that it is a service. Application and BOE are the ones most likely seen."
-- **Version** The version number of the program.
-
-
-### Microsoft.Windows.Inventory.Core.InventoryApplicationRemove
-
-This event indicates that a new set of InventoryDevicePnpAdd events will be sent.
-
-The following fields are available:
-
-- **InventoryVersion** The version of the inventory file generating the events.
-
-
-### Microsoft.Windows.Inventory.Core.InventoryApplicationStartSync
-
-This event indicates that a new set of InventoryApplicationAdd events will be sent.
-
-The following fields are available:
-
-- **InventoryVersion** The version of the inventory file generating the events.
-
-
-### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerRemove
-
-This event indicates that the InventoryDeviceContainer object is no longer present.
-
-The following fields are available:
-
-- **InventoryVersion** The version of the inventory file generating the events.
-
-
-### Microsoft.Windows.Inventory.Core.InventoryDriverPackageAdd
-
-This event sends basic metadata about drive packages installed on the system to help keep Windows up-to-date.
-
-The following fields are available:
-
-- **Class** The class name for the device driver.
-- **ClassGuid** The class GUID for the device driver.
-- **Date** The driver package date.
-- **Directory** The path to the driver package.
-- **DriverInBox** Is the driver included with the operating system?
-- **Inf** The INF name of the driver package.
-- **InventoryVersion** The version of the inventory file generating the events.
-- **Provider** The provider for the driver package.
-- **SubmissionId** The HLK submission ID for the driver package.
-- **Version** The version of the driver package.
-
-
-### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryStartSync
-
-This event indicates that a new set of InventoryDriverBinaryAdd events will be sent.
-
-The following fields are available:
-
-- **InventoryVersion** The version of the inventory file generating the events.
-
-
-### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryRemove
-
-This event indicates that the InventoryDriverBinary object is no longer present.
-
-The following fields are available:
-
-- **InventoryVersion** The version of the inventory file generating the events.
-
-
-### Microsoft.Windows.Inventory.Core.InventoryDriverPackageRemove
-
-This event indicates that the InventoryDriverPackageRemove object is no longer present.
-
-The following fields are available:
-
-- **InventoryVersion** The version of the inventory file generating the events.
-
-
-### Microsoft.Windows.Inventory.Core.InventoryDevicePnpRemove
-
-This event indicates that the InventoryDevicePnpRemove object is no longer present.
-
-The following fields are available:
-
-- **InventoryVersion** The version of the inventory file generating the events.
-
-
-### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerAdd
-
-This event sends basic metadata about a device container (such as a monitor or printer as opposed to a PNP device) to help keep Windows up-to-date.
-
-The following fields are available:
-
-- **Categories** A comma separated list of functional categories in which the container belongs.
-- **DiscoveryMethod** The discovery method for the device container.
-- **FriendlyName** The name of the device container.
-- **InventoryVersion** The version of the inventory file generating the events.
-- **IsActive** Is the device connected, or has it been seen in the last 14 days?
-- **IsConnected** For a physically attached device, this value is the same as IsPresent. For wireless a device, this value represents a communication link.
-- **IsMachineContainer** Is the container the root device itself?
-- **IsNetworked** Is this a networked device?
-- **IsPaired** Does the device container require pairing?
-- **Manufacturer** The manufacturer name for the device container.
-- **ModelId** A model GUID.
-- **ModelName** The model name.
-- **ModelNumber** The model number for the device container.
-- **PrimaryCategory** The primary category for the device container.
-
-
-### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerStartSync
-
-This event indicates that a new set of InventoryDeviceContainerAdd events will be sent.
-
-The following fields are available:
-
-- **InventoryVersion** The version of the inventory file generating the events.
-
-
-### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassStartSync
-
-This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent.
-
-The following fields are available:
-
-- **InventoryVersion** The version of the inventory file generating the events.
-
-
-### Microsoft.Windows.Inventory.Core.InventoryDriverPackageStartSync
-
-This event indicates that a new set of InventoryDriverPackageAdd events will be sent.
-
-The following fields are available:
-
-- **InventoryVersion** The version of the inventory file generating the events.
-
-
-### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassRemove
-
-This event indicates that the InventoryDeviceMediaClassRemove object is no longer present.
-
-The following fields are available:
-
-- **InventoryVersion** The version of the inventory file generating the events.
-
-
-### Microsoft.Windows.Inventory.Core.InventoryDevicePnpStartSync
-
-This event indicates that a new set of InventoryDevicePnpAdd events will be sent.
-
-The following fields are available:
-
-- **InventoryVersion** The version of the inventory file generating the events.
-
-
-### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassAdd
-
-This event sends additional metadata about a PNP device that is specific to a particular class of devices to help keep Windows up to date while reducing overall size of data payload.
-
-The following fields are available:
-
-- **Audio_CaptureDriver** The Audio device capture driver endpoint.
-- **Audio_RenderDriver** The Audio device render driver endpoint.
-- **InventoryVersion** The version of the inventory file generating the events.
-
-
-### Microsoft.Windows.Inventory.Core.InventoryDevicePnpAdd
-
-This event represents the basic metadata about a PNP device and its associated driver
-
-The following fields are available:
-
-- **class** The device setup class of the driver loaded for the device
-- **classGuid** The device class GUID from the driver package
-- **COMPID** A JSON array the provides the value and order of the compatible ID tree for the device.
-- **ContainerId** A system-supplied GUID that uniquely groups the functional devices associated with a single-function or multifunction device installed in the device.
-- **description** The device description
-- **deviceState** DeviceState is a bitmask of the following: DEVICE_IS_CONNECTED 0x0001 (currently only for container). DEVICE_IS_NETWORK_DEVICE 0x0002 (currently only for container). DEVICE_IS_PAIRED 0x0004 (currently only for container). DEVICE_IS_ACTIVE 0x0008 (currently never set). DEVICE_IS_MACHINE 0x0010 (currently only for container). DEVICE_IS_PRESENT 0x0020 (currently always set). DEVICE_IS_HIDDEN 0x0040. DEVICE_IS_PRINTER 0x0080 (currently only for container). DEVICE_IS_WIRELESS 0x0100. DEVICE_IS_WIRELESS_FAT 0x0200. The most common values are therefore: 32 (0x20)= device is present. 96 (0x60)= device is present but hidden. 288 (0x120)= device is a wireless device that is present
-- **DriverId** A unique identifier for the installed device.
-- **DriverName** The name of the driver image file.
-- **driverPackageStrongName** The immediate parent directory name in the Directory field of InventoryDriverPackage.
-- **driverVerDate** The date of the driver loaded for the device
-- **driverVerVersion** The version of the driver loaded for the device
-- **enumerator** The bus that enumerated the device
-- **HWID** A JSON array that provides the value and order of the HWID tree for the device.
-- **Inf** The INF file name.
-- **installState** The device installation state. One of these values: https://msdn.microsoft.com/en-us/library/windows/hardware/ff543130.aspx
-- **InventoryVersion** The version of the inventory file generating the events.
-- **lowerClassFilters** Lower filter class drivers IDs installed for the device.
-- **lowerFilters** Lower filter drivers IDs installed for the device
-- **manufacturer** The device manufacturer
-- **matchingID** Represents the hardware ID or compatible ID that Windows uses to install a device instance
-- **model** The device model
-- **parentId** Device instance id of the parent of the device
-- **ProblemCode** The current error code for the device.
-- **provider** The device provider
-- **service** The device service name#N##N##N##N##N#
-- **STACKID** A JSON array that provides the value and order of the STACKID tree for the device.
-- **upperClassFilters** Upper filter class drivers IDs installed for the device
-- **upperFilters** Upper filter drivers IDs installed for the device
-
-
-### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryAdd
-
-This event provides the basic metadata about driver binaries running on the system
-
-The following fields are available:
-
-- **DriverCheckSum** The checksum of the driver file.
-- **DriverCompany** The company name that developed the driver.
-- **driverInBox** Is the driver included with the operating system?
-- **driverIsKernelMode** Is it a kernel mode driver?
-- **DriverName** The file name of the driver.
-- **driverPackageStrongName** The strong name of the driver package
-- **driverSigned** The strong name of the driver package
-- **DriverTimeStamp** The low 32 bits of the time stamp of the driver file.
-- **DriverType** A bitfield of driver attributes: 1. define DRIVER_MAP_DRIVER_TYPE_PRINTER 0x0001. 2. define DRIVER_MAP_DRIVER_TYPE_KERNEL 0x0002. 3. define DRIVER_MAP_DRIVER_TYPE_USER 0x0004. 4. define DRIVER_MAP_DRIVER_IS_SIGNED 0x0008. 5. define DRIVER_MAP_DRIVER_IS_INBOX 0x0010. 6. define DRIVER_MAP_DRIVER_IS_WINQUAL 0x0040. 7. define DRIVER_MAP_DRIVER_IS_SELF_SIGNED 0x0020. 8. define DRIVER_MAP_DRIVER_IS_CI_SIGNED 0x0080. 9. define DRIVER_MAP_DRIVER_HAS_BOOT_SERVICE 0x0100. 10. define DRIVER_MAP_DRIVER_TYPE_I386 0x10000. 11. define DRIVER_MAP_DRIVER_TYPE_IA64 0x20000. 12. define DRIVER_MAP_DRIVER_TYPE_AMD64 0x40000. 13. define DRIVER_MAP_DRIVER_TYPE_ARM 0x100000. 14. define DRIVER_MAP_DRIVER_TYPE_THUMB 0x200000. 15. define DRIVER_MAP_DRIVER_TYPE_ARMNT 0x400000. 16. define DRIVER_MAP_DRIVER_IS_TIME_STAMPED 0x800000.
-- **DriverVersion** The version of the driver file.
-- **ImageSize** The size of the driver file.
-- **Inf** The name of the INF file.
-- **InventoryVersion** The version of the inventory file generating the events.
-- **Product** The product name that is included in the driver file.
-- **ProductVersion** The product version that is included in the driver file.
-- **service** The device service name
-- **WdfVersion** The Windows Driver Framework version.
-
-
-### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicator
-
-This event sends value data about the markers on custom devices, to help keep Windows up to date. The formal name for markers is UEX Indicators. See marker list for definitions.
-
-The following fields are available:
-
-- **IndicatorValue** Value of the marker/indicator
-- **Key** Name of the marker/indicator
-
-
-### Microsoft.Windows.Inventory.Core.AmiTelCacheVersions
-
-This event sends inventory component versions for the Device Inventory data.
-
-The following fields are available:
-
-- **aeinv** The version of the App inventory component.
-- **devinv** The file version of the Device inventory component.
-
-
-### Microsoft.Windows.Inventory.Core.AmiTelCacheChecksum
-
-This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object.
-
-The following fields are available:
-
-- **Device** A count of device objects in cache
-- **DeviceCensus** A count of devicecensus objects in cache
-- **DriverPackageExtended** A count of driverpackageextended objects in cache
-- **File** A count of file objects in cache
-- **FileSigningInfo** A count of file signing info objects in cache.
-- **Generic** A count of generic objects in cache
-- **HwItem** A count of hwitem objects in cache
-- **InventoryApplication** A count of application objects in cache
-- **InventoryApplicationFile** A count of application file objects in cache
-- **InventoryDeviceContainer** A count of device container objects in cache
-- **InventoryDeviceInterface** A count of inventory device interface objects in cache.
-- **InventoryDeviceMediaClass** A count of device media objects in cache
-- **InventoryDevicePnp** A count of devicepnp objects in cache
-- **InventoryDriverBinary** A count of driver binary objects in cache
-- **InventoryDriverPackage** A count of device objects in cache
-- **Metadata** A count of metadata objects in cache
-- **Orphan** A count of orphan file objects in cache
-- **Programs** A count of program objects in cache
-
-
-### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceStartSync
-
-This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent.
-
-The following fields are available:
-
-- **InventoryVersion** The version of the inventory file generating the events.
-
-
-### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceAdd
-
-This event retrieves information about what sensor interfaces are available on the device.
-
-The following fields are available:
-
-- **Accelerometer3D** Indicates if an Accelerator3D sensor is found.
-- **ActivityDetection** Indicates if an Activity Detection sensor is found.
-- **AmbientLight** Indicates if an Ambient Light sensor is found.
-- **Barometer** Indicates if a Barometer sensor is found.
-- **Custom** Indicates if a Custom sensor is found.
-- **EnergyMeter** Indicates if an Energy sensor is found.
-- **FloorElevation** Indicates if a Floor Elevation sensor is found.
-- **GeomagneticOrientation** Indicates if a Geo Magnetic Orientation sensor is found.
-- **GravityVector** Indicates if a Gravity Detector sensor is found.
-- **Gyrometer3D** Indicates if a Gyrometer3D sensor is found.
-- **Humidity** Indicates if a Humidity sensor is found.
-- **InventoryVersion** The version of the inventory file generating the events.
-- **LinearAccelerometer** Indicates if a Linear Accelerometer sensor is found.
-- **Magnetometer3D** Indicates if a Magnetometer3D sensor is found.
-- **Orientation** Indicates if an Orientation sensor is found.
-- **Pedometer** Indicates if a Pedometer sensor is found.
-- **Proximity** Indicates if a Proximity sensor is found.
-- **RelativeOrientation** Indicates if a Relative Orientation sensor is found.
-- **SimpleDeviceOrientation** Indicates if a Simple Device Orientation sensor is found.
-- **Temperature** Indicates if a Temperature sensor is found.
-
-### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInStartSync
-
-This event indicates that a new sync is being generated for this object type.
-
-There are no fields in this event.
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsStartSync
@@ -2426,18 +2431,221 @@ There are no fields in this event.
### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorRemove
-This event is a counterpart to InventoryMiscellaneousUexIndicatorAdd that indicates that the item has been removed.
+This event is a counterpart to InventoryMiscellaneousUexIndicatorAdd, indicating that the item has been removed. There are no additional unique fields in this event.
+
+The following fields are available:
+
+- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
-There are no fields in this event.
### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorStartSync
This event indicates that a new set of InventoryMiscellaneousUexIndicatorAdd events will be sent.
+The following fields are available:
+
+- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
+
+### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsAdd
+
+This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule
+
+The following fields are available:
+
+- **Count** Count of total Microsoft Office VBA rule violations
+
+### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInAdd
+
+This event provides data on the installed Office Add-ins.
+
+- **AddInCLSID** The CLSID key office the Office addin.
+- **AddInId** The ID of the Office addin.
+- **BinFileTimestamp** The timestamp of the Office addin.
+- **BinFileVersion** The version of the Office addin.
+- **Description** The description of the Office addin.
+- **FileId** The file ID of the Office addin.
+- **FriendlyName** The friendly name of the Office addin.
+- **FullPath** The full path to the Office addin.
+- **LoadBehavior** A Uint32 that describes the load behavior.
+- **LoadTime** The load time for the Office addin.
+- **OfficeApplication** The OIffice application for this addin.
+- **OfficeArchitecture** The architecture of the addin.
+- **OfficeVersion** The Office version for this addin.
+- **OutlookCrashingAddin** A boolean value that indicates if crashes have been found for this addin.
+- **Provider** The provider name for this addin.
+
+### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInStartSync
+
+This event indicates that a new sync is being generated for this object type.
+
There are no fields in this event.
+### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersAdd
+
+This event provides data on the installed Office identifiers.
+
+- **OAudienceData** The Office Audience descriptor.
+- **OAudienceId** The Office Audience ID.
+- **OMID** The Office machine ID.
+- **OPlatform** The Office architecture.
+- **OVersion** The Office version
+- **OTenantId** The Office 365 Tenant GUID.
+- **OWowMID** The Office machine ID.
+
+### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersStartSync
+
+This event indicates that a new sync is being generated for this object type.
+
+There are no fields in this event.
+
+### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsStartSync
+
+This event indicates that a new sync is being generated for this object type.
+
+There are no fields in this event.
+
+### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsStartSync
+
+This event indicates that a new sync is being generated for this object type.
+
+There are no fields in this event.
+
+### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsAdd
+
+This event provides data on the installed Office-related Internet Explorer features.
+
+- **OIeFeatureAddon** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx).
+- **OIeMachineLockdown** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx).
+- **OIeMimeHandling** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx).
+- **OIeMimeSniffing** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx).
+- **OIeNoAxInstall** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx).
+- **OIeNoDownload** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx).
+- **OIeObjectCaching** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx).
+- **OIePasswordDisable** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx).
+- **OIeSafeBind** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx).
+- **OIeSecurityBand** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx).
+- **OIeUncSaveCheck** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx).
+- **OIeValidateUrl** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx).
+- **OIeWebOcPopup** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx).
+- **OIeWinRestrict** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx).
+- **OIeZoneElevate** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx).
+
+### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsAdd
+
+This event describes the Office products that are installed.
+
+- **OC2rApps** The Office Click-to-Run apps.
+- **OC2rSkus** The Office Click-to-Run products.
+- **OMsiApps** The Office MSI apps.
+- **OProductCodes** The Office MSI product code.
+
## OneDrive events
+### Microsoft.OneDrive.Sync.Setup.APIOperation
+
+This event includes basic data about install and uninstall OneDrive API operations.
+
+The following fields are available:
+
+- **APIName** The name of the API.
+- **ScenarioName** The name of the scenario.
+- **Duration** How long the operation took.
+- **isSuccess** Was the operation successful?
+- **ResultCode** The result code.
+
+
+### Microsoft.OneDrive.Sync.Setup.EndExperience
+
+This event includes a success or failure summary of the installation.
+
+The following fields are available:
+
+- **APIName** The name of the API.
+- **ScenarioName** The name of the scenario.
+- **Hresult** The HResult of the operation.
+- **isSuccess** Was the operation successful?
+
+
+### Microsoft.OneDrive.Sync.Setup.OSUpgradeInstallationOperation
+
+This event is related to the OS version when the OS is upgraded with OneDrive installed.
+
+The following fields are available:
+
+- **HResult** The HResult of the operation.
+- **SourceOSVersion** The source version of the operating system.
+- **SourceOSBuildNumber** The source build number of the operating system.
+- **SourceOSBuildBranch** The source branch of the operating system.
+- **CurrentOSVersion** The current version of the operating system.
+- **CurrentOSBuildNumber** The current build number of the operating system.
+- **CurrentOSBuildBranch** The current branch of the operating system.
+- **CurrentOneDriveVersion** The current version of OneDrive.
+
+
+### Microsoft.OneDrive.Sync.Setup.RegisterStandaloneUpdaterAPIOperation
+
+This event is related to registering or unregistering the OneDrive update task.
+
+The following fields are available:
+
+- **APIName** The name of the API.
+- **ScenarioName** The name of the scenario.
+- **UnregisterOldTaskResult** The HResult of the UnregisterOldTask operation.
+- **RegisterNewTaskResult** The HResult of the RegisterNewTask operation.
+- **isSuccess** Was the operation successful?
+
+
+### Microsoft.OneDrive.Sync.Setup.SetupCommonData
+
+This event contains basic OneDrive configuration data that helps to diagnose failures.
+
+The following fields are available:
+
+- **AppVersion** The version of the app.
+- **OfficeVersion** The version of Office that is installed.
+- **BuildArch** Is the architecture x86 or x64?
+- **Market** Which market is this in?
+- **OneDriveDeviceId** The OneDrive device ID.
+- **MachineGuid** The CEIP machine ID.
+- **IsMSFTInternal** Is this an internal Microsoft device?
+- **OSDeviceName** Only if the device is internal to Microsoft, the device name.
+- **OSUserName** Only if the device is internal to Microsoft, the user name.
+- **Environment** Is the device on the production or int service?
+- **OfficeVersionString** The version of Office that is installed.
+- **BuildArchitecture** Is the architecture x86 or x64?
+- **UserGuid** The CEIP user ID.
+- **MSFTInternal** Is this an internal Microsoft device?
+
+
+### Microsoft.OneDrive.Sync.Updater.CommonData
+
+This event contains basic OneDrive configuration data that helps to diagnose failures.
+
+The following fields are available:
+
+- **AppVersion** The version of the app.
+- **OfficeVersion** The version of Office that is installed.
+- **BuildArch** Is the architecture x86 or x64?
+- **Market** Which market is this in?
+- **OneDriveDeviceId** The OneDrive device ID.
+- **MachineGuid** The CEIP machine ID.
+- **IsMSFTInternal** Is this an internal Microsoft device?
+- **OSDeviceName** Only if the device is internal to Microsoft, the device name.
+- **OSUserName** Only if the device is internal to Microsoft, the user name.
+- **Environment** Is the device on the production or int service?
+- **UserGuid** A unique global user identifier.
+
+
+### Microsoft.OneDrive.Sync.Updater.ComponentInstallState
+
+This event determines the installation state of dependent OneDrive components.
+
+The following fields are available:
+
+- **ComponentName** The name of the dependent component.
+- **isInstalled** Is the dependent component installed?
+
+
### Microsoft.OneDrive.Sync.Updater.OfficeRegistration
This event determines the status of the OneDrive integration with Microsoft Office.
@@ -2447,14 +2655,14 @@ The following fields are available:
- **isValid** Is the Microsoft Office registration valid?
-### Microsoft.OneDrive.Sync.Updater.UpdateTierReg
+### Microsoft.OneDrive.Sync.Updater.OverlayIconStatus
-This event determines status of the update tier registry values.
+This event indicates if the OneDrive overlay icon is working correctly. 0 = healthy; 1 = can be fixed; 2 = broken
The following fields are available:
-- **regReadEnterpriseHr** The HResult of the enterprise reg read value.
-- **regReadTeamHr** The HResult of the team reg read value.
+- **32bit** The status of the OneDrive overlay icon on a 32-bit operating system.
+- **64bit** The status of the OneDrive overlay icon on a 64-bit operating system.
### Microsoft.OneDrive.Sync.Updater.RepairResult
@@ -2466,15 +2674,6 @@ The following fields are available:
- **hr** The HResult of the operation.
-### Microsoft.OneDrive.Sync.Updater.UpdateXmlDownloadHResult
-
-This event determines the status when downloading the OneDrive update configuration file.
-
-The following fields are available:
-
-- **hr** The HResult of the operation.
-
-
### Microsoft.OneDrive.Sync.Updater.SetupBinaryDownloadHResult
This event indicates the status when downloading the OneDrive setup file.
@@ -2490,9 +2689,28 @@ This event determines the outcome of the operation.
The following fields are available:
-- **hr** The HResult of the operation.
-- **IsLoggingEnabled** Is logging enabled?
- **UpdaterVersion** The version of the updater.
+- **IsLoggingEnabled** Is logging enabled?
+- **hr** The HResult of the operation.
+
+
+### Microsoft.OneDrive.Sync.Updater.UpdateTierReg
+
+This event determines status of the update tier registry values.
+
+The following fields are available:
+
+- **regReadEnterpriseHr** The HResult of the enterprise reg read value.
+- **regReadTeamHr** The HResult of the team reg read value.
+
+
+### Microsoft.OneDrive.Sync.Updater.UpdateXmlDownloadHResult
+
+This event determines the status when downloading the OneDrive update configuration file.
+
+The following fields are available:
+
+- **hr** The HResult of the operation.
### Microsoft.OneDrive.Sync.Updater.WebConnectionStatus
@@ -2504,141 +2722,34 @@ The following fields are available:
- **winInetError** The HResult of the operation.
-### Microsoft.OneDrive.Sync.Updater.OverlayIconStatus
-
-This event indicates if the OneDrive overlay icon is working correctly. 0 = healthy; 1 = can be fixed; 2 = broken
-
-The following fields are available:
-
-- **32bit** The status of the OneDrive overlay icon on a 32-bit operating system.
-- **64bit** The status of the OneDrive overlay icon on a 64-bit operating system.
-- **SixtyFourBit** The status of the OneDrive overlay icon on a 32-bit operating system.
-- **ThirtyTwoBit** The status of the OneDrive overlay icon on a 64-bit operating system.
-
-
-### Microsoft.OneDrive.Sync.Updater.ComponentInstallState
-
-This event determines the installation state of dependent OneDrive components.
-
-The following fields are available:
-
-- **ComponentName** The name of the dependent component.
-- **isInstalled** Is the dependent component installed?
-
-
-### Microsoft.OneDrive.Sync.Updater.CommonData
-
-This event contains basic OneDrive configuration data that helps to diagnose failures.
-
-The following fields are available:
-
-- **AppVersion** The version of the app.
-- **BuildArch** Is the architecture x86 or x64?
-- **Environment** Is the device on the production or int service?
-- **IsMSFTInternal** Is this an internal Microsoft device?
-- **MachineGuid** The CEIP machine ID.
-- **Market** Which market is this in?
-- **OfficeVersion** The version of Office that is installed.
-- **OneDriveDeviceId** The OneDrive device ID.
-- **OSDeviceName** Only if the device is internal to Microsoft, the device name.
-- **OSUserName** Only if the device is internal to Microsoft, the user name.
-- **UserGuid** A unique global user identifier.
-
-
-### Microsoft.OneDrive.Sync.Setup.APIOperation
-
-This event includes basic data about install and uninstall OneDrive API operations.
-
-The following fields are available:
-
-- **APIName** The name of the API.
-- **Duration** How long the operation took.
-- **IsSuccess** Was the operation successful?
-- **ResultCode** The result code.
-- **ScenarioName** The name of the scenario.
-
-
-### Microsoft.OneDrive.Sync.Setup.RegisterStandaloneUpdaterAPIOperation
-
-This event is related to registering or unregistering the OneDrive update task.
-
-The following fields are available:
-
-- **APIName** The name of the API.
-- **IsSuccess** Was the operation successful?
-- **RegisterNewTaskResult** The HResult of the RegisterNewTask operation.
-- **ScenarioName** The name of the scenario.
-- **UnregisterOldTaskResult** The HResult of the UnregisterOldTask operation.
-
-
-### Microsoft.OneDrive.Sync.Setup.EndExperience
-
-This event includes a success or failure summary of the installation.
-
-The following fields are available:
-
-- **APIName** The name of the API.
-- **HResult** Indicates the result code of the event
-- **IsSuccess** Was the operation successful?
-- **ScenarioName** The name of the scenario.
-
-
-### Microsoft.OneDrive.Sync.Setup.OSUpgradeInstallationOperation
-
-This event is related to the OS version when the OS is upgraded with OneDrive installed.
-
-The following fields are available:
-
-- **CurrentOneDriveVersion** The current version of OneDrive.
-- **CurrentOSBuildBranch** The current branch of the operating system.
-- **CurrentOSBuildNumber** The current build number of the operating system.
-- **CurrentOSVersion** The current version of the operating system.
-- **HResult** The HResult of the operation.
-- **SourceOSBuildBranch** The source branch of the operating system.
-- **SourceOSBuildNumber** The source build number of the operating system.
-- **SourceOSVersion** The source version of the operating system.
-
-
-### Microsoft.OneDrive.Sync.Setup.SetupCommonData
-
-This event contains basic OneDrive configuration data that helps to diagnose failures.
-
-The following fields are available:
-
-- **AppVersion** The version of the app.
-- **BuildArchitecture** Is the architecture x86 or x64?
-- **Environment** Is the device on the production or int service?
-- **MachineGuid** The CEIP machine ID.
-- **Market** Which market is this in?
-- **MSFTInternal** Is this an internal Microsoft device?
-- **OfficeVersionString** The version of Office that is installed.
-- **OSDeviceName** Only if the device is internal to Microsoft, the device name.
-- **OSUserName** Only if the device is internal to Microsoft, the user name.
-- **UserGuid** The CEIP user ID.
-
-
## Setup events
+### SetupPlatformTel.SetupPlatformTelActivityEvent
+
+This event sends a unique ID that can be used to bind Setup Platform events together, to help keep Windows up to date.
+
+The following fields are available:
+
+- **FieldName** Retrieves the event name/data point. Examples: InstallStartTime, InstallEndtime, OverallResult etc.
+- **GroupName** Retrieves the groupname the event belongs to. Example: Install Information, DU Information, Disk Space Information etc.
+- **Value** Retrieves the value associated with the corresponding event name. For example: For time-related events, this will include the system time.
+- **ActivityId** Provides a unique Id to correlate events that occur between a activity start event, and a stop event
+- **ActivityName** Provides a friendly name of the package type that belongs to the ActivityId (Setup, LanguagePack, GDR, Driver, etc.)
+
+
### SetupPlatformTel.SetupPlatformTelActivityStarted
-"This event sends basic metadata about the update installation process generated by SetupPlatform to help keep Windows up to date. "
+This event sends basic metadata about the update installation process generated by SetupPlatform to help keep Windows up to date.
The following fields are available:
- **Name** The name of the dynamic update type. Example: GDR driver
-### SetupPlatformTel.SetupPlatformTelActivityEvent
+### SetupPlatformTel.SetupPlatformTelActivityStopped
-This event sends basic metadata about the SetupPlatform update installation process, to help keep Windows up-to-date
+This event sends basic metadata about the update installation process generated by SetupPlatform to help keep Windows up to date.
-The following fields are available:
-
-- **ActivityId** Provides a unique Id to correlate events that occur between a activity start event, and a stop event
-- **ActivityName** Provides a friendly name of the package type that belongs to the ActivityId (Setup, LanguagePack, GDR, Driver, etc.)
-- **FieldName** Retrieves the event name/data point. Examples: InstallStartTime, InstallEndtime, OverallResult etc.
-- **GroupName** Retrieves the groupname the event belongs to. Example: Install Information, DU Information, Disk Space Information etc.
-- **value** Value associated with the corresponding event name. For example, time-related events will include the system time
### SetupPlatformTel.SetupPlatformTelEvent
@@ -2660,9 +2771,9 @@ Activity for deletion of a user account for devices set up for Shared PC mode as
The following fields are available:
-- **accountType** The type of account that was deleted. Example: AD, AAD, or Local
-- **userSid** The security identifier of the account.
- **wilActivity** Windows Error Reporting data collected when there is a failure in deleting a user account with the Transient Account Manager.
+- **userSid** The security identifier of the account.
+- **accountType** The type of account that was deleted. Example: AD, AAD, or Local
### Microsoft.Windows.SharedPC.AccountManager.SinglePolicyEvaluation
@@ -2678,19 +2789,281 @@ The following fields are available:
## Software update events
-### SoftwareUpdateClientTelemetry.UpdateDetected
+### SoftwareUpdateClientTelemetry.CheckForUpdates
-This event sends data about an AppX app that has been updated from the Windows Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates.
+This event sends tracking data about the software distribution client check for content that is applicable to a device, to help keep Windows up to date
The following fields are available:
-- **ApplicableUpdateInfo** Metadata for the updates which were detected as applicable
-- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client
-- **NumberOfApplicableUpdates** The number of updates which were ultimately deemed applicable to the system after the detection process is complete
+- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed.
+- **EventInstanceID** A globally unique identifier for event instance.
+- **DeviceModel** What is the device model.
+- **BiosName** The name of the device BIOS.
+- **BIOSVendor** The vendor of the BIOS.
+- **BiosVersion** The version of the BIOS.
+- **BiosReleaseDate** The release date of the device BIOS.
+- **SystemBIOSMajorRelease** Major version of the BIOS.
+- **SystemBIOSMinorRelease** Minor version of the BIOS.
+- **BiosFamily** The family of the BIOS (Basic Input Output System).
+- **BiosSKUNumber** The sku number of the device BIOS.
+- **ClientVersion** The version number of the software distribution client.
+- **WUDeviceID** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue.
+- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client.
+- **ProcessName** The process name of the caller who initiated API calls, in the event where CallerApplicationName was not provided.
+- **ServiceGuid** An ID which represents which service the software distribution client is checking for content (Windows Update, Microsoft Store, etc.).
+- **StatusCode** Indicates the result of a CheckForUpdates event (success, cancellation, failure code HResult).
+- **ExtendedStatusCode** Secondary error code for certain scenarios where StatusCode wasn't specific enough.
+- **FlightRing** The ring (speed of getting builds) that a device is on if participating in flighting (pre-release builds).
+- **FlightBranch** The branch that a device is on if participating in flighting (pre-release builds).
- **RelatedCV** The previous Correlation Vector that was used before swapping with a new one
-- **WUDeviceID** The unique device ID controlled by the software distribution client
+- **IsWUfBEnabled** Indicates if Windows Update for Business is enabled on the device.
+- **IsWUfBDualScanEnabled** Indicates if Windows Update for Business dual scan is enabled on the device.
+- **ShippingMobileOperator** The mobile operator that a device shipped on.
+- **CurrentMobileOperator** The mobile operator the device is currently connected to.
+- **HomeMobileOperator** The mobile operator that the device was originally intended to work with.
+- **PhonePreviewEnabled** Indicates whether a phone was getting preview build, prior to flighting (pre-release builds) being introduced.
+- **ActivityMatchingId** Contains a unique ID identifying a single CheckForUpdates session from initialization to completion.
+- **SyncType** Describes the type of scan the event was
+- **IPVersion** Indicates whether the download took place over IPv4 or IPv6
+- **NumberOfApplicationsCategoryScanEvaluated** The number of categories (apps) for which an app update scan checked
+- **ScanDurationInSeconds** The number of seconds a scan took
+- **ScanEnqueueTime** The number of seconds it took to initialize a scan
+- **NumberOfLoop** The number of round trips the scan required
+- **NumberOfUpdatesEvaluated** The total number of updates which were evaluated as a part of the scan
+- **NumberOfNewUpdatesFromServiceSync** The number of updates which were seen for the first time in this scan
+- **ServiceUrl** The environment URL a device is configured to scan with
+- **Online** Indicates if this was an online scan.
+- **AllowCachedResults** Indicates if the scan allowed using cached results.
+- **MetadataIntegrityMode** The mode of the update transport metadata integrity check. 0-Unknown, 1-Ignoe, 2-Audit, 3-Enforce
+- **TotalNumMetadataSignatures** The total number of metadata signatures checks done for new metadata that was synced down.
+- **NumFailedMetadataSignatures** The number of metadata signatures checks which failed for new metadata synced down.
+- **MSIError** The last error that was encountered during a scan for updates.
+- **DriverError** The error code hit during a driver scan. This is 0 if no error was encountered.
+- **FailedUpdatesCount** The number of updates that failed to be evaluated during the scan.
+- **FailedUpdateGuids** The GUIDs for the updates that failed to be evaluated during the scan.
+- **CapabilityDetectoidGuid** The GUID for a hardware applicability detectoid that could not be evaluated.
+- **ExtendedMetadataCabUrl** Hostname that is used to download an update.
+- **CDNId** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue.
+- **CDNCountryCode** Two letter country abbreviation for the CDN's location.
+- **NetworkConnectivityDetected** Indicates the type of network connectivity that was detected. 0 - IPv4, 1 - IPv6
+- **NumberOfApplicableUpdates** The number of updates which were ultimately deemed applicable to the system after the detection process is complete
+- **ApplicableUpdateInfo** Metadata for the updates which were detected as applicable
+- **WebServiceRetryMethods** Web service method requests that needed to be retried to complete operation.
+- **DeferredUpdates** Update IDs which are currently being deferred until a later time
+- **BranchReadinessLevel** The servicing branch configured on the device.
+- **DeferralPolicySources** Sources for any update deferral policies defined (GPO = 0x10, MDM = 0x100, Flight = 0x1000, UX = 0x10000).
+- **QualityUpdateDeferral** The deferral period configured for quality OS updates on the device (in days).
+- **QualityUpdatePause** Indicates whether quality OS updates are paused on the device.
+- **QualityUpdatePausePeriod** The pause duration configured for quality OS updates on the device (in days).
+- **FeatureUpdateDeferral** The deferral period configured for feature OS updates on the device (in days).
+- **FeatureUpdatePause** Indicates whether feature OS updates are paused on the device.
+- **FeatureUpdatePausePeriod** The pause duration configured for feature OS updates on the device (in days).
+- **DriverExclusionPolicy** Indicates if the policy for not including drivers with Windows Update is enabled.
+- **TargetMetadataVersion** For self-initiated healing, this is the target version of the SIH engine to download (if needed). If not, the value is null.
+- **CachedEngineVersion** For self-initiated healing, the version of the SIH engine that is cached on the device. If the SIH engine does not exist, the value is null.
+- **SearchFilter** Contains information indicating filters applied while checking for content applicable to the device. For example, to filter out all content which may require a reboot.
- **IntentPFNs** Intended application-set metadata for atomic update scenarios.
-- **ServiceGuid** An ID which represents which service the software distribution client is connecting to (Windows Update, Windows Store, etc.)
+- **PausedUpdates** A list of UpdateIds which that currently being paused.
+- **PauseQualityUpdatesStartTime** If quality OS updates are paused on the device, this is the date and time for the beginning of the pause time window.
+- **PauseQualityUpdatesEndTime** If quality OS updates are paused on the device, this is the date and time for the end of the pause time window.
+- **PauseFeatureUpdatesStartTime** If feature OS updates are paused on the device, this is the date and time for the beginning of the pause time window.
+- **PauseFeatureUpdatesEndTime** If feature OS updates are paused on the device, this is the date and time for the end of the pause time window.
+- **Context** Gives context on where the error has occurred. Example: AutoEnable, GetSLSData, AddService, Misc, or Unknown
+- **DriverSyncPassPerformed** Were drivers scanned this time?
+
+
+### SoftwareUpdateClientTelemetry.Commit
+
+This event sends data on whether the Update Service has been called to execute an upgrade, to help keep Windows up to date.
+
+The following fields are available:
+
+- **EventScenario** State of call
+- **EventInstanceID** A globally unique identifier for event instance.
+- **DeviceModel** What is the device model.
+- **BiosName** The name of the device BIOS.
+- **BIOSVendor** The vendor of the BIOS.
+- **BiosVersion** The version of the BIOS.
+- **BiosReleaseDate** The release date of the device BIOS.
+- **SystemBIOSMajorRelease** Major version of the BIOS.
+- **SystemBIOSMinorRelease** Minor version of the BIOS.
+- **BiosFamily** The family of the BIOS (Basic Input Output System).
+- **BiosSKUNumber** The sku number of the device BIOS.
+- **ClientVersion** The version number of the software distribution client.
+- **WUDeviceID** UniqueDeviceID
+- **ServerId** Identifier for the service to which the software distribution client is connecting, such as Windows Update and Microsoft Store.
+- **EventType** Possible values are "Child", "Bundle", or "Driver".
+- **UpdateId** Unique Update ID
+- **BundleId** Identifier associated with the specific content bundle; should not be all zeros if the bundleID was found.
+- **RevisionNumber** Unique revision number of Update
+- **HandlerType** Indicates the kind of content (app, driver, windows patch, etc.)
+- **BundleRevisionNumber** Identifies the revision number of the content bundle
+- **FlightId** The specific id of the flight the device is getting
+- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client
+
+
+### SoftwareUpdateClientTelemetry.Download
+
+This event sends tracking data about the software distribution client download of the content for that update, to help keep Windows up to date.
+
+The following fields are available:
+
+- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started downloading content, or whether it was cancelled, succeeded, or failed.
+- **EventInstanceID** A globally unique identifier for event instance.
+- **DeviceModel** What is the device model.
+- **BiosName** The name of the device BIOS.
+- **BIOSVendor** The vendor of the BIOS.
+- **BiosVersion** The version of the BIOS.
+- **BiosReleaseDate** The release date of the device BIOS.
+- **SystemBIOSMajorRelease** Major version of the BIOS.
+- **SystemBIOSMinorRelease** Minor version of the BIOS.
+- **BiosFamily** The family of the BIOS (Basic Input Output System).
+- **BiosSKUNumber** The sku number of the device BIOS.
+- **ClientVersion** The version number of the software distribution client.
+- **WUDeviceID** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue.
+- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client.
+- **ProcessName** The process name of the caller who initiated API calls, in the event where CallerApplicationName was not provided.
+- **ServiceGuid** An ID which represents which service the software distribution client is installing content for (Windows Update, Microsoft Store, etc.).
+- **StatusCode** Indicates the result of a Download event (success, cancellation, failure code HResult).
+- **ExtendedStatusCode** Secondary error code for certain scenarios where StatusCode wasn't specific enough.
+- **FlightRing** The ring (speed of getting builds) that a device is on if participating in flighting (pre-release builds).
+- **FlightBranch** The branch that a device is on if participating in flighting (pre-release builds).
+- **RelatedCV** The previous Correlation Vector that was used before swapping with a new one
+- **IsWUfBEnabled** Indicates if Windows Update for Business is enabled on the device.
+- **IsWUfBDualScanEnabled** Indicates if Windows Update for Business dual scan is enabled on the device.
+- **ShippingMobileOperator** The mobile operator that a device shipped on.
+- **CurrentMobileOperator** The mobile operator the device is currently connected to.
+- **HomeMobileOperator** The mobile operator that the device was originally intended to work with.
+- **PhonePreviewEnabled** Indicates whether a phone was opted-in to getting preview builds, prior to flighting (pre-release builds) being introduced.
+- **IPVersion** Indicates whether the download took place over IPv4 or IPv6.
+- **NetworkCostBitMask** Indicates what kind of network the device is connected to (roaming, metered, over data cap, etc.)
+- **NetworkRestrictionStatus** More general version of NetworkCostBitMask, specifying whether Windows considered the current network to be "metered."
+- **TimeToEstablishConnection** Time (in ms) it took to establish the connection prior to beginning downloaded.
+- **HostName** The hostname URL the content is downloading from.
+- **CDNId** ID which defines which CDN the software distribution client downloaded the content from.
+- **CDNCountryCode** Two letter country abbreviation for the CDN's location.
+- **ActiveDownloadTime** How long the download took, in seconds, excluding time where the update wasn't actively being downloaded.
+- **IsDependentSet** Indicates whether a driver is a part of a larger System Hardware/Firmware Update
+- **TargetingVersion** For drivers targeted to a specific device model, this is the version number of the drivers being distributed to the device.
+- **HardwareId** If this download was for a driver targeted to a particular device model, this ID indicates the model of the device.
+- **UpdateImportance** Indicates whether a piece of content was marked as Important, Recommended, or Optional.
+- **TargetGroupId** For drivers targeted to a specific device model, this ID indicates the distribution group of devices receiving that driver.
+- **RepeatFailFlag** Indicates whether this specific piece of content had previously failed to download.
+- **BytesDownloaded** How many bytes were downloaded for an individual piece of content (not the entire bundle).
+- **TotalExpectedBytes** The total count of bytes that the download is expected to be.
+- **ThrottlingServiceHResult** Result code (success/failure) while contacting a web service to determine whether this device should download content yet.
+- **EventType** Possible values are Child, Bundle, or Driver.
+- **UpdateId** An identifier associated with the specific piece of content.
+- **RevisionNumber** Identifies the revision number of this specific piece of content.
+- **BundleId** Identifier associated with the specific content bundle; should not be all zeros if the bundleID was found.
+- **BundleRevisionNumber** Identifies the revision number of the content bundle.
+- **HandlerType** Indicates what kind of content is being downloaded (app, driver, windows patch, etc.).
+- **DownloadPriority** Indicates whether a download happened at background, normal, or foreground priority.
+- **FlightId** The specific id of the flight (pre-release build) the device is getting.
+- **Setup360Phase** If the download is for an operating system upgrade, this datapoint indicates which phase of the upgrade is underway.
+- **UsedDO** Whether the download used the delivery optimization service.
+- **CbsDownloadMethod** Indicates whether the download was a full-file download or a partial/delta download.
+- **UsedSystemVolume** Indicates whether the content was downloaded to the device's main system storage drive, or an alternate storage drive.
+- **FlightBuildNumber** If this download was for a flight (pre-release build), this indicates the build number of that flight.
+- **BundleBytesDownloaded** How many bytes were downloaded for the specific content bundle.
+- **BundleRepeatFailFlag** Indicates whether this particular update bundle had previously failed to download.
+- **DownloadScenarioId** A unique ID for a given download used to tie together WU and DO events.
+- **PackageFullName** The package name of the content.
+- **AppXBlockHashValidationFailureCount** A count of the number of blocks that have failed validation after being downloaded.
+- **CachedEngineVersion** For self-initiated healing, the version of the SIH engine that is cached on the device. If the SIH engine does not exist, the value is null.
+- **TargetMetadataVersion** For self-initiated healing, this is the target version of the SIH engine to download (if needed). If not, the value is null.
+- **DownloadType** Differentiates the download type of SIH downloads between Metadata and Payload downloads.
+- **WUSetting** Indicates the users' current updating settings.
+- **ProcessorArchitecture** Processor architecture of the system (x86, AMD64, ARM).
+- **PlatformRole** The PowerPlatformRole as defined on MSDN
+- **IsAOACDevice** Is it Always On, Always Connected?
+- **EventNamespaceID** Indicates whether the event succeeded or failed. Has the format EventType+Event where Event is Succeeded, Cancelled, Failed, etc.
+- **Edition** Indicates the edition of Windows being used.
+- **DeviceOEM** What OEM does this device belong to.
+- **ClientManagedByWSUSServer** Indicates whether the client is managed by Windows Server Update Services (WSUS).
+- **QualityUpdatePause** Indicates whether quality OS updates are paused on the device.
+- **FeatureUpdatePause** Indicates whether feature OS updates are paused on the device.
+- **AppXDownloadScope** Indicates the scope of the download for application content. For streaming install scenarios, AllContent - non-streaming download, RequiredOnly - streaming download requested content required for launch, AutomaticOnly - streaming download requested automatic streams for the app, and Unknown - for events sent before download scope is determined by the Windows Update client.
+
+
+### SoftwareUpdateClientTelemetry.Install
+
+This event sends tracking data about the software distribution client installation of the content for that update, to help keep Windows up to date.
+
+The following fields are available:
+
+- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started installing content, or whether it was cancelled, succeeded, or failed.
+- **EventInstanceID** A globally unique identifier for event instance.
+- **DeviceModel** What is the device model.
+- **BiosName** The name of the device BIOS.
+- **BIOSVendor** The vendor of the BIOS.
+- **BiosVersion** The version of the BIOS.
+- **BiosReleaseDate** The release date of the device BIOS.
+- **SystemBIOSMajorRelease** Major version of the BIOS.
+- **SystemBIOSMinorRelease** Minor version of the BIOS.
+- **BiosFamily** The family of the BIOS (Basic Input Output System).
+- **BiosSKUNumber** The sku number of the device BIOS.
+- **ClientVersion** The version number of the software distribution client.
+- **WUDeviceID** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue.
+- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client.
+- **ProcessName** The process name of the caller who initiated API calls, in the event where CallerApplicationName was not provided.
+- **ServiceGuid** An ID which represents which service the software distribution client is installing content for (Windows Update, Microsoft Store, etc.).
+- **StatusCode** Indicates the result of an installation event (success, cancellation, failure code HResult).
+- **ExtendedStatusCode** Secondary error code for certain scenarios where StatusCode wasn't specific enough.
+- **FlightRing** The ring that a device is on if participating in the Windows Insider Program.
+- **FlightBranch** The branch that a device is on if participating in the Windows Insider Program.
+- **RelatedCV** The previous Correlation Vector that was used before swapping with a new one
+- **IsWUfBEnabled** Is Windows Update for Business enabled on the device?
+- **IsWUfBDualScanEnabled** Is Windows Update for Business dual scan enabled on the device?
+- **ShippingMobileOperator** The mobile operator that a device shipped on.
+- **CurrentMobileOperator** Mobile operator that device is currently connected to.
+- **HomeMobileOperator** The mobile operator that the device was originally intended to work with.
+- **PhonePreviewEnabled** Indicates whether a phone was getting preview build, prior to flighting being introduced.
+- **TargetGroupId** For drivers targeted to a specific device model, this ID indicates the distribution group of devices receiving that driver.
+- **RepeatFailFlag** Indicates whether this specific piece of content had previously failed to install.
+- **EventType** Possible values are Child, Bundle, or Driver.
+- **TargetingVersion** For drivers targeted to a specific device model, this is the version number of the drivers being distributed to the device.
+- **UpdateImportance** Indicates whether a piece of content was marked as Important, Recommended, or Optional.
+- **IsFirmware** Is this update a firmware update?
+- **IsFinalOutcomeEvent** Does this event signal the end of the update/upgrade process?
+- **IsDependentSet** Is the driver part of a larger System Hardware/Firmware update?
+- **DriverPingBack** Contains information about the previous driver and system state.
+- **ExtendedErrorCode** The extended error code.
+- **CSIErrorType** The stage of CBS installation where it failed.
+- **MsiAction** The stage of MSI installation where it failed.
+- **MsiProductCode** The unique identifier of the MSI installer.
+- **TransactionCode** The ID which represents a given MSI installation
+- **HardwareId** If this install was for a driver targeted to a particular device model, this ID indicates the model of the device.
+- **IsSuccessFailurePostReboot** Did it succeed and then fail after a restart?
+- **UpdateId** Unique update ID
+- **RevisionNumber** The revision number of this specific piece of content.
+- **BundleId** Identifier associated with the specific content bundle; should not be all zeros if the bundleID was found.
+- **BundleRevisionNumber** Identifies the revision number of the content bundle.
+- **HandlerType** Indicates what kind of content is being installed. Example: app, driver, Windows update
+- **FlightId** The specific ID of the Windows Insider build the device is getting.
+- **Setup360Phase** If the install is for an operating system upgrade, indicates which phase of the upgrade is underway.
+- **UsedSystemVolume** Indicates whether the content was downloaded and then installed from the device's main system storage drive, or an alternate storage drive.
+- **FlightBuildNumber** If this installation was for a Windows Insider build, this is the build number of that build.
+- **BundleRepeatFailFlag** Has this particular update bundle previously failed to install?
+- **PackageFullName** The package name of the content being installed.
+- **CachedEngineVersion** For self-initiated healing, the version of the SIH engine that is cached on the device. If the SIH engine does not exist, the value is null.
+- **BundleBytesDownloaded** How many bytes were downloaded for the specific content bundle?
+- **CbsDownloadMethod** Was the download a full download or a partial download?
+- **ClientManagedByWSUSServer** Is the client managed by Windows Server Update Services (WSUS)?
+- **DeviceOEM** What OEM does this device belong to.
+- **DownloadPriority** The priority of the download activity.
+- **DownloadScenarioId** A unique ID for a given download used to tie together WU and DO events.
+- **Edition** Indicates the edition of Windows being used.
+- **EventNamespaceID** Indicates whether the event succeeded or failed. Has the format EventType+Event where Event is Succeeded, Cancelled, Failed, etc.
+- **IsAOACDevice** Is it Always On, Always Connected? (Mobile device usage model)
+- **PlatformRole** The PowerPlatformRole as defined on MSDN.
+- **ProcessorArchitecture** Processor architecture of the system (x86, AMD64, ARM).
+- **RepeatSuccessInstallFlag** Indicates whether this specific piece of content had previously installed successful, for example if another user had already installed it.
+- **WUSetting** Indicates the user's current updating settings.
+- **IntentPFNs** Intended application-set metadata for atomic update scenarios.
+- **QualityUpdatePause** Are quality OS updates paused on the device?
+- **FeatureUpdatePause** Are feature OS updates paused on the device?
+- **MergedUpdate** Was the OS update and a BSP update merged for installation?
### SoftwareUpdateClientTelemetry.SLSDiscovery
@@ -2700,65 +3073,59 @@ This event sends data about the ability of Windows to discover the location of a
The following fields are available:
- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed
+- **SusClientId** The unique device ID controlled by the software distribution client
+- **WUAVersion** The version number of the software distribution client
+- **ServiceID** An ID which represents which service the software distribution client is connecting to (Windows Update, Microsoft Store, etc.)
+- **UrlPath** Path to the SLS cab that was downloaded
- **HResult** Indicates the result code of the event (success, cancellation, failure code HResult)
- **IsBackground** Indicates whether the SLS discovery event took place in the foreground or background
- **NextExpirationTime** Indicates when the SLS cab expires
-- **ServiceID** An ID which represents which service the software distribution client is connecting to (Windows Update, Windows Store, etc.)
-- **SusClientId** The unique device ID controlled by the software distribution client
-- **UrlPath** Path to the SLS cab that was downloaded
-- **WUAVersion** The version number of the software distribution client
-### SoftwareUpdateClientTelemetry.Commit
+### SoftwareUpdateClientTelemetry.UpdateDetected
-This event sends data on whether the Update Service has been called to execute an upgrade, to help keep Windows up to date.
+This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates.
The following fields are available:
-- **BiosFamily** The family of the BIOS (Basic Input Output System).
-- **BiosName** The name of the device BIOS.
-- **BiosReleaseDate** The release date of the device BIOS.
-- **BiosSKUNumber** The sku number of the device BIOS.
-- **BIOSVendor** The vendor of the BIOS.
-- **BiosVersion** The version of the BIOS.
-- **BundleId** Identifier associated with the specific content bundle; should not be all zeros if the bundleID was found.
-- **ClientVersion** The version number of the software distribution client.
-- **DeviceModel** What is the device model.
-- **EventInstanceID** A globally unique identifier for event instance.
-- **EventScenario** State of call
-- **EventType** "Possible values are ""Child"", ""Bundle"", or ""Driver""."
-- **HandlerType** Indicates the kind of content (app, driver, windows patch, etc.)
-- **RevisionNumber** Unique revision number of Update
-- **ServerId** Identifier for the service to which the software distribution client is connecting, such as Windows Update and Windows Store.
-- **SystemBIOSMajorRelease** Major version of the BIOS.
-- **SystemBIOSMinorRelease** Minor version of the BIOS.
-- **UpdateId** Unique Update ID
-- **WUDeviceID** UniqueDeviceID
-- **BundleRevisionNumber** Identifies the revision number of the content bundle
-- **FlightId** The specific id of the flight the device is getting
- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client
-
-
-### SoftwareUpdateClientTelemetry.DownloadCheckpoint
-
-This event provides a checkpoint between each of the Windows Update download phases for UUP content
-
-The following fields are available:
-
-- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed
-- **ExtendedStatusCode** Secondary error code for certain scenarios where StatusCode wasn't specific enough
-- **FileId** A hash that uniquely identifies a file
-- **FileName** Name of the downloaded file
+- **ApplicableUpdateInfo** Metadata for the updates which were detected as applicable
+- **NumberOfApplicableUpdates** The number of updates which were ultimately deemed applicable to the system after the detection process is complete
+- **WUDeviceID** The unique device ID controlled by the software distribution client
- **RelatedCV** The previous Correlation Vector that was used before swapping with a new one
-- **StatusCode** Indicates the result of a CheckForUpdates event (success, cancellation, failure code HResult)
-- **EventType** "Possible values are ""Child"", ""Bundle"", ""Relase"" or ""Driver"""
-- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client
+- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed
+- **EventInstanceID** A globally unique identifier for event instance
+- **DeviceModel** The device's model as defined in system bios
+- **BiosName** The name of the device's system bios
+- **BIOSVendor** The vendor of the device's system bios
+- **BiosVersion** The version of the device's system bios
+- **BiosReleaseDate** The release date of the device's system bios
+- **SystemBIOSMajorRelease** The major release version of the device's system system
+- **SystemBIOSMinorRelease** The minor release version of the device's system system
+- **BiosFamily** The device's family as defined in system bios
+- **BiosSKUNumber** The device's SKU as defined in system bios
- **ClientVersion** The version number of the software distribution client
-- **FlightId** The unique identifier for each flight
-- **RevisionNumber** Unique revision number of Update
-- **ServiceGuid** An ID which represents which service the software distribution client is checking for content (Windows Update, Microsoft Store, etc.)
-- **UpdateId** Unique Update ID
-- **WUDeviceID** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue
+- **ProcessName** The process name of the caller who initiated API calls, in the event where CallerApplicationName was not provided
+- **ServiceGuid** An ID which represents which service the software distribution client is connecting to (Windows Update, Microsoft Store, etc.)
+- **StatusCode** Indicates the result code of the event (success, cancellation, failure code HResult)
+- **ExtendedStatusCode** Secondary status code for certain scenarios where StatusCode wasn't specific enough
+- **FlightRing** The ring (speed of getting builds) that a device is on if participating in flighting (pre-release builds).
+- **FlightBranch** The branch that a device is on if participating in flighting (pre-release builds).
+- **ShippingMobileOperator** The mobile operator that a device shipped on.
+- **CurrentMobileOperator** The mobile operator the device is currently connected to.
+- **HomeMobileOperator** The mobile operator that the device was originally intended to work with
+- **PhonePreviewEnabled** Indicates whether a phone was getting preview build, prior to flighting (pre-release builds) being introduced.
+- **ActivityMatchingId** Contains a unique ID identifying a single CheckForUpdates session from initialization to completion
+- **SyncType** Describes the type of scan the event was
+- **IPVersion** Indicates whether the download took place over IPv4 or IPv6
+- **NumberOfApplicationsCategoryScanEvaluated** The number of categories (apps) for which an app update scan checked
+- **ScanDurationInSeconds** The number of seconds a scan took
+- **ScanEnqueueTime** The number of seconds it took to initialize a scan
+- **NumberOfLoop** The number of round trips the scan required
+- **NumberOfUpdatesEvaluated** The total number of updates which were evaluated as a part of the scan
+- **NumberOfNewUpdatesFromServiceSync** The number of updates which were seen for the first time in this scan
+- **ServiceUrl** The environment URL a device is configured to scan with
+- **IntentPFNs** Intended application-set metadata for atomic update scenarios.
### SoftwareUpdateClientTelemetry.UpdateMetadataIntegrity
@@ -2768,324 +3135,56 @@ This event identifies whether updates have been tampered with and protects again
The following fields are available:
- **EventScenario** The purpose of this event, such as scan started, scan succeeded, or scan failed.
-- **ExtendedStatusCode** The secondary status code of the event.
-- **LeafCertId** Integral ID from the FragmentSigning data for certificate that failed.
+- **ServiceGuid** Identifies the service to which the software distribution client is connected, Example: Windows Update or Microsoft Store
- **MetadataIntegrityMode** The mode of the transport metadata integrity check. 0 = unknown; 1 = ignore; 2 = audit; 3 = enforce
-- **MetadataSignature** A base64-encoded string of the signature associated with the update metadata (specified by revision ID).
-- **RevisionId** The revision ID for a specific piece of content.
-- **RevisionNumber** The revision number for a specific piece of content.
-- **ServiceGuid** Identifies the service to which the software distribution client is connected, Example: Windows Update or Windows Store
-- **SHA256OfLeafCertPublicKey** A base64 encoding of the hash of the Base64CertData in the FragmentSigning data of the leaf certificate.
-- **SHA256OfTimestampToken** A base64-encoded string of hash of the timestamp token blob.
-- **SignatureAlgorithm** The hash algorithm for the metadata signature.
- **StatusCode** The status code of the event.
-- **TimestampTokenId** The time this was created. It is encoded in a timestamp blob and will be zero if the token is malformed.
+- **ExtendedStatusCode** The secondary status code of the event.
+- **RevisionId** The revision ID for a specific piece of content.
- **UpdateId** The update ID for a specific piece of content.
-- **TimestampTokenCertThumbprint** "The thumbprint of the encoded timestamp token. "
+- **RevisionNumber** The revision number for a specific piece of content.
+- **TimestampTokenId** The time this was created. It is encoded in a timestamp blob and will be zero if the token is malformed.
+- **LeafCertId** Integral ID from the FragmentSigning data for certificate that failed.
+- **SHA256OfLeafCertPublicKey** A base64 encoding of the hash of the Base64CertData in the FragmentSigning data of the leaf certificate.
+- **MetadataSignature** A base64-encoded string of the signature associated with the update metadata (specified by revision ID).
+- **SignatureAlgorithm** The hash algorithm for the metadata signature.
+- **SHA256OfTimestampToken** A base64-encoded string of hash of the timestamp token blob.
- **ValidityWindowInDays** The validity window that's in effect when verifying the timestamp.
-- **ListOfSHA256OfIntermediateCerData** A semicolon delimited list of base64 encoding of hashes for the Base64CerData in the FragmentSigning data of an intermediate certificate.
+- **TimestampTokenCertThumbprint** The thumbprint of the encoded timestamp token.
- **RawMode** The raw unparsed mode string from the SLS response. This field is null if not applicable.
- **RawValidityWindowInDays** The raw unparsed validity window string in days of the timestamp token. This field is null if not applicable.
- **SHA256OfLeafCerData** A base64 encoding of the hash for the Base64CerData in the FragmentSigning data of the leaf certificate.
+- **ListOfSHA256OfIntermediateCerData** A semicolon delimited list of base64 encoding of hashes for the Base64CerData in the FragmentSigning data of an intermediate certificate.
- **EndpointUrl** The endpoint URL where the device obtains update metadata. This is used to distinguish between test, staging, and production environments.
- **SLSPrograms** A test program to which a device may have opted in. Example: Insider Fast
-### SoftwareUpdateClientTelemetry.Download
-
-This event sends tracking data about the software distribution client download of the content for that update, to help keep Windows up to date.
-
-The following fields are available:
-
-- **ActiveDownloadTime** How long the download took, in seconds, excluding time where the update wasn't actively being downloaded.
-- **AppXBlockHashValidationFailureCount** A count of the number of blocks that have failed validation after being downloaded.
-- **AppXDownloadScope** Indicates the scope of the download for application content. For streaming install scenarios, AllContent - non-streaming download, RequiredOnly - streaming download requested content required for launch, AutomaticOnly - streaming download requested automatic streams for the app, and Unknown - for events sent before download scope is determined by the Windows Update client.
-- **BiosFamily** The family of the BIOS (Basic Input Output System).
-- **BiosName** The name of the device BIOS.
-- **BiosReleaseDate** The release date of the device BIOS.
-- **BiosSKUNumber** The sku number of the device BIOS.
-- **BIOSVendor** The vendor of the BIOS.
-- **BiosVersion** The version of the BIOS.
-- **BundleBytesDownloaded** How many bytes were downloaded for the specific content bundle.
-- **BundleId** Identifier associated with the specific content bundle; should not be all zeros if the bundleID was found.
-- **BundleRepeatFailFlag** Indicates whether this particular update bundle had previously failed to download.
-- **BundleRevisionNumber** Identifies the revision number of the content bundle.
-- **BytesDownloaded** How many bytes were downloaded for an individual piece of content (not the entire bundle).
-- **CachedEngineVersion** For self-initiated healing, the version of the SIH engine that is cached on the device. If the SIH engine does not exist, the value is null.
-- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client.
-- **CbsDownloadMethod** Indicates whether the download was a full-file download or a partial/delta download.
-- **CDNCountryCode** Two letter country abbreviation for the CDN's location.
-- **CDNId** ID which defines which CDN the software distribution client downloaded the content from.
-- **ClientManagedByWSUSServer** Indicates whether the client is managed by Windows Server Update Services (WSUS).
-- **ClientVersion** The version number of the software distribution client.
-- **CurrentMobileOperator** The mobile operator the device is currently connected to.
-- **DeviceModel** What is the device model.
-- **DeviceOEM** What OEM does this device belong to.
-- **DownloadPriority** Indicates whether a download happened at background, normal, or foreground priority.
-- **DownloadScenarioId** A unique ID for a given download used to tie together WU and DO events.
-- **DownloadType** Differentiates the download type of SIH downloads between Metadata and Payload downloads.
-- **Edition** Indicates the edition of Windows being used.
-- **EventInstanceID** A globally unique identifier for event instance.
-- **EventNamespaceID** Indicates whether the event succeeded or failed. Has the format EventType+Event where Event is Succeeded, Cancelled, Failed, etc.
-- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started downloading content, or whether it was cancelled, succeeded, or failed.
-- **EventType** Possible values are Child, Bundle, or Driver.
-- **ExtendedStatusCode** Secondary error code for certain scenarios where StatusCode wasn't specific enough.
-- **FeatureUpdatePause** Indicates whether feature OS updates are paused on the device.
-- **FlightBranch** The branch that a device is on if participating in flighting (pre-release builds).
-- **FlightBuildNumber** If this download was for a flight (pre-release build), this indicates the build number of that flight.
-- **FlightId** The specific id of the flight (pre-release build) the device is getting.
-- **FlightRing** The ring (speed of getting builds) that a device is on if participating in flighting (pre-release builds).
-- **HandlerType** Indicates what kind of content is being downloaded (app, driver, windows patch, etc.).
-- **HardwareId** If this download was for a driver targeted to a particular device model, this ID indicates the model of the device.
-- **HomeMobileOperator** The mobile operator that the device was originally intended to work with.
-- **HostName** The hostname URL the content is downloading from.
-- **IPVersion** Indicates whether the download took place over IPv4 or IPv6.
-- **IsAOACDevice** Is it Always On, Always Connected?
-- **IsDependentSet** Indicates whether a driver is a part of a larger System Hardware/Firmware Update
-- **IsWUfBDualScanEnabled** Indicates if Windows Update for Business dual scan is enabled on the device.
-- **IsWUfBEnabled** Indicates if Windows Update for Business is enabled on the device.
-- **NetworkCostBitMask** Indicates what kind of network the device is connected to (roaming, metered, over data cap, etc.)
-- **NetworkRestrictionStatus** "More general version of NetworkCostBitMask, specifying whether Windows considered the current network to be ""metered."""
-- **PackageFullName** The package name of the content.
-- **PhonePreviewEnabled** Indicates whether a phone was opted-in to getting preview builds, prior to flighting (pre-release builds) being introduced.
-- **PlatformRole** The PowerPlatformRole as defined on MSDN
-- **ProcessName** The process name of the caller who initiated API calls, in the event where CallerApplicationName was not provided.
-- **ProcessorArchitecture** Processor architecture of the system (x86, AMD64, ARM).
-- **QualityUpdatePause** Indicates whether quality OS updates are paused on the device.
-- **RelatedCV** The previous Correlation Vector that was used before swapping with a new one
-- **RepeatFailFlag** Indicates whether this specific piece of content had previously failed to download.
-- **RevisionNumber** Identifies the revision number of this specific piece of content.
-- **ServiceGuid** An ID which represents which service the software distribution client is installing content for (Windows Update, Windows Store, etc.).
-- **Setup360Phase** If the download is for an operating system upgrade, this datapoint indicates which phase of the upgrade is underway.
-- **ShippingMobileOperator** The mobile operator that a device shipped on.
-- **StatusCode** Indicates the result of a Download event (success, cancellation, failure code HResult).
-- **SystemBIOSMajorRelease** Major version of the BIOS.
-- **SystemBIOSMinorRelease** Minor version of the BIOS.
-- **TargetGroupId** For drivers targeted to a specific device model, this ID indicates the distribution group of devices receiving that driver.
-- **TargetingVersion** For drivers targeted to a specific device model, this is the version number of the drivers being distributed to the device.
-- **TargetMetadataVersion** For self-initiated healing, this is the target version of the SIH engine to download (if needed). If not, the value is null.
-- **ThrottlingServiceHResult** Result code (success/failure) while contacting a web service to determine whether this device should download content yet.
-- **TimeToEstablishConnection** Time (in ms) it took to establish the connection prior to beginning downloaded.
-- **TotalExpectedBytes** The total count of bytes that the download is expected to be.
-- **UpdateId** An identifier associated with the specific piece of content.
-- **UpdateImportance** Indicates whether a piece of content was marked as Important, Recommended, or Optional.
-- **UsedDO** Whether the download used the delivery optimization service.
-- **UsedSystemVolume** Indicates whether the content was downloaded to the device's main system storage drive, or an alternate storage drive.
-- **WUDeviceID** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue.
-- **WUSetting** Indicates the users' current updating settings.
-
-
-### SoftwareUpdateClientTelemetry.CheckForUpdates
-
-This event sends tracking data about the software distribution client check for content that is applicable to a device, to help keep Windows up to date
-
-The following fields are available:
-
-- **ActivityMatchingId** Contains a unique ID identifying a single CheckForUpdates session from initialization to completion.
-- **AllowCachedResults** Indicates if the scan allowed using cached results.
-- **BiosFamily** The family of the BIOS (Basic Input Output System).
-- **BiosName** The name of the device BIOS.
-- **BiosReleaseDate** The release date of the device BIOS.
-- **BiosSKUNumber** The sku number of the device BIOS.
-- **BIOSVendor** The vendor of the BIOS.
-- **BiosVersion** The version of the BIOS.
-- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client.
-- **CapabilityDetectoidGuid** The GUID for a hardware applicability detectoid that could not be evaluated.
-- **CDNCountryCode** Two letter country abbreviation for the CDN's location.
-- **CDNId** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue.
-- **ClientVersion** The version number of the software distribution client.
-- **CurrentMobileOperator** The mobile operator the device is currently connected to.
-- **DeviceModel** What is the device model.
-- **DriverError** The error code hit during a driver scan. This is 0 if no error was encountered.
-- **EventInstanceID** A globally unique identifier for event instance.
-- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed.
-- **ExtendedMetadataCabUrl** Hostname that is used to download an update.
-- **ExtendedStatusCode** Secondary error code for certain scenarios where StatusCode wasn't specific enough.
-- **FailedUpdateGuids** The GUIDs for the updates that failed to be evaluated during the scan.
-- **FailedUpdatesCount** The number of updates that failed to be evaluated during the scan.
-- **FlightBranch** The branch that a device is on if participating in flighting (pre-release builds).
-- **FlightRing** The ring (speed of getting builds) that a device is on if participating in flighting (pre-release builds).
-- **HomeMobileOperator** The mobile operator that the device was originally intended to work with.
-- **IPVersion** Indicates whether the download took place over IPv4 or IPv6
-- **IsWUfBDualScanEnabled** Indicates if Windows Update for Business dual scan is enabled on the device.
-- **IsWUfBEnabled** Indicates if Windows Update for Business is enabled on the device.
-- **MetadataIntegrityMode** The mode of the update transport metadata integrity check. 0-Unknown, 1-Ignoe, 2-Audit, 3-Enforce
-- **MSIError** The last error that was encountered during a scan for updates.
-- **NetworkConnectivityDetected** Indicates the type of network connectivity that was detected. 0 - IPv4, 1 - IPv6
-- **NumberOfApplicationsCategoryScanEvaluated** The number of categories (apps) for which an app update scan checked
-- **NumberOfLoop** The number of round trips the scan required
-- **NumberOfNewUpdatesFromServiceSync** The number of updates which were seen for the first time in this scan
-- **NumberOfUpdatesEvaluated** The total number of updates which were evaluated as a part of the scan
-- **NumFailedMetadataSignatures** The number of metadata signatures checks which failed for new metadata synced down.
-- **Online** Indicates if this was an online scan.
-- **PhonePreviewEnabled** Indicates whether a phone was getting preview build, prior to flighting (pre-release builds) being introduced.
-- **ProcessName** The process name of the caller who initiated API calls, in the event where CallerApplicationName was not provided.
-- **RelatedCV** The previous Correlation Vector that was used before swapping with a new one
-- **ScanDurationInSeconds** The number of seconds a scan took
-- **ScanEnqueueTime** The number of seconds it took to initialize a scan
-- **ServiceGuid** An ID which represents which service the software distribution client is checking for content (Windows Update, Windows Store, etc.).
-- **ServiceUrl** The environment URL a device is configured to scan with
-- **ShippingMobileOperator** The mobile operator that a device shipped on.
-- **StatusCode** Indicates the result of a CheckForUpdates event (success, cancellation, failure code HResult).
-- **SyncType** Describes the type of scan the event was
-- **SystemBIOSMajorRelease** Major version of the BIOS.
-- **SystemBIOSMinorRelease** Minor version of the BIOS.
-- **TotalNumMetadataSignatures** The total number of metadata signatures checks done for new metadata that was synced down.
-- **WUDeviceID** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue.
-- **ApplicableUpdateInfo** Metadata for the updates which were detected as applicable
-- **NumberOfApplicableUpdates** The number of updates which were ultimately deemed applicable to the system after the detection process is complete
-- **WebServiceRetryMethods** Web service method requests that needed to be retried to complete operation.
-- **BranchReadinessLevel** The servicing branch configured on the device.
-- **DeferralPolicySources** Sources for any update deferral policies defined (GPO = 0x10, MDM = 0x100, Flight = 0x1000, UX = 0x10000).
-- **DeferredUpdates** Update IDs which are currently being deferred until a later time
-- **DriverExclusionPolicy** Indicates if the policy for not including drivers with Windows Update is enabled.
-- **FeatureUpdateDeferral** The deferral period configured for feature OS updates on the device (in days).
-- **FeatureUpdatePause** Indicates whether feature OS updates are paused on the device.
-- **FeatureUpdatePausePeriod** The pause duration configured for feature OS updates on the device (in days).
-- **QualityUpdateDeferral** The deferral period configured for quality OS updates on the device (in days).
-- **QualityUpdatePause** Indicates whether quality OS updates are paused on the device.
-- **QualityUpdatePausePeriod** The pause duration configured for quality OS updates on the device (in days).
-- **IntentPFNs** Intended application-set metadata for atomic update scenarios.
-- **PausedUpdates** A list of UpdateIds which that currently being paused.
-- **PauseFeatureUpdatesEndTime** If feature OS updates are paused on the device, this is the date and time for the end of the pause time window.
-- **PauseFeatureUpdatesStartTime** If feature OS updates are paused on the device, this is the date and time for the beginning of the pause time window.
-- **PauseQualityUpdatesEndTime** If quality OS updates are paused on the device, this is the date and time for the end of the pause time window.
-- **PauseQualityUpdatesStartTime** If quality OS updates are paused on the device, this is the date and time for the beginning of the pause time window.
-- **CachedEngineVersion** For self-initiated healing, the version of the SIH engine that is cached on the device. If the SIH engine does not exist, the value is null.
-- **TargetMetadataVersion** For self-initiated healing, this is the target version of the SIH engine to download (if needed). If not, the value is null.
-- **Context** Gives context on where the error has occurred. Example: AutoEnable, GetSLSData, AddService, Misc, or Unknown
-- **DriverSyncPassPerformed** Were drivers scanned this time?
-
-
-### SoftwareUpdateClientTelemetry.Install
-
-This event sends tracking data about the software distribution client installation of the content for that update, to help keep Windows up to date.
-
-The following fields are available:
-
-- **BiosFamily** The family of the BIOS (Basic Input Output System).
-- **BiosName** The name of the device BIOS.
-- **BiosReleaseDate** The release date of the device BIOS.
-- **BiosSKUNumber** The sku number of the device BIOS.
-- **BIOSVendor** The vendor of the BIOS.
-- **BiosVersion** The version of the BIOS.
-- **BundleBytesDownloaded** How many bytes were downloaded for the specific content bundle?
-- **BundleId** Identifier associated with the specific content bundle; should not be all zeros if the bundleID was found.
-- **BundleRepeatFailFlag** Has this particular update bundle previously failed to install?
-- **BundleRevisionNumber** Identifies the revision number of the content bundle.
-- **CachedEngineVersion** For self-initiated healing, the version of the SIH engine that is cached on the device. If the SIH engine does not exist, the value is null.
-- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client.
-- **CbsDownloadMethod** Was the download a full download or a partial download?
-- **ClientManagedByWSUSServer** Is the client managed by Windows Server Update Services (WSUS)?
-- **ClientVersion** The version number of the software distribution client.
-- **CSIErrorType** The stage of CBS installation where it failed.
-- **CurrentMobileOperator** Mobile operator that device is currently connected to.
-- **DeviceModel** What is the device model.
-- **DeviceOEM** What OEM does this device belong to.
-- **DownloadPriority** The priority of the download activity.
-- **DownloadScenarioId** A unique ID for a given download used to tie together WU and DO events.
-- **DriverPingBack** Contains information about the previous driver and system state.
-- **Edition** Indicates the edition of Windows being used.
-- **EventInstanceID** A globally unique identifier for event instance.
-- **EventNamespaceID** Indicates whether the event succeeded or failed. Has the format EventType+Event where Event is Succeeded, Cancelled, Failed, etc.
-- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started installing content, or whether it was cancelled, succeeded, or failed.
-- **EventType** Possible values are Child, Bundle, or Driver.
-- **ExtendedErrorCode** The extended error code.
-- **ExtendedStatusCode** Secondary error code for certain scenarios where StatusCode wasn't specific enough.
-- **FeatureUpdatePause** Are feature OS updates paused on the device?
-- **FlightBranch** The branch that a device is on if participating in the Windows Insider Program.
-- **FlightBuildNumber** If this installation was for a Windows Insider build, this is the build number of that build.
-- **FlightId** The specific ID of the Windows Insider build the device is getting.
-- **FlightRing** The ring that a device is on if participating in the Windows Insider Program.
-- **HandlerType** Indicates what kind of content is being installed. Example: app, driver, Windows update
-- **HardwareId** If this install was for a driver targeted to a particular device model, this ID indicates the model of the device.
-- **HomeMobileOperator** The mobile operator that the device was originally intended to work with.
-- **IntentPFNs** Intended application-set metadata for atomic update scenarios.
-- **IsAOACDevice** Is it Always On, Always Connected? (Mobile device usage model)
-- **IsDependentSet** Is the driver part of a larger System Hardware/Firmware update?
-- **IsFinalOutcomeEvent** Does this event signal the end of the update/upgrade process?
-- **IsFirmware** Is this update a firmware update?
-- **IsSuccessFailurePostReboot** Did it succeed and then fail after a restart?
-- **IsWUfBDualScanEnabled** Is Windows Update for Business dual scan enabled on the device?
-- **IsWUfBEnabled** Is Windows Update for Business enabled on the device?
-- **MergedUpdate** Was the OS update and a BSP update merged for installation?
-- **MsiAction** The stage of MSI installation where it failed.
-- **MsiProductCode** The unique identifier of the MSI installer.
-- **PackageFullName** The package name of the content being installed.
-- **PhonePreviewEnabled** Indicates whether a phone was getting preview build, prior to flighting being introduced.
-- **PlatformRole** The PowerPlatformRole as defined on MSDN.
-- **ProcessName** The process name of the caller who initiated API calls, in the event where CallerApplicationName was not provided.
-- **ProcessorArchitecture** Processor architecture of the system (x86, AMD64, ARM).
-- **QualityUpdatePause** Are quality OS updates paused on the device?
-- **RelatedCV** The previous Correlation Vector that was used before swapping with a new one
-- **RepeatFailFlag** Indicates whether this specific piece of content had previously failed to install.
-- **RepeatSuccessInstallFlag** Indicates whether this specific piece of content had previously installed successful, for example if another user had already installed it.
-- **RevisionNumber** The revision number of this specific piece of content.
-- **ServiceGuid** An ID which represents which service the software distribution client is installing content for (Windows Update, Windows Store, etc.).
-- **Setup360Phase** If the install is for an operating system upgrade, indicates which phase of the upgrade is underway.
-- **ShippingMobileOperator** The mobile operator that a device shipped on.
-- **StatusCode** Indicates the result of an installation event (success, cancellation, failure code HResult).
-- **SystemBIOSMajorRelease** Major version of the BIOS.
-- **SystemBIOSMinorRelease** Minor version of the BIOS.
-- **TargetGroupId** For drivers targeted to a specific device model, this ID indicates the distribution group of devices receiving that driver.
-- **TargetingVersion** For drivers targeted to a specific device model, this is the version number of the drivers being distributed to the device.
-- **TransactionCode** The ID which represents a given MSI installation
-- **UpdateId** Unique update ID
-- **UpdateImportance** Indicates whether a piece of content was marked as Important, Recommended, or Optional.
-- **UsedSystemVolume** Indicates whether the content was downloaded and then installed from the device's main system storage drive, or an alternate storage drive.
-- **WUDeviceID** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue.
-- **WUSetting** Indicates the user's current updating settings.
-
-
-### SoftwareUpdateClientTelemetry.DownloadHeartbeat
-
-This event allows tracking of ongoing downloads and contains data to explain the current state of the download
-
-The following fields are available:
-
-- **BundleID** Identifier associated with the specific content bundle. If this value is found, it shouldn't report as all zeros
-- **BytesTotal** Total bytes to transfer for this content
-- **BytesTransferred** Total bytes transferred for this content at the time of heartbeat
-- **ConnectionStatus** Indicates the connectivity state of the device at the time of heartbeat
-- **CurrentError** Last (transient) error encountered by the active download
-- **DownloadFlags** Flags indicating if power state is ignored
-- **DownloadState** Current state of the active download for this content (queued, suspended, or progressing)
-- **IsNetworkMetered** "Indicates whether Windows considered the current network to be ?metered"""
-- **MOAppDownloadLimit** Mobile operator cap on size of application downloads, if any
-- **MOUpdateDownloadLimit** Mobile operator cap on size of operating system update downloads, if any
-- **PowerState** Indicates the power state of the device at the time of heartbeart (DC, AC, Battery Saver, or Connected Standby)
-- **RelatedCV** "The previous correlation vector that was used by the client, before swapping with a new one "
-- **ResumeCount** Number of times this active download has resumed from a suspended state
-- **ServiceID** "Identifier for the service to which the software distribution client is connecting (Windows Update, Windows Store, etc) "
-- **SuspendCount** Number of times this active download has entered a suspended state
-- **SuspendReason** Last reason for why this active download entered a suspended state
-- **CallerApplicationName** Name provided by the caller who initiated API calls into the software distribution client
-- **ClientVersion** The version number of the software distribution client
-- **EventType** "Possible values are ""Child"", ""Bundle"", or ""Driver"""
-- **FlightId** The unique identifier for each flight
-- **RevisionNumber** Identifies the revision number of this specific piece of content
-- **ServiceGuid** Identifier for the service to which the software distribution client is connecting (Windows Update, Windows Store, etc)
-- **UpdateId** "Identifier associated with the specific piece of content "
-- **WUDeviceID** "Unique device id controlled by the software distribution client "
-
-
## Update events
-### Update360Telemetry.UpdateAgentPostRebootResult
+### Update360Telemetry.UpdateAgent_DownloadRequest
-This event collects information for both Mobile and Desktop regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario
+This event sends data during the download request phase of updating Windows.
The following fields are available:
-- **ErrorCode** The error code returned for the current post reboot phase
-- **FlightId** The unique identifier for each flight
-- **ObjectId** Unique value for each Update Agent mode
-- **RelatedCV** Correlation vector value generated from the latest USO scan
-- **Result** Indicates the Hresult
+- **ErrorCode** The error code returned for the current download request phase.
+- **PackageCountTotal** Total number of packages needed.
+- **PackageCountRequired** Number of required packages requested.
+- **PackageCountOptional** Number of optional packages requested.
+- **ObjectId** Unique value for each Update Agent mode.
+- **SessionId** Unique value for each Update Agent mode attempt.
- **ScenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate
-- **SessionId** Unique value for each Update Agent mode attempt
-- **UpdateId** Unique ID for each update
-- **PostRebootResult** Indicates the Hresult
+- **RelatedCV** Correlation vector value generated from the latest USO scan.
+- **Result** Result of the download request phase of update.
+- **PackageSizeCanonical** Size of canonical packages in bytes
+- **PackageSizeDiff** Size of diff packages in bytes
+- **PackageSizeExpress** Size of express packages in bytes
+- **FlightId** Unique ID for each flight.
+- **UpdateId** Unique ID for each update.
+- **PackageCountTotalCanonical** Total number of canonical packages.
+- **PackageCountTotalDiff** Total number of diff packages.
+- **PackageCountTotalExpress** Total number of express packages.
+- **RangeRequestState** Represents the state of the download range request.
+- **DeletedCorruptFiles** Indicates if UpdateAgent found any corrupt payload files and whether the payload was deleted.
### Update360Telemetry.UpdateAgent_Initialize
@@ -3095,42 +3194,15 @@ This event sends data during the initialize phase of updating Windows.
The following fields are available:
- **ErrorCode** The error code returned for the current initialize phase.
+- **SessionData** Contains instructions to update agent for processing FODs and DUICs (Null for other scenarios).
+- **UpdateId** Unique ID for each update.
- **FlightId** Unique ID for each flight.
- **FlightMetadata** Contains the FlightId and the build being flighted.
- **ObjectId** Unique value for each Update Agent mode.
-- **RelatedCV** Correlation vector value generated from the latest USO scan.
-- **ScenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate
-- **SessionData** Contains instructions to update agent for processing FODs and DUICs (Null for other scenarios).
- **SessionId** Unique value for each Update Agent mode attempt .
-- **UpdateId** Unique ID for each update.
-- **Result** Result of the initialize phase of update. 0 = Succeeded, 1 = Failed, 2 = Cancelled, 3 = Blocked, 4 = BlockCancelled
-
-
-### Update360Telemetry.UpdateAgent_DownloadRequest
-
-This event sends data during the download request phase of updating Windows.
-
-The following fields are available:
-
-- **ErrorCode** The error code returned for the current download request phase.
-- **ObjectId** Unique value for each Update Agent mode.
-- **PackageCountOptional** Number of optional packages requested.
-- **PackageCountRequired** Number of required packages requested.
-- **PackageCountTotal** Total number of packages needed.
-- **RelatedCV** Correlation vector value generated from the latest USO scan.
- **ScenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate
-- **SessionId** Unique value for each Update Agent mode attempt.
-- **PackageSizeCanonical** Size of canonical packages in bytes
-- **PackageSizeDiff** Size of diff packages in bytes
-- **PackageSizeExpress** Size of express packages in bytes
-- **Result** Result of the download request phase of update.
-- **FlightId** Unique ID for each flight.
-- **UpdateId** Unique ID for each update.
-- **PackageCountTotalCanonical** Total number of canonical packages.
-- **PackageCountTotalDiff** Total number of diff packages.
-- **PackageCountTotalExpress** Total number of express packages.
-- **DeletedCorruptFiles** Indicates if UpdateAgent found any corrupt payload files and whether the payload was deleted.
-- **RangeRequestState** Represents the state of the download range request.
+- **RelatedCV** Correlation vector value generated from the latest USO scan.
+- **Result** Result of the initialize phase of update. 0 = Succeeded, 1 = Failed, 2 = Cancelled, 3 = Blocked, 4 = BlockCancelled
### Update360Telemetry.UpdateAgent_Install
@@ -3141,10 +3213,10 @@ The following fields are available:
- **ErrorCode** The error code returned for the current install phase.
- **ObjectId** Unique value for each Update Agent mode.
-- **RelatedCV** Correlation vector value generated from the latest scan.
-- **ScenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate
- **SessionId** Unique value for each Update Agent mode attempt.
-- **Result** "Result of the install phase of update. 0 = Succeeded 1 = Failed, 2 = Cancelled, 3 = Blocked, 4 = BlockCancelled "
+- **ScenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate
+- **RelatedCV** Correlation vector value generated from the latest scan.
+- **Result** Result of the install phase of update. 0 = Succeeded 1 = Failed, 2 = Cancelled, 3 = Blocked, 4 = BlockCancelled
- **FlightId** Unique ID for each flight.
- **UpdateId** Unique ID for each update.
@@ -3157,9 +3229,9 @@ The following fields are available:
- **Mode** Indicates that the Update Agent mode that has started. 1 = Initialize, 2 = DownloadRequest, 3 = Install, 4 = Commit
- **ObjectId** Unique value for each Update Agent mode.
-- **RelatedCV** The correlation vector value generated from the latest scan.
-- **ScenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate
- **SessionId** Unique value for each Update Agent mode attempt.
+- **ScenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate
+- **RelatedCV** The correlation vector value generated from the latest scan.
- **FlightId** Unique ID for each flight.
- **UpdateId** Unique ID for each update.
@@ -3170,211 +3242,38 @@ This event sends data during the launching of the setup box when updating Window
The following fields are available:
-- **ObjectId** Unique value for each Update Agent mode.
- **Quiet** Indicates whether setup is running in quiet mode. 0 = false 1 = true
-- **RelatedCV** Correlation vector value generated from the latest scan.
-- **ScenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate
+- **ObjectId** Unique value for each Update Agent mode.
- **SessionId** Unique value for each Update Agent mode attempt.
+- **ScenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate
+- **RelatedCV** Correlation vector value generated from the latest scan.
- **FlightId** Unique ID for each flight.
- **UpdateId** Unique ID for each update.
- **SetupMode** Setup mode 1 = predownload, 2 = install, 3 = finalize
- **SandboxSize** The size of the sandbox folder on the device.
-## Update notification events
-
-### Microsoft.Windows.UpdateNotificationPipeline.JavascriptJavascriptCriticalGenericMessage
-
-This event indicates that Javascript is reporting a schema and a set of values for critical telemetry
-
-The following fields are available:
-
-- **CampaignConfigVersion** Configuration version for the current campaign
-- **CampaignID** Currently campaign that's running on UNP
-- **ConfigCatalogVersion** Current catalog version of UNP
-- **ContentVersion** Content version for the current campaign on UNP
-- **CV** Correlation vector
-- **DetectorVersion** Most recently run detector version for the current campaign on UNP
-- **GlobalEventCounter** Client-side counter that indicates the event ordering sent by the user
-- **key1** Interaction data for the UI
-- **key10** Interaction data for the UI
-- **key11** Interaction data for the UI
-- **key12** Interaction data for the UI
-- **key13** Interaction data for the UI
-- **key14** Interaction data for the UI
-- **key15** Interaction data for the UI
-- **key16** Interaction data for the UI
-- **key17** Interaction data for the UI
-- **key18** Interaction data for the UI
-- **key19** Interaction data for the UI
-- **key2** Interaction data for the UI
-- **key20** Interaction data for the UI
-- **key21** Interaction data for the UI
-- **key22** Interaction data for the UI
-- **key23** Interaction data for the UI
-- **key24** Interaction data for the UI
-- **key25** Interaction data for the UI
-- **key26** Interaction data for the UI
-- **key27** Interaction data for the UI
-- **key28** Interaction data for the UI
-- **key29** Interaction data for the UI
-- **key3** Interaction data for the UI
-- **key30** Interaction data for the UI
-- **key4** Interaction data for the UI
-- **key5** Interaction data for the UI
-- **key6** Interaction data for the UI
-- **key7** Interaction data for the UI
-- **key8** Interaction data for the UI
-- **key9** Interaction data for the UI
-- **PackageVersion** Current package version of UNP
-- **schema** Type of UI interaction
-
-
-### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignHeartbeat
-
-This event is sent at the start of each campaign, to be used as a heartbeat
-
-The following fields are available:
-
-- **CampaignConfigVersion** Configuration version for the current campaign
-- **CampaignID** Currently campaign that's running on UNP
-- **ConfigCatalogVersion** Current catalog version of UNP
-- **ContentVersion** Content version for the current campaign on UNP
-- **CV** Correlation vector
-- **DetectorVersion** Most recently run detector version for the current campaign on UNP
-- **GlobalEventCounter** Client-side counter that indicates the event ordering sent by the user
-- **PackageVersion** Current UNP package version
-
-
-### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignManagerCleaningCampaign
-
-This event indicates that the Campaign Manager is cleaning up the campaign content
-
-The following fields are available:
-
-- **CampaignConfigVersion** Configuration version for the current campaign
-- **CampaignID** Current campaign that's running on UNP
-- **ConfigCatalogVersion** Current catalog version of UNP
-- **ContentVersion** Content version for the current campaign on UNP
-- **CV** Correlation vector
-- **DetectorVersion** Most recently run detector version for the current campaign on UNP
-- **GlobalEventCounter** Client-side counter that indicates the event ordering sent by the user
-- **PackageVersion** Current UNP package version
-
-
-### Microsoft.Windows.UpdateNotificationPipeline.UnpCampaignManagerGetIsCamppaignCompleteFailed
-
-This event is sent when a campaign completion status query fails
-
-The following fields are available:
-
-- **CampaignConfigVersion** Configuration version for the current campaign
-- **CampaignID** Current campaign that's running on UNP
-- **ConfigCatalogVersion** Current catalog version of UNP
-- **ContentVersion** Content version for the current campaign on UNP
-- **CV** Correlation vector
-- **DetectorVersion** Most recently run detector version for the current campaign on UNP
-- **GlobalEventCounter** Client-side counter that indicates the event ordering sent by the user
-- **hresult** HRESULT of the failure
-- **PackageVersion** Current UNP package version
-
-
-### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignManagerHeartbeat
-
-This event is sent at the start of the CampaignManager event and is intended to be used as a heartbeat
-
-The following fields are available:
-
-- **CampaignConfigVersion** Configuration version for the current campaign
-- **CampaignID** Currently campaign that's running on UNP
-- **ConfigCatalogVersion** Current catalog version of UNP
-- **ContentVersion** Content version for the current campaign on UNP
-- **CV** Correlation vector
-- **DetectorVersion** Most recently run detector version for the current campaign on UNP
-- **GlobalEventCounter** Client-side counter that indicates the event ordering sent by the user
-- **PackageVersion** Current UNP package version
-
-
-### Microsoft.Windows.UpdateNotificationPipeline.UnpCampaignManagerRunCampaignFailed
-
-This event is sent when the Campaign Manager encounters an unexpected error while running the campaign
-
-The following fields are available:
-
-- **CampaignConfigVersion** Configuration version for the current campaign
-- **CampaignID** Currently campaign that's running on UNP
-- **ConfigCatalogVersion** Current catalog version of UNP
-- **ContentVersion** Content version for the current campaign on UNP
-- **CV** Correlation vector
-- **DetectorVersion** Most recently run detector version for the current campaign on UNP
-- **GlobalEventCounter** Client-side counter that indicates the event ordering sent by the user
-- **hresult** HRESULT of the failure#N#
-- **PackageVersion** Current UNP package version
-
-
## Upgrade events
-### Setup360Telemetry.PreDownloadUX
+### Setup360Telemetry.Downlevel
-The event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, the Setup360Telemetry.PredownloadUX indicates the outcome of the PredownloadUX portion of the update process.
+This event sends data indicating that the device has invoked the downlevel phase of the upgrade. It's used to help keep Windows up-to-date and secure.
The following fields are available:
-- **ClientId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
-- **HostOSBuildNumber** The build number of the previous operating system.
-- **HostOsSkuName** The OS edition which is running the Setup360 instance (previous operating system).
-- **InstanceId** Unique GUID that identifies each instance of setuphost.exe.
-- **ReportId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, this is the GUID for the install.wim.
-- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
-- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback
-- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used to diagnose errors.
-- **Setup360Scenario** The Setup360 flow type. Examplle: Boot, Media, Update, MCT
-- **SetupVersionBuildNumber** The build number of Setup360 (build number of the target OS).
-- **State** The exit state of the Setup360 run. Example: succeeded, failed, blocked, cancelled
-- **TestId** A string to uniquely identify a group of events.
-- **WuId** Windows Update client ID.
-
-
-### Setup360Telemetry.UnexpectedEvent
-
-This event sends data indicating that the device has invoked the unexpected event phase of the upgrade, to help keep Windows up to date.
-
-The following fields are available:
-
-- **ClientId** With Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
-- **HostOSBuildNumber** The build number of the previous OS.
-- **HostOsSkuName** The OS edition which is running Setup360 instance (previous OS).
-- **InstanceId** A unique GUID that identifies each instance of setuphost.exe
-- **ReportId** With Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim.
-- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
-- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback
-- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used used to diagnose errors.
+- **ClientId** If using Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, the default value is Media360, but it can be overwritten by the caller to a unique value.
+- **InstanceId** A unique GUID that identifies each instance of setuphost.exe.
+- **ReportId** In the Windows Update scenario, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim.
+- **WuId** This is the Windows Update Client ID. In the Windows Update scenario, this is the same as the clientId.
+- **TestId** A string that uniquely identifies a group of events.
+- **State** Exit state of given Setup360 run. Example: succeeded, failed, blocked, cancelled
+- **HostOsSkuName** The operating system edition which is running Setup360 instance (downlevel OS).
+- **HostOSBuildNumber** The build number of the downlevel OS.
- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT
-- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
-- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled
-- **TestId** A string to uniquely identify a group of events.
-- **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as the clientId.
-
-
-### Setup360Telemetry.PreInstallQuiet
-
-This event sends data indicating that the device has invoked the preinstall quiet phase of the upgrade, to help keep Windows up to date.
-
-The following fields are available:
-
-- **ClientId** With Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
-- **HostOSBuildNumber** The build number of the previous OS.
-- **HostOsSkuName** The OS edition which is running Setup360 instance (previous OS).
-- **InstanceId** A unique GUID that identifies each instance of setuphost.exe
-- **ReportId** With Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim.
+- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback
+- **Setup360Result** The result of Setup360. It's an HRESULT error code that can be used to diagnose errors.
- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
-- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback etc.
-- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used to diagnose errors.
-- **Setup360Scenario** Setup360 flow type (Boot, Media, Update, MCT)
-- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
-- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled
-- **TestId** A string to uniquely identify a group of events.
-- **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as the clientId.
+- **SetupVersionBuildNumber** The build number of Setup360 (build number of the target OS).
### Setup360Telemetry.Finalize
@@ -3384,60 +3283,18 @@ This event sends data indicating that the device has invoked the finalize phase
The following fields are available:
- **ClientId** With Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
-- **HostOSBuildNumber** The build number of the previous OS.
-- **HostOsSkuName** The OS edition which is running Setup360 instance (previous OS).
- **InstanceId** A unique GUID that identifies each instance of setuphost.exe
- **ReportId** With Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim.
-- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
-- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback
-- **Setup360Result** The result of Setup360. This is an HRESULT error code that is used to diagnose errors.
-- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT
-- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
-- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled
-- **TestId** A string to uniquely identify a group of events.
- **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as the clientId.
-
-
-### Setup360Telemetry.PostRebootInstall
-
-This event sends data indicating that the device has invoked the postrebootinstall phase of the upgrade, to help keep Windows up-to-date.
-
-The following fields are available:
-
-- **ClientId** With Windows Update, this is the Windows Update client ID that is passed to Setup. In Media setup, the default value is Media360, but can be overwritten by the caller to a unique value.
-- **HostOSBuildNumber** The build number of the previous OS.
-- **HostOsSkuName** The OS edition which is running Setup360 instance (previous OS).
-- **InstanceId** A unique GUID that identifies each instance of setuphost.exe.
-- **ReportId** With Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim.
-- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
-- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback
-- **Setup360Result** The result of Setup360. This is an HRESULT error code that's used to diagnose errors.
-- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT
-- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
-- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled
- **TestId** A string to uniquely identify a group of events.
-- **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as ClientId.
-
-
-### Setup360Telemetry.PreDownloadQuiet
-
-This event sends data indicating that the device has invoked the predownload quiet phase of the upgrade, to help keep Windows up to date.
-
-The following fields are available:
-
-- **ClientId** Using Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
+- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled
+- **HostOsSkuName** The OS edition which is running Setup360 instance (previous OS).
- **HostOSBuildNumber** The build number of the previous OS.
-- **HostOsSkuName** The OS edition which is running Setup360 instance (previous operating system).
-- **InstanceId** A unique GUID that identifies each instance of setuphost.exe
-- **ReportId** Using Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim.
-- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
+- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT
- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback
- **Setup360Result** The result of Setup360. This is an HRESULT error code that is used to diagnose errors.
-- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT
+- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
-- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, canceled
-- **TestId** A string to uniquely identify a group of events.
-- **WuId** This is the Windows Update Client ID. Using Windows Update, this is the same as the clientId.
### Setup360Telemetry.OsUninstall
@@ -3447,39 +3304,102 @@ The event sends data regarding OS updates and upgrades from Windows 7, Windows 8
The following fields are available:
- **ClientId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
-- **HostOSBuildNumber** The build number of the previous OS.
-- **HostOsSkuName** The OS edition which is running the Setup360 instance (previous OS).
- **InstanceId** A unique GUID that identifies each instance of setuphost.exe.
- **ReportId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, this is the GUID for the install.wim.
-- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
+- **WuId** Windows Update client ID.
+- **TestId** A string to uniquely identify a group of events.
+- **State** Exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled
+- **HostOsSkuName** The OS edition which is running the Setup360 instance (previous OS).
+- **HostOSBuildNumber** The build number of the previous OS.
+- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT
- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback
- **Setup360Result** The result of Setup360. This is an HRESULT error code that is used to diagnose errors.
-- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT
+- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
-- **State** Exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled
-- **TestId** A string to uniquely identify a group of events.
-- **WuId** Windows Update client ID.
-### Setup360Telemetry.Downlevel
+### Setup360Telemetry.PostRebootInstall
-This event sends data indicating that the device has invoked the downlevel phase of the upgrade. It's used to help keep Windows up-to-date and secure.
+This event sends data indicating that the device has invoked the postrebootinstall phase of the upgrade, to help keep Windows up-to-date.
The following fields are available:
-- **ClientId** If using Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, the default value is Media360, but it can be overwritten by the caller to a unique value.
-- **HostOSBuildNumber** The build number of the downlevel OS.
-- **HostOsSkuName** The operating system edition which is running Setup360 instance (downlevel OS).
+- **ClientId** With Windows Update, this is the Windows Update client ID that is passed to Setup. In Media setup, the default value is Media360, but can be overwritten by the caller to a unique value.
- **InstanceId** A unique GUID that identifies each instance of setuphost.exe.
-- **ReportId** In the Windows Update scenario, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim.
-- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
-- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback
-- **Setup360Result** The result of Setup360. It's an HRESULT error code that can be used to diagnose errors.
+- **ReportId** With Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim.
+- **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as ClientId.
+- **TestId** A string to uniquely identify a group of events.
+- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled
+- **HostOsSkuName** The OS edition which is running Setup360 instance (previous OS).
+- **HostOSBuildNumber** The build number of the previous OS.
- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT
+- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback
+- **Setup360Result** The result of Setup360. This is an HRESULT error code that's used to diagnose errors.
+- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
+- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
+
+
+### Setup360Telemetry.PreDownloadQuiet
+
+This event sends data indicating that the device has invoked the predownload quiet phase of the upgrade, to help keep Windows up to date.
+
+The following fields are available:
+
+- **ClientId** Using Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
+- **InstanceId** A unique GUID that identifies each instance of setuphost.exe
+- **ReportId** Using Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim.
+- **WuId** This is the Windows Update Client ID. Using Windows Update, this is the same as the clientId.
+- **TestId** A string to uniquely identify a group of events.
+- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, canceled
+- **HostOsSkuName** The OS edition which is running Setup360 instance (previous operating system).
+- **HostOSBuildNumber** The build number of the previous OS.
+- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT
+- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback
+- **Setup360Result** The result of Setup360. This is an HRESULT error code that is used to diagnose errors.
+- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
+- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
+
+
+### Setup360Telemetry.PreDownloadUX
+
+The event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, the Setup360Telemetry.PredownloadUX indicates the outcome of the PredownloadUX portion of the update process.
+
+The following fields are available:
+
+- **ClientId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
+- **InstanceId** Unique GUID that identifies each instance of setuphost.exe.
+- **ReportId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, this is the GUID for the install.wim.
+- **WuId** Windows Update client ID.
+- **TestId** A string to uniquely identify a group of events.
+- **State** The exit state of the Setup360 run. Example: succeeded, failed, blocked, cancelled
+- **HostOsSkuName** The OS edition which is running the Setup360 instance (previous operating system).
+- **HostOSBuildNumber** The build number of the previous operating system.
+- **Setup360Scenario** The Setup360 flow type. Examplle: Boot, Media, Update, MCT
+- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback
+- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used to diagnose errors.
+- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
- **SetupVersionBuildNumber** The build number of Setup360 (build number of the target OS).
-- **State** Exit state of given Setup360 run. Example: succeeded, failed, blocked, cancelled
-- **TestId** A string that uniquely identifies a group of events.
-- **WuId** This is the Windows Update Client ID. In the Windows Update scenario, this is the same as the clientId.
+
+
+### Setup360Telemetry.PreInstallQuiet
+
+This event sends data indicating that the device has invoked the preinstall quiet phase of the upgrade, to help keep Windows up to date.
+
+The following fields are available:
+
+- **ClientId** With Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
+- **InstanceId** A unique GUID that identifies each instance of setuphost.exe
+- **ReportId** With Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim.
+- **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as the clientId.
+- **TestId** A string to uniquely identify a group of events.
+- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled
+- **HostOsSkuName** The OS edition which is running Setup360 instance (previous OS).
+- **HostOSBuildNumber** The build number of the previous OS.
+- **Setup360Scenario** Setup360 flow type (Boot, Media, Update, MCT)
+- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback etc.
+- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used to diagnose errors.
+- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
+- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
### Setup360Telemetry.PreInstallUX
@@ -3489,18 +3409,18 @@ This event sends data regarding OS updates and upgrades from Windows 7, Windows
The following fields are available:
- **ClientId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
-- **HostOSBuildNumber** The build number of the previous OS.
-- **HostOsSkuName** The OS edition which is running the Setup360 instance (previous OS).
- **InstanceId** A unique GUID that identifies each instance of setuphost.exe.
- **ReportId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, this is the GUID for the install.wim.
-- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
+- **WuId** Windows Update client ID.
+- **TestId** A string to uniquely identify a group of events.
+- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled
+- **HostOsSkuName** The OS edition which is running the Setup360 instance (previous OS).
+- **HostOSBuildNumber** The build number of the previous OS.
+- **Setup360Scenario** The Setup360 flow type, Example: Boot, Media, Update, MCT
- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback
- **Setup360Result** The result of Setup360. This is an HRESULT error code that is used to diagnose errors.
-- **Setup360Scenario** The Setup360 flow type, Example: Boot, Media, Update, MCT
+- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
-- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled
-- **TestId** A string to uniquely identify a group of events.
-- **WuId** Windows Update client ID.
### Setup360Telemetry.Setup360
@@ -3509,54 +3429,34 @@ This event sends data about OS deployment scenarios, to help keep Windows up-to-
The following fields are available:
-- **FieldName** Retrieves the data point.
-- **FlightData** Specifies a unique identifier for each group of Windows Insider builds.
- **InstanceId** Retrieves a unique identifier for each instance of a setup session.
- **ReportId** Retrieves the report ID.
+- **FlightData** Specifies a unique identifier for each group of Windows Insider builds.
- **ScenarioId** Retrieves the deployment scenario.
+- **FieldName** Retrieves the data point.
- **Value** Retrieves the value associated with the corresponding FieldName.
- **ClientId** Retrieves the upgrade ID: Upgrades via Windows Update - specifies the WU clientID. All other deployment - static string.
-## Windows as a Service diagnostic events
+### Setup360Telemetry.UnexpectedEvent
-### Microsoft.Windows.WaaSMedic.SummaryEvent
-
-This event provides the results from the WaaSMedic engine
+This event sends data indicating that the device has invoked the unexpected event phase of the upgrade, to help keep Windows up to date.
The following fields are available:
-- **detectionSummary** Result of each detection that ran
-- **featureAssessmentImpact** Windows as a Service (WaaS) Assessment impact on feature updates
-- **insufficientSessions** True, if the device has enough activity to be eligible for update diagnostics. False, if otherwise
-- **isManaged** Indicates the device is managed for updates
-- **isWUConnected** Indicates the device is connected to Windows Update
-- **noMoreActions** All available WaaSMedic diagnostics have run. There are no pending diagnostics and corresponding actions
-- **qualityAssessmentImpact** Windows as a Service (WaaS) Assessment impact for quality updates
-- **remediationSummary** Result of each operation performed on a device to fix an invalid state or configuration that's preventing the device from getting updates. For example, if Windows Update service is turned off, the fix is to turn the it back on
-- **usingBackupFeatureAssessment** The WaaSMedic engine contacts Windows as a Service (WaaS) Assessment to determine whether the device is up-to-date. If WaaS Assessment isn't available, the engine falls back to backup feature assessments, which are determined programmatically on the client#N#
-- **usingBackupQualityAssessment** The WaaSMedic engine contacts Windows as a Service (WaaS) Assessment to determine whether the device is up-to-date. If WaaS Assessment isn't available, the engine falls back to backup quality assessments, which are determined programmatically on the client#N#
-- **versionString** Installed version of the WaaSMedic engine
-- **hrEngineResult** Indicates the WaaSMedic engine operation error codes
-
-
-### Microsoft.Windows.WaaSMedic.Summary
-
-This event provides the results of the WaaSMedic diagnostic run
-
-The following fields are available:
-
-- **detectionSummary** Result of each detection that ran
-- **remediationSummary** Result of each operation performed on a device to fix an invalid state or configuration that's preventing the device from getting updates. For example, if Windows Update service is turned off, the fix is to turn the it back on
-- **versionString** Installed version of the WaaSMedic engine
-- **featureAssessmentImpact** Windows as a Service (WaaS) Assessment impact on feature updates
-- **insufficientSessions** True, if the device has enough activity to be eligible for update diagnostics. False, if otherwise
-- **isManaged** Indicates the device is managed for updates
-- **isWUConnected** Indicates the device is connected to Windows Update
-- **noMoreActions** All available WaaSMedic diagnostics have run. There are no pending diagnostics and corresponding actions
-- **qualityAssessmentImpact** Windows as a Service (WaaS) Assessment impact for quality updates
-- **usingBackupFeatureAssessment** The WaaSMedic engine contacts Windows as a Service (WaaS) Assessment to determine whether the device is up-to-date. If WaaS Assessment isn't available, the engine falls back to backup feature assessments, which are determined programmatically on the client
-- **usingBackupQualityAssessment** The WaaSMedic engine contacts Windows as a Service (WaaS) Assessment to determine whether the device is up-to-date. If WaaS Assessment isn't available, the engine falls back to backup quality assessments, which are determined programmatically on the client
+- **ClientId** With Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
+- **InstanceId** A unique GUID that identifies each instance of setuphost.exe
+- **ReportId** With Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim.
+- **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as the clientId.
+- **TestId** A string to uniquely identify a group of events.
+- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled
+- **HostOsSkuName** The OS edition which is running Setup360 instance (previous OS).
+- **HostOSBuildNumber** The build number of the previous OS.
+- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT
+- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback
+- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used used to diagnose errors.
+- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
+- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
## Windows Error Reporting events
@@ -3567,19 +3467,19 @@ This event sends binary data from the collected dump file wheneveer a bug check
The following fields are available:
-- **BootId** Uint32 identifying the boot number for this device.
-- **BugCheckCode** "Uint64 ""bugcheck code"" that identifies a proximate cause of the bug check."
-- **BugCheckParameter1** Uint64 parameter providing additional information.
-- **BugCheckParameter2** Uint64 parameter providing additional information.
-- **BugCheckParameter3** Uint64 parameter providing additional information.
-- **BugCheckParameter4** Uint64 parameter providing additional information.
-- **DumpFileAttributes** Codes that identify the type of data contained in the dump file
-- **DumpFileSize** Size of the dump file
-- **IsValidDumpFile** True if the dump file is valid for the debugger, false otherwise
- **ReportId** WER Report Id associated with this bug check (used for finding the corresponding report archive in Watson).
+- **BugCheckCode** Uint64 "bugcheck code" that identifies a proximate cause of the bug check.
+- **BugCheckParameter1** Uint64 parameter providing additional information.
+- **BootId** Uint32 identifying the boot number for this device.
+- **BugCheckParameter2** Uint64 parameter providing additional information.
+- **BugCheckParameter4** Uint64 parameter providing additional information.
+- **BugCheckParameter3** Uint64 parameter providing additional information.
+- **IsValidDumpFile** True if the dump file is valid for the debugger, false otherwise
+- **DumpFileSize** Size of the dump file
+- **DumpFileAttributes** Codes that identify the type of data contained in the dump file
-## Windows Store events
+## Microsoft Store events
### Microsoft.Windows.StoreAgent.Telemetry.AbortedInstallation
@@ -3587,27 +3487,78 @@ This event is sent when an installation or update is canceled by a user or the s
The following fields are available:
-- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed.
-- **AttemptNumber** Number of retry attempts before it was canceled.
-- **BundleId** The Item Bundle ID.
-- **CategoryId** The Item Category ID.
+- **PFN** The product family name of the product being installed.
- **ClientAppId** The identity of the app that initiated this operation.
- **HResult** The result code of the last action performed before this operation.
-- **IntentPFNs** Intent Product Family Name
-- **IsBundle** Is this a bundle?
-- **IsInteractive** Was this requested by a user?
-- **IsMandatory** Was this a mandatory update?
-- **IsRemediation** Was this a remediation install?
-- **IsRestore** Is this automatically restoring a previously acquired product?
- **IsUpdate** Flag indicating if this is an update.
-- **IsWin32** Flag indicating if this is a Win32 app (not used).
-- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
-- **PFN** The product family name of the product being installed.
+- **AttemptNumber** Number of retry attempts before it was canceled.
+- **CategoryId** The Item Category ID.
- **ProductId** The identity of the package or packages being installed.
+- **IsInteractive** Was this requested by a user?
+- **IsRemediation** Was this a remediation install?
+- **BundleId** The Item Bundle ID.
+- **IsMandatory** Was this a mandatory update?
- **SystemAttemptNumber** The total number of automatic attempts at installation before it was canceled.
-- **UpdateId** Update ID (if this is an update)
- **UserAttemptNumber** The total number of user attempts at installation before it was canceled.
+- **IsRestore** Is this automatically restoring a previously acquired product?
+- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
+- **IsBundle** Is this a bundle?
- **WUContentId** The Windows Update content ID
+- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.BeginGetInstalledContentIds
+
+This event is sent when an inventory of the apps installed is started to determine whether updates for those apps are available. It's used to help keep Windows up-to-date and secure.
+
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.BeginUpdateMetadataPrepare
+
+This event is sent when the Store Agent cache is refreshed with any available package updates. It's used to help keep Windows up-to-date and secure.
+
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.CancelInstallation
+
+This event is sent when an app update or installation is canceled while in interactive mode. This can be canceled by the user or the system. It's used to help keep Windows up-to-date and secure.
+
+The following fields are available:
+
+- **IsInteractive** Was this requested by a user?
+- **AttemptNumber** Total number of installation attempts.
+- **BundleId** The identity of the Windows Insider build that is associated with this product.
+- **PreviousHResult** The previous HResult code.
+- **ClientAppId** The identity of the app that initiated this operation.
+- **CategoryId** The identity of the package or packages being installed.
+- **PFN** The name of all packages to be downloaded and installed.
+- **ProductId** The name of the package or packages requested for installation.
+- **IsUpdate** Is this a product update?
+- **IsRemediation** Is this repairing a previous installation?
+- **RelatedCV** Correlation Vector of a previous performed action on this product.
+- **PreviousInstallState** Previous installation state before it was canceled.
+- **IsMandatory** Is this a mandatory update?
+- **SystemAttemptNumber** Total number of automatic attempts to install before it was canceled.
+- **UserAttemptNumber** Total number of user attempts to install before it was canceled.
+- **IsRestore** Is this an automatic restore of a previously acquired product?
+- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
+- **IsBundle** Is this a bundle?
+- **WUContentId** The Windows Update content ID
+- **AggregatedPackageFullNames** The names of all package or packages to be downloaded and installed.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.CompleteInstallOperationRequest
+
+This event is sent after the app installations or updates. It's used to help keep Windows up-to-date and secure
+
+The following fields are available:
+
+- **IsBundle** Is this a bundle?
+- **ProductId** The Store Product ID of the product being installed.
+- **SkuId** Specific edition of the item being installed.
+- **CatalogId** The Store Product ID of the app being installed.
+- **PackageFamilyName** The name of the package being installed.
+- **HResult** HResult code of the action being performed.
### Microsoft.Windows.StoreAgent.Telemetry.EndAcquireLicense
@@ -3616,28 +3567,24 @@ This event is sent after the license is acquired when a product is being install
The following fields are available:
-- **AggregatedPackageFullNames** Includes a set of package full names for each app that is part of an atomic set.
-- **AttemptNumber** The total number of attempts to acquire this product.
-- **BundleId** The bundle ID
+- **PFN** Product Family Name of the product being installed.
+- **HResult** HResult code to show the result of the operation (success/failure).
+- **ProductId** The Store Product ID for the product being installed.
+- **IsInteractive** Did the user initiate the installation?
- **CategoryId** The identity of the package or packages being installed.
- **ClientAppId** The identity of the app that initiated this operation.
-- **HResult** HResult code to show the result of the operation (success/failure).
-- **IntentPFNs** Intent Product Family Name
-- **IsBundle** Is this a bundle?
-- **IsInteractive** Did the user initiate the installation?
-- **IsMandatory** Is this a mandatory update?
- **IsRemediation** Is this repairing a previous installation?
-- **IsRestore** Is this happening after a device restore?
-- **IsUpdate** Is this an update?
-- **IsWin32** Flag indicating if this is a Win32app.
-- **ParentBundledId** The product's parent bundle ID.
-- **ParentBundleId** The parent bundle ID (if it's part of a bundle).
-- **PFN** Product Family Name of the product being installed.
-- **ProductId** The Store Product ID for the product being installed.
-- **SystemAttemptNumber** The number of attempts by the system to acquire this product.
- **UpdateId** The update ID (if this is an update)
+- **AttemptNumber** The total number of attempts to acquire this product.
+- **IsUpdate** Is this an update?
+- **IsMandatory** Is this a mandatory update?
+- **SystemAttemptNumber** The number of attempts by the system to acquire this product.
- **UserAttemptNumber** The number of attempts by the user to acquire this product
+- **IsRestore** Is this happening after a device restore?
+- **IsBundle** Is this a bundle?
- **WUContentId** The Windows Update content ID
+- **ParentBundledId** The product's parent bundle ID.
+- **AggregatedPackageFullNames** Includes a set of package full names for each app that is part of an atomic set.
### Microsoft.Windows.StoreAgent.Telemetry.EndDownload
@@ -3646,29 +3593,26 @@ This event happens during the app update or installation when content is being d
The following fields are available:
-- **AggregatedPackageFullNames** The name of all packages to be downloaded and installed.
+- **PFN** The Product Family Name of the app being download.
+- **IsRemediation** Is this repairing a previous installation?
+- **DownloadSize** The total size of the download.
+- **ClientAppId** The identity of the app that initiated this operation.
+- **CategoryId** The identity of the package or packages being installed.
+- **IsUpdate** Is this an update?
+- **HResult** The result code of the last action performed.
+- **IsInteractive** Is this initiated by the user?
- **AttemptNumber** Number of retry attempts before it was canceled.
- **BundleId** The identity of the Windows Insider build associated with this product.
-- **CategoryId** The identity of the package or packages being installed.
-- **ClientAppId** The identity of the app that initiated this operation.
-- **DownloadSize** The total size of the download.
-- **ExtendedHResult** Any extended HResult error codes.
-- **HResult** The result code of the last action performed.
-- **IntentPFNs** Intent Product Family Name
-- **IsBundle** Is this a bundle?
-- **IsInteractive** Is this initiated by the user?
-- **IsMandatory** Is this a mandatory installation?
-- **IsRemediation** Is this repairing a previous installation?
-- **IsRestore** Is this a restore of a previously acquired product?
-- **IsUpdate** Is this an update?
-- **IsWin32** Flag indicating if this is a Win32 app (unused).
-- **ParentBundleId** The parent bundle ID (if it's part of a bundle).
-- **PFN** The Product Family Name of the app being download.
- **ProductId** The Store Product ID for the product being installed.
+- **IsMandatory** Is this a mandatory installation?
- **SystemAttemptNumber** The number of attempts by the system to download.
-- **UpdateId** Update ID (if this is an update)
- **UserAttemptNumber** The number of attempts by the user to download.
+- **IsRestore** Is this a restore of a previously acquired product?
+- **ParentBundleId** The parent bundle ID (if it's part of a bundle).
+- **IsBundle** Is this a bundle?
- **WUContentId** The Windows Update content ID.
+- **ExtendedHResult** Any extended HResult error codes.
+- **AggregatedPackageFullNames** The name of all packages to be downloaded and installed.
### Microsoft.Windows.StoreAgent.Telemetry.EndFrameworkUpdate
@@ -3695,28 +3639,25 @@ This event is sent after a product has been installed. It's used to help keep Wi
The following fields are available:
-- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed.
-- **AttemptNumber** The number of retry attempts before it was canceled.
- **BundleId** The identity of the build associated with this product.
-- **CategoryId** The identity of the package or packages being installed.
-- **ClientAppId** The identity of the app that initiated this operation.
-- **ExtendedHResult** The extended HResult error code.
-- **HResult** The result code of the last action performed.
-- **IntentPFNs** Intent Product Family Name
-- **IsBundle** Is this a bundle?
-- **IsInteractive** Is this an interactive installation?
-- **IsMandatory** Is this a mandatory installation?
-- **IsRemediation** Is this repairing a previous installation?
-- **IsRestore** Is this automatically restoring a previously acquired product?
-- **IsUpdate** Is this an update?
-- **IsWin32** Flag indicating if this a Win32 app (unused).
-- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
- **PFN** Product Family Name of the product being installed.
+- **ClientAppId** The identity of the app that initiated this operation.
+- **CategoryId** The identity of the package or packages being installed.
- **ProductId** The Store Product ID for the product being installed.
+- **AttemptNumber** The number of retry attempts before it was canceled.
+- **HResult** The result code of the last action performed.
+- **IsRemediation** Is this repairing a previous installation?
+- **IsInteractive** Is this an interactive installation?
+- **IsUpdate** Is this an update?
+- **IsMandatory** Is this a mandatory installation?
- **SystemAttemptNumber** The total number of system attempts.
-- **UpdateId** Update ID (if this is an update)
- **UserAttemptNumber** The total number of user attempts.
+- **IsRestore** Is this automatically restoring a previously acquired product?
+- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
+- **IsBundle** Is this a bundle?
- **WUContentId** The Windows Update content ID
+- **ExtendedHResult** The extended HResult error code.
+- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed.
### Microsoft.Windows.StoreAgent.Telemetry.EndScanForUpdates
@@ -3725,10 +3666,10 @@ This event is sent after a scan for product updates to determine if there are pa
The following fields are available:
-- **ClientAppId** The identity of the app that initiated this operation.
- **HResult** The result code of the last action performed.
- **IsApplicability** Is this request to only check if there are any applicable packages to install?
- **IsInteractive** Is this user requested?
+- **ClientAppId** The identity of the app that initiated this operation.
- **IsOnline** Is the request doing an online check?
@@ -3738,27 +3679,24 @@ This event is sent after searching for update packages to install. It's used to
The following fields are available:
-- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed.
-- **AttemptNumber** The total number of retry attempts before it was canceled.
-- **BundleId** The identity of the build associated with this product.
-- **CategoryId** The identity of the package or packages being installed.
+- **IsRemediation** Is this repairing a previous installation?
+- **IsUpdate** Is this an update?
- **ClientAppId** The identity of the app that initiated this operation.
- **HResult** The result code of the last action performed.
-- **IntentPFNs** The licensing identity of this package.
-- **IsBundle** Is this a bundle?
-- **IsInteractive** Is this user requested?
-- **IsMandatory** Is this a mandatory update?
-- **IsRemediation** Is this repairing a previous installation?
-- **IsRestore** Is this restoring previously acquired content?
-- **IsUpdate** Is this an update?
-- **IsWin32** Flag indicating if this a Win32 app (unused).
-- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
-- **PFN** The name of the package or packages requested for install.
- **ProductId** The Store Product ID for the product being installed.
+- **AttemptNumber** The total number of retry attempts before it was canceled.
+- **IsInteractive** Is this user requested?
+- **PFN** The name of the package or packages requested for install.
+- **BundleId** The identity of the build associated with this product.
+- **CategoryId** The identity of the package or packages being installed.
+- **IsMandatory** Is this a mandatory update?
- **SystemAttemptNumber** The total number of system attempts.
-- **UpdateId** Update ID (if this is an update)
- **UserAttemptNumber** The total number of user attempts.
+- **IsRestore** Is this restoring previously acquired content?
+- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
+- **IsBundle** Is this a bundle?
- **WUContentId** The Windows Update content ID
+- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed.
### Microsoft.Windows.StoreAgent.Telemetry.EndStageUserData
@@ -3767,149 +3705,26 @@ This event is sent between download and installation to see if there is app data
The following fields are available:
-- **AttemptNumber** The total number of retry attempts before it was canceled.
-- **BundleId** The identity of the build associated with this product.
-- **CategoryId** The identity of the package or packages being installed.
-- **ClientAppId** The identity of the app that initiated this operation.
-- **HResult** The result code of the last action performed.
-- **IsBundle** Is this a bundle?
- **IsInteractive** Is this user requested?
-- **IsMandatory** Is this a mandatory update?
-- **IsRemediation** Is this repairing a previous installation?
-- **IsRestore** Is this restoring previously acquired content?
-- **IsUpdate** Is this an update?
-- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
- **PFN** The name of the package or packages requested for install.
+- **IsUpdate** Is this an update?
+- **CategoryId** The identity of the package or packages being installed.
+- **HResult** The result code of the last action performed.
+- **AttemptNumber** The total number of retry attempts before it was canceled.
- **ProductId** The Store Product ID for the product being installed.
+- **BundleId** The identity of the build associated with this product.
+- **IsRemediation** Is this repairing a previous installation?
+- **ClientAppId** The identity of the app that initiated this operation.
+- **IsMandatory** Is this a mandatory update?
- **SystemAttemptNumber** The total number of system attempts.
- **UserAttemptNumber** The total number of system attempts.
+- **IsRestore** Is this restoring previously acquired content?
+- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
+- **IsBundle** Is this a bundle?
- **WUContentId** The Windows Update content ID
-- **IntentPFNs** The licensing identity of this package.
- **AggregatedPackageFullNames** The name of all packages to be downloaded and installed.
-### Microsoft.Windows.StoreAgent.Telemetry.InstallOperationRequest
-
-This event happens at the beginning of the install process when an app update or new app is installed. It's used to help keep Windows up-to-date and secure.
-
-The following fields are available:
-
-- **BundleId** The identity of the build associated with this product.
-- **CatalogId** If this product is from a private catalog, the Store Product ID for the product being installed.
-- **ProductId** The Store Product ID for the product being installed.
-- **SkuId** Specific edition ID being installed.
-- **VolumePath** The disk path of the installation.
-
-
-### Microsoft.Windows.StoreAgent.Telemetry.PauseInstallation
-
-This event is sent when a product install or update is paused either by a user or the system. It's used to help keep Windows up-to-date and secure.
-
-The following fields are available:
-
-- **AttemptNumber** The total number of retry attempts before it was canceled.
-- **BundleId** The identity of the build associated with this product.
-- **CategoryId** The identity of the package or packages being installed.
-- **ClientAppId** The identity of the app that initiated this operation.
-- **IsBundle** Is this a bundle?
-- **IsInteractive** Is this user requested?
-- **IsMandatory** Is this a mandatory update?
-- **IsRemediation** Is this repairing a previous installation?
-- **IsRestore** Is this restoring previously acquired content?
-- **IsUpdate** Is this an update?
-- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
-- **PFN** The Product Full Name.
-- **PreviousHResult** The result code of the last action performed before this operation.
-- **PreviousInstallState** Previous state before the installation or update was paused.
-- **ProductId** The Store Product ID for the product being installed.
-- **RelatedCV** Correlation Vector of a previous performed action on this product.
-- **SystemAttemptNumber** The total number of system attempts.
-- **UserAttemptNumber** The total number of user attempts.
-- **WUContentId** The Windows Update content ID
-- **IntentPFNs** The licensing identity of this package.
-- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed.
-
-
-### Microsoft.Windows.StoreAgent.Telemetry.ResumeInstallation
-
-This event happens when a product install or update is resumed either by a user or the system. It's used to help keep Windows up-to-date and secure.
-
-The following fields are available:
-
-- **AttemptNumber** The number of retry attempts before it was canceled.
-- **BundleId** The identity of the build associated with this product.
-- **CategoryId** The identity of the package or packages being installed.
-- **ClientAppId** The identity of the app that initiated this operation.
-- **IsBundle** Is this a bundle?
-- **IsInteractive** Is this user requested?
-- **IsMandatory** Is this a mandatory update?
-- **IsRemediation** Is this repairing a previous installation?
-- **IsRestore** Is this restoring previously acquired content?
-- **IsUpdate** Is this an update?
-- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
-- **PFN** The name of the package or packages requested for install.
-- **PreviousHResult** The previous HResult error code.
-- **PreviousInstallState** Previous state before the installation was paused.
-- **ProductId** The Store Product ID for the product being installed.
-- **RelatedCV** Correlation Vector for the original install before it was resumed.
-- **SystemAttemptNumber** The total number of system attempts.
-- **UserAttemptNumber** The total number of user attempts.
-- **WUContentId** The Windows Update content ID
-- **IntentPFNs** Intent Product Family Name
-- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed.
-- **HResult** The result code of the last action performed before this operation.
-- **IsUserRetry** Did the user initiate the retry?
-
-
-### Microsoft.Windows.StoreAgent.Telemetry.UpdateAppOperationRequest
-
-This event happens an app for a user needs to be updated. It's used to help keep Windows up-to-date and secure.
-
-The following fields are available:
-
-- **PFamN** The name of the product that is requested for update.
-
-
-### Microsoft.Windows.StoreAgent.Telemetry.CancelInstallation
-
-This event is sent when an app update or installation is canceled while in interactive mode. This can be canceled by the user or the system. It's used to help keep Windows up-to-date and secure.
-
-The following fields are available:
-
-- **AttemptNumber** Total number of installation attempts.
-- **BundleId** The identity of the Windows Insider build that is associated with this product.
-- **CategoryId** The identity of the package or packages being installed.
-- **ClientAppId** The identity of the app that initiated this operation.
-- **IsBundle** Is this a bundle?
-- **IsInteractive** Was this requested by a user?
-- **IsMandatory** Is this a mandatory update?
-- **IsRemediation** Is this repairing a previous installation?
-- **IsRestore** Is this an automatic restore of a previously acquired product?
-- **IsUpdate** Is this a product update?
-- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
-- **PFN** The name of all packages to be downloaded and installed.
-- **PreviousHResult** The previous HResult code.
-- **PreviousInstallState** Previous installation state before it was canceled.
-- **ProductId** The name of the package or packages requested for installation.
-- **RelatedCV** Correlation Vector of a previous performed action on this product.
-- **SystemAttemptNumber** Total number of automatic attempts to install before it was canceled.
-- **UserAttemptNumber** Total number of user attempts to install before it was canceled.
-- **WUContentId** The Windows Update content ID
-- **IntentPFNs** Intent Product Family Name
-- **AggregatedPackageFullNames** The names of all package or packages to be downloaded and installed.
-
-
-### Microsoft.Windows.StoreAgent.Telemetry.SearchForUpdateOperationRequest
-
-This event is sent when searching for update packages to install. It's used to help keep Windows up-to-date and secure.
-
-The following fields are available:
-
-- **CatalogId** The Store Product ID for the product being installed.
-- **ProductId** The Store Product ID for the product being installed.
-- **SkuId** Specfic edition of the app being updated.
-
-
### Microsoft.Windows.StoreAgent.Telemetry.EndUpdateMetadataPrepare
This event happens after a scan for available app updates. It's used to help keep Windows up-to-date and secure.
@@ -3919,18 +3734,97 @@ The following fields are available:
- **HResult** The result code of the last action performed.
-### Microsoft.Windows.StoreAgent.Telemetry.CompleteInstallOperationRequest
+### Microsoft.Windows.StoreAgent.Telemetry.FulfillmentComplete
-This event is sent after the app installations or updates. It's used to help keep Windows up-to-date and secure
+This event is sent at the end of an app install or update and is used to track the very end of the install or update process.
The following fields are available:
-- **CatalogId** The Store Product ID of the app being installed.
-- **HResult** HResult code of the action being performed.
+- **ProductId** The product ID of the app that is being updated or installed.
+- **PFN** The Package Family Name of the app that is being installed or updated.
+- **FailedRetry** Was the installation or update retry successful?
+- **HResult** The HResult code of the operation.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.FulfillmentInitiate
+
+This event is sent at the beginning of an app install or update and is used to track the very beginning of the install or update process.
+
+The following fields are available:
+
+- **ProductId** The product ID of the app that is being updated or installed.
+- **PFN** The Package Family Name of the app that is being installed or updated.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.InstallOperationRequest
+
+This event happens at the beginning of the install process when an app update or new app is installed. It's used to help keep Windows up-to-date and secure.
+
+The following fields are available:
+
+- **CatalogId** If this product is from a private catalog, the Store Product ID for the product being installed.
+- **BundleId** The identity of the build associated with this product.
+- **SkuId** Specific edition ID being installed.
+- **ProductId** The Store Product ID for the product being installed.
+- **VolumePath** The disk path of the installation.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.PauseInstallation
+
+This event is sent when a product install or update is paused either by a user or the system. It's used to help keep Windows up-to-date and secure.
+
+The following fields are available:
+
+- **RelatedCV** Correlation Vector of a previous performed action on this product.
+- **IsRemediation** Is this repairing a previous installation?
+- **PreviousHResult** The result code of the last action performed before this operation.
+- **ProductId** The Store Product ID for the product being installed.
+- **IsUpdate** Is this an update?
+- **PreviousInstallState** Previous state before the installation or update was paused.
+- **CategoryId** The identity of the package or packages being installed.
+- **ClientAppId** The identity of the app that initiated this operation.
+- **AttemptNumber** The total number of retry attempts before it was canceled.
+- **IsInteractive** Is this user requested?
+- **BundleId** The identity of the build associated with this product.
+- **PFN** The Product Full Name.
+- **IsMandatory** Is this a mandatory update?
+- **SystemAttemptNumber** The total number of system attempts.
+- **UserAttemptNumber** The total number of user attempts.
+- **IsRestore** Is this restoring previously acquired content?
+- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
- **IsBundle** Is this a bundle?
-- **PackageFamilyName** The name of the package being installed.
-- **ProductId** The Store Product ID of the product being installed.
-- **SkuId** Specific edition of the item being installed.
+- **WUContentId** The Windows Update content ID
+- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.ResumeInstallation
+
+This event happens when a product install or update is resumed either by a user or the system. It's used to help keep Windows up-to-date and secure.
+
+The following fields are available:
+
+- **RelatedCV** Correlation Vector for the original install before it was resumed.
+- **AttemptNumber** The number of retry attempts before it was canceled.
+- **BundleId** The identity of the build associated with this product.
+- **PreviousHResult** The previous HResult error code.
+- **ClientAppId** The identity of the app that initiated this operation.
+- **CategoryId** The identity of the package or packages being installed.
+- **PFN** The name of the package or packages requested for install.
+- **IsUpdate** Is this an update?
+- **PreviousInstallState** Previous state before the installation was paused.
+- **IsRemediation** Is this repairing a previous installation?
+- **IsInteractive** Is this user requested?
+- **ProductId** The Store Product ID for the product being installed.
+- **IsMandatory** Is this a mandatory update?
+- **SystemAttemptNumber** The total number of system attempts.
+- **UserAttemptNumber** The total number of user attempts.
+- **IsRestore** Is this restoring previously acquired content?
+- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
+- **IsBundle** Is this a bundle?
+- **WUContentId** The Windows Update content ID
+- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed.
+- **IsUserRetry** Did the user initiate the retry?
+- **HResult** The result code of the last action performed before this operation.
### Microsoft.Windows.StoreAgent.Telemetry.ResumeOperationRequest
@@ -3942,64 +3836,88 @@ The following fields are available:
- **ProductId** The Store Product ID for the product being installed.
-### Microsoft.Windows.StoreAgent.Telemetry.FulfillmentComplete
+### Microsoft.Windows.StoreAgent.Telemetry.SearchForUpdateOperationRequest
-This event is sent at the end of an app install or update and is used to track the very end of the install or update process.
+This event is sent when searching for update packages to install. It's used to help keep Windows up-to-date and secure.
The following fields are available:
-- **FailedRetry** Was the installation or update retry successful?
-- **HResult** The HResult code of the operation.
-- **PFN** The Package Family Name of the app that is being installed or updated.
-- **ProductId** The product ID of the app that is being updated or installed.
+- **ProductId** The Store Product ID for the product being installed.
+- **SkuId** Specfic edition of the app being updated.
+- **CatalogId** The Store Product ID for the product being installed.
-### Microsoft.Windows.StoreAgent.Telemetry.FulfillmentInitiate
+### Microsoft.Windows.StoreAgent.Telemetry.UpdateAppOperationRequest
-This event is sent at the beginning of an app install or update and is used to track the very beginning of the install or update process.
+This event happens an app for a user needs to be updated. It's used to help keep Windows up-to-date and secure.
The following fields are available:
-- **PFN** The Package Family Name of the app that is being installed or updated.
-- **ProductId** The product ID of the app that is being updated or installed.
+- **PFamN** The name of the product that is requested for update.
## Windows Update Delivery Optimization events
+### Microsoft.OSG.DU.DeliveryOptClient.DownloadCanceled
+
+This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads.
+
+The following fields are available:
+
+- **bytesFromIntPeers** The number of bytes received from peers not in the same LAN or in the same group.
+- **fileID** The ID of the file being downloaded.
+- **sessionID** The ID of the file download session.
+- **scenarioID** The ID of the scenario.
+- **bytesFromCDN** The number of bytes received from a CDN source.
+- **updateID** The ID of the update being downloaded.
+- **background** Is the download being done in the background?
+- **bytesFromPeers** The number of bytes received from a peer in the same LAN.
+- **clientTelId** A random number used for device sampling.
+- **bytesFromGroupPeers** The number of bytes received from a peer in the same group.
+- **errorCode** The error code that was returned.
+- **doErrorCode** The Delivery Optimization error code that was returned.
+- **cdnErrorCodes** A list of CDN connection errors since the last FailureCDNCommunication event.
+- **cdnErrorCounts** The number of times each error in cdnErrorCodes was encountered.
+- **experimentId** When running a test, this is used to correlate events that are part of the same test.
+- **isVpn** Is the device connected to a Virtual Private Network?
+- **usedMemoryStream** Did the download use memory streaming?
+
+
### Microsoft.OSG.DU.DeliveryOptClient.DownloadCompleted
This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads.
The following fields are available:
-- **background** Is the download a background download?
-- **bytesFromCDN** The number of bytes received from a CDN source.
-- **bytesFromGroupPeers** The number of bytes received from a peer in the same domain group.
+- **sessionID** The ID of the download session.
+- **scenarioID** The ID of the scenario.
- **bytesFromIntPeers** The number of bytes received from peers not in the same LAN or in the same domain group.
-- **bytesFromPeers** The number of bytes received from a peer in the same LAN.
-- **bytesRequested** The total number of bytes requested for download.
-- **cdnConnectionCount** The total number of connections made to the CDN.
-- **cdnErrorCodes** A list of CDN connection errors since the last FailureCDNCommunication event.
-- **cdnErrorCounts** The number of times each error in cdnErrorCodes was encountered.
-- **cdnIp** The IP address of the source CDN.
-- **clientTelId** A random number used for device sampling.
-- **doErrorCode** The Delivery Optimization error code that was returned.
-- **downlinkBps** The maximum measured available download bandwidth (in bytes per second).
-- **downlinkUsageBps** The download speed (in bytes per second).
-- **downloadMode** The download mode used for this file download session.
-- **fileID** The ID of the file being downloaded.
+- **updateID** The ID of the update being downloaded.
- **fileSize** The size of the file being downloaded.
+- **bytesFromCDN** The number of bytes received from a CDN source.
+- **fileID** The ID of the file being downloaded.
+- **background** Is the download a background download?
+- **bytesFromPeers** The number of bytes received from a peer in the same LAN.
+- **totalTime** How long did the download take (in seconds)?
+- **restrictedUpload** Is the upload restricted?
+- **clientTelId** A random number used for device sampling.
+- **bytesFromGroupPeers** The number of bytes received from a peer in the same domain group.
+- **downloadMode** The download mode used for this file download session.
+- **doErrorCode** The Delivery Optimization error code that was returned.
+- **numPeers** The total number of peers used for this download.
+- **cdnConnectionCount** The total number of connections made to the CDN.
+- **lanConnectionCount** The total number of connections made to peers in the same LAN.
- **groupConnectionCount** The total number of connections made to peers in the same group.
- **internetConnectionCount** The total number of connections made to peers not in the same LAN or the same group.
-- **lanConnectionCount** The total number of connections made to peers in the same LAN.
-- **numPeers** The total number of peers used for this download.
-- **restrictedUpload** Is the upload restricted?
-- **scenarioID** The ID of the scenario.
-- **sessionID** The ID of the download session.
-- **totalTimeMs** Duration of the download (in seconds).
-- **updateID** The ID of the update being downloaded.
+- **cdnIp** The IP address of the source CDN.
+- **downlinkBps** The maximum measured available download bandwidth (in bytes per second).
- **uplinkBps** The maximum measured available upload bandwidth (in bytes per second).
+- **downlinkUsageBps** The download speed (in bytes per second).
- **uplinkUsageBps** The upload speed (in bytes per second).
+- **totalTimeMs** Duration of the download (in seconds).
+- **cdnErrorCodes** A list of CDN connection errors since the last FailureCDNCommunication event.
+- **cdnErrorCounts** The number of times each error in cdnErrorCodes was encountered.
+- **bytesRequested** The total number of bytes requested for download.
- **experimentId** When running a test, this is used to correlate with other events that are part of the same test.
- **isVpn** Is the device connected to a Virtual Private Network?
- **usedMemoryStream** Did the download use memory streaming?
@@ -4011,54 +3929,16 @@ This event represents a temporary suspension of a download with Delivery Optimiz
The following fields are available:
-- **background** Is the download a background download?
-- **clientTelId** A random number used for device sampling.
-- **errorCode** The error code that was returned.
-- **fileID** The ID of the file being paused.
-- **reasonCode** The reason for pausing the download.
-- **scenarioID** The ID of the scenario.
-- **sessionID** The ID of the download session.
- **updateID** The ID of the update being paused.
-- **experimentId** When running a test, this is used to correlate with other events that are part of the same test.
-- **isVpn** Is the device connected to a Virtual Private Network?
-
-
-### Microsoft.OSG.DU.DeliveryOptClient.JobError
-
-This event represents a Windows Update job error. It allows for investigation of top errors.
-
-The following fields are available:
-
-- **clientTelId** A random number used for device sampling.
-- **errorCode** The error code returned.
-- **experimentId** When running a test, this is used to correlate with other events that are part of the same test.
-- **fileID** The ID of the file being downloaded.
-- **jobID** The Windows Update job ID.
-
-
-### Microsoft.OSG.DU.DeliveryOptClient.DownloadCanceled
-
-This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads.
-
-The following fields are available:
-
-- **background** Is the download being done in the background?
-- **bytesFromCDN** The number of bytes received from a CDN source.
-- **bytesFromGroupPeers** The number of bytes received from a peer in the same group.
-- **bytesFromIntPeers** The number of bytes received from peers not in the same LAN or in the same group.
-- **bytesFromPeers** The number of bytes received from a peer in the same LAN.
-- **cdnErrorCodes** A list of CDN connection errors since the last FailureCDNCommunication event.
-- **cdnErrorCounts** The number of times each error in cdnErrorCodes was encountered.
-- **clientTelId** A random number used for device sampling.
-- **doErrorCode** The Delivery Optimization error code that was returned.
- **errorCode** The error code that was returned.
-- **experimentId** When running a test, this is used to correlate events that are part of the same test.
-- **fileID** The ID of the file being downloaded.
-- **isVpn** Is the device connected to a Virtual Private Network?
- **scenarioID** The ID of the scenario.
-- **sessionID** The ID of the file download session.
-- **updateID** The ID of the update being downloaded.
-- **usedMemoryStream** Did the download use memory streaming?
+- **background** Is the download a background download?
+- **sessionID** The ID of the download session.
+- **clientTelId** A random number used for device sampling.
+- **reasonCode** The reason for pausing the download.
+- **fileID** The ID of the file being paused.
+- **experimentId** When running a test, this is used to correlate with other events that are part of the same test.
+- **isVpn** Is the device connected to a Virtual Private Network?
### Microsoft.OSG.DU.DeliveryOptClient.DownloadStarted
@@ -4067,29 +3947,29 @@ This event describes the start of a new download with Delivery Optimization. It'
The following fields are available:
-- **background** Is the download a background download?
-- **cdnUrl** The URL of the CDN.
-- **clientTelId** A random number used for device sampling.
-- **deviceProfile** Identifies the usage or form factor. Example: Desktop or Xbox
-- **diceRoll** The dice roll value used in sampling events.
-- **doClientVersion** The version of the Delivery Optimization client.
-- **doErrorCode** The Delivery Optimization error code that was returned.
-- **downloadMode** The download mode used for this file download session.
-- **errorCode** The error code that was returned.
- **experimentId** When running a test, this is used to correlate with other events that are part of the same test.
-- **fileID** The ID of the file being downloaded.
-- **filePath** The path where the file will be written.
-- **groupID** ID for the group.
-- **isVpn** Is the device connected to a Virtual Private Network?
-- **jobID** The ID of the Windows Update job.
-- **minDiskSizeGB** The minimum disk size (in GB) required for Peering.
-- **minDiskSizePolicyEnforced** Is the minimum disk size enforced via policy?
-- **minFileSizePolicy** The minimum content file size policy to allow the download using Peering.
+- **errorCode** The error code that was returned.
+- **doErrorCode** The Delivery Optimization error code that was returned.
- **peerID** The ID for this Delivery Optimization client.
-- **scenarioID** The ID of the scenario.
+- **doClientVersion** The version of the Delivery Optimization client.
+- **jobID** The ID of the Windows Update job.
- **sessionID** The ID of the download session.
- **updateID** The ID of the update being downloaded.
+- **scenarioID** The ID of the scenario.
+- **fileID** The ID of the file being downloaded.
+- **cdnUrl** The URL of the CDN.
+- **filePath** The path where the file will be written.
+- **groupID** ID for the group.
+- **background** Is the download a background download?
+- **downloadMode** The download mode used for this file download session.
+- **minFileSizePolicy** The minimum content file size policy to allow the download using Peering.
+- **diceRoll** The dice roll value used in sampling events.
+- **deviceProfile** Identifies the usage or form factor. Example: Desktop or Xbox
+- **isVpn** Is the device connected to a Virtual Private Network?
- **usedMemoryStream** Did the download use memory streaming?
+- **minDiskSizePolicyEnforced** Is the minimum disk size enforced via policy?
+- **minDiskSizeGB** The minimum disk size (in GB) required for Peering.
+- **clientTelId** A random number used for device sampling.
- **costFlags** A set of flags representing network cost.
@@ -4099,137 +3979,47 @@ This event represents a failure to download from a CDN with Delivery Optimizatio
The following fields are available:
-- **cdnIp** The IP address of the CDN.
-- **cdnUrl** The URL of the CDN.
-- **clientTelId** A random number used for device sampling.
-- **errorCode** The error code that was returned.
-- **errorCount** The total number of times this error code was seen since the last FailureCdnCommunication event was encountered.
-- **httpStatusCode** The HTTP status code returned by the CDN.
-- **sessionID** The ID of the download session.
-- **cdnHeaders** The HTTP headers returned by the CDN.
- **experimentId** When running a test, this is used to correlate with other events that are part of the same test.
- **fileID** The ID of the file being downloaded.
+- **errorCode** The error code that was returned.
+- **httpStatusCode** The HTTP status code returned by the CDN.
+- **errorCount** The total number of times this error code was seen since the last FailureCdnCommunication event was encountered.
+- **sessionID** The ID of the download session.
+- **cdnUrl** The URL of the CDN.
+- **cdnIp** The IP address of the CDN.
+- **cdnHeaders** The HTTP headers returned by the CDN.
+- **clientTelId** A random number used for device sampling.
- **isHeadRequest** The type of HTTP request that was sent to the CDN. Example: HEAD or GET
- **requestSize** The size of the range requested from the CDN.
- **responseSize** The size of the range response received from the CDN.
+### Microsoft.OSG.DU.DeliveryOptClient.JobError
+
+This event represents a Windows Update job error. It allows for investigation of top errors.
+
+The following fields are available:
+
+- **jobID** The Windows Update job ID.
+- **fileID** The ID of the file being downloaded.
+- **errorCode** The error code returned.
+- **clientTelId** A random number used for device sampling.
+- **experimentId** When running a test, this is used to correlate with other events that are part of the same test.
+
+
## Windows Update events
-### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentModeStart
-
-This event sends data for the start of each mode during the process of updating device manifest assets via the UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages.
-
-The following fields are available:
-
-- **flightId** The unique identifier for each flight
-- **mode** Indicates that the Update Agent mode that has started. 1 = Initialize, 2 = DownloadRequest, 3 = Install, 4 = Commit
-- **objectId** Unique value for each Update Agent mode
-- **relatedCV** Correlation vector value generated from the latest scan
-- **scenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate
-- **sessionId** Unique value for each Update Agent mode attempt
-- **updateId** Unique ID for each update
-
-
-### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentInitialize
-
-This event sends data for initializing a new update session for the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages
-
-The following fields are available:
-
-- **errorCode** The error code returned for the current initialize phase
-- **flightId** The unique identifier for each flight
-- **flightMetadata** Contains the FlightId and the build being flighted
-- **objectId** Unique value for each Update Agent mode
-- **relatedCV** Correlation vector value generated from the latest USO scan
-- **result** Result of the initialize phase of update. 0 = Succeeded, 1 = Failed, 2 = Cancelled, 3 = Blocked, 4 = BlockCancelled
-- **scenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate#N#
-- **sessionData** Contains instructions to update agent for processing FODs and DUICs (Null for other scenarios)
-- **sessionId** "Unique value for each Update Agent mode attempt "
-- **updateId** Unique ID for each update
-
-
-### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentCommit
-
-This event collects information regarding the final commit phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages
-
-The following fields are available:
-
-- **errorCode** The error code returned for the current session initialization
-- **flightId** The unique identifier for each flight
-- **objectId** The unique GUID for each diagnostics session
-- **relatedCV** A correlation vector value, generated from the latest USO scan
-- **result** Outcome of the initialization of the session
-- **scenarioId** Identifies the Update scenario
-- **sessionId** The unique value for each update session
-- **updateId** The unique identifier for each Update
-
-
-### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentInstall
-
-This event collects information regarding the install phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages
-
-The following fields are available:
-
-- **errorCode** The error code returned for the current install phase
-- **flightId** The unique identifier for each flight
-- **objectId** Unique value for each Update Agent mode
-- **relatedCV** Correlation vector value generated from the latest scan
-- **result** Result of the install phase of update. 0 = Succeeded 1 = Failed, 2 = Cancelled, 3 = Blocked, 4 = BlockCancelled
-- **scenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate
-- **sessionId** Unique value for each Update Agent mode attempt
-- **updateId** Unique ID for each update
-
-
-### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentDownloadRequest
-
-This event collects information regarding the download request phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages
-
-The following fields are available:
-
-- **deletedCorruptFiles** Indicates if UpdateAgent found any corrupt payload files and whether the payload was deleted
-- **errorCode** The error code returned for the current session initialization
-- **flightId** The unique identifier for each flight
-- **objectId** Unique value for each Update Agent mode
-- **packageCountOptional** Number of optional packages requested
-- **packageCountRequired** Number of required packages requested
-- **packageCountTotal** Total number of packages needed
-- **packageCountTotalCanonical** Total number of canonical packages
-- **packageCountTotalDiff** Total number of diff packages
-- **packageCountTotalExpress** Total number of express packages
-- **packageSizeCanonical** Size of canonical packages in bytes
-- **packageSizeDiff** Size of diff packages in bytes
-- **packageSizeExpress** Size of express packages in bytes
-- **rangeRequestState** Represents the state of the download range request
-- **relatedCV** Correlation vector value generated from the latest USO scan
-- **result** Result of the download request phase of update
-- **scenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate
-- **sessionId** Unique value for each Update Agent mode attempt
-- **updateId** Unique ID for each update
-
-
-### Microsoft.Windows.Update.Orchestrator.GameActive
-
-This event indicates that an enabled GameMode process prevented the device from restarting to complete an update
-
-The following fields are available:
-
-- **eventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed
-- **gameModeReason** Name of the enabled GameMode process that prevented the device from restarting to complete an update
-- **wuDeviceid** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue
-
-
### Microsoft.Windows.Update.DataMigrationFramework.DmfMigrationCompleted
This event sends data collected at the end of the Data Migration Framework (DMF) and parameters involved in its invocation, to help keep Windows up to date.
The following fields are available:
-- **MigrationDurationInMilliseconds** How long the DMF migration took (in milliseconds)
-- **MigrationEndTime** A system timestamp of when the DMF migration completed.
-- **RevisionNumbers** A collection of revision numbers for the updates associated with the DMF session.
+- **MigrationEndtime** A system timestamp of when the DMF migration completed.
- **UpdateIds** A collection of GUIDs for updates that are associated with the DMF session.
-- **WuClientId** The GUID of the Windows Update client responsible for triggering the DMF migration
+- **WuClientid** The GUID of the Windows Update client responsible for triggering the DMF migration.
+- **MigrationDurationinmilliseconds** How long the DMF migration took (in milliseconds).
+- **RevisionNumbers** A collection of revision numbers for the updates associated with the DMF session.
### Microsoft.Windows.Update.DataMigrationFramework.DmfMigrationStarted
@@ -4238,12 +4028,12 @@ This event sends data collected at the beginning of the Data Migration Framework
The following fields are available:
-- **MigrationMicrosoftPhases** Revision numbers for the updates that were installed.
-- **MigrationOEMPhases** WU Update IDs for the updates that were installed.
-- **MigrationStartTime** The timestamp representing the beginning of the DMF migration
-- **WuClientId** The GUID of the Windows Update client invoking DMF
-- **RevisionNumbers** A collection of the revision numbers associated with the UpdateIds.
- **UpdateIds** A collection of GUIDs identifying the upgrades that are running.
+- **MigrationStarttime** The timestamp representing the beginning of the DMF migration.
+- **MigrationOEMphases** The number of OEM-authored migrators scheduled to be ran by DMF for this upgrade.
+- **WuClientid** The GUID of the Windows Update client invoking DMF.
+- **MigrationMicrosoftphases** The number of Microsoft-authored migrators scheduled to be ran by DMF for this upgrade.
+- **RevisionNumbers** A collection of the revision numbers associated with the UpdateIds.
### Microsoft.Windows.Update.DataMigrationFramework.MigratorResult
@@ -4252,127 +4042,23 @@ This event sends DMF migrator data to help keep Windows up to date.
The following fields are available:
-- **CurrentStep** This is the last step the migrator reported before returning a result. This tells us how far through the individual migrator the device was before failure.
-- **ErrorCode** The result (as an HRESULT) of the migrator that just completed.
-- **MigratorId** A GUID identifying the migrator that just completed.
-- **MigratorName** The name of the migrator that just completed.
+- **MigratorGuid** A GUID identifying the migrator that just completed.
- **RunDurationInSeconds** The time it took for the migrator to complete.
+- **CurrentStep** This is the last step the migrator reported before returning a result. This tells us how far through the individual migrator the device was before failure.
+- **MigratorName** The name of the migrator that just completed.
+- **MigratorId** A GUID identifying the migrator that just completed.
+- **ErrorCode** The result (as an HRESULT) of the migrator that just completed.
- **TotalSteps** Migrators report progress in number of completed steps against the total steps. This is the total number of steps.
-### Microsoft.Windows.Update.Orchestrator.Download
+### Microsoft.Windows.Update.Orchestrator.CommitFailed
-This event sends launch data for a Windows Update download to help keep Windows up to date.
+This events tracks when a device needs to restart after an update but did not.
The following fields are available:
-- **deferReason** Reason for download not completing
-- **detectionDeferreason** Reason for download not completing
-- **errorCode** An error code represented as a hexadecimal value
-- **eventScenario** End to end update session ID.
-- **flightID** Unique update ID.
-- **interactive** Identifies if session is user initiated.
-- **revisionNumber** Update revision number.
-- **updateId** Update ID.
-- **updateScenarioType** The update session type.
-- **wuDeviceid** Unique device ID used by Windows Update.
-
-
-### Microsoft.Windows.Update.Orchestrator.FlightInapplicable
-
-This event sends data on whether the update was applicable to the device, to help keep Windows up to date.
-
-The following fields are available:
-
-- **EventPublishedTime** time that the event was generated
-- **revisionNumber** Revision Number of the Update
-- **updateId** Unique Update ID
-- **UpdateStatus** Integer that describes Update state
-- **wuDeviceid** Unique Device ID
-- **flightID** Unique Update ID
-- **updateScenarioType** The update session type.
-
-
-### Microsoft.Windows.Update.Orchestrator.PostInstall
-
-This event sends data about lite stack devices (mobile, IOT, anything non-PC) immediately before data migration is launched to help keep Windows up to date.
-
-The following fields are available:
-
-- **batteryLevel** Current battery capacity in mWh or percentage left.
-- **bundleId** Update grouping ID.
-- **bundleRevisionnumber** Bundle revision number.
-- **errorCode** Hex code for the error message, to allow lookup of the specific error.
-- **eventScenario** End to end update session ID.
-- **flightID** Unique update ID.
-- **sessionType** Interactive vs. Background.
-- **wuDeviceid** Unique device ID used by Windows Update.
-
-
-### Microsoft.Windows.Update.Orchestrator.RebootFailed
-
-This event sends information about whether an update required a reboot and reasons for failure to help keep Windows up to date.
-
-The following fields are available:
-
-- **batteryLevel** Current battery capacity in mWh or percentage left.
-- **deferReason** Reason for install not completing.
-- **EventPublishedTime** The time that the reboot failure occurred.
-- **flightID** Unique update ID.
-- **installRebootDeferreason** Reason for reboot not occurring.
-- **rebootOutsideOfActiveHours** Indicates the timing that the reboot was to occur to ensure the correct update process and experience is provided to keep Windows up to date.
-- **RebootResults** Hex code indicating failure reason. Typically, we expect this to be a specific USO generated hex code.
-- **revisionNumber** Update revision number.
-- **updateId** Update ID.
-- **updateScenarioType** The update session type.
-- **uxRebootstate** Indicates the exact state of the user experience at the time the required reboot was initiated to ensure the correct update process and experience is provided to keep Windows up to date.
-- **wuDeviceid** Unique device ID used by Windows Update.
-
-
-### Microsoft.Windows.Update.Orchestrator.UpdatePolicyCacheRefresh
-
-This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows up to date.
-
-The following fields are available:
-
-- **configuredPoliciescount** Policy Count
-- **policiesNamevaluesource** Policy Name
-- **policyCacherefreshtime** Refresh time
-- **updateInstalluxsetting** This shows whether a user has set policies via UX option
-- **wuDeviceid** Unique device ID used by Windows Update.
-
-
-### Microsoft.Windows.Update.Orchestrator.UpdateRebootRequired
-
-This event sends data about whether an update required a reboot to help keep Windows up to date.
-
-The following fields are available:
-
-- **revisionNumber** Update revision number.
-- **updateId** Update ID.
-- **wuDeviceid** Unique device ID used by Windows Update.
-- **flightID** Unique update ID.
-- **interactive** Indicates the reboot initiation stage of the update process was entered as a result of user action or not.
-- **uxRebootstate** Indicates the exact state of the user experience at the time the required reboot was initiated to ensure the correct update process and experience is provided to keep Windows up to date.
-- **updateScenarioType** The update session type.
-
-
-### Microsoft.Windows.Update.Ux.MusNotification.RebootScheduled
-
-This event sends data about a required reboot that is scheduled with no user interaction, to help keep Windows up to date.
-
-The following fields are available:
-
-- **activeHoursApplicable** True, If Active Hours applicable on this device. False, otherwise.
-- **forcedReboot** True, if a reboot is forced on the device. Otherwise, this is False
-- **rebootArgument** Argument for the reboot task. It also represents specific reboot related action.
-- **rebootOutsideOfActiveHours** True, if a reboot is scheduled outside of active hours. False, otherwise.
-- **rebootScheduledByUser** True, if a reboot is scheduled by user. False, if a reboot is scheduled automatically.
-- **revisionNumber** Revision number of the update that is getting installed with this reboot.
-- **scheduledRebootTime** Time of the scheduled reboot
-- **updateId** Update ID of the update that is getting installed with this reboot.
-- **wuDeviceid** Unique device ID used by Windows Update.
-- **rebootState** The state of the reboot.
+- **wuDeviceid** The Windows Update device GUID.
+- **errorCode** The error code that was returned.
### Microsoft.Windows.Update.Orchestrator.Detection
@@ -4381,17 +4067,50 @@ This event sends launch data for a Windows Update scan to help keep Windows up t
The following fields are available:
+- **wuDeviceid** Unique device ID used by Windows Update.
+- **revisionNumber** Update revision number.
+- **eventScenario** End to end update session ID, or indicates the purpose of sending this event - whether because the software distribution just started installing content, or whether it was cancelled, succeeded, or failed.
- **deferReason** Reason why the device could not check for updates.
- **detectionBlockreason** Reason for detection not completing.
-- **detectionDeferreason** A log of deferral reasons for every update state.
-- **errorCode** The returned error code.
-- **eventScenario** End to end update session ID, or indicates the purpose of sending this event - whether because the software distribution just started installing content, or whether it was cancelled, succeeded, or failed.
-- **flightID** A unique update ID.
- **interactive** Identifies if session is User Initiated.
-- **revisionNumber** Update revision number.
- **updateId** Update ID.
+- **detectionDeferreason** A log of deferral reasons for every update state.
+- **flightID** A unique update ID.
- **updateScenarioType** The update session type.
+- **errorCode** The returned error code.
+
+
+### Microsoft.Windows.Update.Orchestrator.Download
+
+This event sends launch data for a Windows Update download to help keep Windows up to date.
+
+The following fields are available:
+
+- **detectionDeferreason** Reason for download not completing
- **wuDeviceid** Unique device ID used by Windows Update.
+- **interactive** Identifies if session is user initiated.
+- **revisionNumber** Update revision number.
+- **deferReason** Reason for download not completing
+- **updateId** Update ID.
+- **eventScenario** End to end update session ID.
+- **errorCode** An error code represented as a hexadecimal value
+- **flightID** Unique update ID.
+- **updateScenarioType** The update session type.
+
+
+### Microsoft.Windows.Update.Orchestrator.FlightInapplicable
+
+This event sends data on whether the update was applicable to the device, to help keep Windows up to date.
+
+The following fields are available:
+
+- **updateId** Unique Update ID
+- **revisionNumber** Revision Number of the Update
+- **UpdateStatus** Integer that describes Update state
+- **EventPublishedTime** time that the event was generated
+- **wuDeviceid** Unique Device ID
+- **flightID** Unique Update ID
+- **updateScenarioType** The update session type.
### Microsoft.Windows.Update.Orchestrator.InitiatingReboot
@@ -4400,8 +4119,8 @@ This event sends data about an Orchestrator requesting a reboot from power manag
The following fields are available:
-- **EventPublishedTime** Time of the event.
- **revisionNumber** Revision number of the update.
+- **EventPublishedTime** Time of the event.
- **updateId** Update ID.
- **wuDeviceid** Unique device ID used by Windows Update.
- **flightID** Unique update ID
@@ -4411,22 +4130,141 @@ The following fields are available:
- **updateScenarioType** The update session type.
-### Microsoft.Windows.Update.Ux.MusUpdateSettings.RebootScheduled
+### Microsoft.Windows.Update.Orchestrator.Install
-This event sends basic information for scheduling a device restart to install security updates. It's used to help keep Windows up-to-date.
+This event sends launch data for a Windows Update install to help keep Windows up to date.
The following fields are available:
-- **activeHoursApplicable** Is the restart respecting Active Hours?
-- **rebootArgument** The arguments that are passed to the OS for the restarted.
-- **rebootOutsideOfActiveHours** Was the restart scheduled outside of Active Hours?
-- **rebootScheduledByUser** Was the restart scheduled by the user? If the value is false, the restart was scheduled by the device.
-- **rebootState** The state of the restart.
-- **revisionNumber** The revision number of the OS being updated.
-- **scheduledRebootTime** Time of the scheduled reboot
-- **updateId** The Windows Update device GUID.
-- **wuDeviceid** The Windows Update device GUID.
-- **forcedReboot** True, if a reboot is forced on the device. Otherwise, this is False
+- **eventScenario** End to end update session ID.
+- **deferReason** Reason for install not completing.
+- **interactive** Identifies if session is user initiated.
+- **wuDeviceid** Unique device ID used by Windows Update.
+- **batteryLevel** Current battery capacity in mWh or percentage left.
+- **installCommitfailedtime** The time it took for a reboot to happen but the upgrade failed to progress.
+- **errorCode** The error code reppresented by a hexadecimal value.
+- **updateId** Update ID.
+- **revisionNumber** Update revision number.
+- **flightID** Unique update ID
+- **installRebootinitiatetime** The time it took for a reboot to be attempted.
+- **flightUpdate** Flight update
+- **minutesToCommit** The time it took to install updates.
+- **ForcedRebootReminderSet** A boolean value that indicates if a forced reboot will happen for updates.
+- **rebootOutsideOfActiveHours** Indicates the timing that the reboot was to occur to ensure the correct update process and experience is provided to keep Windows up to date.
+- **uxRebootstate** Indicates the exact state of the user experience at the time the required reboot was initiated to ensure the correct update process and experience is provided to keep Windows up to date.
+- **updateScenarioType** The update session type.
+
+
+### Microsoft.Windows.Update.Orchestrator.PostInstall
+
+This event sends data about lite stack devices (mobile, IOT, anything non-PC) immediately before data migration is launched to help keep Windows up to date.
+
+The following fields are available:
+
+- **wuDeviceid** Unique device ID used by Windows Update.
+- **eventScenario** End to end update session ID.
+- **sessionType** Interactive vs. Background.
+- **bundleRevisionnumber** Bundle revision number.
+- **batteryLevel** Current battery capacity in mWh or percentage left.
+- **bundleId** Update grouping ID.
+- **errorCode** Hex code for the error message, to allow lookup of the specific error.
+- **flightID** Unique update ID.
+
+
+### Microsoft.Windows.Update.Orchestrator.RebootFailed
+
+This event sends information about whether an update required a reboot and reasons for failure to help keep Windows up to date.
+
+The following fields are available:
+
+- **updateId** Update ID.
+- **batteryLevel** Current battery capacity in mWh or percentage left.
+- **RebootResults** Hex code indicating failure reason. Typically, we expect this to be a specific USO generated hex code.
+- **installRebootDeferreason** Reason for reboot not occurring.
+- **revisionNumber** Update revision number.
+- **EventPublishedTime** The time that the reboot failure occurred.
+- **deferReason** Reason for install not completing.
+- **wuDeviceid** Unique device ID used by Windows Update.
+- **flightID** Unique update ID.
+- **rebootOutsideOfActiveHours** Indicates the timing that the reboot was to occur to ensure the correct update process and experience is provided to keep Windows up to date.
+- **uxRebootstate** Indicates the exact state of the user experience at the time the required reboot was initiated to ensure the correct update process and experience is provided to keep Windows up to date.
+- **updateScenarioType** The update session type.
+
+
+### Microsoft.Windows.Update.Orchestrator.RestoreRebootTask
+
+This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows up to date.
+
+The following fields are available:
+
+- **RebootTaskRestoredTime** Time at which this reboot task was restored.
+- **wuDeviceid** Device id on which the reboot is restored
+- **revisionNumber** Update revision number.
+- **updateId** Update ID.
+
+
+### Microsoft.Windows.Update.Orchestrator.SystemNeeded
+
+This event sends data about why a device is unable to reboot, to help keep Windows up to date.
+
+The following fields are available:
+
+- **eventScenario** End to end update session ID.
+- **wuDeviceid** Unique device ID used by Windows Update.
+- **systemNeededReason** Reason ID
+- **updateId** Update ID.
+- **revisionNumber** Update revision number.
+- **rebootOutsideOfActiveHours** Indicates the timing that the reboot was to occur to ensure the correct update process and experience is provided to keep Windows up to date.
+- **uxRebootstate** Indicates the exact state of the user experience at the time the required reboot was initiated to ensure the correct update process and experience is provided to keep Windows up to date.
+- **updateScenarioType** The update session type.
+
+
+### Microsoft.Windows.Update.Orchestrator.UpdatePolicyCacheRefresh
+
+This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows up to date.
+
+The following fields are available:
+
+- **wuDeviceid** Unique device ID used by Windows Update.
+- **policyCacherefreshtime** Refresh time
+- **policiesNamevaluesource** Policy Name
+- **updateInstalluxsetting** This shows whether a user has set policies via UX option
+- **configuredPoliciescount** Policy Count
+
+
+### Microsoft.Windows.Update.Orchestrator.UpdateRebootRequired
+
+This event sends data about whether an update required a reboot to help keep Windows up to date.
+
+The following fields are available:
+
+- **updateId** Update ID.
+- **revisionNumber** Update revision number.
+- **wuDeviceid** Unique device ID used by Windows Update.
+- **flightID** Unique update ID.
+- **interactive** Indicates the reboot initiation stage of the update process was entered as a result of user action or not.
+- **uxRebootstate** Indicates the exact state of the user experience at the time the required reboot was initiated to ensure the correct update process and experience is provided to keep Windows up to date.
+- **updateScenarioType** The update session type.
+
+
+### Microsoft.Windows.Update.UpdateStackServicing.CheckForUpdates
+
+This event sends data about the UpdateStackServicing check for updates, to help keep Windows up to date.
+
+The following fields are available:
+
+- **EventScenario** The scenario of the event. Example: Started, Failed, or Succeeded
+- **StatusCode** The HRESULT code of the operation.
+- **CallerApplicationName** The name of the USS scheduled task. Example UssScheduled or UssBoot
+- **ClientVersion** The version of the client.
+- **EventInstanceID** The USS session ID.
+- **WUDeviceID** The Windows Update device ID.
+- **ServiceGuid** The GUID of the service.
+- **BspVersion** The version of the BSP.
+- **OemName** The name of the manufacturer.
+- **DeviceName** The name of the device.
+- **CommercializationOperator** The name of the operator.
+- **DetectionVersion** The string returned from the GetDetectionVersion export of the downloaded detection DLL.
### Microsoft.Windows.Update.Ux.MusNotification.RebootNoLongerNeeded
@@ -4438,6 +4276,24 @@ The following fields are available:
- **UtcTime** The Coordinated Universal Time that the restart was no longer needed.
+### Microsoft.Windows.Update.Ux.MusNotification.RebootScheduled
+
+This event sends data about a required reboot that is scheduled with no user interaction, to help keep Windows up to date.
+
+The following fields are available:
+
+- **updateId** Update ID of the update that is getting installed with this reboot.
+- **ScheduledRebootTime** Time of the scheduled reboot.
+- **wuDeviceid** Unique device ID used by Windows Update.
+- **revisionNumber** Revision number of the update that is getting installed with this reboot.
+- **forcedreboot** True, if a reboot is forced on the device. False, otherwise.
+- **rebootArgument** Argument for the reboot task. It also represents specific reboot related action.
+- **rebootScheduledByUser** True, if a reboot is scheduled by user. False, if a reboot is scheduled automatically.
+- **activeHoursApplicable** True, If Active Hours applicable on this device. False, otherwise.
+- **rebootOutsideOfActiveHours** True, if a reboot is scheduled outside of active hours. False, otherwise.
+- **rebootState** The state of the reboot.
+
+
### Microsoft.Windows.Update.Ux.MusNotification.ToastDisplayedToScheduleReboot
This event is sent when a toast notification is shown to the user about scheduling a device restart.
@@ -4447,139 +4303,29 @@ The following fields are available:
- **UtcTime** The Coordinated Universal Time when the toast notification was shown.
-### Microsoft.Windows.Update.Orchestrator.RestoreRebootTask
+### Microsoft.Windows.Update.Ux.MusUpdateSettings.RebootScheduled
-This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows up to date.
+This event sends basic information for scheduling a device restart to install security updates. It's used to help keep Windows up-to-date.
The following fields are available:
-- **RebootTaskRestoredTime** Time at which this reboot task was restored.
-- **revisionNumber** Update revision number.
-- **updateId** Update ID.
-- **wuDeviceid** Device id on which the reboot is restored
-
-
-### Microsoft.Windows.Update.Orchestrator.SystemNeeded
-
-This event sends data about why a device is unable to reboot, to help keep Windows up to date.
-
-The following fields are available:
-
-- **eventScenario** End to end update session ID.
-- **revisionNumber** Update revision number.
-- **systemNeededReason** Reason ID
-- **updateId** Update ID.
-- **wuDeviceid** Unique device ID used by Windows Update.
-- **rebootOutsideOfActiveHours** Indicates the timing that the reboot was to occur to ensure the correct update process and experience is provided to keep Windows up to date.
-- **uxRebootstate** Indicates the exact state of the user experience at the time the required reboot was initiated to ensure the correct update process and experience is provided to keep Windows up to date.
-- **updateScenarioType** The update session type.
-
-
-### Microsoft.Windows.Update.UpdateStackServicing.CheckForUpdates
-
-This event sends data about the UpdateStackServicing check for updates, to help keep Windows up to date.
-
-The following fields are available:
-
-- **BspVersion** The version of the BSP.
-- **CallerApplicationName** The name of the USS scheduled task. Example UssScheduled or UssBoot
-- **ClientVersion** The version of the client.
-- **CommercializationOperator** The name of the operator.
-- **DetectionVersion** The string returned from the GetDetectionVersion export of the downloaded detection DLL.
-- **DeviceName** The name of the device.
-- **EventInstanceID** The USS session ID.
-- **EventScenario** The scenario of the event. Example: Started, Failed, or Succeeded
-- **OemName** The name of the manufacturer.
-- **ServiceGuid** The GUID of the service.
-- **StatusCode** The HRESULT code of the operation.
-- **WUDeviceID** The Windows Update device ID.
-
-
-### Microsoft.Windows.Update.Orchestrator.CommitFailed
-
-This events tracks when a device needs to restart after an update but did not.
-
-The following fields are available:
-
-- **errorCode** The error code that was returned.
+- **ScheduledRebootTime** The time that the device was restarted.
+- **updateId** The Windows Update device GUID.
+- **revisionNumber** The revision number of the OS being updated.
- **wuDeviceid** The Windows Update device GUID.
+- **forcedreboot** Is the restart that's being scheduled a forced restart?
+- **rebootArgument** The arguments that are passed to the OS for the restarted.
+- **rebootScheduledByUser** Was the restart scheduled by the user? If the value is false, the restart was scheduled by the device.
+- **activeHoursApplicable** Is the restart respecting Active Hours?
+- **rebootOutsideOfActiveHours** Was the restart scheduled outside of Active Hours?
+- **rebootState** The state of the restart.
-### Microsoft.Windows.Update.Orchestrator.Install
+## Winlogon events
-This event sends launch data for a Windows Update install to help keep Windows up to date.
+### Microsoft.Windows.Security.Winlogon.SetupCompleteLogon
-The following fields are available:
-
-- **batteryLevel** Current battery capacity in mWh or percentage left.
-- **deferReason** Reason for install not completing.
-- **eventScenario** End to end update session ID.
-- **interactive** Identifies if session is user initiated.
-- **wuDeviceid** Unique device ID used by Windows Update.
-- **flightUpdate** Flight update
-- **installRebootinitiatetime** The time it took for a reboot to be attempted.
-- **minutesToCommit** The time it took to install updates.
-- **revisionNumber** Update revision number.
-- **updateId** Update ID.
-- **errorCode** The error code reppresented by a hexadecimal value.
-- **installCommitfailedtime** The time it took for a reboot to happen but the upgrade failed to progress.
-- **flightID** Unique update ID
-- **ForcedRebootReminderSet** A boolean value that indicates if a forced reboot will happen for updates.
-- **rebootOutsideOfActiveHours** Indicates the timing that the reboot was to occur to ensure the correct update process and experience is provided to keep Windows up to date.
-- **uxRebootstate** Indicates the exact state of the user experience at the time the required reboot was initiated to ensure the correct update process and experience is provided to keep Windows up to date.
-- **updateScenarioType** The update session type.
+This event signals the completion of the setup process. It happens only once during the first logon.
-### Microsoft.Windows.Update.Orchestrator.PreShutdownStart
-This event is generated right before the shutdown and commit operations
-
-The following fields are available:
-
-- **wuDeviceid** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue
-
-
-### Microsoft.Windows.Update.Orchestrator.DeferRestart
-
-This event indicates that a restart required for installing updates was postponed
-
-The following fields are available:
-
-- **filteredDeferReason** Indicates the raised, but ignorable, reasons that the USO didn't restart (for example, user active or low battery)
-- **raisedDeferReason** Indicates the reason that the USO didn't restart. For example, user active or low battery
-- **wuDeviceid** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue
-- **eventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed
-
-
-### Microsoft.Windows.Update.Orchestrator.DisplayNeeded
-
-Reboot postponed due to needing a display
-
-The following fields are available:
-
-- **displayNeededReason** Reason the display is needed
-- **eventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed
-- **rebootOutsideOfActiveHours** Indicates the timing that the reboot was to occur to ensure the correct update process and experience is provided to keep Windows up to date
-- **revisionNumber** Revision number of the update
-- **updateId** Update ID
-- **updateScenarioType** The update session type
-- **uxRebootstate** Indicates the exact state of the user experience at the time the required reboot was initiated to ensure the correct update process and experience is provided to keep Windows up to date
-- **wuDeviceid** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue
-
-
-### Microsoft.Windows.Update.NotificationUx.RebootScheduled
-
-Indicates when a reboot is scheduled by the system or a user for a security, quality, or feature update
-
-The following fields are available:
-
-- **activeHoursApplicable** True, If Active Hours applicable on this device. False, otherwise
-- **rebootArgument** Argument for the reboot task. It also represents specific reboot related action
-- **rebootOutsideOfActiveHours** True, if a reboot is scheduled outside of active hours. False, otherwise
-- **rebootScheduledByUser** True, if a reboot is scheduled by user. False, if a reboot is scheduled automatically
-- **rebootState** The state of the reboot
-- **revisionNumber** Revision number of the update that is getting installed with this reboot
-- **scheduledRebootTime** Time of the scheduled reboot
-- **updateId** ID of the update that is getting installed with this reboot
-- **wuDeviceid** Unique device ID used by Windows Update
-- **scheduledRebootTimeInUTC** Time of the scheduled reboot in Coordinated Universal Time
\ No newline at end of file
diff --git a/windows/configuration/basic-level-windows-diagnostic-events-and-fields.md b/windows/configuration/basic-level-windows-diagnostic-events-and-fields.md
index cb11a4d0d9..7db5063374 100644
--- a/windows/configuration/basic-level-windows-diagnostic-events-and-fields.md
+++ b/windows/configuration/basic-level-windows-diagnostic-events-and-fields.md
@@ -1,37 +1,47 @@
---
description: Use this article to learn more about what Windows diagnostic data is gathered at the basic level.
-title: Windows 10, version 1703 basic diagnostic events and fields (Windows 10)
-keywords: privacy, telemetry
+title: Windows 10, version 1709 basic diagnostic events and fields (Windows 10)
+keywords: privacy, diagnostic data
ms.prod: w10
ms.mktglfcycl: manage
ms.sitesec: library
ms.pagetype: security
-ms.localizationpriority: high
+localizationpriority: high
author: eross-msft
ms.author: lizross
+ms.date: 10/26/2017
---
-# Windows 10, version 1703 basic level Windows diagnostic events and fields
+# Windows 10, version 1709 basic level Windows diagnostic events and fields
+
**Applies to**
-- Windows 10, version 1703 and later
+- Windows 10, version 1709
-The Basic level gathers a limited set of information that is critical for understanding the device and its configuration including: basic device information, quality-related information, app compatibility, and Microsoft Store. When the level is set to Basic, it also includes the Security level information. The Basic level also helps to identify problems that can occur on a particular device hardware or software configuration. For example, it can help determine if crashes are more frequent on devices with a specific amount of memory or that are running a particular driver version. This helps Microsoft fix operating system or app problems.
-Use this article to learn about diagnostic events, grouped by event area, and the fields within each event. A brief description is provided for each field. Every event generated includes common data, which collects device data. You can learn more about Windows functional and diagnostic data through these articles:
+The Basic level gathers a limited set of information that is critical for understanding the device and its configuration including: basic device information, quality-related information, app compatibility, and Windows Store. When the level is set to Basic, it also includes the Security level information.
+The Basic level helps to identify problems that can occur on a particular device hardware or software configuration. For example, it can help determine if crashes are more frequent on devices with a specific amount of memory or that are running a particular driver version. This helps Microsoft fix operating system or app problems.
+
+Use this article to learn about diagnostic events, grouped by event area, and the fields within each event. A brief description is provided for each field. Every event generated includes common data, which collects device data.
+
+You can learn more about Windows functional and diagnostic data through these articles:
+
+
+- [Windows 10, version 1703 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md)
- [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md)
-- [Configure Windows telemetry in your organization](configure-windows-telemetry-in-your-organization.md)
+- [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md)
->[!Note]
->Updated July 2017 to document new and modified events. We’ve added new fields to several Appraiser events to prepare for upgrades to the next release of Windows and we’ve added a brand-new event, Census.Speech, to collect basic details about speech settings and configuration.
-## Common data extensions
+
+# Common data extensions
### Common Data Extensions.App
+
+
The following fields are available:
- **expId** Associates a flight, such as an OS flight, or an experiment, such as a web site UX experiment, with an event.
@@ -42,6 +52,8 @@ The following fields are available:
### Common Data Extensions.CS
+
+
The following fields are available:
- **sig** A common schema signature that identifies new and modified event schemas.
@@ -49,6 +61,8 @@ The following fields are available:
### Common Data Extensions.CUET
+
+
The following fields are available:
- **stId** Represents the Scenario Entry Point ID. This is a unique GUID for each event in a diagnostic scenario. This used to be Scenario Trigger ID.
@@ -92,7 +106,7 @@ The following fields are available:
- **osVer** Represents the OS version, and its format is OS dependent.
- **appId** Represents a unique identifier of the client application currently loaded in the process producing the event; and is used to group events together and understand usage pattern, errors by application.
- **appVer** Represents the version number of the application. Used to understand errors by Version, Usage by Version across an app.
-- **cV** Represents the Correlation Vector: A single field for tracking partial order of related telemetry events across component boundaries.
+- **cV** Represents the Correlation Vector: A single field for tracking partial order of related diagnostic data events across component boundaries.
### Common Data Extensions.OS
@@ -134,7 +148,7 @@ The following fields are available:
### Common Data Extensions.Consent UI Event
-This User Account Control (UAC) telemetry point collects information on elevations that originate from low integrity levels. This occurs when a process running at low integrity level (IL) requires higher (administrator) privileges, and therefore requests for elevation via UAC (consent.exe). By better understanding the processes requesting these elevations, Microsoft can in turn improve the detection and handling of potentially malicious behavior in this path.
+This User Account Control (UAC) diagnostic data point collects information on elevations that originate from low integrity levels. This occurs when a process running at low integrity level (IL) requires higher (administrator) privileges, and therefore requests for elevation via UAC (consent.exe). By better understanding the processes requesting these elevations, Microsoft can in turn improve the detection and handling of potentially malicious behavior in this path.
The following fields are available:
@@ -239,291 +253,84 @@ The following fields are available:
## Appraiser events
-### Microsoft.Windows.Appraiser.General.ChecksumTotalPictureCount
+### Microsoft.Windows.Appraiser.General.RunContext
-This event lists the types of objects and how many of each exist on the client device. This allows for a quick way to ensure that the records present on the server match what is present on the client.
+"This event indicates what should be expected in the data payload. "
The following fields are available:
-- **DatasourceApplicationFile_RS3** The total DecisionApplicationFile objects targeting the next release of Windows on this device. on this device.
-- **DatasourceDevicePnp_RS3** The total DatasourceDevicePnp objects targeting the next release of Windows on this device.
-- **DatasourceDriverPackage_RS3** The total DatasourceDriverPackage objects targeting the next release of Windows on this device.
-- **DataSourceMatchingInfoBlock_RS3** The total DataSourceMatchingInfoBlock objects targeting the next release of Windows on this device.
-- **DataSourceMatchingInfoPassive_RS3** The total DataSourceMatchingInfoPassive objects targeting the next release of Windows on this device.
-- **DataSourceMatchingInfoPostUpgrade_RS3** The total DataSourceMatchingInfoPostUpgrade objects targeting the next release of Windows on this device.
-- **DatasourceSystemBios_RS3** The total DatasourceSystemBios objects targeting the next release of Windows on this device.
-- **DecisionApplicationFile_RS3** The total DecisionApplicationFile objects targeting the next release of Windows on this device.
-- **DecisionDevicePnp_RS3** The total DecisionDevicePnp objects targeting the next release of Windows on this device.
-- **DecisionDriverPackage_RS3** The total DecisionDriverPackage objects targeting the next release of Windows on this device.
-- **DecisionMatchingInfoBlock_RS3** The total DecisionMatchingInfoBlock objects targeting the next release of Windows on this device.
-- **DecisionMatchingInfoPassive_RS3** The total DataSourceMatchingInfoPostUpgrade objects targeting the next release of Windows on this device.
-- **DecisionMatchingInfoPostUpgrade_RS3** The total DecisionMatchingInfoPostUpgrade objects targeting the next release of Windows on this device.
-- **DecisionMediaCenter_RS3** The total DecisionMediaCenter objects targeting the next release of Windows on this device.
-- **DecisionSystemBios_RS3** The total DecisionSystemBios objects targeting the next release of Windows on this device.
-- **PCFP** An ID for the system that is calculated by hashing hardware identifiers.
-- **InventoryApplicationFile** The total InventoryApplicationFile objects that are present on this device.
-- **InventoryMediaCenter** The total InventoryMediaCenter objects that are present on this device.
-- **InventoryLanguagePack** The total InventoryLanguagePack objects that are present on this device.
-- **InventoryUplevelDriverPackage** The total InventoryUplevelDriverPackage objects that are present on this device.
-- **InventorySystemBios** The total InventorySystemBios objects that are present on this device.
-- **SystemProcessorCompareExchange** The total SystemProcessorCompareExchange objects that are present on this device.
-- **SystemProcessorLahfSahf** The total SystemProcessorLahfSahf objects that are present on this device.
-- **SystemMemory** The total SystemMemory objects that are present on this device.
-- **SystemProcessorPrefetchW** The total SystemProcessorPrefetchW objects that are present on this device.
-- **SystemProcessorSse2** The total SystemProcessorSse2 objects that are present on this device.
-- **SystemProcessorNx** The total SystemProcessorNx objects that are present on this device.
-- **SystemWlan** The total SystemWlan objects that are present on this device.
-- **SystemWim** The total SystemWim objects that are present on this device
-- **SystemTouch** The total SystemTouch objects that are present on this device.
-- **SystemWindowsActivationStatus** The total SystemWindowsActivationStatus objects that are present on this device.
-- **Wmdrm_RS3** The total Wmdrm objects targeting the next release of Windows on this device.
+- **AppraiserBranch** The source branch in which the currently running version of Appraiser was built.
+- **AppraiserProcess** The name of the process that launched Appraiser.
+- **AppraiserVersion** The version of the Appraiser file generating the events.
+- **Context** Indicates what mode Appraiser is running in. Example: Setup or Diagnostic Data.
+- **PCFP** An ID for the system calculated by hashing hardware identifiers.
+- **Time** The client time of the event.
-### Microsoft.Windows.Appraiser.General.ChecksumTotalPictureIdHashSha256
+### Microsoft.Windows.Appraiser.General.TelemetryRunHealth
-This event lists the types of objects and the hashed values of all the identifiers for each one. This allows for a more in-depth way to ensure that the records present on the server match what is present on the client.
+A summary event indicating the parameters and result of a diagnostic data run. This allows the rest of the data sent over the course of the run to be properly contextualized and understood, which is then used to keep Windows up-to-date.
The following fields are available:
-- **DatasourceApplicationFile_RS3** The total DatasourceApplicationFile objects targeting the next release of Windows on this device.
-- **DatasourceDevicePnp_RS3** The total DatasourceDevicePnp objects targeting the next release of Windows on this device.
-- **DatasourceDriverPackage_RS3** The total DatasourceDriverPackage objects targeting the next release of Windows on this device.
-- **DataSourceMatchingInfoBlock_RS3** The total DataSourceMatchingInfoBlock objects targeting the next release of Windows on this device.
-- **DataSourceMatchingInfoPassive_RS3** The total DataSourceMatchingInfoPassive objects targeting the next release of Windows on this device.
-- **DataSourceMatchingInfoPostUpgrade_RS3** The total DataSourceMatchingInfoPostUpgrade objects targeting the next release of Windows on this device.
-- **DatasourceSystemBios_RS3** The total DatasourceSystemBios objects targeting the next release of Windows on this device.
-- **DecisionApplicationFile_RS3** The total DecisionApplicationFile objects targeting the next release of Windows on this device.
-- **DecisionDevicePnp_RS3** The total DecisionDevicePnp objects targeting the next release of Windows on this device.
-- **DecisionDriverPackage_RS3** The total DecisionDriverPackage objects targeting the next release of Windows on this device.
-- **DecisionMatchingInfoBlock_RS3** The total DecisionMatchingInfoBlock objects targeting the next release of Windows on this device.
-- **DecisionMatchingInfoPassive_RS3** The total DataSourceMatchingInfoPostUpgrade objects targeting the next release of Windows on this device.
-- **DecisionMatchingInfoPostUpgrade_RS3** The total DecisionMatchingInfoPostUpgrade objects targeting the next release of Windows on this device.
-- **DecisionMediaCenter_RS3** The total DecisionMediaCenter objects targeting the next release of Windows on this device.
-- **DecisionSystemBios_RS3** The total DecisionSystemBios objects targeting the next release of Windows on this device.
-- **PCFP** An ID for the system that is calculated by hashing hardware identifiers.
-- **InventoryApplicationFile** The SHA256 hash of InventoryApplicationFile objects that are present on this device.
-- **InventoryMediaCenter** The SHA256 hash of InventoryMediaCenter objects that are present on this device.
-- **InventoryLanguagePack** The SHA256 hash of InventoryLanguagePack objects that are present on this device.
-- **InventoryUplevelDriverPackage** The SHA256 hash of InventoryUplevelDriverPackage objects that are present on this device.
-- **InventorySystemBios** The SHA256 hash of InventorySystemBios objects that are present on this device.
-- **SystemProcessorCompareExchange** The SHA256 hash of SystemProcessorCompareExchange objects that are present on this device.
-- **SystemProcessorLahfSahf** The SHA256 hash of SystemProcessorLahfSahf objects that are present on this device.
-- **SystemMemory** The SHA256 hash of SystemMemory objects that are present on this device.
-- **SystemProcessorPrefetchW** The SHA256 hash of SystemProcessorPrefetchW objects that are present on this device.
-- **SystemProcessorSse2** The SHA256 hash of SystemProcessorSse2 objects that are present on this device.
-- **SystemProcessorNx** The SHA256 hash of SystemProcessorNx objects that are present on this device.
-- **SystemWlan** The SHA256 hash of SystemWlan objects that are present on this device.
-- **SystemWim** The SHA256 hash of SystemWim objects that are present on this device.
-- **SystemTouch** The SHA256 hash of SystemTouch objects that are present on this device.
-- **SystemWindowsActivationStatus** The SHA256 hash of SystemWindowsActivationStatus objects that are present on this device.
-- **Wmdrm_RS3** The total Wmdrm objects targeting the next release of Windows on this device.
+- **AppraiserBranch** The source branch in which the version of Appraiser that is running was built.
+- **AppraiserDataVersion** The version of the data files being used by the Appraiser diagnostic data run.
+- **AppraiserProcess** The name of the process that launched Appraiser.
+- **AppraiserVersion** The file version (major, minor and build) of the Appraiser DLL, concatenated without dots.
+- **AuxFinal** Obsolete, always set to false
+- **AuxInitial** Obsolete, indicates if Appraiser is writing data files to be read by the Get Windows 10 app.
+- **DeadlineDate** A timestamp representing the deadline date, which is the time until which appraiser will wait to do a full scan.
+- **EnterpriseRun** Indicates if the diagnostic data run is an enterprise run, which means appraiser was run from the command line with an extra enterprise parameter.
+- **FullSync** Indicates if Appraiser is performing a full sync, which means that full set of events representing the state of the machine are sent. Otherwise, only the changes from the previous run are sent.
+- **InventoryFullSync** Indicates if inventory is performing a full sync, which means that the full set of events representing the inventory of machine are sent.
+- **PCFP** An ID for the system calculated by hashing hardware identifiers.
+- **PerfBackoff** Indicates if the run was invoked with logic to stop running when a user is present. Helps to understand why a run may have a longer elapsed time than normal.
+- **PerfBackoffInsurance** Indicates if appraiser is running without performance backoff because it has run with perf backoff and failed to complete several times in a row.
+- **RunAppraiser** Indicates if Appraiser was set to run at all. If this if false, it is understood that data events will not be received from this device.
+- **RunDate** The date that the diagnostic data run was stated, expressed as a filetime.
+- **RunGeneralTel** Indicates if the generaltel.dll component was run. Generaltel collects additional diagnostic data on an infrequent schedule and only from machines at diagnostic data levels higher than Basic.
+- **RunOnline** Indicates if appraiser was able to connect to Windows Update and theefore is making decisions using up-to-date driver coverage information.
+- **RunResult** The hresult of the Appraiser diagnostic data run.
+- **SendingUtc** Indicates if the Appraiser client is sending events during the current diagnostic data run.
+- **StoreHandleIsNotNull** Obsolete, always set to false
+- **TelementrySent** Indicates if diagnostic data was successfully sent.
+- **ThrottlingUtc** Indicates if the Appraiser client is throttling its output of CUET events to avoid being disabled. This increases runtime but also diagnostic data reliability.
+- **Time** The client time of the event.
+- **VerboseMode** Indicates if appraiser ran in Verbose mode, which is a test-only mode with extra logging.
+- **WhyFullSyncWithoutTablePrefix** Indicates the reason or reasons that a full sync was generated.
-### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileAdd
+### Microsoft.Windows.Appraiser.General.EnterpriseScenarioWithDiagTrackServiceRunning
-This event sends compatibility information about a file to help keep Windows up-to-date.
+The event that indicates that Appraiser has been triggered to run an enterprise scenario while the DiagTrack service is installed. This event can only be sent if a special flag is used to trigger the enterprise scenario.
The following fields are available:
-- **AppraiserVersion** The version of the appraiser file that is generating the events.
-- **AvDisplayName** If it is an anti-virus app, this is its display name.
-- **CompatModelIndex** The compatibility prediction for this file.
-- **HasCitData** Is the file present in CIT data?
-- **HasUpgradeExe** Does the anti-virus app have an upgrade.exe file?
-- **IsAv** Is the file an anti-virus reporting EXE?
-- **ResolveAttempted** This will always be an empty string when sending telemetry.
-- **SdbEntries** An array of fields that indicates the SDB entries that apply to this file.
+- **PCFP** An ID for the system calculated by hashing hardware identifiers.
+- **Time** The client time of the event.
-### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileRemove
+### Microsoft.Windows.Appraiser.General.InventoryApplicationFileAdd
-This event indicates that the DatasourceApplicationFile object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileStartSync
-
-This event indicates that a new set of DatasourceApplicationFileAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpAdd
-
-This event sends compatibility data for a PNP device, to help keep Windows up-to-date.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the appraiser file generating the events.
-- **ActiveNetworkConnection** Is the device an active network device?
-- **IsBootCritical** Is the device boot critical?
-- **SdbEntries** An array of fields indicating the SDB entries that apply to this device.
-- **WuDriverCoverage** Is there a driver uplevel for this device according to Windows Update?
-- **WuDriverUpdateID** The Windows Update ID of the applicable uplevel driver.
-- **WuPopulatedFromID** The expected uplevel driver matching ID based on driver coverage from Windows Update.
-
-
-### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpRemove
-
-This event indicates that the DatasourceDevicePnp object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpStartSync
-
-This event indicates that a new set of DatasourceDevicePnpAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageAdd
-
-This event sends compatibility database data about driver packages to help keep Windows up-to-date.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the appraiser file generating the events.
-- **SdbEntries** An array of fields indicating the SDB entries that apply to this driver package.
-
-
-### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageRemove
-
-This event indicates that the DatasourceDriverPackage object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageStartSync
-
-This event indicates that a new set of DatasourceDriverPackageAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockAdd
-
-This event sends blocking data about any compatibility blocking entries hit on the system that are not directly related to specific applications or devices, to help keep Windows up-to-date.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the appraiser file generating the events.
-- **SdbEntries** An array of fields indicating the SDB entries that apply to this file.
-
-
-### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockRemove
-
-This event indicates that the DataSourceMatchingInfoBlock object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockStartSync
-
-This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events have been sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveAdd
-
-This event sends compatibility database information about non-blocking compatibility entries on the system that are not keyed by either applications or devices, to help keep Windows up-to-date.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the appraiser file generating the events.
-- **SdbEntries** An array of fields indicating the SDB entries that apply to this file.
-
-
-### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveRemove
-
-This event indicates that the DataSourceMatchingInfoPassive object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveStartSync
-
-This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeAdd
-
-This event sends compatibility database information about entries requiring reinstallation after an upgrade on the system that are not keyed by either applications or devices, to help keep Windows up-to-date.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the appraiser file generating the events.
-- **SdbEntries** An array of fields indicating the SDB entries that apply to this file.
-
-
-### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeRemove
-
-This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeStartSync
-
-This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosAdd
-
-This event sends compatibility database information about the BIOS to help keep Windows up-to-date.
+This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or are part of an anti-virus program.
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file generating the events.
-- **SdbEntries** An array of fields indicating the SDB entries that apply to this BIOS.
-
-
-### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosRemove
-
-This event indicates that the DatasourceSystemBios object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosStartSync
-
-This event indicates that a new set of DatasourceSystemBiosAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+- **BinaryType** A binary type. Example: UNINITIALIZED, ZERO_BYTE, DATA_ONLY, DOS_MODULE, NE16_MODULE, PE32_UNKNOWN, PE32_I386, PE32_ARM, PE64_UNKNOWN, PE64_AMD64, PE64_ARM64, PE64_IA64, PE32_CLR_32, PE32_CLR_IL, PE32_CLR_IL_PREFER32, PE64_CLR_64
+- **BinFileVersion** An attempt to clean up FileVersion at the client that tries to place the version into 4 octets.
+- **BinProductVersion** An attempt to clean up ProductVersion at the client that tries to place the version into 4 octets.
+- **BoeProgramId** If there is no entry in Add/Remove Programs, this is the ProgramID that is generated from the file metadata.
+- **CompanyName** The company name of the vendor who developed this file.
+- **FileId** A hash that uniquely identifies a file.
+- **FileVersion** The File version field from the file metadata under Properties -> Details.
+- **LinkDate** The date and time that this file was linked on.
+- **LowerCaseLongPath** The full file path to the file that was inventoried on the device.
+- **Name** The name of the file that was inventoried.
+- **ProductName** The Product name field from the file metadata under Properties -> Details.
+- **ProductVersion** The Product version field from the file metadata under Properties -> Details.
+- **ProgramId** A hash of the Name, Version, Publisher, and Language of an application used to identify it.
+- **Size** The size of the file (in hexadecimal bytes).
### Microsoft.Windows.Appraiser.General.DecisionApplicationFileAdd
@@ -552,97 +359,13 @@ The following fields are available:
- **SdbReinstallUpgradeWarn** The file is tagged as needing to be reinstalled after upgrade with a warning in the SDB. It does not block upgrade.
- **SoftBlock** The file is softblocked in the SDB and has a warning.
+### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockAdd
-### Microsoft.Windows.Appraiser.General.DecisionApplicationFileRemove
-
-This event indicates Indicates that the DecisionApplicationFile object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DecisionApplicationFileStartSync
-
-This event indicates that a new set of DecisionApplicationFileAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DecisionDevicePnpAdd
-
-This event sends compatibility decision data about a PNP device to help keep Windows up-to-date.
+This event sends blocking data about any compatibility blocking entries hit on the system that are not directly related to specific applications or devices, to help keep Windows up-to-date.
The following fields are available:
- **AppraiserVersion** The version of the appraiser file generating the events.
-- **AssociatedDriverIsBlocked** Is the driver associated with this PNP device blocked?
-- **BlockAssociatedDriver** Should the driver associated with this PNP device be blocked?
-- **BlockUpgradeIfDriverBlocked** Is the PNP device both boot critical and does not have a driver included with the OS?
-- **BlockUpgradeIfDriverBlockedAndOnlyActiveNetwork** Is this PNP device the only active network device?
-- **BlockingDevice** Is this PNP device blocking upgrade?
-- **DisplayGenericMessage** Will a generic message be shown during Setup for this PNP device?
-- **DriverAvailableInbox** Is a driver included with the operating system for this PNP device?
-- **DriverAvailableOnline** Is there a driver for this PNP device on Windows Update?
-- **DriverAvailableUplevel** Is there a driver on Windows Update or included with the operating system for this PNP device?
-- **DriverBlockOverridden** Is there is a driver block on the device that has been overridden?
-- **NeedsDismissAction** Will the user would need to dismiss a warning during Setup for this device?
-- **NotRegressed** Does the device have a problem code on the source OS that is no better than the one it would have on the target OS?
-- **SdbDeviceBlockUpgrade** Is there an SDB block on the PNP device that blocks upgrade?
-- **SdbDriverBlockOverridden** Is there an SDB block on the PNP device that blocks upgrade, but that block was overridden?
-
-
-### Microsoft.Windows.Appraiser.General.DecisionDevicePnpRemove
-
-This event indicates that the DecisionDevicePnp object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DecisionDevicePnpStartSync
-
-This event indicates that the DecisionDevicePnp object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DecisionDriverPackageAdd
-
-This event sends decision data about driver package compatibility to help keep Windows up-to-date.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the appraiser file generating the events.
-- **DriverBlockOverridden** Does the driver package have an SDB block that blocks it from migrating, but that block has been overridden?
-- **DriverIsDeviceBlocked** Was the driver package was blocked because of a device block?
-- **DriverIsDriverBlocked** Is the driver package blocked because of a driver block?
-- **DriverShouldNotMigrate** Should the driver package be migrated during upgrade?
-- **SdbDriverBlockOverridden** Does the driver package have an SDB block that blocks it from migrating, but that block has been overridden?
-
-
-### Microsoft.Windows.Appraiser.General.DecisionDriverPackageRemove
-
-This event indicates that the DecisionDriverPackage object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DecisionDriverPackageStartSync
-
-This event indicates that a new set of DecisionDriverPackageAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockAdd
@@ -659,23 +382,13 @@ The following fields are available:
- **SdbBlockUpgradeUntilUpdate** Is a matching info block blocking upgrade but has the until update tag?
-### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockRemove
+### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveAdd
-This event indicates that the DecisionMatchingInfoBlock object is no longer present.
+This event sends compatibility database information about non-blocking compatibility entries on the system that are not keyed by either applications or devices, to help keep Windows up-to-date.
The following fields are available:
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockStartSync
-
-This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
+- **AppraiserVersion** The version of the appraiser file generating the events.
### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveAdd
@@ -688,22 +401,13 @@ The following fields are available:
- **MigApplication** Is there a matching info block with a mig for the current mode of upgrade?
-### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveRemove
+### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeAdd
-This event Indicates that the DecisionMatchingInfoPassive object is no longer present.
+This event sends compatibility database information about entries requiring reinstallation after an upgrade on the system that are not keyed by either applications or devices, to help keep Windows up-to-date.
The following fields are available:
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveStartSync
-
-This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+- **AppraiserVersion** The version of the appraiser file generating the events.
### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeAdd
@@ -719,212 +423,64 @@ The following fields are available:
- **SdbReinstallUpgrade** The file is tagged as needing to be reinstalled after upgrade in the compatibility database (but is not blocking upgrade).
-### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeRemove
+### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpAdd
-This event indicates that the DecisionMatchingInfoPostUpgrade object is no longer present.
+This event sends compatibility data for a PNP device, to help keep Windows up-to-date.
The following fields are available:
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+- **ActiveNetworkConnection** Is the device an active network device?
+- **AppraiserVersion** The version of the appraiser file generating the events.
+- **IsBootCritical** Is the device boot critical?
+- **WuDriverCoverage** Is there a driver uplevel for this device according to Windows Update?
+- **WuDriverUpdateId** The Windows Update ID of the applicable uplevel driver.
+- **WuPopulatedFromId** The expected uplevel driver matching ID based on driver coverage from Windows Update.
-### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeStartSync
+### Microsoft.Windows.Appraiser.General.DecisionDevicePnpAdd
-This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent.
+This event sends compatibility decision data about a PNP device to help keep Windows up-to-date.
The following fields are available:
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+- **AssociatedDriverWillNotMigrate** Will the driver associated with this plug-and-play device migrate?
+- **AppraiserVersion** The version of the appraiser file generating the events.
+- **AssociatedDriverIsBlocked** Is the driver associated with this PNP device blocked?
+- **BlockAssociatedDriver** Should the driver associated with this PNP device be blocked?
+- **BlockingDevice** Is this PNP device blocking upgrade?
+- **BlockUpgradeIfDriverBlocked** Is the PNP device both boot critical and does not have a driver included with the OS?
+- **BlockUpgradeIfDriverBlockedAndOnlyActiveNetwork** Is this PNP device the only active network device?
+- **DisplayGenericMessage** Will a generic message be shown during Setup for this PNP device?
+- **DriverAvailableInbox** Is a driver included with the operating system for this PNP device?
+- **DriverAvailableOnline** Is there a driver for this PNP device on Windows Update?
+- **DriverAvailableUplevel** Is there a driver on Windows Update or included with the operating system for this PNP device?
+- **DriverBlockOverridden** Is there is a driver block on the device that has been overridden?
+- **NeedsDismissAction** Will the user would need to dismiss a warning during Setup for this device?
+- **NotRegressed** Does the device have a problem code on the source OS that is no better than the one it would have on the target OS?
+- **SdbDeviceBlockUpgrade** Is there an SDB block on the PNP device that blocks upgrade?
+- **SdbDriverBlockOverridden** Is there an SDB block on the PNP device that blocks upgrade, but that block was overridden?
-### Microsoft.Windows.Appraiser.General.DecisionMediaCenterAdd
+### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageAdd
-This event sends decision data about the presence of Windows Media Center, to help keep Windows up-to-date.
+This event sends compatibility database data about driver packages to help keep Windows up-to-date.
The following fields are available:
-- **AppraiserVersion** The version of the Appraiser file generating the events.
-- **BlockingApplication** Is there any application issues that interfere with upgrade due to Windows Media Center?
-- **MediaCenterActivelyUsed** If Windows Media Center is supported on the edition, has it been run at least once and are the MediaCenterIndicators are true?
-- **MediaCenterInUse** Is Windows Media Center actively being used?
-- **MediaCenterIndicators** Do any indicators imply that Windows Media Center is in active use?
-- **MediaCenterPaidOrActivelyUsed** Is Windows Media Center actively being used or is it running on a supported edition?
-- **NeedsDismissAction** Are there any actions that can be dismissed coming from Windows Media Center?
+- **AppraiserVersion** The version of the appraiser file generating the events.
+### Microsoft.Windows.Appraiser.General.DecisionDriverPackageAdd
-### Microsoft.Windows.Appraiser.General.DecisionMediaCenterRemove
-
-This event indicates that the DecisionMediaCenter object is no longer present.
+This event sends decision data about driver package compatibility to help keep Windows up-to-date.
The following fields are available:
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DecisionMediaCenterStartSync
-
-This event indicates that a new set of DecisionMediaCenterAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DecisionSystemBiosAdd
-
-This event sends compatibility decision data about the BIOS to help keep Windows up-to-date.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file generating the events.
-- **Blocking** Is the device blocked from upgrade due to a BIOS block?
-- **HasBiosBlock** Does the device have a BIOS block?
-
-
-### Microsoft.Windows.Appraiser.General.DecisionSystemBiosRemove
-
-This event indicates that the DecisionSystemBios object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DecisionSystemBiosStartSync
-
-This event indicates that a new set of DecisionSystemBiosAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.EnterpriseScenarioWithDiagTrackServiceRunning
-
-The event that indicates that Appraiser has been triggered to run an enterprise scenario while the DiagTrack service is installed. This event can only be sent if a special flag is used to trigger the enterprise scenario.
-
-The following fields are available:
-
-- **Time** The client time of the event.
-- **PCFP** An ID for the system calculated by hashing hardware identifiers.
-
-
-### Microsoft.Windows.Appraiser.General.GatedRegChange
-
-This event sends data about the results of running a set of quick-blocking instructions, to help keep Windows up to date.
-
-The following fields are available:
-
-- **Time** The client time of the event.
-- **PCFP** An ID for the system calculated by hashing hardware identifiers.
-- **RegKey** The registry key name for which a result is being sent.
-- **RegValue** The registry value for which a result is being sent.
-- **OldData** The previous data in the registry value before the scan ran.
-- **NewData** The data in the registry value after the scan completed.
-
-
-### Microsoft.Windows.Appraiser.General.InventoryApplicationFileAdd
-
-This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or are part of an anti-virus program.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file generating the events.
-- **BinFileVersion** An attempt to clean up FileVersion at the client that tries to place the version into 4 octets.
-- **BinProductVersion** An attempt to clean up ProductVersion at the client that tries to place the version into 4 octets.
-- **BinaryType** A binary type. Example: UNINITIALIZED, ZERO_BYTE, DATA_ONLY, DOS_MODULE, NE16_MODULE, PE32_UNKNOWN, PE32_I386, PE32_ARM, PE64_UNKNOWN, PE64_AMD64, PE64_ARM64, PE64_IA64, PE32_CLR_32, PE32_CLR_IL, PE32_CLR_IL_PREFER32, PE64_CLR_64
-- **BoeProgramId** If there is no entry in Add/Remove Programs, this is the ProgramID that is generated from the file metadata.
-- **CompanyName** The company name of the vendor who developed this file.
-- **FileId** A hash that uniquely identifies a file.
-- **FileVersion** The File version field from the file metadata under Properties -> Details.
-- **LinkDate** The date and time that this file was linked on.
-- **LowerCaseLongPath** The full file path to the file that was inventoried on the device.
-- **Name** The name of the file that was inventoried.
-- **ProductName** The Product name field from the file metadata under Properties -> Details.
-- **ProductVersion** The Product version field from the file metadata under Properties -> Details.
-- **ProgramId** A hash of the Name, Version, Publisher, and Language of an application used to identify it.
-- **Size** The size of the file (in hexadecimal bytes).
-
-
-### Microsoft.Windows.Appraiser.General.InventoryApplicationFileRemove
-
-This event indicates that the InventoryApplicationFile object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.InventoryApplicationFileStartSync
-
-This event indicates indicates that a new set of InventoryApplicationFileAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.InventoryLanguagePackAdd
-
-This event sends data about the number of language packs installed on the system, to help keep Windows up-to-date.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-- **HasLanguagePack** Does this device have 2 or more language packs?
-- **LanguagePackCount** How many language packs are installed?
-
-
-### Microsoft.Windows.Appraiser.General.InventoryLanguagePackRemove
-
-This event indicates that the InventoryLanguagePack object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.InventoryLanguagePackStartSync
-
-This event indicates that a new set of InventoryLanguagePackAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.InventoryMediaCenterAdd
-
-This event sends true/false data about decision points used to understand whether Windows Media Center is used on the system, to help keep Windows up to date.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file generating the events.
-- **EverLaunched** Has Windows Media Center ever been launched?
-- **HasConfiguredTv** Has the user configured a TV tuner through Windows Media Center?
-- **HasExtendedUserAccounts** Are any Windows Media Center Extender user accounts configured?
-- **HasWatchedFolders** Are any folders configured for Windows Media Center to watch?
-- **IsDefaultLauncher** Is Windows Media Center the default app for opening music or video files?
-- **IsPaid** Is the user running a Windows Media Center edition that implies they paid for Windows Media Center?
-- **IsSupported** Does the running OS support Windows Media Center?
-
-
-### Microsoft.Windows.Appraiser.General.InventoryMediaCenterRemove
-
-This event indicates that the InventoryMediaCenter object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.InventoryMediaCenterStartSync
-
-This event indicates that a new set of InventoryMediaCenterAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+- **AppraiserVersion** The version of the appraiser file generating the events.
+- **DriverBlockOverridden** Does the driver package have an SDB block that blocks it from migrating, but that block has been overridden?
+- **DriverIsDeviceBlocked** Was the driver package was blocked because of a device block?
+- **DriverIsDriverBlocked** Is the driver package blocked because of a driver block?
+- **DriverShouldNotMigrate** Should the driver package be migrated during upgrade?
+- **SdbDriverBlockOverridden** Does the driver package have an SDB block that blocks it from migrating, but that block has been overridden?
### Microsoft.Windows.Appraiser.General.InventorySystemBiosAdd
@@ -940,116 +496,6 @@ The following fields are available:
- **Model** The model field from Win32_ComputerSystem.
-### Microsoft.Windows.Appraiser.General.InventorySystemBiosRemove
-
-This event indicates that the InventorySystemBios object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.InventorySystemBiosStartSync
-
-This event indicates that a new set of InventorySystemBiosAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageAdd
-
-This event is only runs during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. Is critical to understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-- **BootCritical** Is the driver package marked as boot critical?
-- **Build** The build value from the driver package.
-- **CatalogFile** The name of the catalog file within the driver package.
-- **ClassGuid** The device class GUID from the driver package.
-- **Class** The device class from the driver package.
-- **Date** The date from the driver package.
-- **SignatureStatus** Indicates if the driver package is signed. Unknown:0, Unsigned:1, Signed: 2
-- **Inbox** Is the driver package of a driver that is included with Windows?
-- **VersionMajor** The major version of the driver package.
-- **VersionMinor** The minor version of the driver package.
-- **OriginalName** The original name of the INF file before it was renamed. Generally a path under $WINDOWS.~BT\Drivers\DU
-- **Provider** The provider of the driver package.
-- **PublishedName** The name of the INF file, post-rename.
-- **Revision** The revision of the driver package.
-
-
-### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageRemove
-
-This event indicates that the InventoryUplevelDriverPackage object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageStartSync
-
-This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.IsOnlineTelemetryOutputter
-
-This event indicates if Appraiser was able to connect successfully to Windows Update to get driver availability information.
-
-The following fields are available:
-
-- **Time** The client time of the event.
-- **PCFP** A unique hardware identifier that is calculated by hashing hardware identifiers.
-- **IsOnlineRun** Was the device able to connect to Windows Update to get driver availability information?
-
-
-### Microsoft.Windows.Appraiser.General.IsOnlineWuDriverDataSource
-
-This event indicates if Appraiser was able to connect to Windows Update to gather driver coverage information.
-
-The following fields are available:
-
-- **Time** The client time of the event.
-- **PCFP** A unique hardware identifier that is calculated by hashing hardware identifiers.
-- **IsOnlineRun** Was the device able to connect to Windows Update to get driver availability information?
-- **TargetVersion** The abbreviated name for the OS version against which Windows Update was queried.
-
-
-### Microsoft.Windows.Appraiser.General.RunContext
-
-This event indicates what should be expected in the data payload.
-
-The following fields are available:
-
-- **AppraiserBranch** The source branch in which the currently running version of Appraiser was built.
-- **AppraiserVersion** The version of the Appraiser file generating the events.
-- **Context** Indicates what mode Appraiser is running in. Example: Setup or Telemetry.
-- **Time** The client time of the event.
-- **AppraiserProcess** The name of the process that launched Appraiser.
-- **PCFP** An ID for the system calculated by hashing hardware identifiers.
-
-
-### Microsoft.Windows.Appraiser.General.SetupAdlStatus
-
-This event indicates if Appraiser used data files from the setup image or more up-to-date data files downloaded from a Microsoft server.
-
-The following fields are available:
-
-- **Time** The client time of the event.
-- **PCFP** An ID for the system calculated by hashing hardware identifiers.
-- **Result** The last result of the operation to determine if there is a data file to download.
-- **OneSettingsInitialized** Was the query to OneSettings, where the information is stored on if there is a data file to download, initialized?
-- **Url** The URL of the data file to download. This will be an empty string if there is no data file to download.
-- **UsingAlternateData** Is the client using alternate data file or using the data file in the setup image?
-
-
### Microsoft.Windows.Appraiser.General.SystemMemoryAdd
This event sends data on the amount of memory on the system and whether it meets requirements, to help keep Windows up-to-date.
@@ -1066,23 +512,25 @@ The following fields are available:
- **virtualKB** The amount of virtual memory (in KB).
-### Microsoft.Windows.Appraiser.General.SystemMemoryRemove
+### Microsoft.Windows.Appraiser.General.DecisionSystemBiosAdd
-This event that the SystemMemory object is no longer present.
+This event sends compatibility decision data about the BIOS to help keep Windows up-to-date.
The following fields are available:
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+- **AppraiserVersion** The version of the Appraiser file generating the events.
+- **Blocking** Is the device blocked from upgrade due to a BIOS block?
+- **HasBiosBlock** Does the device have a BIOS block?
-### Microsoft.Windows.Appraiser.General.SystemMemoryStartSync
+### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosAdd
-This event indicates that a new set of SystemMemoryAdd events will be sent.
+This event sends compatibility database information about the BIOS to help keep Windows up-to-date.
The following fields are available:
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
+- **AppraiserVersion** The version of the Appraiser file generating the events.
+- **SdbEntries** An array of fields indicating the SDB entries that apply to this BIOS.
### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeAdd
@@ -1095,24 +543,6 @@ The following fields are available:
- **CompareExchange128Support** Does the CPU support CompareExchange128?
-### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeRemove
-
-This event indicates that the SystemProcessorCompareExchange object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeStartSync
-
-This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfAdd
This event sends data indicating whether the system supports the LahfSahf CPU requirement, to help keep Windows up-to-date.
@@ -1123,25 +553,6 @@ The following fields are available:
- **Blocking** Is the upgrade blocked due to the processor?
- **LahfSahfSupport** Does the CPU support LAHF/SAHF?
-
-### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfRemove
-
-This event indicates that the SystemProcessorLahfSahf object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfStartSync
-
-This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
### Microsoft.Windows.Appraiser.General.SystemProcessorNxAdd
This event sends data indicating whether the system supports the NX CPU requirement, to help keep Windows up-to-date.
@@ -1154,24 +565,6 @@ The following fields are available:
- **NXProcessorSupport** Does the processor support NX?
-### Microsoft.Windows.Appraiser.General.SystemProcessorNxRemove
-
-This event indicates that the SystemProcessorNx object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.SystemProcessorNxStartSync
-
-This event indicates that a new set of SystemProcessorNxAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWAdd
This event sends data indicating whether the system supports the PrefetchW CPU requirement, to help keep Windows up-to-date.
@@ -1183,24 +576,6 @@ The following fields are available:
- **PrefetchWSupport** Does the processor support PrefetchW?
-### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWRemove
-
-This event indicates that the SystemProcessorPrefetchW object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWStartSync
-
-This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
### Microsoft.Windows.Appraiser.General.SystemProcessorSse2Add
This event sends data indicating whether the system supports the SSE2 CPU requirement, to help keep Windows up-to-date.
@@ -1212,22 +587,15 @@ The following fields are available:
- **SSE2ProcessorSupport** Does the processor support SSE2?
-### Microsoft.Windows.Appraiser.General.SystemProcessorSse2Remove
+### Microsoft.Windows.Appraiser.General.SystemWimAdd
-This event indicates that the SystemProcessorSse2 object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.SystemProcessorSse2StartSync
-
-This event indicates that a new set of SystemProcessorSse2Add events will be sent.
+This event sends data indicating whether the operating system is running from a compressed WIM file, to help keep Windows up-to-date.
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+- **IsWimBoot** Is the current operating system running from a compressed WIM file?
+- **RegistryWimBootValue** The raw value from the registry that is used to indicate if the device is running from a WIM.
### Microsoft.Windows.Appraiser.General.SystemTouchAdd
@@ -1241,53 +609,6 @@ The following fields are available:
- **MaximumTouches** The maximum number of touch points supported by the device hardware.
-### Microsoft.Windows.Appraiser.General.SystemTouchRemove
-
-This event indicates that the SystemTouch object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.SystemTouchStartSync
-
-This event indicates that a new set of SystemTouchAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.SystemWimAdd
-
-This event sends data indicating whether the operating system is running from a compressed WIM file, to help keep Windows up-to-date.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-- **IsWimBoot** Is the current operating system running from a compressed WIM file?
-- **RegistryWimBootValue** The raw value from the registry that is used to indicate if the device is running from a WIM.
-
-
-### Microsoft.Windows.Appraiser.General.SystemWimRemove
-
-This event indicates that the SystemWim object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.SystemWimStartSync
-
-This event indicates that a new set of SystemWimAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusAdd
This event sends data indicating whether the current operating system is activated, to help keep Windows up-to-date.
@@ -1299,22 +620,15 @@ The following fields are available:
- **WindowsNotActivatedDecision** Is the current operating system activated?
-### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusRemove
+### Microsoft.Windows.Appraiser.General.InventoryLanguagePackAdd
-This event indicates that the SystemWindowsActivationStatus object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusStartSync
-
-This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent.
+This event sends data about the number of language packs installed on the system, to help keep Windows up-to-date.
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+- **HasLanguagePack** Does this device have 2 or more language packs?
+- **LanguagePackCount** How many language packs are installed?
### Microsoft.Windows.Appraiser.General.SystemWlanAdd
@@ -1332,9 +646,201 @@ The following fields are available:
- **WlanNativeDriver** Does the device have a non-emulated WLAN driver?
-### Microsoft.Windows.Appraiser.General.SystemWlanRemove
+### Microsoft.Windows.Appraiser.General.InventoryMediaCenterAdd
-This event indicates that the SystemWlan object is no longer present.
+This event sends true/false data about decision points used to understand whether Windows Media Center is used on the system, to help keep Windows up to date.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file generating the events.
+- **EverLaunched** Has Windows Media Center ever been launched?
+- **HasConfiguredTv** Has the user configured a TV tuner through Windows Media Center?
+- **HasExtendedUserAccounts** Are any Windows Media Center Extender user accounts configured?
+- **HasWatchedFolders** Are any folders configured for Windows Media Center to watch?
+- **IsDefaultLauncher** Is Windows Media Center the default app for opening music or video files?
+- **IsPaid** Is the user running a Windows Media Center edition that implies they paid for Windows Media Center?
+- **IsSupported** Does the running OS support Windows Media Center?
+
+
+### Microsoft.Windows.Appraiser.General.DecisionMediaCenterAdd
+
+This event sends decision data about the presence of Windows Media Center, to help keep Windows up-to-date.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file generating the events.
+- **BlockingApplication** Is there any application issues that interfere with upgrade due to Windows Media Center?
+- **MediaCenterActivelyUsed** If Windows Media Center is supported on the edition, has it been run at least once and are the MediaCenterIndicators are true?
+- **MediaCenterIndicators** Do any indicators imply that Windows Media Center is in active use?
+- **MediaCenterInUse** Is Windows Media Center actively being used?
+- **MediaCenterPaidOrActivelyUsed** Is Windows Media Center actively being used or is it running on a supported edition?
+- **NeedsDismissAction** Are there any actions that can be dismissed coming from Windows Media Center?
+
+
+### Microsoft.Windows.Appraiser.General.ChecksumTotalPictureCount
+
+This event lists the types of objects and how many of each exist on the client device. This allows for a quick way to ensure that the records present on the server match what is present on the client.
+
+The following fields are available:
+
+- **DatasourceApplicationFile_RS2** The total DatasourceApplicationFile objects targeting Windows 10 version 1703 present on this device.
+- **DatasourceDevicePnp_RS2** The total DatasourceDevicePnp objects targeting Windows 10 version 1703 present on this device.
+- **DatasourceDriverPackage_RS2** The total DatasourceDriverPackage objects targeting Windows 10 version 1703 present on this device.
+- **DataSourceMatchingInfoBlock_RS2** The total DataSourceMatchingInfoBlock objects targeting Windows 10 version 1703 present on this device.
+- **DataSourceMatchingInfoPassive_RS2** The total DataSourceMatchingInfoPassive objects targeting Windows 10 version 1703 present on this device.
+- **DataSourceMatchingInfoPostUpgrade_RS2** The total DataSourceMatchingInfoPostUpgrade objects targeting Windows 10 version 1703 present on this device.
+- **DatasourceSystemBios_RS2** The total DatasourceSystemBios objects targeting Windows 10 version 1703 present on this device.
+- **DecisionApplicationFile_RS2** The total DecisionApplicationFile objects targeting Windows 10 version 1703 present on this device.
+- **DecisionDevicePnp_RS2** The total DecisionDevicePnp objects targeting Windows 10 version 1703 present on this device.
+- **DecisionDriverPackage_RS2** The total DecisionDriverPackage objects targeting Windows 10 version 1703 present on this device.
+- **DecisionMatchingInfoBlock_RS2** The total DecisionMatchingInfoBlock objects targeting Windows 10 version 1703 present on this device.
+- **DecisionMatchingInfoPassive_RS2** The total DecisionMatchingInfoPassive objects targeting Windows 10 version 1703 present on this device.
+- **DecisionMatchingInfoPostUpgrade_RS2** The total DecisionMatchingInfoPostUpgrade objects targeting Windows 10 version 1703 present on this device.
+- **DecisionMediaCenter_RS2** The total DecisionMediaCenter objects targeting Windows 10 version 1703 present on this device.
+- **DecisionSystemBios_RS2** The total DecisionSystemBios objects targeting Windows 10 version 1703 present on this device.
+- **InventoryApplicationFile** The total InventoryApplicationFile objects that are present on this device.
+- **InventoryLanguagePack** The total InventoryLanguagePack objects that are present on this device.
+- **InventoryMediaCenter** The total InventoryMediaCenter objects that are present on this device.
+- **InventorySystemBios** The total InventorySystemBios objects that are present on this device.
+- **InventoryUplevelDriverPackage** The total InventoryUplevelDriverPackage objects that are present on this device.
+- **PCFP** An ID for the system that is calculated by hashing hardware identifiers.
+- **SystemMemory** The total SystemMemory objects that are present on this device.
+- **SystemProcessorCompareExchange** The total SystemProcessorCompareExchange objects that are present on this device.
+- **SystemProcessorLahfSahf** The total SystemProcessorLahfSahf objects that are present on this device.
+- **SystemProcessorNx** The total SystemProcessorNx objects that are present on this device.
+- **SystemProcessorPrefetchW** The total SystemProcessorPrefetchW objects that are present on this device.
+- **SystemProcessorSse2** The total SystemProcessorSse2 objects that are present on this device.
+- **SystemTouch** The total SystemTouch objects that are present on this device.
+- **SystemWim** The total SystemWim objects that are present on this device
+- **SystemWindowsActivationStatus** The total SystemWindowsActivationStatus objects that are present on this device.
+- **SystemWlan** The total SystemWlan objects that are present on this device.
+- **Wmdrm_RS2** The total Wmdrm objects targeting Windows 10 version 1703 present on this device.
+- **DatasourceApplicationFile_RS3** "The total DecisionApplicationFile objects targeting the next release of Windows on this device. "
+- **DatasourceDevicePnp_RS3** The total DatasourceDevicePnp objects targeting the next release of Windows on this device.
+- **DatasourceDriverPackage_RS3** The total DatasourceDriverPackage objects targeting the next release of Windows on this device.
+- **DataSourceMatchingInfoBlock_RS3** The total DataSourceMatchingInfoBlock objects targeting the next release of Windows on this device.
+- **DataSourceMatchingInfoPassive_RS3** The total DataSourceMatchingInfoPassive objects targeting the next release of Windows on this device.
+- **DataSourceMatchingInfoPostUpgrade_RS3** The total DataSourceMatchingInfoPostUpgrade objects targeting the next release of Windows on this device.
+- **DatasourceSystemBios_RS3** The total DatasourceSystemBios objects targeting the next release of Windows on this device.
+- **DecisionApplicationFile_RS3** The total DecisionApplicationFile objects targeting the next release of Windows on this device.
+- **DecisionDevicePnp_RS3** The total DecisionDevicePnp objects targeting the next release of Windows on this device.
+- **DecisionDriverPackage_RS3** The total DecisionDriverPackage objects targeting the next release of Windows on this device.
+- **DecisionMatchingInfoBlock_RS3** The total DecisionMatchingInfoBlock objects targeting the next release of Windows on this device.
+- **DecisionMatchingInfoPassive_RS3** The total DataSourceMatchingInfoPassive objects targeting the next release of Windows on this device.
+- **DecisionMatchingInfoPostUpgrade_RS3** The total DecisionMatchingInfoPostUpgrade objects targeting the next release of Windows on this device.
+- **DecisionMediaCenter_RS3** The total DecisionMediaCenter objects targeting the next release of Windows on this device.
+- **DecisionSystemBios_RS3** The total DecisionSystemBios objects targeting the next release of Windows on this device.
+- **Wmdrm_RS3** The total Wmdrm objects targeting the next release of Windows on this device.
+
+
+### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageStartSync
+
+This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfStartSync
+
+This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.SystemProcessorSse2StartSync
+
+This event indicates that a new set of SystemProcessorSse2Add events will be sent.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.InventorySystemBiosStartSync
+
+This event indicates that a new set of InventorySystemBiosAdd events will be sent.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+### Microsoft.Windows.Appraiser.General.DecisionSystemBiosStartSync
+
+This event indicates that a new set of DecisionSystemBiosAdd events will be sent.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.SystemMemoryStartSync
+
+This event indicates that a new set of SystemMemoryAdd events will be sent.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeStartSync
+
+This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+### Microsoft.Windows.Appraiser.General.SystemProcessorNxStartSync
+
+This event indicates that a new set of SystemProcessorNxAdd events will be sent.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWStartSync
+
+This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.SystemWimStartSync
+
+This event indicates that a new set of SystemWimAdd events will be sent.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosStartSync
+
+This event indicates that a new set of DatasourceSystemBiosAdd events will be sent.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.SystemTouchStartSync
+
+This event indicates that a new set of SystemTouchAdd events will be sent.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageEndSync
+
+This event indicates that a full set of DatasourceDriverPackageAdd events has been sent.
The following fields are available:
@@ -1349,60 +855,62 @@ The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusStartSync
-### Microsoft.Windows.Appraiser.General.TelemetryRunHealth
-
-A summary event indicating the parameters and result of a telemetry run. This allows the rest of the data sent over the course of the run to be properly contextualized and understood, which is then used to keep Windows up-to-date.
-
-The following fields are available:
-
-- **PerfBackoff** Indicates if the run was invoked with logic to stop running when a user is present. Helps to understand why a run may have a longer elapsed time than normal.
-- **RunAppraiser** Indicates if Appraiser was set to run at all. If this if false, it is understood that data events will not be received from this device.
-- **ThrottlingUtc** Indicates if the Appraiser client is throttling its output of CUET events to avoid being disabled. This increases runtime but also telemetry reliability.
-- **AuxInitial** Obsolete, indicates if Appraiser is writing data files to be read by the Get Windows 10 app.
-- **Time** The client time of the event.
-- **RunDate** The date that the telemetry run was stated, expressed as a filetime.
-- **AppraiserProcess** The name of the process that launched Appraiser.
-- **AppraiserVersion** The file version (major, minor and build) of the Appraiser DLL, concatenated without dots.
-- **SendingUtc** Indicates if the Appraiser client is sending events during the current telemetry run.
-- **DeadlineDate** A timestamp representing the deadline date, which is the time until which appraiser will wait to do a full scan.
-- **AppraiserBranch** The source branch in which the version of Appraiser that is running was built.
-- **EnterpriseRun** Indicates if the telemetry run is an enterprise run, which means appraiser was run from the command line with an extra enterprise parameter.
-- **RunGeneralTel** Indicates if the generaltel.dll component was run. Generaltel collects additional telemetry on an infrequent schedule and only from machines at telemetry levels higher than Basic.
-- **PerfBackoffInsurance** Indicates if appraiser is running without performance backoff because it has run with perf backoff and failed to complete several times in a row.
-- **AuxFinal** Obsolete, always set to false
-- **StoreHandleIsNotNull** Obsolete, always set to false
-- **VerboseMode** Indicates if appraiser ran in Verbose mode, which is a test-only mode with extra logging.
-- **AppraiserDataVersion** The version of the data files being used by the Appraiser telemetry run.
-- **FullSync** Indicates if Appraiser is performing a full sync, which means that full set of events representing the state of the machine are sent. Otherwise, only the changes from the previous run are sent.
-- **InventoryFullSync** Indicates if inventory is performing a full sync, which means that the full set of events representing the inventory of machine are sent.
-- **PCFP** An ID for the system calculated by hashing hardware identifiers.
-- **RunOnline** Indicates if appraiser was able to connect to Windows Update and theefore is making decisions using up-to-date driver coverage information.
-- **TelementrySent** Indicates if telemetry was successfully sent.
-- **WhyFullSyncWithoutTablePrefix** Indicates the reason or reasons that a full sync was generated.
-- **RunResult** The hresult of the Appraiser telemetry run.
-
-
-### Microsoft.Windows.Appraiser.General.WmdrmAdd
-
-This event sends data about the usage of older digital rights management on the system, to help keep Windows up to date. This data does not indicate the details of the media using the digital rights management, only whether any such files exist. Collecting this data was critical to ensuring the correct mitigation for customers, and should be able to be removed once all mitigations are in place.
+This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent.
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-- **WmdrmCdRipped** Indicates if the system has any files encrypted with personal DRM, which was used for ripped CDs.
-- **WmdrmNonPermanent** Indicates if the system has any files with non-permanent licenses.
-- **WmdrmPurchased** Indicates if the system has any files with permanent licenses.
-- **WmdrmApiResult** Raw value of the API used to gather DRM state.
-- **WmdrmInUse** WmdrmIndicators AND dismissible block in setup was not dismissed.
-- **WmdrmIndicators** WmdrmCdRipped OR WmdrmPurchased
-- **NeedsDismissAction** Indicates if a dismissible message is needed to warn the user about a potential loss of data due to DRM deprecation.
-- **BlockingApplication** Same as NeedsDismissAction
-### Microsoft.Windows.Appraiser.General.WmdrmRemove
+### Microsoft.Windows.Appraiser.General.DecisionMediaCenterStartSync
-This event indicates that the Wmdrm object is no longer present.
+This event indicates that a new set of DecisionMediaCenterAdd events will be sent.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.InventoryMediaCenterStartSync
+
+This event indicates that a new set of InventoryMediaCenterAdd events will be sent.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveStartSync
+
+This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveStartSync
+
+This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.InventoryApplicationFileStartSync
+
+This event indicates indicates that a new set of InventoryApplicationFileAdd events will be sent.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeStartSync
+
+This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent.
The following fields are available:
@@ -1417,19 +925,444 @@ The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveEndSync
-## Census events
-
-### Census.App
-
-This event sends version data about the Apps running on this device, to help keep Windows up to date.
+This event indicates that a full set of DataSourceMatchingInfoPassiveAdd events have been sent.
The following fields are available:
-- **IEVersion** Retrieves which version of Internet Explorer is running on this device.
-- **CensusVersion** The version of Census that generated the current data for this device.
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockStartSync
+
+This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileStartSync
+
+This event indicates that a new set of DatasourceApplicationFileAdd events will be sent.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpStartSync
+
+This event indicates that a new set of DatasourceDevicePnpAdd events will be sent.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockStartSync
+
+This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events have been sent.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DecisionApplicationFileStartSync
+
+This event indicates that a new set of DecisionApplicationFileAdd events will be sent.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.InventoryLanguagePackStartSync
+
+This event indicates that a new set of InventoryLanguagePackAdd events will be sent.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeStartSync
+
+This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+### Microsoft.Windows.Appraiser.General.DecisionDevicePnpStartSync
+
+This event indicates that the DecisionDevicePnp object is no longer present.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageStartSync
+
+This event indicates that a new set of DatasourceDriverPackageAdd events will be sent.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DecisionDriverPackageStartSync
+
+This event indicates that a new set of DecisionDriverPackageAdd events will be sent.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.WmdrmAdd
+
+This event sends data about the usage of older digital rights management on the system, to help keep Windows up to date. This data does not indicate the details of the media using the digital rights management, only whether any such files exist. Collecting this data was critical to ensuring the correct mitigation for customers, and should be able to be removed once all mitigations are in place.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+- **BlockingApplication** Same as NeedsDismissAction
+- **NeedsDismissAction** Indicates if a dismissible message is needed to warn the user about a potential loss of data due to DRM deprecation.
+- **WmdrmApiResult** Raw value of the API used to gather DRM state.
+- **WmdrmCdRipped** Indicates if the system has any files encrypted with personal DRM, which was used for ripped CDs.
+- **WmdrmIndicators** WmdrmCdRipped OR WmdrmPurchased
+- **WmdrmInUse** WmdrmIndicators AND dismissible block in setup was not dismissed.
+- **WmdrmNonPermanent** Indicates if the system has any files with non-permanent licenses.
+- **WmdrmPurchased** Indicates if the system has any files with permanent licenses.
+
+### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageAdd
+
+This event is only runs during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. Is critical to understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+- **BootCritical** Is the driver package marked as boot critical?
+- **Build** The build value from the driver package.
+- **CatalogFile** The name of the catalog file within the driver package.
+- **Class** The device class from the driver package.
+- **ClassGuid** The device class GUID from the driver package.
+- **Date** The date from the driver package.
+- **Inbox** Is the driver package of a driver that is included with Windows?
+- **OriginalName** The original name of the INF file before it was renamed. Generally a path under $WINDOWS.~BT\Drivers\DU
+- **Provider** The provider of the driver package.
+- **PublishedName** The name of the INF file, post-rename.
+- **Revision** The revision of the driver package.
+- **SignatureStatus** Indicates if the driver package is signed. Unknown:0, Unsigned:1, Signed: 2
+- **VersionMajor** The major version of the driver package.
+- **VersionMinor** The minor version of the driver package.
+
+### Microsoft.Windows.Appraiser.General.GatedRegChange
+
+This event sends data about the results of running a set of quick-blocking instructions, to help keep Windows up to date.
+
+The following fields are available:
+
+- **NewData** The data in the registry value after the scan completed.
+- **OldData** The previous data in the registry value before the scan ran.
+- **PCFP** An ID for the system calculated by hashing hardware identifiers.
+- **RegKey** The registry key name for which a result is being sent.
+- **RegValue** The registry value for which a result is being sent.
+- **Time** The client time of the event.
+
+
+### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileRemove
+
+This event indicates that the DatasourceApplicationFile object is no longer present.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpRemove
+
+This event indicates that the DatasourceDevicePnp object is no longer present.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageRemove
+
+This event indicates that the DatasourceDriverPackage object is no longer present.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.SystemProcessorSse2Remove
+
+This event indicates that the SystemProcessorSse2 object is no longer present.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageRemove
+
+This event indicates that the InventoryUplevelDriverPackage object is no longer present.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DecisionMediaCenterRemove
+
+This event indicates that the DecisionMediaCenter object is no longer present.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.InventoryMediaCenterRemove
+
+This event indicates that the InventoryMediaCenter object is no longer present.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosRemove
+
+This event indicates that the DatasourceSystemBios object is no longer present.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DecisionApplicationFileRemove
+
+This event indicates Indicates that the DecisionApplicationFile object is no longer present.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeRemove
+
+This event indicates that the DecisionMatchingInfoPostUpgrade object is no longer present.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.SystemTouchRemove
+
+"This event indicates that the SystemTouch object is no longer present. "
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusRemove
+
+This event indicates that the SystemWindowsActivationStatus object is no longer present.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.SystemWlanRemove
+
+"This event indicates that the SystemWlan object is no longer present. "
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeRemove
+
+This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.SystemProcessorNxRemove
+
+This event indicates that the SystemProcessorNx object is no longer present.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockRemove
+
+This event indicates that the DataSourceMatchingInfoBlock object is no longer present.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DecisionDevicePnpRemove
+
+This event indicates that the DecisionDevicePnp object is no longer present.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveRemove
+
+This event Indicates that the DecisionMatchingInfoPassive object is no longer present.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.SystemMemoryRemove
+
+This event that the SystemMemory object is no longer present.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockRemove
+
+This event indicates that the DecisionMatchingInfoBlock object is no longer present.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveRemove
+
+This event indicates that the DataSourceMatchingInfoPassive object is no longer present.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.InventoryApplicationFileRemove
+
+This event indicates that the InventoryApplicationFile object is no longer present.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.SystemWimRemove
+
+"This event indicates that the SystemWim object is no longer present. "
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.InventorySystemBiosRemove
+
+"This event indicates that the InventorySystemBios object is no longer present. "
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.WmdrmRemove
+
+This event indicates that the Wmdrm object is no longer present.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfRemove
+
+"This event indicates that the SystemProcessorLahfSahf object is no longer present. "
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.InventoryLanguagePackRemove
+
+This event indicates that the InventoryLanguagePack object is no longer present.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DecisionDriverPackageRemove
+
+This event indicates that the DecisionDriverPackage object is no longer present.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DecisionSystemBiosRemove
+
+This event indicates that the DecisionSystemBios object is no longer present.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeRemove
+
+"This event indicates that the SystemProcessorCompareExchange object is no longer present. "
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWRemove
+
+This event indicates that the SystemProcessorPrefetchW object is no longer present.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.InventoryDriverBinaryEndSync
+
+This event indicates that a full set of InventoryDriverBinaryAdd events has been sent.
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+## Census events
+
### Census.Battery
This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use, type to help keep Windows up to date.
@@ -1439,8 +1372,43 @@ The following fields are available:
- **InternalBatteryCapablities** Represents information about what the battery is capable of doing.
- **InternalBatteryCapacityCurrent** Represents the battery's current fully charged capacity in mWh (or relative). Compare this value to DesignedCapacity to estimate the battery's wear.
- **InternalBatteryCapacityDesign** Represents the theoretical capacity of the battery when new, in mWh.
-- **IsAlwaysOnAlwaysConnectedCapable** Represents whether the battery enables the device to be AlwaysOnAlwaysConnected . Boolean value.
- **InternalBatteryNumberOfCharges** Provides the number of battery charges. This is used when creating new products and validating that existing products meets targeted functionality performance.
+- **IsAlwaysOnAlwaysConnectedCapable** Represents whether the battery enables the device to be AlwaysOnAlwaysConnected . Boolean value.
+
+
+### Census.Enterprise
+
+This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment.
+
+The following fields are available:
+
+- **AzureOSIDPresent** Represents the field used to identify an Azure machine.
+- **AzureVMType** Represents whether the instance is Azure VM PAAS, Azure VM IAAS or any other VMs.
+- **CDJType** Represents the type of cloud domain joined for the machine.
+- **CommercialId** Represents the GUID for the commercial entity which the device is a member of. Will be used to reflect insights back to customers.
+- **ContainerType** The type of container, such as process or virtual machine hosted.
+- **EnrollmentType** Represents the type of enrollment, such as MDM or Intune, for a particular device.
+- **HashedDomain** The hashed representation of the user domain used for login.
+- **IsCloudDomainJoined** Is this device joined to an Azure Active Directory (AAD) tenant? true/false
+- **IsDERequirementMet** Represents if the device can do device encryption.
+- **IsDeviceProtected** Represents if Device protected by BitLocker/Device Encryption
+- **IsDomainJoined** Indicates whether a machine is joined to a domain.
+- **IsEDPEnabled** Represents if Enterprise data protected on the device.
+- **IsMDMEnrolled** Whether the device has been MDM Enrolled or not.
+- **MPNId** Returns the Partner ID/MPN ID from Regkey. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\DeployID
+- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in an Enterprise SCCM environment.
+- **ServerFeatures** Represents the features installed on a Windows Server. This can be used by developers and administrators who need to automate the process of determining the features installed on a set of server computers.
+- **SystemCenterID** The SCCM ID is an anonymized one-way hash of the Active Directory Organization identifier
+
+
+### Census.App
+
+This event sends version data about the Apps running on this device, to help keep Windows up to date.
+
+The following fields are available:
+
+- **CensusVersion** The version of Census that generated the current data for this device.
+- **IEVersion** Retrieves which version of Internet Explorer is running on this device.
### Census.Camera
@@ -1453,28 +1421,26 @@ The following fields are available:
- **RearFacingCameraResolution** Represents the resolution of the rear facing camera in megapixels. If a rear facing camera does not exist, then the value is 0.
-### Census.Enterprise
+### Census.UserDisplay
-This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment.
+This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system, to help keep Windows up to date.
The following fields are available:
-- **IsCloudDomainJoined** Is this device joined to an Azure Active Directory (AAD) tenant? true/false
-- **IsMDMEnrolled** Whether the device has been MDM Enrolled or not.
-- **ServerFeatures** Represents the features installed on a Windows Server. This can be used by developers and administrators who need to automate the process of determining the features installed on a set of server computers.
-- **CommercialId** Represents the GUID for the commercial entity which the device is a member of. Will be used to reflect insights back to customers.
-- **AzureVMType** Represents whether the instance is Azure VM PAAS, Azure VM IAAS or any other VMs.
-- **AzureOSIDPresent** Represents the field used to identify an Azure machine.
-- **IsDomainJoined** Indicates whether a machine is joined to a domain.
-- **HashedDomain** The hashed representation of the user domain used for login.
-- **SystemCenterID** The SCCM ID is an anonymized one-way hash of the Active Directory Organization identifier
-- **MPNId** Returns the Partner ID/MPN ID from Regkey. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\DeployID
-- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in an Enterprise SCCM environment.
-- **CDJType** Represents the type of cloud domain joined for the machine.
-- **IsDeviceProtected** Represents if Device protected by BitLocker/Device Encryption
-- **IsDERequirementMet** Represents if the device can do device encryption.
-- **IsEDPEnabled** Represents if Enterprise data protected on the device.
-- **ContainerType** The type of container, such as process or virtual machine hosted.
+- **InternalPrimaryDisplayLogicalDPIX** Retrieves the logical DPI in the x-direction of the internal display.
+- **InternalPrimaryDisplayLogicalDPIY** Retrieves the logical DPI in the y-direction of the internal display.
+- **InternalPrimaryDisplayPhysicalDPIX** Retrieves the physical DPI in the x-direction of the internal display.
+- **InternalPrimaryDisplayPhysicalDPIY** Retrieves the physical DPI in the y-direction of the internal display.
+- **InternalPrimaryDisplayResolutionHorizontal** Retrieves the number of pixels in the horizontal direction of the internal display.
+- **InternalPrimaryDisplayResolutionVertical** Retrieves the number of pixels in the vertical direction of the internal display.
+- **InternalPrimaryDisplaySizePhysicalH** Retrieves the physical horizontal length of the display in mm. Used for calculating the diagonal length in inches .
+- **InternalPrimaryDisplaySizePhysicalY** Retrieves the physical vertical length of the display in mm. Used for calculating the diagonal length in inches
+- **InternalPrimaryDisplayType** Represents the type of technology used in the monitor, such as Plasma, LED, LCOS, etc.
+- **NumberofExternalDisplays** Retrieves the number of external displays connected to the machine
+- **NumberofInternalDisplays** Retrieves the number of internal displays in a machine.
+- **VRAMDedicated** Retrieves the video RAM in MB.
+- **VRAMDedicatedSystem** Retrieves the amount of memory on the dedicated video card.
+- **VRAMSharedSystem** Retrieves the amount of RAM memory that the video card can use.
### Census.Firmware
@@ -1495,49 +1461,54 @@ This event sends Windows Insider data from customers participating in improvemen
The following fields are available:
-- **FlightIds** A list of the different Windows Insider builds on this device.
-- **MSA_Accounts** Represents a list of hashed IDs of the Microsoft Accounts that are flighting (pre-release builds) on this device.
-- **IsFlightsDisabled** Represents if the device is participating in the Windows Insider program.
-- **FlightingBranchName** The name of the Windows Insider branch currently used by the device.
-- **DeviceSampleRate** The telemetry sample rate assigned to the device.
+- **DeviceSampleRate** The diagnostic data sample rate assigned to the device.
- **EnablePreviewBuilds** Used to enable Windows Insider builds on a device.
+- **FlightIds** A list of the different Windows Insider builds on this device.
+- **FlightingBranchName** The name of the Windows Insider branch currently used by the device.
+- **IsFlightsDisabled** Represents if the device is participating in the Windows Insider program.
+- **MSA_Accounts** Represents a list of hashed IDs of the Microsoft Accounts that are flighting (pre-release builds) on this device.
- **SSRK** Retrieves the mobile targeting settings.
### Census.Hardware
-This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support, to help keep Windows up-to-date.
+This event sends data about the device, including hardware type, OEM brand, model line, model, diagnostic data level setting, and TPM support, to help keep Windows up-to-date.
The following fields are available:
+- **ActiveMicCount** The number of active microphones attached to the device.
- **ChassisType** Represents the type of device chassis, such as desktop or low profile desktop. The possible values can range between 1 - 36.
- **ComputerHardwareID** Identifies a device class that is represented by a hash of different SMBIOS fields.
+- **D3DMaxFeatureLevel** The supported Direct3D version.
- **DeviceColor** Indicates a color of the device.
+- **DeviceForm** Indicates the form as per the device classification.
- **DeviceName** The device name that is set by the user.
+- **DigitizerSupport** Is a digitizer supported?
+- **DUID** The device unique ID.
+- **Gyroscope** Indicates whether the device has a gyroscope.
+- **InventoryId** The device ID used for compatibility testing.
+- **Magnetometer** Indicates whether the device has a magnetometer.
+- **NFCProximity** Indicates whether the device supports NFC.
- **OEMDigitalMarkerFileName** The name of the file placed in the \Windows\system32\drivers directory that specifies the OEM and model name of the device.
- **OEMManufacturerName** The device manufacturer name. The OEMName for an inactive device is not reprocessed even if the clean OEM name is changed at a later date.
-- **OEMModelNumber** The device model number.
+- **OEMModelBaseBoard** The baseboard model used by the OEM.
+- **OEMModelBaseBoardVersion** Differentiates between developer and retail devices.
- **OEMModelName** The device model name.
+- **OEMModelNumber** The device model number.
- **OEMModelSKU** The device edition that is defined by the manufacturer.
+- **OEMModelSystemFamily** The system family set on the device by an OEM.
+- **OEMModelSystemVersion** The system model version set on the device by the OEM.
- **OEMOptionalIdentifier** A Microsoft assigned value that represents a specific OEM subsidiary.
- **OEMSerialNumber** The serial number of the device that is set by the manufacturer.
- **PhoneManufacturer** The friendly name of the phone manufacturer.
-- **SoCName** The firmware manufacturer of the device.
-- **DUID** The device unique ID.
-- **InventoryId** The device ID used for compatibility testing.
-- **VoiceSupported** Does the device have a cellular radio capable of making voice calls?
- **PowerPlatformRole** The OEM preferred power management profile. It's used to help to identify the basic form factor of the device.
-- **TPMVersion** The supported Trusted Platform Module (TPM) on the device. If no TPM is present, the value is 0.
+- **SoCName** The firmware manufacturer of the device.
- **StudyID** Used to identify retail and non-retail device.
-- **TelemetryLevel** The telemetry level the user has opted into, such as Basic or Enhanced.
-- **TelemetrySettingAuthority** Determines who set the telemetry level, such as GP, MDM, or the user.
-- **DeviceForm** Indicates the form as per the device classification.
-- **DigitizerSupport** Is a digitizer supported?
-- **OEMModelBaseBoard** The baseboard model used by the OEM.
-- **OEMModelSystemFamily** The system family set on the device by an OEM.
-- **OEMModelBaseBoardVersion** Differentiates between developer and retail devices.
-- **ActiveMicCount** The number of active microphones attached to the device.
-- **OEMModelSystemVersion** The system model version set on the device by the OEM.
+- **TelemetryLevel** The diagnostic data level the user has opted into, such as Basic or Enhanced.
+- **TelemetryLevelLimitEnhanced** The diagnostic data level for Windows Analytics-based solutions.
+- **TelemetrySettingAuthority** Determines who set the diagnostic data level, such as GP, MDM, or the user.
+- **TPMVersion** The supported Trusted Platform Module (TPM) on the device. If no TPM is present, the value is 0.
+- **VoiceSupported** Does the device have a cellular radio capable of making voice calls?
### Census.Memory
@@ -1556,21 +1527,21 @@ This event sends data about the mobile and cellular network used by the device (
The following fields are available:
+- **IMEI0** Represents the International Mobile Station Equipment Identity. This number is usually unique and used by the mobile operator to distinguish different phone hardware. Microsoft does not have access to mobile operator billing data so collecting this data does not expose or identify the user. The two fields represent phone with dual sim coverage.
+- **IMEI1** Represents the International Mobile Station Equipment Identity. This number is usually unique and used by the mobile operator to distinguish different phone hardware. Microsoft does not have access to mobile operator billing data so collecting this data does not expose or identify the user. The two fields represent phone with dual sim coverage.
+- **MCC0** Represents the Mobile Country Code (MCC). It used with the Mobile Network Code (MNC) to uniquely identify a mobile network operator. The two fields represent phone with dual sim coverage.
+- **MCC1** Represents the Mobile Country Code (MCC). It used with the Mobile Network Code (MNC) to uniquely identify a mobile network operator. The two fields represent phone with dual sim coverage.
+- **MEID** Represents the Mobile Equipment Identity (MEID). MEID is a worldwide unique phone ID assigned to CDMA phones. MEID replaces electronic serial number (ESN), and is equivalent to IMEI for GSM and WCDMA phones. Microsoft does not have access to mobile operator billing data so collecting this data does not expose or identify the user.
+- **MNC0** Retrieves the Mobile Network Code (MNC). It used with the Mobile Country Code (MCC) to uniquely identify a mobile network operator. The two fields represent phone with dual sim coverage.
+- **MNC1** Retrieves the Mobile Network Code (MNC). It used with the Mobile Country Code (MCC) to uniquely identify a mobile network operator. The two fields represent phone with dual sim coverage.
- **MobileOperatorBilling** Represents the telephone company that provides services for mobile phone users.
- **MobileOperatorCommercialized** Represents which reseller and geography the phone is commercialized for. This is the set of values on the phone for who and where it was intended to be used. For example, the commercialized mobile operator code AT&T in the US would be ATT-US.
-- **NetworkCost** Represents the network cost associated with a connection.
-- **IMEI0** Represents the International Mobile Station Equipment Identity. This number is usually unique and used by the mobile operator to distinguish different phone hardware. Microsoft does not have access to mobile operator billing data so collecting this data does not expose or identify the user. The two fields represent phone with dual sim coverage.
-- **SPN0** Retrieves the Service Provider Name (SPN). For example, these might be AT&T, Sprint, T-Mobile, or Verizon. The two fields represent phone with dual sim coverage.
- **MobileOperatorNetwork0** Represents the operator of the current mobile network that the device is used on. (AT&T, T-Mobile, Vodafone). The two fields represent phone with dual sim coverage.
-- **MCC0** Represents the Mobile Country Code (MCC). It used with the Mobile Network Code (MNC) to uniquely identify a mobile network operator. The two fields represent phone with dual sim coverage.
-- **MNC0** Retrieves the Mobile Network Code (MNC). It used with the Mobile Country Code (MCC) to uniquely identify a mobile network operator. The two fields represent phone with dual sim coverage.
-- **IMEI1** Represents the International Mobile Station Equipment Identity. This number is usually unique and used by the mobile operator to distinguish different phone hardware. Microsoft does not have access to mobile operator billing data so collecting this data does not expose or identify the user. The two fields represent phone with dual sim coverage.
-- **SPN1** Retrieves the Service Provider Name (SPN). For example, these might be AT&T, Sprint, T-Mobile, or Verizon. The two fields represent phone with dual sim coverage.
- **MobileOperatorNetwork1** Represents the operator of the current mobile network that the device is used on. (AT&T, T-Mobile, Vodafone). The two fields represent phone with dual sim coverage.
-- **MCC1** Represents the Mobile Country Code (MCC). It used with the Mobile Network Code (MNC) to uniquely identify a mobile network operator. The two fields represent phone with dual sim coverage.
-- **MNC1** Retrieves the Mobile Network Code (MNC). It used with the Mobile Country Code (MCC) to uniquely identify a mobile network operator. The two fields represent phone with dual sim coverage.
-- **MEID** Represents the Mobile Equipment Identity (MEID). MEID is a worldwide unique phone ID assigned to CDMA phones. MEID replaces electronic serial number (ESN), and is equivalent to IMEI for GSM and WCDMA phones. Microsoft does not have access to mobile operator billing data so collecting this data does not expose or identify the user.
- **NetworkAdapterGUID** The GUID of the primary network adapter.
+- **NetworkCost** Represents the network cost associated with a connection.
+- **SPN0** Retrieves the Service Provider Name (SPN). For example, these might be AT&T, Sprint, T-Mobile, or Verizon. The two fields represent phone with dual sim coverage.
+- **SPN1** Retrieves the Service Provider Name (SPN). For example, these might be AT&T, Sprint, T-Mobile, or Verizon. The two fields represent phone with dual sim coverage.
### Census.OS
@@ -1579,39 +1550,41 @@ This event sends data about the operating system such as the version, locale, up
The following fields are available:
+- **ActivationChannel** Retrieves the retail license key or Volume license key for a machine.
+- **AssignedAccessStatus** The kiosk configuration mode.
+- **CompactOS** Indicates if the Compact OS feature from Win10 is enabled.
+- **DeveloperUnlockStatus** "Represents if a device has been developer unlocked by the user or Group Policy. "
+- **DeviceTimeZone** The time zone that is set on the device. Example: Pacific Standard Time
- **GenuineState** Retrieves the ID Value specifying the OS Genuine check.
+- **InstallationType** Retrieves the type of OS installation. (Clean, Upgrade, Reset, Refresh, Update).
+- **InstallLanguage** The first language installed on the user machine.
+- **IsDeviceRetailDemo** Retrieves if the device is running in demo mode.
+- **IsEduData** Returns Boolean if the education data policy is enabled.
- **IsPortableOperatingSystem** Retrieves whether OS is running Windows-To-Go
- **IsSecureBootEnabled** Retrieves whether Boot chain is signed under UEFI.
-- **InstallationType** Retrieves the type of OS installation. (Clean, Upgrade, Reset, Refresh, Update).
+- **LanguagePacks** The list of language packages installed on the device.
+- **LicenseStateReason** Retrieves why (or how) a system is licensed or unlicensed. The HRESULT may indicate an error code that indicates a key blocked error, or it may indicate that we are running an OS License granted by the Microsoft Store.
+- **OA3xOriginalProductKey** Retrieves the License key stamped by the OEM to the machine.
+- **OSEdition** Retrieves the version of the current OS.
+- **OSInstallDateTime** Retrieves the date the OS was installed using ISO 8601 (Date part) == yyyy-mm-dd
- **OSInstallType** Retrieves a numeric description of what install was used on the device i.e. clean, upgrade, refresh, reset, etc
- **OSOOBEDateTime** Retrieves Out of Box Experience (OOBE) Date in Coordinated Universal Time (UTC).
- **OSSKU** Retrieves the Friendly Name of OS Edition.
+- **OSSubscriptionStatus** Represents the existing status for enterprise subscription feature for PRO machines.
+- **OSSubscriptionTypeId** Returns boolean for enterprise subscription feature for selected PRO machines.
- **OSTimeZoneBiasInMins** Retrieves the time zone set on machine.
- **OSUILocale** Retrieves the locale of the UI that is currently used by the OS.
-- **RACw7Id** Retrieves the Microsoft Reliability Analysis Component (RAC) Win7 Identifier. RAC is used to monitor and analyze system usage and reliability.
-- **CompactOS** Indicates if the Compact OS feature from Win10 is enabled.
-- **Signature** Retrieves if it is a signature machine sold by Microsoft store.
-- **IsDeviceRetailDemo** Retrieves if the device is running in demo mode.
-- **ActivationChannel** Retrieves the retail license key or Volume license key for a machine.
-- **LicenseStateReason** Retrieves why (or how) a system is licensed or unlicensed. The HRESULT may indicate an error code that indicates a key blocked error, or it may indicate that we are running an OS License granted by the MS store.
-- **OA3xOriginalProductKey** Retrieves the License key stamped by the OEM to the machine.
-- **ProductKeyID2** Retrieves the License key if the machine is updated with a new license key.
-- **ServiceMachineIP** Retrieves the IP address of the KMS host used for anti-piracy.
-- **ServiceProductKeyID** Retrieves the License key of the KMS
-- **LanguagePacks** The list of language packages installed on the device.
-- **InstallLanguage** The first language installed on the user machine.
-- **IsEduData** Returns Boolean if the education data policy is enabled.
-- **SharedPCMode** Returns Boolean for education devices used as shared cart
-- **SLICVersion** Returns OS type/version from SLIC table.
-- **SLICStatus** Whether a SLIC table exists on the device.
-- **OSEdition** Retrieves the version of the current OS.
-- **ProductActivationTime** Returns the OS Activation time for tracking piracy issues.
- **ProductActivationResult** Returns Boolean if the OS Activation was successful.
-- **OSSubscriptionTypeId** Returns boolean for enterprise subscription feature for selected PRO machines.
-- **OSSubscriptionStatus** Represents the existing status for enterprise subscription feature for PRO machines.
+- **ProductActivationTime** Returns the OS Activation time for tracking piracy issues.
+- **ProductKeyID2** Retrieves the License key if the machine is updated with a new license key.
+- **RACw7Id** Retrieves the Microsoft Reliability Analysis Component (RAC) Win7 Identifier. RAC is used to monitor and analyze system usage and reliability.
+- **ServiceMachineIP** Retrieves the IP address of the KMS host used for anti-piracy.
- **ServiceMachinePort** Retrieves the port of the KMS host used for anti-piracy.
-- **DeviceTimeZone** The time zone that is set on the device. Example: Pacific Standard Time
-- **DeveloperUnlockStatus** Represents if a device has been developer unlocked by the user or Group Policy.
+- **ServiceProductKeyID** Retrieves the License key of the KMS
+- **SharedPCMode** Returns Boolean for education devices used as shared cart
+- **Signature** Retrieves if it is a signature machine sold by Microsoft store.
+- **SLICStatus** Whether a SLIC table exists on the device.
+- **SLICVersion** Returns OS type/version from SLIC table.
### Census.Processor
@@ -1620,31 +1593,15 @@ This event sends data about the processor (architecture, speed, number of cores,
The following fields are available:
-- **ProcessorCores** Retrieves the number of cores in the processor.
-- **ProcessorPhysicalCores** Number of physical cores in the processor.
- **ProcessorArchitecture** Retrieves the processor architecture of the installed operating system. The complete list of values can be found in DimProcessorArchitecture.
- **ProcessorClockSpeed** Retrieves the clock speed of the processor in MHz.
+- **ProcessorCores** Retrieves the number of cores in the processor.
+- **ProcessorIdentifier** The processor identifier of a manufacturer.
- **ProcessorManufacturer** Retrieves the name of the processor's manufacturer.
- **ProcessorModel** Retrieves the name of the processor model.
+- **ProcessorPhysicalCores** Number of physical cores in the processor.
+- **ProcessorUpdateRevision** The microcode version.
- **SocketCount** Number of physical CPU sockets of the machine.
-- **ProcessorIdentifier** The processor identifier of a manufacturer.
-
-
-### Census.Speech
-
-This event is used to gather basic speech settings on the device.
-
-The following fields are available:
-
-- **AboveLockEnabled** Cortana setting that represents if Cortana can be invoked when the device is locked.
-- **GPAllowInputPersonalization** Indicates if a Group Policy setting has enabled speech functionalities.
-- **HolographicSpeechInputDisabled** Holographic setting that represents if the attached HMD devices have speech functionality disabled by the user.
-- **HolographicSpeechInputDisabledRemote** Indicates if a remote policy has disabled speech functionalities for the HMD devices.
-- **KWSEnabled** Cortana setting that represents if a user has enabled the "Hey Cortana" keyword spotter (KWS).
-- **MDMAllowInputPersonalization** Indicates if an MDM policy has enabled speech functionalities.
-- **RemotelyManaged** Indicates if the device is being controlled by a remote administrator (MDM or Group Policy) in the context of speech functionalities.
-- **SpeakerIdEnabled** Cortana setting that represents if keyword detection has been trained to try to respond to a single user's voice.
-- **SpeechServicesEnabled** Windows setting that represents whether a user is opted-in for speech services on the device.
### Census.Storage
@@ -1654,8 +1611,35 @@ This event sends data about the total capacity of the system volume and primary
The following fields are available:
- **PrimaryDiskTotalCapacity** Retrieves the amount of disk space on the primary disk of the device in MB.
-- **SystemVolumeTotalCapacity** Retrieves the size of the partition that the System volume is installed on in MB.
- **PrimaryDiskType** Retrieves an enumerator value of type STORAGE_BUS_TYPE that indicates the type of bus to which the device is connected. This should be used to interpret the raw device properties at the end of this structure (if any).
+- **SystemVolumeTotalCapacity** Retrieves the size of the partition that the System volume is installed on in MB.
+
+
+### Census.VM
+
+This event sends data indicating whether virtualization is enabled on the device, and its various characteristics, to help keep Windows up to date.
+
+The following fields are available:
+
+- **CloudService** Indicates which cloud service, if any, that this virtual machine is running within.
+- **HyperVisor** Retrieves whether the current OS is running on top of a Hypervisor.
+- **IOMMUPresent** Represents if an input/output memory management unit (IOMMU) is present.
+- **isVDI** Is the device using Virtual Desktop Infrastructure?
+- **IsVirtualDevice** Retrieves that when the Hypervisor is Microsoft's Hyper-V Hypervisor or other Hv#HASH#1 Hypervisor, this field will be set to FALSE for the Hyper-V host OS and TRUE for any guest OS's. This field should not be relied upon for non-Hv#HASH#1 Hypervisors.
+- **SLATSupported** Represents whether Second Level Address Translation (SLAT) is supported by the hardware.
+- **VirtualizationFirmwareEnabled** Represents whether virtualization is enabled in the firmware.
+
+
+### Census.Xbox
+
+This event sends data about the Xbox Console, such as Serial Number and DeviceId, to help keep Windows up to date.
+
+The following fields are available:
+
+- **XboxConsolePreferredLanguage** Retrieves the preferred language selected by the user on Xbox console.
+- **XboxConsoleSerialNumber** Retrieves the serial number of the Xbox console.
+- **XboxLiveDeviceId** Retrieves the unique device id of the console.
+- **XboxLiveSandboxId** Retrieves the developer sandbox id if the device is internal to MS.
### Census.Userdefault
@@ -1664,29 +1648,8 @@ This event sends data about the current user's default preferences for browser a
The following fields are available:
-- **DefaultBrowserProgId** The ProgramId of the current user's default browser
- **DefaultApp** The current uer's default program selected for the following extension or protocol: .html,.htm,.jpg,.jpeg,.png,.mp3,.mp4, .mov,.pdf
-
-
-### Census.UserDisplay
-
-This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system, to help keep Windows up to date.
-
-The following fields are available:
-
-- **InternalPrimaryDisplayLogicalDPIX** Retrieves the logical DPI in the x-direction of the internal display.
-- **InternalPrimaryDisplayLogicalDPIY** Retrieves the logical DPI in the y-direction of the internal display.
-- **InternalPrimaryDisplayPhysicalDPIX** Retrieves the physical DPI in the x-direction of the internal display.
-- **InternalPrimaryDisplayPhysicalDPIY** Retrieves the physical DPI in the y-direction of the internal display.
-- **InternalPrimaryDisplayResolutionHorizontal** Retrieves the number of pixels in the horizontal direction of the internal display.
-- **InternalPrimaryDisplayResolutionVertical** Retrieves the number of pixels in the vertical direction of the internal display.
-- **InternalPrimaryDisplaySizePhysicalH** Retrieves the physical horizontal length of the display in mm. Used for calculating the diagonal length in inches .
-- **InternalPrimaryDisplaySizePhysicalY** Retrieves the physical vertical length of the display in mm. Used for calculating the diagonal length in inches
-- **NumberofInternalDisplays** Retrieves the number of internal displays in a machine.
-- **NumberofExternalDisplays** Retrieves the number of external displays connected to the machine
-- **VRAMDedicated** Retrieves the video RAM in MB.
-- **VRAMDedicatedSystem** Retrieves the amount of memory on the dedicated video card.
-- **VRAMSharedSystem** Retrieves the amount of RAM memory that the video card can use.
+- **DefaultBrowserProgId** The ProgramId of the current user's default browser
### Census.UserNLS
@@ -1696,23 +1659,10 @@ This event sends data about the default app language, input, and display languag
The following fields are available:
- **DefaultAppLanguage** The current user Default App Language.
-- **HomeLocation** The current user location, which is populated using GetUserGeoId() function.
- **DisplayLanguage** The current user preferred Windows Display Language.
-- **SpeechInputLanguages** The Speech Input languages installed on the device.
+- **HomeLocation** The current user location, which is populated using GetUserGeoId() function.
- **KeyboardInputLanguages** The Keyboard input languages installed on the device.
-
-
-### Census.VM
-
-This event sends data indicating whether virtualization is enabled on the device, and its various characteristics, to help keep Windows up to date.
-
-The following fields are available:
-
-- **VirtualizationFirmwareEnabled** Represents whether virtualization is enabled in the firmware.
-- **SLATSupported** Represents whether Second Level Address Translation (SLAT) is supported by the hardware.
-- **IOMMUPresent** Represents if an input/output memory management unit (IOMMU) is present.
-- **IsVirtualDevice** Retrieves that when the Hypervisor is Microsoft's Hyper-V Hypervisor or other Hv#1 Hypervisor, this field will be set to FALSE for the Hyper-V host OS and TRUE for any guest OS's. This field should not be relied upon for non-Hv#1 Hypervisors.
-- **HyperVisor** Retrieves whether the current OS is running on top of a Hypervisor.
+- **SpeechInputLanguages** The Speech Input languages installed on the device.
### Census.WU
@@ -1721,80 +1671,103 @@ This event sends data about the Windows update server and other App store polici
The following fields are available:
-- **WUMachineId** Retrieves the Windows Update (WU) Machine Identifier.
-- **WUServer** Retrieves the HTTP(S) URL of the WSUS server that is used by Automatic Updates and API callers (by default).
-- **WUDODownloadMode** Retrieves whether DO is turned on and how to acquire/distribute updates Delivery Optimization (DO) allows users to deploy previously downloaded WU updates to other devices on the same network.
-- **OSWUAutoUpdateOptions** Retrieves the auto update settings on the device.
-- **AppStoreAutoUpdate** Retrieves the Appstore settings for auto upgrade. (Enable/Disabled).
-- **AppStoreAutoUpdatePolicy** Retrieves the Microsoft Store App Auto Update group policy setting
-- **AppStoreAutoUpdateMDM** Retrieves the App Auto Update value for MDM: 0 - Disallowed. 1 - Allowed. 2 - Not configured. Default: [2] Not configured
-- **DelayUpgrade** Retrieves the Windows upgrade flag for delaying upgrades.
-- **UpdateServiceURLConfigured** Retrieves if the device is managed by Windows Server Update Services (WSUS).
-- **WUDeferUpgradePeriod** Retrieves if deferral is set for Upgrades
-- **WUDeferUpdatePeriod** Retrieves if deferral is set for Updates
-- **WUPauseState** Retrieves WU setting to determine if updates are paused
-- **OSUninstalled** A flag that represents when a feature update is uninstalled on a device .
-- **OSRolledBack** A flag that represents when a feature update has rolled back during setup.
-- **OSRollbackCount** The number of times feature updates have rolled back on the device.
-- **UninstallActive** A flag that represents when a device has uninstalled a previous upgrade recently.
- **AppraiserGatedStatus** Indicates whether a device has been gated for upgrading.
+- **AppStoreAutoUpdate** Retrieves the Appstore settings for auto upgrade. (Enable/Disabled).
+- **AppStoreAutoUpdateMDM** Retrieves the App Auto Update value for MDM: 0 - Disallowed. 1 - Allowed. 2 - Not configured. Default: [2] Not configured
+- **AppStoreAutoUpdatePolicy** Retrieves the Windows Store App Auto Update group policy setting
+- **DelayUpgrade** Retrieves the Windows upgrade flag for delaying upgrades.
+- **OSAssessmentFeatureOutOfDate** How many days has it been since a the last feature update was released but the device did not install it?
+- **OSAssessmentForFeatureUpdate** Is the device is on the latest feature update?
+- **OSAssessmentForQualityUpdate** Is the device on the latest quality update?
+- **OSAssessmentForSecurityUpdate** Is the device on the latest security update?
+- **OSAssessmentQualityOutOfDate** How many days has it been since a the last quality update was released but the device did not install it?
+- **OSAssessmentReleaseInfoTime** The freshness of release information used to perform an assessment.
+- **OSRollbackCount** The number of times feature updates have rolled back on the device.
+- **OSRolledBack** A flag that represents when a feature update has rolled back during setup.
+- **OSUninstalled** A flag that represents when a feature update is uninstalled on a device .
+- **OSWUAutoUpdateOptions** Retrieves the auto update settings on the device.
+- **UninstallActive** A flag that represents when a device has uninstalled a previous upgrade recently.
+- **UpdateServiceURLConfigured** Retrieves if the device is managed by Windows Server Update Services (WSUS).
+- **WUDeferUpdatePeriod** Retrieves if deferral is set for Updates
+- **WUDeferUpgradePeriod** Retrieves if deferral is set for Upgrades
+- **WUDODownloadMode** Retrieves whether DO is turned on and how to acquire/distribute updates Delivery Optimization (DO) allows users to deploy previously downloaded WU updates to other devices on the same network.
+- **WUMachineId** Retrieves the Windows Update (WU) Machine Identifier.
+- **WUPauseState** Retrieves WU setting to determine if updates are paused
+- **WUServer** Retrieves the HTTP(S) URL of the WSUS server that is used by Automatic Updates and API callers (by default).
-### Census.Xbox
+### Census.Speech
-This event sends data about the Xbox Console, such as Serial Number and DeviceId, to help keep Windows up to date.
+This event is used to gather basic speech settings on the device.
The following fields are available:
-- **XboxLiveDeviceId** Retrieves the unique device id of the console.
-- **XboxConsoleSerialNumber** Retrieves the serial number of the Xbox console.
-- **XboxLiveSandboxId** Retrieves the developer sandbox id if the device is internal to MS.
-- **XboxConsolePreferredLanguage** Retrieves the preferred language selected by the user on Xbox console.
+- **AboveLockEnabled** Cortana setting that represents if Cortana can be invoked when the device is locked.
+- **GPAllowInputPersonalization** Indicates if a Group Policy setting has enabled speech functionalities.
+- **HolographicSpeechInputDisabled** Holographic setting that represents if the attached HMD devices have speech functionality disabled by the user.
+- **HolographicSpeechInputDisabledRemote** Indicates if a remote policy has disabled speech functionalities for the HMD devices.
+- **KWSEnabled** "Cortana setting that represents if a user has enabled the ""Hey Cortana"" keyword spotter (KWS)."
+- **MDMAllowInputPersonalization** Indicates if an MDM policy has enabled speech functionalities.
+- **RemotelyManaged** Indicates if the device is being controlled by a remote admininistrator (MDM or Group Policy) in the context of speech functionalities.
+- **SpeakerIdEnabled** Cortana setting that represents if keyword detection has been trained to try to respond to a single user's voice.
+- **SpeechServicesEnabled** Windows setting that represents whether a user is opted-in for speech services on the device.
+
+### Census.Security
+
+This event provides information on about security settings used to help keep Windows up-to-date and secure.
+
+- **AvailableSecurityProperties** Enumerates and reports state on the relevant security properties for Device Guard.
+- **CGRunning** Is Credential Guard running?
+- **DGState** A summary of the Device Guard state.
+- **HVCIRunning** Is HVCI running?
+- **RequiredSecurityProperties** Describes the required security properties to enable virtualization-based security.
+- **SecureBootCapable** Is this device capable of running Secure Boot?
+- **VBSState** Is virtualization-based security enabled, disabled, or running?
## Diagnostic data events
-### TelClientSynthetic.AuthorizationInfo_RuntimeTransition
-
-This event sends data indicating that a device has undergone a change of telemetry opt-in level during the runtime of the device (not at UTC boot or offline), to help keep Windows up to date.
-
-The following fields are available:
-
-- **CanAddMsaToMsTelemetry** True if UTC is allowed to add MSA user identity onto telemetry from the OS provider groups.
-- **CanCollectAnyTelemetry** True if UTC is allowed to collect non-OS telemetry. Non-OS telemetry is responsible for providing its own opt-in mechanism.
-- **CanCollectCoreTelemetry** True if UTC is allowed to collect data which is tagged with both MICROSOFT_KEYWORD_CRITICAL_DATA and MICROSOFT_EVENTTAG_CORE_DATA.
-- **CanCollectHeartbeats** True if UTC is allowed to collect heartbeats.
-- **CanCollectOsTelemetry** True if UTC is allowed to collect telemetry from the OS provider groups (often called Microsoft Telemetry).
-- **CanPerformDiagnosticEscalations** True if UTC is allowed to perform all scenario escalations.
-- **CanPerformScripting** True if UTC is allowed to perform scripting.
-- **CanPerformTraceEscalations** True if UTC is allowed to perform scenario escalations with tracing actions.
-- **CanReportScenarios** True if UTC is allowed to load and report scenario completion, failure, and cancellation events.
-- **TransitionFromEverythingOff** True if this transition is moving from not allowing core telemetry to allowing core telemetry.
-- **PreviousPermissions** Bitmask representing the previously configured permissions since the telemetry opt-in level was last changed.
-
-
### TelClientSynthetic.AuthorizationInfo_Startup
-This event sends data indicating that a device has undergone a change of telemetry opt-in level detected at UTC startup, to help keep Windows up to date.
+This event sends data indicating that a device has undergone a change of diagnostic data opt-in level detected at UTC startup, to help keep Windows up to date.
The following fields are available:
-- **TransitionFromEverythingOff** True if this transition is moving from not allowing core telemetry to allowing core telemetry.
-- **CanCollectAnyTelemetry** True if UTC is allowed to collect non-OS telemetry. Non-OS telemetry is responsible for providing its own opt-in mechanism.
-- **CanCollectHeartbeats** True if UTC is allowed to collect heartbeats.
+- **CanAddMsaToMsTelemetry** True if UTC is allowed to add MSA user identity onto diagnostic data from the OS provider groups.
+- **CanCollectAnyTelemetry** True if UTC is allowed to collect non-OS diagnostic data. Non-OS diagnostic data is responsible for providing its own opt-in mechanism.
- **CanCollectCoreTelemetry** True if UTC is allowed to collect data which is tagged with both MICROSOFT_KEYWORD_CRITICAL_DATA and MICROSOFT_EVENTTAG_CORE_DATA.
-- **CanCollectOsTelemetry** True if UTC is allowed to collect telemetry from the OS provider groups (often called Microsoft Telemetry).
-- **CanReportScenarios** True if UTC is allowed to load and report scenario completion, failure, and cancellation events.
-- **CanAddMsaToMsTelemetry** True if UTC is allowed to add MSA user identity onto telemetry from the OS provider groups.
-- **CanPerformTraceEscalations** True if UTC is allowed to perform scenario escalations with tracing actions.
+- **CanCollectHeartbeats** True if UTC is allowed to collect heartbeats.
+- **CanCollectOsTelemetry** True if UTC is allowed to collect diagnostic data from the OS provider groups.
- **CanPerformDiagnosticEscalations** True if UTC is allowed to perform all scenario escalations.
- **CanPerformScripting** True if UTC is allowed to perform scripting.
-- **PreviousPermissions** Bitmask representing the previously configured permissions since the telemetry client was last started.
+- **CanPerformTraceEscalations** True if UTC is allowed to perform scenario escalations with tracing actions.
+- **CanReportScenarios** True if UTC is allowed to load and report scenario completion, failure, and cancellation events.
+- **PreviousPermissions** Bitmask representing the previously configured permissions since the diagnostic data client was last started.
+- **TransitionFromEverythingOff** True if this transition is moving from not allowing core diagnostic data to allowing core diagnostic data.
+
+
+### TelClientSynthetic.AuthorizationInfo_RuntimeTransition
+
+This event sends data indicating that a device has undergone a change of diagnostic data opt-in level during the runtime of the device (not at UTC boot or offline), to help keep Windows up to date.
+
+The following fields are available:
+
+- **CanAddMsaToMsTelemetry** True if UTC is allowed to add MSA user identity onto diagnostic data from the OS provider groups.
+- **CanCollectAnyTelemetry** True if UTC is allowed to collect non-OS diagnostic data. Non-OS diagnostic data is responsible for providing its own opt-in mechanism.
+- **CanCollectCoreTelemetry** True if UTC is allowed to collect data which is tagged with both MICROSOFT_KEYWORD_CRITICAL_DATA and MICROSOFT_EVENTTAG_CORE_DATA.
+- **CanCollectHeartbeats** True if UTC is allowed to collect heartbeats.
+- **CanCollectOsTelemetry** True if UTC is allowed to collect diagnostic data from the OS provider groups.
+- **CanPerformDiagnosticEscalations** True if UTC is allowed to perform all scenario escalations.
+- **CanPerformScripting** True if UTC is allowed to perform scripting.
+- **CanPerformTraceEscalations** True if UTC is allowed to perform scenario escalations with tracing actions.
+- **CanReportScenarios** True if UTC is allowed to load and report scenario completion, failure, and cancellation events.
+- **PreviousPermissions** Bitmask representing the previously configured permissions since the diagnostic data opt-in level was last changed.
+- **TransitionFromEverythingOff** True if this transition is moving from not allowing core diagnostic data to allowing core diagnostic data.
### TelClientSynthetic.ConnectivityHeartBeat_0
-This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it fires an event. A Connectivity Heartbeat event also fires when a device recovers from costed network to free network.
+This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads diagnostic data events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it fires an event. A Connectivity Heartbeat event also fires when a device recovers from costed network to free network.
The following fields are available:
@@ -1802,53 +1775,53 @@ The following fields are available:
- **CensusStartTime** Returns timestamp corresponding to last successful census run.
- **CensusTaskEnabled** Returns Boolean value for the census task (Enable/Disable) on client machine.
- **LastConnectivityLossTime** Retrieves the last time the device lost free network.
+- **LastConntectivityLossTime** Retrieves the last time the device lost free network.
- **NetworkState** Retrieves the network state: 0 = No network. 1 = Restricted network. 2 = Free network.
- **NoNetworkTime** Retrieves the time spent with no network (since the last time) in seconds.
- **RestrictedNetworkTime** Retrieves the time spent on a metered (cost restricted) network in seconds.
-- **LastConntectivityLossTime** Retrieves the last time the device lost free network.
### TelClientSynthetic.HeartBeat_5
-This event sends data about the health and quality of the telemetry data from the given device, to help keep Windows up to date. It also enables data analysts to determine how 'trusted' the data is from a given device.
+This event sends data about the health and quality of the diagnostic data data from the given device, to help keep Windows up to date. It also enables data analysts to determine how 'trusted' the data is from a given device.
The following fields are available:
-- **PreviousHeartBeatTime** The time of last heartbeat event. This allows chaining of events.
-- **EtwDroppedCount** The number of events dropped by the ETW layer of the telemetry client.
-- **ConsumerDroppedCount** The number of events dropped by the consumer layer of the telemetry client.
-- **DecodingDroppedCount** The number of events dropped because of decoding failures.
-- **ThrottledDroppedCount** The number of events dropped due to throttling of noisy providers.
-- **DbDroppedCount** The number of events that were dropped because the database was full.
-- **EventSubStoreResetCounter** The number of times the event database was reset.
-- **EventSubStoreResetSizeSum** The total size of the event database across all resets reports in this instance.
-- **CriticalOverflowEntersCounter** The number of times a critical overflow mode was entered into the event database.
-- **EnteringCriticalOverflowDroppedCounter** The number of events that was dropped because a critical overflow mode was initiated.
-- **UploaderDroppedCount** The number of events dropped by the uploader layer of the telemetry client.
-- **InvalidHttpCodeCount** The number of invalid HTTP codes received from Vortex.
-- **LastInvalidHttpCode** The last invalid HTTP code received from Vortex.
-- **MaxInUseScenarioCounter** The soft maximum number of scenarios loaded by the Connected User Experience and Telemetry component.
-- **LastEventSizeOffender** The name of the last event that exceeded the maximum event size.
-- **SettingsHttpAttempts** The number of attempts to contact the OneSettings service.
-- **SettingsHttpFailures** The number of failures from contacting the OneSettings service.
-- **VortexHttpAttempts** The number of attempts to contact the Vortex service.
-- **EventsUploaded** The number of events that have been uploaded.
-- **DbCriticalDroppedCount** The total number of dropped critical events in the event database.
-- **VortexHttpFailures4xx** The number of 400-499 error codes received from Vortex.
-- **VortexHttpFailures5xx** The number of 500-599 error codes received from Vortex.
-- **VortexFailuresTimeout** The number of timeout failures received from Vortex.
-- **HeartBeatSequenceNumber** A monotonically increasing heartbeat counter.
-- **EtwDroppedBufferCount** The number of buffers dropped in the CUET ETW session.
-- **FullTriggerBufferDroppedCount** The number of events that were dropped because the trigger buffer was full.
-- **CriticalDataThrottleDroppedCount** The number of critical data sampled events that were dropped because of throttling.
-- **CriticalDataDbDroppedCount** The number of critical data sampled events that were dropped at the database layer.
-- **MaxActiveAgentConnectionCount** The maximum number of active agents during this heartbeat timeframe.
- **AgentConnectionErrorsCount** The number of non-timeout errors associated with the host/agent channel.
-- **LastAgentConnectionError** The last non-timeout error that happened in the host/agent channel.
-- **Flags** Flags that indicate device state, such as network, battery, and opt-in state.
-- **CensusTaskEnabled** Indicates whether Census is enabled.
- **CensusExitCode** The last exit code of the Census task.
- **CensusStartTime** The time of the last Census run.
+- **CensusTaskEnabled** Indicates whether Census is enabled.
+- **ConsumerDroppedCount** The number of events dropped by the consumer layer of the diagnostic data client.
+- **CriticalDataDbDroppedCount** The number of critical data sampled events that were dropped at the database layer.
+- **CriticalDataThrottleDroppedCount** The number of critical data sampled events that were dropped because of throttling.
+- **CriticalOverflowEntersCounter** The number of times a critical overflow mode was entered into the event database.
+- **DbCriticalDroppedCount** The total number of dropped critical events in the event database.
+- **DbDroppedCount** The number of events that were dropped because the database was full.
+- **DecodingDroppedCount** The number of events dropped because of decoding failures.
+- **EnteringCriticalOverflowDroppedCounter** The number of events that was dropped because a critical overflow mode was initiated.
+- **EtwDroppedBufferCount** The number of buffers dropped in the CUET ETW session.
+- **EtwDroppedCount** The number of events dropped by the ETW layer of the diagnostic data client.
+- **EventSubStoreResetCounter** The number of times the event database was reset.
+- **EventSubStoreResetSizeSum** The total size of the event database across all resets reports in this instance.
+- **EventsUploaded** The number of events that have been uploaded.
+- **Flags** Flags that indicate device state, such as network, battery, and opt-in state.
+- **FullTriggerBufferDroppedCount** The number of events that were dropped because the trigger buffer was full.
+- **HeartBeatSequenceNumber** A monotonically increasing heartbeat counter.
+- **InvalidHttpCodeCount** The number of invalid HTTP codes received from Vortex.
+- **LastAgentConnectionError** The last non-timeout error that happened in the host/agent channel.
+- **LastEventSizeOffender** The name of the last event that exceeded the maximum event size.
+- **LastInvalidHttpCode** The last invalid HTTP code received from Vortex.
+- **MaxActiveAgentConnectionCount** The maximum number of active agents during this heartbeat timeframe.
+- **MaxInUseScenarioCounter** The soft maximum number of scenarios loaded by the Connected User Experience and Telemetry component.
+- **PreviousHeartBeatTime** The time of last heartbeat event. This allows chaining of events.
+- **SettingsHttpAttempts** The number of attempts to contact the OneSettings service.
+- **SettingsHttpFailures** The number of failures from contacting the OneSettings service.
+- **ThrottledDroppedCount** The number of events dropped due to throttling of noisy providers.
+- **UploaderDroppedCount** The number of events dropped by the uploader layer of the diagnostic data client.
+- **VortexFailuresTimeout** The number of timeout failures received from Vortex.
+- **VortexHttpAttempts** The number of attempts to contact the Vortex service.
+- **VortexHttpFailures4xx** The number of 400-499 error codes received from Vortex.
+- **VortexHttpFailures5xx** The number of 500-599 error codes received from Vortex.
### TelClientSynthetic.PrivacySettingsAfterCreatorsUpdate
@@ -1869,39 +1842,39 @@ This event sends basic GPU and display driver information to keep Windows and di
The following fields are available:
-- **version** The event version.
-- **bootId** The system boot ID.
- **aiSeqId** The event sequence ID.
-- **MeasureEnabled** Is the device listening to MICROSOFT_KEYWORD_MEASURES?
-- **TelemetryEnabled** Is the device listening to MICROSOFT_KEYWORD_TELEMETRY?
-- **InterfaceId** The GPU interface ID.
-- **GPUVendorID** The GPU vendor ID.
-- **GPUDeviceID** The GPU device ID.
-- **SubVendorID** The GPU sub vendor ID.
-- **SubSystemID** The subsystem ID.
-- **GPURevisionID** The GPU revision ID.
-- **DriverVersion** The display driver version.
+- **bootId** The system boot ID.
+- **ComputePreemptionLevel** The maximum preemption level supported by GPU for compute payload.
+- **DedicatedSystemMemoryB** The amount of system memory dedicated for GPU use (in bytes).
+- **DedicatedVideoMemoryB** The amount of dedicated VRAM of the GPU (in bytes).
+- **DisplayAdapterLuid** The display adapter LUID.
- **DriverDate** The date of the display driver.
- **DriverRank** The rank of the display driver.
-- **IsMiracastSupported** Does the GPU support Miracast?
-- **IsMsMiracastSupported** Are the GPU Miracast capabilities driven by a Microsoft solution?
+- **DriverVersion** The display driver version.
+- **GPUDeviceID** The GPU device ID.
+- **GPUPreemptionLevel** The maximum preemption level supported by GPU for graphics payload.
+- **GPURevisionID** The GPU revision ID.
+- **GPUVendorID** The GPU vendor ID.
+- **InterfaceId** The GPU interface ID.
+- **IsDisplayDevice** Does the GPU have displaying capabilities?
- **IsHybridDiscrete** Does the GPU have discrete GPU capabilities in a hybrid device?
- **IsHybridIntegrated** Does the GPU have integrated GPU capabilities in a hybrid device?
-- **IsMPOSupported** Does the GPU support Multi-Plane Overlays?
- **IsLDA** Is the GPU comprised of Linked Display Adapters?
+- **IsMiracastSupported** Does the GPU support Miracast?
- **IsMismatchLDA** Is at least one device in the Linked Display Adapters chain from a different vendor?
+- **IsMPOSupported** Does the GPU support Multi-Plane Overlays?
+- **IsMsMiracastSupported** Are the GPU Miracast capabilities driven by a Microsoft solution?
- **IsPostAdapter** Is this GPU the POST GPU in the device?
-- **IsSoftwareDevice** Is this a software implementation of the GPU?
- **IsRenderDevice** Does the GPU have rendering capabilities?
-- **IsDisplayDevice** Does the GPU have displaying capabilities?
-- **WDDMVersion** The Windows Display Driver Model version.
-- **DisplayAdapterLuid** The display adapter LUID.
-- **GPUPreemptionLevel** The maximum preemption level supported by GPU for graphics payload.
-- **ComputePreemptionLevel** The maximum preemption level supported by GPU for compute payload.
-- **TelInvEvntTrigger** What triggered this event to be logged? Example: 0 (GPU enumeration) or 1 (DxgKrnlTelemetry provider toggling)
-- **DedicatedVideoMemoryB** The amount of dedicated VRAM of the GPU (in bytes).
-- **DedicatedSystemMemoryB** The amount of system memory dedicated for GPU use (in bytes).
+- **IsSoftwareDevice** Is this a software implementation of the GPU?
+- **MeasureEnabled** Is the device listening to MICROSOFT_KEYWORD_MEASURES?
- **SharedSystemMemoryB** The amount of system memory shared by GPU and CPU (in bytes).
+- **SubSystemID** The subsystem ID.
+- **SubVendorID** The GPU sub vendor ID.
+- **TelemetryEnabled** Is the device listening to MICROSOFT_KEYWORD_TELEMETRY?
+- **TelInvEvntTrigger** What triggered this event to be logged? Example: 0 (GPU enumeration) or 1 (DxgKrnlTelemetry provider toggling)
+- **version** The event version.
+- **WDDMVersion** The Windows Display Driver Model version.
- **NumVidPnSources** The number of supported display output sources.
- **NumVidPnTargets** The number of supported display output targets.
@@ -1910,31 +1883,52 @@ The following fields are available:
### Microsoft.Windows.FaultReporting.AppCrashEvent
-This event sends data about crashes for both native and managed applications, to help keep Windows up to date. The data includes information about the crashing process and a summary of its exception record. It does not contain any Watson bucketing information. The bucketing information is recorded in a Windows Error Reporting (WER) event that is generated when the WER client reports the crash to the Watson service, and the WER event will contain the same ReportID (see field 14 of crash event, field 19 of WER event) as the crash event for the crash being reported. AppCrash is emitted once for each crash handled by WER (e.g. from an unhandled exception or FailFast or ReportException). Note that Generic Watson event types (e.g. from PLM) that may be considered crashes" by a user DO NOT emit this event.
+"This event sends data about crashes for both native and managed applications, to help keep Windows up to date. The data includes information about the crashing process and a summary of its exception record. It does not contain any Watson bucketing information. The bucketing information is recorded in a Windows Error Reporting (WER) event that is generated when the WER client reports the crash to the Watson service, and the WER event will contain the same ReportID (see field 14 of crash event, field 19 of WER event) as the crash event for the crash being reported. AppCrash is emitted once for each crash handled by WER (e.g. from an unhandled exception or FailFast or ReportException). Note that Generic Watson event types (e.g. from PLM) that may be considered crashes"" by a user DO NOT emit this event."
The following fields are available:
-- **ProcessId** The ID of the process that has crashed.
-- **ProcessCreateTime** The time of creation of the process that has crashed.
+- **AppName** The name of the app that has crashed.
+- **AppSessionGuid** GUID made up of process ID and is used as a correlation vector for process instances in the diagnostic data backend.
+- **AppTimeStamp** The date/time stamp of the app.
+- **AppVersion** The version of the app that has crashed.
- **ExceptionCode** The exception code returned by the process that has crashed.
- **ExceptionOffset** The address where the exception had occurred.
-- **AppName** The name of the app that has crashed.
-- **AppVersion** The version of the app that has crashed.
-- **AppTimeStamp** The date/time stamp of the app.
+- **Flags** "Flags indicating how reporting is done. For example, queue the report, do not offer JIT debugging, or do not terminate the process after reporting. "
- **ModName** Exception module name (e.g. bar.dll).
-- **ModVersion** The version of the module that has crashed.
- **ModTimeStamp** The date/time stamp of the module.
+- **ModVersion** The version of the module that has crashed.
- **PackageFullName** Store application identity.
- **PackageRelativeAppId** Store application identity.
- **ProcessArchitecture** Architecture of the crashing process, as one of the PROCESSOR_ARCHITECTURE_* constants: 0: PROCESSOR_ARCHITECTURE_INTEL. 5: PROCESSOR_ARCHITECTURE_ARM. 9: PROCESSOR_ARCHITECTURE_AMD64. 12: PROCESSOR_ARCHITECTURE_ARM64.
+- **ProcessCreateTime** The time of creation of the process that has crashed.
+- **ProcessId** The ID of the process that has crashed.
- **ReportId** A GUID used to identify the report. This can used to track the report across Watson.
-- **Flags** Flags indicating how reporting is done. For example, queue the report, do not offer JIT debugging, or do not terminate the process after reporting.
-- **AppSessionGuid** GUID made up of process ID and is used as a correlation vector for process instances in the telemetry backend.
- **TargetAppId** The kernel reported AppId of the application being reported.
- **TargetAppVer** The specific version of the application being reported
- **TargetAsId** The sequence number for the hanging process.
+## Feature update events
+
+### Microsoft.Windows.Upgrade.Uninstall.UninstallFailed
+
+This event sends diagnostic data about failures when uninstalling a feature update, to help resolve any issues preventing customers from reverting to a known state
+
+The following fields are available:
+
+- **failureReason** Provides data about the uninstall initialization operation failure
+- **hr** Provides the Win32 error code for the operation failure
+
+
+### Microsoft.Windows.Upgrade.Uninstall.UninstallFinalizedAndRebootTriggered
+
+Indicates that the uninstall was properly configured and that a system reboot was initiated
+
+The following fields are available:
+
+- **name** Name of the event
+
+
## Hang Reporting events
### Microsoft.Windows.HangReporting.AppHangEvent
@@ -1944,364 +1938,133 @@ This event sends data about hangs for both native and managed applications, to h
The following fields are available:
- **AppName** The name of the app that has hung.
-- **TypeCode** Bitmap describing the hang type.
-- **ProcessId** The ID of the process that has hung.
-- **UTCReplace_TargetAppId** The kernel reported AppId of the application being reported.
-- **ProcessCreateTime** The time of creation of the process that has hung.
-- **UTCReplace_TargetAppVer** The specific version of the application being reported.
-- **WaitingOnAppName** If this is a cross process hang waiting for an application, this has the name of the application.
+- **AppSessionGuid** GUID made up of process id used as a correlation vector for process instances in the diagnostic data backend.
+- **AppVersion** The version of the app that has hung.
+- **PackageFullName** Store application identity.
- **PackageRelativeAppId** Store application identity.
- **ProcessArchitecture** Architecture of the hung process, as one of the PROCESSOR_ARCHITECTURE_* constants: 0: PROCESSOR_ARCHITECTURE_INTEL. 5: PROCESSOR_ARCHITECTURE_ARM. 9: PROCESSOR_ARCHITECTURE_AMD64. 12: PROCESSOR_ARCHITECTURE_ARM64.
-- **WaitingOnPackageRelativeAppId** If this is a cross process hang waiting for a package, this has the relative application id of the package.
-- **WaitingOnAppVersion** If this is a cross process hang, this has the version of the application for which it is waiting.
-- **AppSessionGuid** GUID made up of process id used as a correlation vector for process instances in the telemetry backend.
-- **WaitingOnPackageFullName** If this is a cross process hang waiting for a package, this has the full name of the package for which it is waiting.
-- **PackageFullName** Store application identity.
-- **AppVersion** The version of the app that has hung.
+- **ProcessCreateTime** The time of creation of the process that has hung.
+- **ProcessId** The ID of the process that has hung.
- **ReportId** A GUID used to identify the report. This can used to track the report across Watson.
- **TargetAppId** The kernel reported AppId of the application being reported.
- **TargetAppVer** The specific version of the application being reported.
- **TargetAsId** The sequence number for the hanging process.
+- **TypeCode** Bitmap describing the hang type.
+- **WaitingOnAppName** If this is a cross process hang waiting for an application, this has the name of the application.
+- **WaitingOnAppVersion** If this is a cross process hang, this has the version of the application for which it is waiting.
+- **WaitingOnPackageFullName** If this is a cross process hang waiting for a package, this has the full name of the package for which it is waiting.
+- **WaitingOnPackageRelativeAppId** If this is a cross process hang waiting for a package, this has the relative application id of the package.
## Inventory events
-### Microsoft.Windows.Inventory.Core.AmiTelCacheChecksum
+### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassStartSync
-This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object.
+This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent
The following fields are available:
-- **Device** A count of device objects in cache
-- **DeviceCensus** A count of devicecensus objects in cache
-- **DriverPackageExtended** A count of driverpackageextended objects in cache
-- **File** A count of file objects in cache
-- **Generic** A count of generic objects in cache
-- **HwItem** A count of hwitem objects in cache
-- **InventoryApplication** A count of application objects in cache
-- **InventoryApplicationFile** A count of application file objects in cache
-- **InventoryDeviceContainer** A count of device container objects in cache
-- **InventoryDeviceMediaClass** A count of device media objects in cache
-- **InventoryDevicePnp** A count of devicepnp objects in cache
-- **InventoryDriverBinary** A count of driver binary objects in cache
-- **InventoryDriverPackage** A count of device objects in cache
-- **Metadata** A count of metadata objects in cache
-- **Orphan** A count of orphan file objects in cache
-- **Programs** A count of program objects in cache
-- **FileSigningInfo** A count of file signing info objects in cache.
-- **InventoryDeviceInterface** A count of inventory device interface objects in cache.
+- **InventoryVersion** The version of the inventory file generating the events
-### Microsoft.Windows.Inventory.Core.AmiTelCacheVersions
+### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassAdd
-This event sends inventory component versions for the Device Inventory data.
+This event sends basic metadata about the USB hubs on the device
The following fields are available:
-- **aeinv** The version of the App inventory component.
-- **devinv** The file version of the Device inventory component.
+- **InventoryVersion** The version of the inventory file generating the events
+- **TotalUserConnectablePorts** Total number of connectable USB ports
+- **TotalUserConnectableTypeCPorts** Total number of connectable USB Type C ports
-### Microsoft.Windows.Inventory.Core.InventoryApplicationAdd
+### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsAdd
-This event sends basic metadata about an application on the system to help keep Windows up to date.
+This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule
The following fields are available:
-- **ProgramInstanceId** A hash of the file IDs in an app.
-- **Name** The name of the application. Location pulled from depends on 'Source' field.
-- **Type** One of ("Application", "Hotfix", "BOE", "Service", "Unknown"). Application indicates Win32 or Appx app, Hotfix indicates app updates (KBs), BOE indicates it's an app with no ARP or MSI entry, Service indicates that it is a service. Application and BOE are the ones most likely seen.
-- **Publisher** The Publisher of the application. Location pulled from depends on the 'Source' field.
-- **Version** The version number of the program.
-- **Language** The language code of the program.
-- **Source** How the program was installed (ARP, MSI, Appx, etc...)
-- **MsiProductCode** A GUID that describe the MSI Product.
-- **MsiPackageCode** A GUID that describes the MSI Package. Multiple 'Products' (apps) can make up an MsiPackage.
-- **HiddenArp** Indicates whether a program hides itself from showing up in ARP.
-- **OSVersionAtInstallTime** The four octets from the OS version at the time of the application's install.
-- **RootDirPath** The path to the root directory where the program was installed.
-- **InstallDate** The date the application was installed (a best guess based on folder creation date heuristics)
-- **InstallDateMsi** The install date if the application was installed via MSI. Passed as an array.
-- **InstallDateFromLinkFile** The estimated date of install based on the links to the files. Passed as an array.
-- **InstallDateArpLastModified** The date of the registry ARP key for a given application. Hints at install date but not always accurate. Passed as an array.
-- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
-- **objectInstanceId** ProgramId (a hash of Name, Version, Publisher, and Language of an application used to identify it).
-- **PackageFullName** The package full name for a Store application.
-- **InventoryVersion** The version of the inventory file generating the events.
-- **StoreAppType** A sub-classification for the type of Microsoft Store app, such as UWP or Win8StoreApp.
+- **Count** Count of total Microsoft Office VBA rule violations
+
+### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInAdd
+
+This event provides data on the installed Office Add-ins.
+
+- **AddInCLSID** The CLSID key office the Office addin.
+- **AddInId** The ID of the Office addin.
+- **BinFileTimestamp** The timestamp of the Office addin.
+- **BinFileVersion** The version of the Office addin.
+- **Description** The description of the Office addin.
+- **FileId** The file ID of the Office addin.
+- **FriendlyName** The friendly name of the Office addin.
+- **FullPath** The full path to the Office addin.
+- **LoadBehavior** A Uint32 that describes the load behavior.
+- **LoadTime** The load time for the Office addin.
+- **OfficeApplication** The OIffice application for this addin.
+- **OfficeArchitecture** The architecture of the addin.
+- **OfficeVersion** The Office version for this addin.
+- **OutlookCrashingAddin** A boolean value that indicates if crashes have been found for this addin.
+- **Provider** The provider name for this addin.
-### Microsoft.Windows.Inventory.Core.InventoryApplicationRemove
+### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAAdd
-This event indicates that a new set of InventoryDevicePnpAdd events will be sent.
+This event provides a summary rollup count of conditions encountered while performing a local scan of Office files, analyzing for known VBA programmability compatibility issues between legacy office version and ProPlus, and between 32 and 64-bit versions
The following fields are available:
-- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
-- **InventoryVersion** The version of the inventory file generating the events.
+- **Design** Count of files with design issues found
+- **Design_x64** Count of files with 64 bit design issues found
+- **DuplicateVBA** Count of files with duplicate VBA code
+- **HasVBA** Count of files with VBA code
+- **Inaccessible** Count of files that were inaccessible for scanning
+- **Issues** Count of files with issues detected
+- **Issues_x64** Count of files with 64-bit issues detected
+- **IssuesNone** Count of files with no issues detected
+- **IssuesNone_x64** Count of files with no 64-bit issues detected
+- **Locked** Count of files that were locked, preventing scanning
+- **NoVBA** Count of files with no VBA inside
+- **Protected** Count of files that were password protected, preventing scanning
+- **RemLimited** Count of files that require limited remediation changes
+- **RemLimited_x64** Count of files that require limited remediation changes for 64-bit issues
+- **RemSignificant** Count of files that require significant remediation changes
+- **RemSignificant_x64** Count of files that require significant remediation changes for 64-bit issues
+- **Score** Overall compatibility score calculated for scanned content
+- **Score_x64** Overall 64-bit compatibility score calculated for scanned content
+- **Total** Total number of files scanned
+- **Validation** Count of files that require additional manual validation
+- **Validation_x64** Count of files that require additional manual validation for 64-bit issues
-### Microsoft.Windows.Inventory.Core.InventoryApplicationStartSync
+### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkStartSync
-This event indicates that a new set of InventoryApplicationAdd events will be sent.
+This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent
The following fields are available:
-- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
-- **InventoryVersion** The version of the inventory file generating the events.
+- **InventoryVersion** The version of the inventory file generating the events
-### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerAdd
+### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkAdd
-This event sends basic metadata about a device container (such as a monitor or printer as opposed to a PNP device) to help keep Windows up-to-date.
+This event provides the basic metadata about the frameworks an application may depend on
The following fields are available:
-- **ModelName** The model name.
-- **ModelId** A model GUID.
-- **PrimaryCategory** The primary category for the device container.
-- **Categories** A comma separated list of functional categories in which the container belongs.
-- **IsConnected** For a physically attached device, this value is the same as IsPresent. For wireless a device, this value represents a communication link.
-- **IsActive** Is the device connected, or has it been seen in the last 14 days?
-- **IsPaired** Does the device container require pairing?
-- **IsNetworked** Is this a networked device?
-- **IsMachineContainer** Is the container the root device itself?
-- **FriendlyName** The name of the device container.
-- **DiscoveryMethod** The discovery method for the device container.
-- **ModelNumber** The model number for the device container.
-- **Manufacturer** The manufacturer name for the device container.
-- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
-- **objectInstanceId** ContainerId
-- **InventoryVersion** The version of the inventory file generating the events.
+- **FileId** A hash that uniquely identifies a file
+- **Frameworks** The list of frameworks this file depends on
+- **InventoryVersion** The version of the inventory file generating the events
+- **ProgramId** A hash of the Name, Version, Publisher, and Language of an application used to identify it
-### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerRemove
+### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorAdd
-This event indicates that the InventoryDeviceContainer object is no longer present.
+These events represent the basic metadata about the OS indicators installed on the system which are used for keeping the device up-to-date.
The following fields are available:
-- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
-- **InventoryVersion** The version of the inventory file generating the events.
-
-
-### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerStartSync
-
-This event indicates that a new set of InventoryDeviceContainerAdd events will be sent.
-
-The following fields are available:
-
-- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
-- **InventoryVersion** The version of the inventory file generating the events.
-
-
-### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceAdd
-
-This event retrieves information about what sensor interfaces are available on the device.
-
-The following fields are available:
-
-- **InventoryVersion** The version of the inventory file generating the events.
-- **Accelerometer3D** Indicates if an Accelerator3D sensor is found.
-- **ActivityDetection** Indicates if an Activity Detection sensor is found.
-- **AmbientLight** Indicates if an Ambient Light sensor is found.
-- **Barometer** Indicates if a Barometer sensor is found.
-- **Custom** Indicates if a Custom sensor is found.
-- **FloorElevation** Indicates if a Floor Elevation sensor is found.
-- **GeomagneticOrientation** Indicates if a Geo Magnetic Orientation sensor is found.
-- **GravityVector** Indicates if a Gravity Detector sensor is found.
-- **Gyrometer3D** Indicates if a Gyrometer3D sensor is found.
-- **Humidity** Indicates if a Humidity sensor is found.
-- **LinearAccelerometer** Indicates if a Linear Accelerometer sensor is found.
-- **Magnetometer3D** Indicates if a Magnetometer3D sensor is found.
-- **Orientation** Indicates if an Orientation sensor is found.
-- **Pedometer** Indicates if a Pedometer sensor is found.
-- **Proximity** Indicates if a Proximity sensor is found.
-- **RelativeOrientation** Indicates if a Relative Orientation sensor is found.
-- **SimpleDeviceOrientation** Indicates if a Simple Device Orientation sensor is found.
-- **Temperature** Indicates if a Temperature sensor is found.
-
-
-### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceStartSync
-
-This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent.
-
-The following fields are available:
-
-- **InventoryVersion** The version of the inventory file generating the events.
-
-
-### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassAdd
-
-This event sends additional metadata about a PNP device that is specific to a particular class of devices to help keep Windows up to date while reducing overall size of data payload.
-
-The following fields are available:
-
-- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
-- **InventoryVersion** The version of the inventory file generating the events.
-- **Audio_CaptureDriver** The Audio device capture driver endpoint.
-- **Audio_RenderDriver** The Audio device render driver endpoint.
-
-
-### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassRemove
-
-This event indicates that the InventoryDeviceMediaClassRemove object is no longer present.
-
-The following fields are available:
-
-- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
-- **InventoryVersion** The version of the inventory file generating the events.
-
-
-### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassStartSync
-
-This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent.
-
-The following fields are available:
-
-- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
-- **InventoryVersion** The version of the inventory file generating the events.
-
-
-### Microsoft.Windows.Inventory.Core.InventoryDevicePnpAdd
-
-This event sends basic metadata about a PNP device and its associated driver to help keep Windows up-to-date.
-
-The following fields are available:
-
-- **HWID** A JSON array that provides the value and order of the HWID tree for the device.
-- **COMPID** A JSON array the provides the value and order of the compatible ID tree for the device.
-- **InstallState** The device installation state. One of these values: https://msdn.microsoft.com/en-us/library/windows/hardware/ff543130.aspx
-- **Enumerator** The bus that enumerated the device.
-- **ContainerId** A system-supplied GUID that uniquely groups the functional devices associated with a single-function or multifunction device installed in the device.
-- **DeviceState** DeviceState is a bitmask of the following: DEVICE_IS_CONNECTED 0x0001 (currently only for container). DEVICE_IS_NETWORK_DEVICE 0x0002 (currently only for container). DEVICE_IS_PAIRED 0x0004 (currently only for container). DEVICE_IS_ACTIVE 0x0008 (currently never set). DEVICE_IS_MACHINE 0x0010 (currently only for container). DEVICE_IS_PRESENT 0x0020 (currently always set). DEVICE_IS_HIDDEN 0x0040. DEVICE_IS_PRINTER 0x0080 (currently only for container). DEVICE_IS_WIRELESS 0x0100. DEVICE_IS_WIRELESS_FAT 0x0200. The most common values are therefore: 32 (0x20)= device is present. 96 (0x60)= device is present but hidden. 288 (0x120)= device is a wireless device that is present.
-- **ParentId** Device instance id of the parent of the device.
-- **STACKID** A JSON array that provides the value and order of the STACKID tree for the device.
-- **Description** The device description.
-- **MatchingID** Represents the hardware ID or compatible ID that Windows uses to install a device instance.
-- **Class** The device setup class of the driver loaded for the device.
-- **ClassGuid** The device setup class guid of the driver loaded for the device.
-- **Manufacturer** The device manufacturer.
-- **Model** The device model.
-- **Inf** The INF file name.
-- **DriverVerVersion** The version of the driver loaded for the device.
-- **DriverVerDate** The date of the driver loaded for the device.
-- **Provider** The device provider.
-- **DriverPackageStrongName** The immediate parent directory name in the Directory field of InventoryDriverPackage.
-- **Service** The device service name.
-- **LowerClassFilters** Lower filter class drivers IDs installed for the device.
-- **LowerFilters** Lower filter drivers IDs installed for the device.
-- **UpperClassFilters** Upper filter class drivers IDs installed for the device.
-- **UpperFilters** Upper filter drivers IDs installed for the device.
-- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
-- **DriverId** A unique identifier for the installed device.
-- **DriverName** The name of the driver image file.
-- **InventoryVersion** The version of the inventory file generating the events.
-- **ProblemCode** The current error code for the device.
-
-
-### Microsoft.Windows.Inventory.Core.InventoryDevicePnpRemove
-
-This event indicates that the InventoryDevicePnpRemove object is no longer present.
-
-The following fields are available:
-
-- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
-- **InventoryVersion** The version of the inventory file generating the events.
-
-
-### Microsoft.Windows.Inventory.Core.InventoryDevicePnpStartSync
-
-This event indicates that a new set of InventoryDevicePnpAdd events will be sent.
-
-The following fields are available:
-
-- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
-- **InventoryVersion** The version of the inventory file generating the events.
-
-
-### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryAdd
-
-This event sends basic metadata about driver files running on the system to help keep Windows up-to-date.
-
-The following fields are available:
-
-- **DriverName** The file name of the driver.
-- **Inf** The name of the INF file.
-- **DriverPackageStrongName** The strong name of the driver package.
-- **DriverCompany** The company name that developed the driver.
-- **DriverCheckSum** The checksum of the driver file.
-- **DriverTimeStamp** The low 32 bits of the time stamp of the driver file.
-- **DriverType** A bitfield of driver attributes: 1. define DRIVER_MAP_DRIVER_TYPE_PRINTER 0x0001. 2. define DRIVER_MAP_DRIVER_TYPE_KERNEL 0x0002. 3. define DRIVER_MAP_DRIVER_TYPE_USER 0x0004. 4. define DRIVER_MAP_DRIVER_IS_SIGNED 0x0008. 5. define DRIVER_MAP_DRIVER_IS_INBOX 0x0010. 6. define DRIVER_MAP_DRIVER_IS_WINQUAL 0x0040. 7. define DRIVER_MAP_DRIVER_IS_SELF_SIGNED 0x0020. 8. define DRIVER_MAP_DRIVER_IS_CI_SIGNED 0x0080. 9. define DRIVER_MAP_DRIVER_HAS_BOOT_SERVICE 0x0100. 10. define DRIVER_MAP_DRIVER_TYPE_I386 0x10000. 11. define DRIVER_MAP_DRIVER_TYPE_IA64 0x20000. 12. define DRIVER_MAP_DRIVER_TYPE_AMD64 0x40000. 13. define DRIVER_MAP_DRIVER_TYPE_ARM 0x100000. 14. define DRIVER_MAP_DRIVER_TYPE_THUMB 0x200000. 15. define DRIVER_MAP_DRIVER_TYPE_ARMNT 0x400000. 16. define DRIVER_MAP_DRIVER_IS_TIME_STAMPED 0x800000.
-- **DriverInBox** Is the driver included with the operating system?
-- **DriverSigned** Is the driver signed?
-- **DriverIsKernelMode** Is it a kernel mode driver?
-- **DriverVersion** The version of the driver file.
-- **ImageSize** The size of the driver file.
-- **Product** The product name that is included in the driver file.
-- **ProductVersion** The product version that is included in the driver file.
-- **WdfVersion** The Windows Driver Framework version.
-- **Service** The name of the service that is installed for the device.
-- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
-- **InventoryVersion** The version of the inventory file generating the events.
-
-
-### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryRemove
-
-This event indicates that the InventoryDriverBinary object is no longer present.
-
-The following fields are available:
-
-- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
-- **InventoryVersion** The version of the inventory file generating the events.
-
-
-### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryStartSync
-
-This event indicates that a new set of InventoryDriverBinaryAdd events will be sent.
-
-The following fields are available:
-
-- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
-- **InventoryVersion** The version of the inventory file generating the events.
-
-
-### Microsoft.Windows.Inventory.Core.InventoryDriverPackageAdd
-
-This event sends basic metadata about drive packages installed on the system to help keep Windows up-to-date.
-
-The following fields are available:
-
-- **Inf** The INF name of the driver package.
-- **ClassGuid** The class GUID for the device driver.
-- **Class** The class name for the device driver.
-- **Directory** The path to the driver package.
-- **Date** The driver package date.
-- **Version** The version of the driver package.
-- **Provider** The provider for the driver package.
-- **SubmissionId** The HLK submission ID for the driver package.
-- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
-- **InventoryVersion** The version of the inventory file generating the events.
-
-
-### Microsoft.Windows.Inventory.Core.InventoryDriverPackageRemove
-
-This event indicates that the InventoryDriverPackageRemove object is no longer present.
-
-The following fields are available:
-
-- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
-- **InventoryVersion** The version of the inventory file generating the events.
-
-
-### Microsoft.Windows.Inventory.Core.InventoryDriverPackageStartSync
-
-This event indicates that a new set of InventoryDriverPackageAdd events will be sent.
-
-The following fields are available:
-
-- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
-- **InventoryVersion** The version of the inventory file generating the events.
+- **IndicatorValue** The indicator value
+- **Value** Describes an operating system indicator that may be relevant for the device upgrade.
### Microsoft.Windows.Inventory.Indicators.Checksum
@@ -2314,141 +2077,367 @@ The following fields are available:
- **PCFP** Equivalent to the InventoryId field that is found in other core events.
-### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorAdd
+### Microsoft.Windows.Inventory.Core.InventoryApplicationAdd
-These events represent the basic metadata about the OS indicators installed on the system which are used for keeping the device up-to-date.
+This event sends basic metadata about an application on the system to help keep Windows up to date.
The following fields are available:
-- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
-- **IndicatorValue** The indicator value
+- **HiddenArp** Indicates whether a program hides itself from showing up in ARP.
+- **InstallDate** The date the application was installed (a best guess based on folder creation date heuristics).
+- **InstallDateArpLastModified** The date of the registry ARP key for a given application. Hints at install date but not always accurate. Passed as an array. Example: 4/11/2015 00:00:00
+- **InstallDateFromLinkFile** The estimated date of install based on the links to the files. Passed as an array.
+- **InstallDateMsi** The install date if the application was installed via MSI. Passed as an array.
+- **InventoryVersion** The version of the inventory file generating the events.
+- **Language** The language code of the program.
+- **MsiPackageCode** A GUID that describes the MSI Package. Multiple 'Products' (apps) can make up an MsiPackage.
+- **MsiProductCode** A GUID that describe the MSI Product.
+- **Name** The name of the application
+- **OSVersionAtInstallTime** The four octets from the OS version at the time of the application's install.
+- **PackageFullName** The package full name for a Store application.
+- **ProgramInstanceId** A hash of the file IDs in an app.
+- **Publisher** The Publisher of the application. Location pulled from depends on the 'Source' field.
+- **RootDirPath** The path to the root directory where the program was installed.
+- **Source** How the program was installed (ARP, MSI, Appx, etc...)
+- **StoreAppType** A sub-classification for the type of Windows Store app, such as UWP or Win8StoreApp.
+- **Type** "One of (""Application"", ""Hotfix"", ""BOE"", ""Service"", ""Unknown""). Application indicates Win32 or Appx app, Hotfix indicates app updates (KBs), BOE indicates it's an app with no ARP or MSI entry, Service indicates that it is a service. Application and BOE are the ones most likely seen."
+- **Version** The version number of the program.
+### Microsoft.Windows.Inventory.Core.InventoryApplicationRemove
+
+This event indicates that a new set of InventoryDevicePnpAdd events will be sent.
+
+The following fields are available:
+
+- **InventoryVersion** The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryApplicationStartSync
+
+This event indicates that a new set of InventoryApplicationAdd events will be sent.
+
+The following fields are available:
+
+- **InventoryVersion** The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerRemove
+
+This event indicates that the InventoryDeviceContainer object is no longer present.
+
+The following fields are available:
+
+- **InventoryVersion** The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDriverPackageAdd
+
+This event sends basic metadata about drive packages installed on the system to help keep Windows up-to-date.
+
+The following fields are available:
+
+- **Class** The class name for the device driver.
+- **ClassGuid** The class GUID for the device driver.
+- **Date** The driver package date.
+- **Directory** The path to the driver package.
+- **DriverInBox** Is the driver included with the operating system?
+- **Inf** The INF name of the driver package.
+- **InventoryVersion** The version of the inventory file generating the events.
+- **Provider** The provider for the driver package.
+- **SubmissionId** The HLK submission ID for the driver package.
+- **Version** The version of the driver package.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryStartSync
+
+This event indicates that a new set of InventoryDriverBinaryAdd events will be sent.
+
+The following fields are available:
+
+- **InventoryVersion** The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryRemove
+
+This event indicates that the InventoryDriverBinary object is no longer present.
+
+The following fields are available:
+
+- **InventoryVersion** The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDriverPackageRemove
+
+This event indicates that the InventoryDriverPackageRemove object is no longer present.
+
+The following fields are available:
+
+- **InventoryVersion** The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDevicePnpRemove
+
+This event indicates that the InventoryDevicePnpRemove object is no longer present.
+
+The following fields are available:
+
+- **InventoryVersion** The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerAdd
+
+This event sends basic metadata about a device container (such as a monitor or printer as opposed to a PNP device) to help keep Windows up-to-date.
+
+The following fields are available:
+
+- **Categories** A comma separated list of functional categories in which the container belongs.
+- **DiscoveryMethod** The discovery method for the device container.
+- **FriendlyName** The name of the device container.
+- **InventoryVersion** The version of the inventory file generating the events.
+- **IsActive** Is the device connected, or has it been seen in the last 14 days?
+- **IsConnected** For a physically attached device, this value is the same as IsPresent. For wireless a device, this value represents a communication link.
+- **IsMachineContainer** Is the container the root device itself?
+- **IsNetworked** Is this a networked device?
+- **IsPaired** Does the device container require pairing?
+- **Manufacturer** The manufacturer name for the device container.
+- **ModelId** A model GUID.
+- **ModelName** The model name.
+- **ModelNumber** The model number for the device container.
+- **PrimaryCategory** The primary category for the device container.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerStartSync
+
+This event indicates that a new set of InventoryDeviceContainerAdd events will be sent.
+
+The following fields are available:
+
+- **InventoryVersion** The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassStartSync
+
+This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent.
+
+The following fields are available:
+
+- **InventoryVersion** The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDriverPackageStartSync
+
+This event indicates that a new set of InventoryDriverPackageAdd events will be sent.
+
+The following fields are available:
+
+- **InventoryVersion** The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassRemove
+
+This event indicates that the InventoryDeviceMediaClassRemove object is no longer present.
+
+The following fields are available:
+
+- **InventoryVersion** The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDevicePnpStartSync
+
+This event indicates that a new set of InventoryDevicePnpAdd events will be sent.
+
+The following fields are available:
+
+- **InventoryVersion** The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassAdd
+
+This event sends additional metadata about a PNP device that is specific to a particular class of devices to help keep Windows up to date while reducing overall size of data payload.
+
+The following fields are available:
+
+- **Audio_CaptureDriver** The Audio device capture driver endpoint.
+- **Audio_RenderDriver** The Audio device render driver endpoint.
+- **InventoryVersion** The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDevicePnpAdd
+
+This event represents the basic metadata about a PNP device and its associated driver
+
+The following fields are available:
+
+- **class** The device setup class of the driver loaded for the device
+- **classGuid** The device class GUID from the driver package
+- **COMPID** A JSON array the provides the value and order of the compatible ID tree for the device.
+- **ContainerId** A system-supplied GUID that uniquely groups the functional devices associated with a single-function or multifunction device installed in the device.
+- **description** The device description
+- **deviceState** DeviceState is a bitmask of the following: DEVICE_IS_CONNECTED 0x0001 (currently only for container). DEVICE_IS_NETWORK_DEVICE 0x0002 (currently only for container). DEVICE_IS_PAIRED 0x0004 (currently only for container). DEVICE_IS_ACTIVE 0x0008 (currently never set). DEVICE_IS_MACHINE 0x0010 (currently only for container). DEVICE_IS_PRESENT 0x0020 (currently always set). DEVICE_IS_HIDDEN 0x0040. DEVICE_IS_PRINTER 0x0080 (currently only for container). DEVICE_IS_WIRELESS 0x0100. DEVICE_IS_WIRELESS_FAT 0x0200. The most common values are therefore: 32 (0x20)= device is present. 96 (0x60)= device is present but hidden. 288 (0x120)= device is a wireless device that is present
+- **DriverId** A unique identifier for the installed device.
+- **DriverName** The name of the driver image file.
+- **driverPackageStrongName** The immediate parent directory name in the Directory field of InventoryDriverPackage.
+- **driverVerDate** The date of the driver loaded for the device
+- **driverVerVersion** The version of the driver loaded for the device
+- **enumerator** The bus that enumerated the device
+- **HWID** A JSON array that provides the value and order of the HWID tree for the device.
+- **Inf** The INF file name.
+- **installState** The device installation state. One of these values: https://msdn.microsoft.com/en-us/library/windows/hardware/ff543130.aspx
+- **InventoryVersion** The version of the inventory file generating the events.
+- **lowerClassFilters** Lower filter class drivers IDs installed for the device.
+- **lowerFilters** Lower filter drivers IDs installed for the device
+- **manufacturer** The device manufacturer
+- **matchingID** Represents the hardware ID or compatible ID that Windows uses to install a device instance
+- **model** The device model
+- **parentId** Device instance id of the parent of the device
+- **ProblemCode** The current error code for the device.
+- **provider** The device provider
+- **service** The device service name#N##N##N##N##N#
+- **STACKID** A JSON array that provides the value and order of the STACKID tree for the device.
+- **upperClassFilters** Upper filter class drivers IDs installed for the device
+- **upperFilters** Upper filter drivers IDs installed for the device
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryAdd
+
+This event provides the basic metadata about driver binaries running on the system
+
+The following fields are available:
+
+- **DriverCheckSum** The checksum of the driver file.
+- **DriverCompany** The company name that developed the driver.
+- **driverInBox** Is the driver included with the operating system?
+- **driverIsKernelMode** Is it a kernel mode driver?
+- **DriverName** The file name of the driver.
+- **driverPackageStrongName** The strong name of the driver package
+- **driverSigned** The strong name of the driver package
+- **DriverTimeStamp** The low 32 bits of the time stamp of the driver file.
+- **DriverType** A bitfield of driver attributes: 1. define DRIVER_MAP_DRIVER_TYPE_PRINTER 0x0001. 2. define DRIVER_MAP_DRIVER_TYPE_KERNEL 0x0002. 3. define DRIVER_MAP_DRIVER_TYPE_USER 0x0004. 4. define DRIVER_MAP_DRIVER_IS_SIGNED 0x0008. 5. define DRIVER_MAP_DRIVER_IS_INBOX 0x0010. 6. define DRIVER_MAP_DRIVER_IS_WINQUAL 0x0040. 7. define DRIVER_MAP_DRIVER_IS_SELF_SIGNED 0x0020. 8. define DRIVER_MAP_DRIVER_IS_CI_SIGNED 0x0080. 9. define DRIVER_MAP_DRIVER_HAS_BOOT_SERVICE 0x0100. 10. define DRIVER_MAP_DRIVER_TYPE_I386 0x10000. 11. define DRIVER_MAP_DRIVER_TYPE_IA64 0x20000. 12. define DRIVER_MAP_DRIVER_TYPE_AMD64 0x40000. 13. define DRIVER_MAP_DRIVER_TYPE_ARM 0x100000. 14. define DRIVER_MAP_DRIVER_TYPE_THUMB 0x200000. 15. define DRIVER_MAP_DRIVER_TYPE_ARMNT 0x400000. 16. define DRIVER_MAP_DRIVER_IS_TIME_STAMPED 0x800000.
+- **DriverVersion** The version of the driver file.
+- **ImageSize** The size of the driver file.
+- **Inf** The name of the INF file.
+- **InventoryVersion** The version of the inventory file generating the events.
+- **Product** The product name that is included in the driver file.
+- **ProductVersion** The product version that is included in the driver file.
+- **service** The device service name
+- **WdfVersion** The Windows Driver Framework version.
+
+
+### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicator
+
+This event sends value data about the markers on custom devices, to help keep Windows up to date. The formal name for markers is UEX Indicators. See marker list for definitions.
+
+The following fields are available:
+
+- **IndicatorValue** Value of the marker/indicator
+- **Key** Name of the marker/indicator
+
+
+### Microsoft.Windows.Inventory.Core.AmiTelCacheVersions
+
+This event sends inventory component versions for the Device Inventory data.
+
+The following fields are available:
+
+- **aeinv** The version of the App inventory component.
+- **devinv** The file version of the Device inventory component.
+
+
+### Microsoft.Windows.Inventory.Core.AmiTelCacheChecksum
+
+This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object.
+
+The following fields are available:
+
+- **Device** A count of device objects in cache
+- **DeviceCensus** A count of devicecensus objects in cache
+- **DriverPackageExtended** A count of driverpackageextended objects in cache
+- **File** A count of file objects in cache
+- **FileSigningInfo** A count of file signing info objects in cache.
+- **Generic** A count of generic objects in cache
+- **HwItem** A count of hwitem objects in cache
+- **InventoryApplication** A count of application objects in cache
+- **InventoryApplicationFile** A count of application file objects in cache
+- **InventoryDeviceContainer** A count of device container objects in cache
+- **InventoryDeviceInterface** A count of inventory device interface objects in cache.
+- **InventoryDeviceMediaClass** A count of device media objects in cache
+- **InventoryDevicePnp** A count of devicepnp objects in cache
+- **InventoryDriverBinary** A count of driver binary objects in cache
+- **InventoryDriverPackage** A count of device objects in cache
+- **Metadata** A count of metadata objects in cache
+- **Orphan** A count of orphan file objects in cache
+- **Programs** A count of program objects in cache
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceStartSync
+
+This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent.
+
+The following fields are available:
+
+- **InventoryVersion** The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceAdd
+
+This event retrieves information about what sensor interfaces are available on the device.
+
+The following fields are available:
+
+- **Accelerometer3D** Indicates if an Accelerator3D sensor is found.
+- **ActivityDetection** Indicates if an Activity Detection sensor is found.
+- **AmbientLight** Indicates if an Ambient Light sensor is found.
+- **Barometer** Indicates if a Barometer sensor is found.
+- **Custom** Indicates if a Custom sensor is found.
+- **EnergyMeter** Indicates if an Energy sensor is found.
+- **FloorElevation** Indicates if a Floor Elevation sensor is found.
+- **GeomagneticOrientation** Indicates if a Geo Magnetic Orientation sensor is found.
+- **GravityVector** Indicates if a Gravity Detector sensor is found.
+- **Gyrometer3D** Indicates if a Gyrometer3D sensor is found.
+- **Humidity** Indicates if a Humidity sensor is found.
+- **InventoryVersion** The version of the inventory file generating the events.
+- **LinearAccelerometer** Indicates if a Linear Accelerometer sensor is found.
+- **Magnetometer3D** Indicates if a Magnetometer3D sensor is found.
+- **Orientation** Indicates if an Orientation sensor is found.
+- **Pedometer** Indicates if a Pedometer sensor is found.
+- **Proximity** Indicates if a Proximity sensor is found.
+- **RelativeOrientation** Indicates if a Relative Orientation sensor is found.
+- **SimpleDeviceOrientation** Indicates if a Simple Device Orientation sensor is found.
+- **Temperature** Indicates if a Temperature sensor is found.
+
+### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInStartSync
+
+This event indicates that a new sync is being generated for this object type.
+
+There are no fields in this event.
+
+### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsStartSync
+
+This event indicates that a new sync is being generated for this object type.
+
+There are no fields in this event.
+
+### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAStartSync
+
+This event indicates that a new sync is being generated for this object type.
+
+There are no fields in this event.
+
### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorRemove
-This event is a counterpart to InventoryMiscellaneousUexIndicatorAdd, indicating that the item has been removed. There are no additional unique fields in this event.
-
-The following fields are available:
-
-- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
+This event is a counterpart to InventoryMiscellaneousUexIndicatorAdd that indicates that the item has been removed.
+There are no fields in this event.
### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorStartSync
This event indicates that a new set of InventoryMiscellaneousUexIndicatorAdd events will be sent.
-The following fields are available:
-
-- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
-
+There are no fields in this event.
## OneDrive events
-### Microsoft.OneDrive.Sync.Setup.APIOperation
-
-This event includes basic data about install and uninstall OneDrive API operations.
-
-The following fields are available:
-
-- **APIName** The name of the API.
-- **ScenarioName** The name of the scenario.
-- **Duration** How long the operation took.
-- **isSuccess** Was the operation successful?
-- **ResultCode** The result code.
-
-
-### Microsoft.OneDrive.Sync.Setup.EndExperience
-
-This event includes a success or failure summary of the installation.
-
-The following fields are available:
-
-- **APIName** The name of the API.
-- **ScenarioName** The name of the scenario.
-- **Hresult** The HResult of the operation.
-- **isSuccess** Was the operation successful?
-
-
-### Microsoft.OneDrive.Sync.Setup.OSUpgradeInstallationOperation
-
-This event is related to the OS version when the OS is upgraded with OneDrive installed.
-
-The following fields are available:
-
-- **HResult** The HResult of the operation.
-- **SourceOSVersion** The source version of the operating system.
-- **SourceOSBuildNumber** The source build number of the operating system.
-- **SourceOSBuildBranch** The source branch of the operating system.
-- **CurrentOSVersion** The current version of the operating system.
-- **CurrentOSBuildNumber** The current build number of the operating system.
-- **CurrentOSBuildBranch** The current branch of the operating system.
-- **CurrentOneDriveVersion** The current version of OneDrive.
-
-
-### Microsoft.OneDrive.Sync.Setup.RegisterStandaloneUpdaterAPIOperation
-
-This event is related to registering or unregistering the OneDrive update task.
-
-The following fields are available:
-
-- **APIName** The name of the API.
-- **ScenarioName** The name of the scenario.
-- **UnregisterOldTaskResult** The HResult of the UnregisterOldTask operation.
-- **RegisterNewTaskResult** The HResult of the RegisterNewTask operation.
-- **isSuccess** Was the operation successful?
-
-
-### Microsoft.OneDrive.Sync.Setup.SetupCommonData
-
-This event contains basic OneDrive configuration data that helps to diagnose failures.
-
-The following fields are available:
-
-- **AppVersion** The version of the app.
-- **OfficeVersion** The version of Office that is installed.
-- **BuildArch** Is the architecture x86 or x64?
-- **Market** Which market is this in?
-- **OneDriveDeviceId** The OneDrive device ID.
-- **MachineGuid** The CEIP machine ID.
-- **IsMSFTInternal** Is this an internal Microsoft device?
-- **OSDeviceName** Only if the device is internal to Microsoft, the device name.
-- **OSUserName** Only if the device is internal to Microsoft, the user name.
-- **Environment** Is the device on the production or int service?
-- **OfficeVersionString** The version of Office that is installed.
-- **BuildArchitecture** Is the architecture x86 or x64?
-- **UserGuid** The CEIP user ID.
-- **MSFTInternal** Is this an internal Microsoft device?
-
-
-### Microsoft.OneDrive.Sync.Updater.CommonData
-
-This event contains basic OneDrive configuration data that helps to diagnose failures.
-
-The following fields are available:
-
-- **AppVersion** The version of the app.
-- **OfficeVersion** The version of Office that is installed.
-- **BuildArch** Is the architecture x86 or x64?
-- **Market** Which market is this in?
-- **OneDriveDeviceId** The OneDrive device ID.
-- **MachineGuid** The CEIP machine ID.
-- **IsMSFTInternal** Is this an internal Microsoft device?
-- **OSDeviceName** Only if the device is internal to Microsoft, the device name.
-- **OSUserName** Only if the device is internal to Microsoft, the user name.
-- **Environment** Is the device on the production or int service?
-- **UserGuid** A unique global user identifier.
-
-
-### Microsoft.OneDrive.Sync.Updater.ComponentInstallState
-
-This event determines the installation state of dependent OneDrive components.
-
-The following fields are available:
-
-- **ComponentName** The name of the dependent component.
-- **isInstalled** Is the dependent component installed?
-
-
### Microsoft.OneDrive.Sync.Updater.OfficeRegistration
This event determines the status of the OneDrive integration with Microsoft Office.
@@ -2458,14 +2447,14 @@ The following fields are available:
- **isValid** Is the Microsoft Office registration valid?
-### Microsoft.OneDrive.Sync.Updater.OverlayIconStatus
+### Microsoft.OneDrive.Sync.Updater.UpdateTierReg
-This event indicates if the OneDrive overlay icon is working correctly. 0 = healthy; 1 = can be fixed; 2 = broken
+This event determines status of the update tier registry values.
The following fields are available:
-- **32bit** The status of the OneDrive overlay icon on a 32-bit operating system.
-- **64bit** The status of the OneDrive overlay icon on a 64-bit operating system.
+- **regReadEnterpriseHr** The HResult of the enterprise reg read value.
+- **regReadTeamHr** The HResult of the team reg read value.
### Microsoft.OneDrive.Sync.Updater.RepairResult
@@ -2477,6 +2466,15 @@ The following fields are available:
- **hr** The HResult of the operation.
+### Microsoft.OneDrive.Sync.Updater.UpdateXmlDownloadHResult
+
+This event determines the status when downloading the OneDrive update configuration file.
+
+The following fields are available:
+
+- **hr** The HResult of the operation.
+
+
### Microsoft.OneDrive.Sync.Updater.SetupBinaryDownloadHResult
This event indicates the status when downloading the OneDrive setup file.
@@ -2492,28 +2490,9 @@ This event determines the outcome of the operation.
The following fields are available:
-- **UpdaterVersion** The version of the updater.
+- **hr** The HResult of the operation.
- **IsLoggingEnabled** Is logging enabled?
-- **hr** The HResult of the operation.
-
-
-### Microsoft.OneDrive.Sync.Updater.UpdateTierReg
-
-This event determines status of the update tier registry values.
-
-The following fields are available:
-
-- **regReadEnterpriseHr** The HResult of the enterprise reg read value.
-- **regReadTeamHr** The HResult of the team reg read value.
-
-
-### Microsoft.OneDrive.Sync.Updater.UpdateXmlDownloadHResult
-
-This event determines the status when downloading the OneDrive update configuration file.
-
-The following fields are available:
-
-- **hr** The HResult of the operation.
+- **UpdaterVersion** The version of the updater.
### Microsoft.OneDrive.Sync.Updater.WebConnectionStatus
@@ -2525,34 +2504,141 @@ The following fields are available:
- **winInetError** The HResult of the operation.
-## Setup events
+### Microsoft.OneDrive.Sync.Updater.OverlayIconStatus
-### SetupPlatformTel.SetupPlatformTelActivityEvent
-
-This event sends a unique ID that can be used to bind Setup Platform events together, to help keep Windows up to date.
+This event indicates if the OneDrive overlay icon is working correctly. 0 = healthy; 1 = can be fixed; 2 = broken
The following fields are available:
-- **FieldName** Retrieves the event name/data point. Examples: InstallStartTime, InstallEndtime, OverallResult etc.
-- **GroupName** Retrieves the groupname the event belongs to. Example: Install Information, DU Information, Disk Space Information etc.
-- **Value** Retrieves the value associated with the corresponding event name. For example: For time-related events, this will include the system time.
-- **ActivityId** Provides a unique Id to correlate events that occur between a activity start event, and a stop event
-- **ActivityName** Provides a friendly name of the package type that belongs to the ActivityId (Setup, LanguagePack, GDR, Driver, etc.)
+- **32bit** The status of the OneDrive overlay icon on a 32-bit operating system.
+- **64bit** The status of the OneDrive overlay icon on a 64-bit operating system.
+- **SixtyFourBit** The status of the OneDrive overlay icon on a 32-bit operating system.
+- **ThirtyTwoBit** The status of the OneDrive overlay icon on a 64-bit operating system.
+### Microsoft.OneDrive.Sync.Updater.ComponentInstallState
+
+This event determines the installation state of dependent OneDrive components.
+
+The following fields are available:
+
+- **ComponentName** The name of the dependent component.
+- **isInstalled** Is the dependent component installed?
+
+
+### Microsoft.OneDrive.Sync.Updater.CommonData
+
+This event contains basic OneDrive configuration data that helps to diagnose failures.
+
+The following fields are available:
+
+- **AppVersion** The version of the app.
+- **BuildArch** Is the architecture x86 or x64?
+- **Environment** Is the device on the production or int service?
+- **IsMSFTInternal** Is this an internal Microsoft device?
+- **MachineGuid** The CEIP machine ID.
+- **Market** Which market is this in?
+- **OfficeVersion** The version of Office that is installed.
+- **OneDriveDeviceId** The OneDrive device ID.
+- **OSDeviceName** Only if the device is internal to Microsoft, the device name.
+- **OSUserName** Only if the device is internal to Microsoft, the user name.
+- **UserGuid** A unique global user identifier.
+
+
+### Microsoft.OneDrive.Sync.Setup.APIOperation
+
+This event includes basic data about install and uninstall OneDrive API operations.
+
+The following fields are available:
+
+- **APIName** The name of the API.
+- **Duration** How long the operation took.
+- **IsSuccess** Was the operation successful?
+- **ResultCode** The result code.
+- **ScenarioName** The name of the scenario.
+
+
+### Microsoft.OneDrive.Sync.Setup.RegisterStandaloneUpdaterAPIOperation
+
+This event is related to registering or unregistering the OneDrive update task.
+
+The following fields are available:
+
+- **APIName** The name of the API.
+- **IsSuccess** Was the operation successful?
+- **RegisterNewTaskResult** The HResult of the RegisterNewTask operation.
+- **ScenarioName** The name of the scenario.
+- **UnregisterOldTaskResult** The HResult of the UnregisterOldTask operation.
+
+
+### Microsoft.OneDrive.Sync.Setup.EndExperience
+
+This event includes a success or failure summary of the installation.
+
+The following fields are available:
+
+- **APIName** The name of the API.
+- **HResult** Indicates the result code of the event
+- **IsSuccess** Was the operation successful?
+- **ScenarioName** The name of the scenario.
+
+
+### Microsoft.OneDrive.Sync.Setup.OSUpgradeInstallationOperation
+
+This event is related to the OS version when the OS is upgraded with OneDrive installed.
+
+The following fields are available:
+
+- **CurrentOneDriveVersion** The current version of OneDrive.
+- **CurrentOSBuildBranch** The current branch of the operating system.
+- **CurrentOSBuildNumber** The current build number of the operating system.
+- **CurrentOSVersion** The current version of the operating system.
+- **HResult** The HResult of the operation.
+- **SourceOSBuildBranch** The source branch of the operating system.
+- **SourceOSBuildNumber** The source build number of the operating system.
+- **SourceOSVersion** The source version of the operating system.
+
+
+### Microsoft.OneDrive.Sync.Setup.SetupCommonData
+
+This event contains basic OneDrive configuration data that helps to diagnose failures.
+
+The following fields are available:
+
+- **AppVersion** The version of the app.
+- **BuildArchitecture** Is the architecture x86 or x64?
+- **Environment** Is the device on the production or int service?
+- **MachineGuid** The CEIP machine ID.
+- **Market** Which market is this in?
+- **MSFTInternal** Is this an internal Microsoft device?
+- **OfficeVersionString** The version of Office that is installed.
+- **OSDeviceName** Only if the device is internal to Microsoft, the device name.
+- **OSUserName** Only if the device is internal to Microsoft, the user name.
+- **UserGuid** The CEIP user ID.
+
+
+## Setup events
+
### SetupPlatformTel.SetupPlatformTelActivityStarted
-This event sends basic metadata about the update installation process generated by SetupPlatform to help keep Windows up to date.
+"This event sends basic metadata about the update installation process generated by SetupPlatform to help keep Windows up to date. "
The following fields are available:
- **Name** The name of the dynamic update type. Example: GDR driver
-### SetupPlatformTel.SetupPlatformTelActivityStopped
+### SetupPlatformTel.SetupPlatformTelActivityEvent
-This event sends basic metadata about the update installation process generated by SetupPlatform to help keep Windows up to date.
+This event sends basic metadata about the SetupPlatform update installation process, to help keep Windows up-to-date
+The following fields are available:
+
+- **ActivityId** Provides a unique Id to correlate events that occur between a activity start event, and a stop event
+- **ActivityName** Provides a friendly name of the package type that belongs to the ActivityId (Setup, LanguagePack, GDR, Driver, etc.)
+- **FieldName** Retrieves the event name/data point. Examples: InstallStartTime, InstallEndtime, OverallResult etc.
+- **GroupName** Retrieves the groupname the event belongs to. Example: Install Information, DU Information, Disk Space Information etc.
+- **value** Value associated with the corresponding event name. For example, time-related events will include the system time
### SetupPlatformTel.SetupPlatformTelEvent
@@ -2574,9 +2660,9 @@ Activity for deletion of a user account for devices set up for Shared PC mode as
The following fields are available:
-- **wilActivity** Windows Error Reporting data collected when there is a failure in deleting a user account with the Transient Account Manager.
-- **userSid** The security identifier of the account.
- **accountType** The type of account that was deleted. Example: AD, AAD, or Local
+- **userSid** The security identifier of the account.
+- **wilActivity** Windows Error Reporting data collected when there is a failure in deleting a user account with the Transient Account Manager.
### Microsoft.Windows.SharedPC.AccountManager.SinglePolicyEvaluation
@@ -2592,281 +2678,19 @@ The following fields are available:
## Software update events
-### SoftwareUpdateClientTelemetry.CheckForUpdates
+### SoftwareUpdateClientTelemetry.UpdateDetected
-This event sends tracking data about the software distribution client check for content that is applicable to a device, to help keep Windows up to date
+This event sends data about an AppX app that has been updated from the Windows Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates.
The following fields are available:
-- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed.
-- **EventInstanceID** A globally unique identifier for event instance.
-- **DeviceModel** What is the device model.
-- **BiosName** The name of the device BIOS.
-- **BIOSVendor** The vendor of the BIOS.
-- **BiosVersion** The version of the BIOS.
-- **BiosReleaseDate** The release date of the device BIOS.
-- **SystemBIOSMajorRelease** Major version of the BIOS.
-- **SystemBIOSMinorRelease** Minor version of the BIOS.
-- **BiosFamily** The family of the BIOS (Basic Input Output System).
-- **BiosSKUNumber** The sku number of the device BIOS.
-- **ClientVersion** The version number of the software distribution client.
-- **WUDeviceID** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue.
-- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client.
-- **ProcessName** The process name of the caller who initiated API calls, in the event where CallerApplicationName was not provided.
-- **ServiceGuid** An ID which represents which service the software distribution client is checking for content (Windows Update, Microsoft Store, etc.).
-- **StatusCode** Indicates the result of a CheckForUpdates event (success, cancellation, failure code HResult).
-- **ExtendedStatusCode** Secondary error code for certain scenarios where StatusCode wasn't specific enough.
-- **FlightRing** The ring (speed of getting builds) that a device is on if participating in flighting (pre-release builds).
-- **FlightBranch** The branch that a device is on if participating in flighting (pre-release builds).
-- **RelatedCV** The previous Correlation Vector that was used before swapping with a new one
-- **IsWUfBEnabled** Indicates if Windows Update for Business is enabled on the device.
-- **IsWUfBDualScanEnabled** Indicates if Windows Update for Business dual scan is enabled on the device.
-- **ShippingMobileOperator** The mobile operator that a device shipped on.
-- **CurrentMobileOperator** The mobile operator the device is currently connected to.
-- **HomeMobileOperator** The mobile operator that the device was originally intended to work with.
-- **PhonePreviewEnabled** Indicates whether a phone was getting preview build, prior to flighting (pre-release builds) being introduced.
-- **ActivityMatchingId** Contains a unique ID identifying a single CheckForUpdates session from initialization to completion.
-- **SyncType** Describes the type of scan the event was
-- **IPVersion** Indicates whether the download took place over IPv4 or IPv6
-- **NumberOfApplicationsCategoryScanEvaluated** The number of categories (apps) for which an app update scan checked
-- **ScanDurationInSeconds** The number of seconds a scan took
-- **ScanEnqueueTime** The number of seconds it took to initialize a scan
-- **NumberOfLoop** The number of round trips the scan required
-- **NumberOfUpdatesEvaluated** The total number of updates which were evaluated as a part of the scan
-- **NumberOfNewUpdatesFromServiceSync** The number of updates which were seen for the first time in this scan
-- **ServiceUrl** The environment URL a device is configured to scan with
-- **Online** Indicates if this was an online scan.
-- **AllowCachedResults** Indicates if the scan allowed using cached results.
-- **MetadataIntegrityMode** The mode of the update transport metadata integrity check. 0-Unknown, 1-Ignoe, 2-Audit, 3-Enforce
-- **TotalNumMetadataSignatures** The total number of metadata signatures checks done for new metadata that was synced down.
-- **NumFailedMetadataSignatures** The number of metadata signatures checks which failed for new metadata synced down.
-- **MSIError** The last error that was encountered during a scan for updates.
-- **DriverError** The error code hit during a driver scan. This is 0 if no error was encountered.
-- **FailedUpdatesCount** The number of updates that failed to be evaluated during the scan.
-- **FailedUpdateGuids** The GUIDs for the updates that failed to be evaluated during the scan.
-- **CapabilityDetectoidGuid** The GUID for a hardware applicability detectoid that could not be evaluated.
-- **ExtendedMetadataCabUrl** Hostname that is used to download an update.
-- **CDNId** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue.
-- **CDNCountryCode** Two letter country abbreviation for the CDN's location.
-- **NetworkConnectivityDetected** Indicates the type of network connectivity that was detected. 0 - IPv4, 1 - IPv6
-- **NumberOfApplicableUpdates** The number of updates which were ultimately deemed applicable to the system after the detection process is complete
- **ApplicableUpdateInfo** Metadata for the updates which were detected as applicable
-- **WebServiceRetryMethods** Web service method requests that needed to be retried to complete operation.
-- **DeferredUpdates** Update IDs which are currently being deferred until a later time
-- **BranchReadinessLevel** The servicing branch configured on the device.
-- **DeferralPolicySources** Sources for any update deferral policies defined (GPO = 0x10, MDM = 0x100, Flight = 0x1000, UX = 0x10000).
-- **QualityUpdateDeferral** The deferral period configured for quality OS updates on the device (in days).
-- **QualityUpdatePause** Indicates whether quality OS updates are paused on the device.
-- **QualityUpdatePausePeriod** The pause duration configured for quality OS updates on the device (in days).
-- **FeatureUpdateDeferral** The deferral period configured for feature OS updates on the device (in days).
-- **FeatureUpdatePause** Indicates whether feature OS updates are paused on the device.
-- **FeatureUpdatePausePeriod** The pause duration configured for feature OS updates on the device (in days).
-- **DriverExclusionPolicy** Indicates if the policy for not including drivers with Windows Update is enabled.
-- **TargetMetadataVersion** For self-initiated healing, this is the target version of the SIH engine to download (if needed). If not, the value is null.
-- **CachedEngineVersion** For self-initiated healing, the version of the SIH engine that is cached on the device. If the SIH engine does not exist, the value is null.
-- **SearchFilter** Contains information indicating filters applied while checking for content applicable to the device. For example, to filter out all content which may require a reboot.
-- **IntentPFNs** Intended application-set metadata for atomic update scenarios.
-- **PausedUpdates** A list of UpdateIds which that currently being paused.
-- **PauseQualityUpdatesStartTime** If quality OS updates are paused on the device, this is the date and time for the beginning of the pause time window.
-- **PauseQualityUpdatesEndTime** If quality OS updates are paused on the device, this is the date and time for the end of the pause time window.
-- **PauseFeatureUpdatesStartTime** If feature OS updates are paused on the device, this is the date and time for the beginning of the pause time window.
-- **PauseFeatureUpdatesEndTime** If feature OS updates are paused on the device, this is the date and time for the end of the pause time window.
-- **Context** Gives context on where the error has occurred. Example: AutoEnable, GetSLSData, AddService, Misc, or Unknown
-- **DriverSyncPassPerformed** Were drivers scanned this time?
-
-
-### SoftwareUpdateClientTelemetry.Commit
-
-This event sends data on whether the Update Service has been called to execute an upgrade, to help keep Windows up to date.
-
-The following fields are available:
-
-- **EventScenario** State of call
-- **EventInstanceID** A globally unique identifier for event instance.
-- **DeviceModel** What is the device model.
-- **BiosName** The name of the device BIOS.
-- **BIOSVendor** The vendor of the BIOS.
-- **BiosVersion** The version of the BIOS.
-- **BiosReleaseDate** The release date of the device BIOS.
-- **SystemBIOSMajorRelease** Major version of the BIOS.
-- **SystemBIOSMinorRelease** Minor version of the BIOS.
-- **BiosFamily** The family of the BIOS (Basic Input Output System).
-- **BiosSKUNumber** The sku number of the device BIOS.
-- **ClientVersion** The version number of the software distribution client.
-- **WUDeviceID** UniqueDeviceID
-- **ServerId** Identifier for the service to which the software distribution client is connecting, such as Windows Update and Microsoft Store.
-- **EventType** Possible values are "Child", "Bundle", or "Driver".
-- **UpdateId** Unique Update ID
-- **BundleId** Identifier associated with the specific content bundle; should not be all zeros if the bundleID was found.
-- **RevisionNumber** Unique revision number of Update
-- **HandlerType** Indicates the kind of content (app, driver, windows patch, etc.)
-- **BundleRevisionNumber** Identifies the revision number of the content bundle
-- **FlightId** The specific id of the flight the device is getting
- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client
-
-
-### SoftwareUpdateClientTelemetry.Download
-
-This event sends tracking data about the software distribution client download of the content for that update, to help keep Windows up to date.
-
-The following fields are available:
-
-- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started downloading content, or whether it was cancelled, succeeded, or failed.
-- **EventInstanceID** A globally unique identifier for event instance.
-- **DeviceModel** What is the device model.
-- **BiosName** The name of the device BIOS.
-- **BIOSVendor** The vendor of the BIOS.
-- **BiosVersion** The version of the BIOS.
-- **BiosReleaseDate** The release date of the device BIOS.
-- **SystemBIOSMajorRelease** Major version of the BIOS.
-- **SystemBIOSMinorRelease** Minor version of the BIOS.
-- **BiosFamily** The family of the BIOS (Basic Input Output System).
-- **BiosSKUNumber** The sku number of the device BIOS.
-- **ClientVersion** The version number of the software distribution client.
-- **WUDeviceID** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue.
-- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client.
-- **ProcessName** The process name of the caller who initiated API calls, in the event where CallerApplicationName was not provided.
-- **ServiceGuid** An ID which represents which service the software distribution client is installing content for (Windows Update, Microsoft Store, etc.).
-- **StatusCode** Indicates the result of a Download event (success, cancellation, failure code HResult).
-- **ExtendedStatusCode** Secondary error code for certain scenarios where StatusCode wasn't specific enough.
-- **FlightRing** The ring (speed of getting builds) that a device is on if participating in flighting (pre-release builds).
-- **FlightBranch** The branch that a device is on if participating in flighting (pre-release builds).
+- **NumberOfApplicableUpdates** The number of updates which were ultimately deemed applicable to the system after the detection process is complete
- **RelatedCV** The previous Correlation Vector that was used before swapping with a new one
-- **IsWUfBEnabled** Indicates if Windows Update for Business is enabled on the device.
-- **IsWUfBDualScanEnabled** Indicates if Windows Update for Business dual scan is enabled on the device.
-- **ShippingMobileOperator** The mobile operator that a device shipped on.
-- **CurrentMobileOperator** The mobile operator the device is currently connected to.
-- **HomeMobileOperator** The mobile operator that the device was originally intended to work with.
-- **PhonePreviewEnabled** Indicates whether a phone was opted-in to getting preview builds, prior to flighting (pre-release builds) being introduced.
-- **IPVersion** Indicates whether the download took place over IPv4 or IPv6.
-- **NetworkCostBitMask** Indicates what kind of network the device is connected to (roaming, metered, over data cap, etc.)
-- **NetworkRestrictionStatus** More general version of NetworkCostBitMask, specifying whether Windows considered the current network to be "metered."
-- **TimeToEstablishConnection** Time (in ms) it took to establish the connection prior to beginning downloaded.
-- **HostName** The hostname URL the content is downloading from.
-- **CDNId** ID which defines which CDN the software distribution client downloaded the content from.
-- **CDNCountryCode** Two letter country abbreviation for the CDN's location.
-- **ActiveDownloadTime** How long the download took, in seconds, excluding time where the update wasn't actively being downloaded.
-- **IsDependentSet** Indicates whether a driver is a part of a larger System Hardware/Firmware Update
-- **TargetingVersion** For drivers targeted to a specific device model, this is the version number of the drivers being distributed to the device.
-- **HardwareId** If this download was for a driver targeted to a particular device model, this ID indicates the model of the device.
-- **UpdateImportance** Indicates whether a piece of content was marked as Important, Recommended, or Optional.
-- **TargetGroupId** For drivers targeted to a specific device model, this ID indicates the distribution group of devices receiving that driver.
-- **RepeatFailFlag** Indicates whether this specific piece of content had previously failed to download.
-- **BytesDownloaded** How many bytes were downloaded for an individual piece of content (not the entire bundle).
-- **TotalExpectedBytes** The total count of bytes that the download is expected to be.
-- **ThrottlingServiceHResult** Result code (success/failure) while contacting a web service to determine whether this device should download content yet.
-- **EventType** Possible values are Child, Bundle, or Driver.
-- **UpdateId** An identifier associated with the specific piece of content.
-- **RevisionNumber** Identifies the revision number of this specific piece of content.
-- **BundleId** Identifier associated with the specific content bundle; should not be all zeros if the bundleID was found.
-- **BundleRevisionNumber** Identifies the revision number of the content bundle.
-- **HandlerType** Indicates what kind of content is being downloaded (app, driver, windows patch, etc.).
-- **DownloadPriority** Indicates whether a download happened at background, normal, or foreground priority.
-- **FlightId** The specific id of the flight (pre-release build) the device is getting.
-- **Setup360Phase** If the download is for an operating system upgrade, this datapoint indicates which phase of the upgrade is underway.
-- **UsedDO** Whether the download used the delivery optimization service.
-- **CbsDownloadMethod** Indicates whether the download was a full-file download or a partial/delta download.
-- **UsedSystemVolume** Indicates whether the content was downloaded to the device's main system storage drive, or an alternate storage drive.
-- **FlightBuildNumber** If this download was for a flight (pre-release build), this indicates the build number of that flight.
-- **BundleBytesDownloaded** How many bytes were downloaded for the specific content bundle.
-- **BundleRepeatFailFlag** Indicates whether this particular update bundle had previously failed to download.
-- **DownloadScenarioId** A unique ID for a given download used to tie together WU and DO events.
-- **PackageFullName** The package name of the content.
-- **AppXBlockHashValidationFailureCount** A count of the number of blocks that have failed validation after being downloaded.
-- **CachedEngineVersion** For self-initiated healing, the version of the SIH engine that is cached on the device. If the SIH engine does not exist, the value is null.
-- **TargetMetadataVersion** For self-initiated healing, this is the target version of the SIH engine to download (if needed). If not, the value is null.
-- **DownloadType** Differentiates the download type of SIH downloads between Metadata and Payload downloads.
-- **WUSetting** Indicates the users' current updating settings.
-- **ProcessorArchitecture** Processor architecture of the system (x86, AMD64, ARM).
-- **PlatformRole** The PowerPlatformRole as defined on MSDN
-- **IsAOACDevice** Is it Always On, Always Connected?
-- **EventNamespaceID** Indicates whether the event succeeded or failed. Has the format EventType+Event where Event is Succeeded, Cancelled, Failed, etc.
-- **Edition** Indicates the edition of Windows being used.
-- **DeviceOEM** What OEM does this device belong to.
-- **ClientManagedByWSUSServer** Indicates whether the client is managed by Windows Server Update Services (WSUS).
-- **QualityUpdatePause** Indicates whether quality OS updates are paused on the device.
-- **FeatureUpdatePause** Indicates whether feature OS updates are paused on the device.
-- **AppXDownloadScope** Indicates the scope of the download for application content. For streaming install scenarios, AllContent - non-streaming download, RequiredOnly - streaming download requested content required for launch, AutomaticOnly - streaming download requested automatic streams for the app, and Unknown - for events sent before download scope is determined by the Windows Update client.
-
-
-### SoftwareUpdateClientTelemetry.Install
-
-This event sends tracking data about the software distribution client installation of the content for that update, to help keep Windows up to date.
-
-The following fields are available:
-
-- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started installing content, or whether it was cancelled, succeeded, or failed.
-- **EventInstanceID** A globally unique identifier for event instance.
-- **DeviceModel** What is the device model.
-- **BiosName** The name of the device BIOS.
-- **BIOSVendor** The vendor of the BIOS.
-- **BiosVersion** The version of the BIOS.
-- **BiosReleaseDate** The release date of the device BIOS.
-- **SystemBIOSMajorRelease** Major version of the BIOS.
-- **SystemBIOSMinorRelease** Minor version of the BIOS.
-- **BiosFamily** The family of the BIOS (Basic Input Output System).
-- **BiosSKUNumber** The sku number of the device BIOS.
-- **ClientVersion** The version number of the software distribution client.
-- **WUDeviceID** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue.
-- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client.
-- **ProcessName** The process name of the caller who initiated API calls, in the event where CallerApplicationName was not provided.
-- **ServiceGuid** An ID which represents which service the software distribution client is installing content for (Windows Update, Microsoft Store, etc.).
-- **StatusCode** Indicates the result of an installation event (success, cancellation, failure code HResult).
-- **ExtendedStatusCode** Secondary error code for certain scenarios where StatusCode wasn't specific enough.
-- **FlightRing** The ring that a device is on if participating in the Windows Insider Program.
-- **FlightBranch** The branch that a device is on if participating in the Windows Insider Program.
-- **RelatedCV** The previous Correlation Vector that was used before swapping with a new one
-- **IsWUfBEnabled** Is Windows Update for Business enabled on the device?
-- **IsWUfBDualScanEnabled** Is Windows Update for Business dual scan enabled on the device?
-- **ShippingMobileOperator** The mobile operator that a device shipped on.
-- **CurrentMobileOperator** Mobile operator that device is currently connected to.
-- **HomeMobileOperator** The mobile operator that the device was originally intended to work with.
-- **PhonePreviewEnabled** Indicates whether a phone was getting preview build, prior to flighting being introduced.
-- **TargetGroupId** For drivers targeted to a specific device model, this ID indicates the distribution group of devices receiving that driver.
-- **RepeatFailFlag** Indicates whether this specific piece of content had previously failed to install.
-- **EventType** Possible values are Child, Bundle, or Driver.
-- **TargetingVersion** For drivers targeted to a specific device model, this is the version number of the drivers being distributed to the device.
-- **UpdateImportance** Indicates whether a piece of content was marked as Important, Recommended, or Optional.
-- **IsFirmware** Is this update a firmware update?
-- **IsFinalOutcomeEvent** Does this event signal the end of the update/upgrade process?
-- **IsDependentSet** Is the driver part of a larger System Hardware/Firmware update?
-- **DriverPingBack** Contains information about the previous driver and system state.
-- **ExtendedErrorCode** The extended error code.
-- **CSIErrorType** The stage of CBS installation where it failed.
-- **MsiAction** The stage of MSI installation where it failed.
-- **MsiProductCode** The unique identifier of the MSI installer.
-- **TransactionCode** The ID which represents a given MSI installation
-- **HardwareId** If this install was for a driver targeted to a particular device model, this ID indicates the model of the device.
-- **IsSuccessFailurePostReboot** Did it succeed and then fail after a restart?
-- **UpdateId** Unique update ID
-- **RevisionNumber** The revision number of this specific piece of content.
-- **BundleId** Identifier associated with the specific content bundle; should not be all zeros if the bundleID was found.
-- **BundleRevisionNumber** Identifies the revision number of the content bundle.
-- **HandlerType** Indicates what kind of content is being installed. Example: app, driver, Windows update
-- **FlightId** The specific ID of the Windows Insider build the device is getting.
-- **Setup360Phase** If the install is for an operating system upgrade, indicates which phase of the upgrade is underway.
-- **UsedSystemVolume** Indicates whether the content was downloaded and then installed from the device's main system storage drive, or an alternate storage drive.
-- **FlightBuildNumber** If this installation was for a Windows Insider build, this is the build number of that build.
-- **BundleRepeatFailFlag** Has this particular update bundle previously failed to install?
-- **PackageFullName** The package name of the content being installed.
-- **CachedEngineVersion** For self-initiated healing, the version of the SIH engine that is cached on the device. If the SIH engine does not exist, the value is null.
-- **BundleBytesDownloaded** How many bytes were downloaded for the specific content bundle?
-- **CbsDownloadMethod** Was the download a full download or a partial download?
-- **ClientManagedByWSUSServer** Is the client managed by Windows Server Update Services (WSUS)?
-- **DeviceOEM** What OEM does this device belong to.
-- **DownloadPriority** The priority of the download activity.
-- **DownloadScenarioId** A unique ID for a given download used to tie together WU and DO events.
-- **Edition** Indicates the edition of Windows being used.
-- **EventNamespaceID** Indicates whether the event succeeded or failed. Has the format EventType+Event where Event is Succeeded, Cancelled, Failed, etc.
-- **IsAOACDevice** Is it Always On, Always Connected? (Mobile device usage model)
-- **PlatformRole** The PowerPlatformRole as defined on MSDN.
-- **ProcessorArchitecture** Processor architecture of the system (x86, AMD64, ARM).
-- **RepeatSuccessInstallFlag** Indicates whether this specific piece of content had previously installed successful, for example if another user had already installed it.
-- **WUSetting** Indicates the user's current updating settings.
+- **WUDeviceID** The unique device ID controlled by the software distribution client
- **IntentPFNs** Intended application-set metadata for atomic update scenarios.
-- **QualityUpdatePause** Are quality OS updates paused on the device?
-- **FeatureUpdatePause** Are feature OS updates paused on the device?
-- **MergedUpdate** Was the OS update and a BSP update merged for installation?
+- **ServiceGuid** An ID which represents which service the software distribution client is connecting to (Windows Update, Windows Store, etc.)
### SoftwareUpdateClientTelemetry.SLSDiscovery
@@ -2876,59 +2700,65 @@ This event sends data about the ability of Windows to discover the location of a
The following fields are available:
- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed
-- **SusClientId** The unique device ID controlled by the software distribution client
-- **WUAVersion** The version number of the software distribution client
-- **ServiceID** An ID which represents which service the software distribution client is connecting to (Windows Update, Microsoft Store, etc.)
-- **UrlPath** Path to the SLS cab that was downloaded
- **HResult** Indicates the result code of the event (success, cancellation, failure code HResult)
- **IsBackground** Indicates whether the SLS discovery event took place in the foreground or background
- **NextExpirationTime** Indicates when the SLS cab expires
+- **ServiceID** An ID which represents which service the software distribution client is connecting to (Windows Update, Windows Store, etc.)
+- **SusClientId** The unique device ID controlled by the software distribution client
+- **UrlPath** Path to the SLS cab that was downloaded
+- **WUAVersion** The version number of the software distribution client
-### SoftwareUpdateClientTelemetry.UpdateDetected
+### SoftwareUpdateClientTelemetry.Commit
-This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates.
+This event sends data on whether the Update Service has been called to execute an upgrade, to help keep Windows up to date.
The following fields are available:
+- **BiosFamily** The family of the BIOS (Basic Input Output System).
+- **BiosName** The name of the device BIOS.
+- **BiosReleaseDate** The release date of the device BIOS.
+- **BiosSKUNumber** The sku number of the device BIOS.
+- **BIOSVendor** The vendor of the BIOS.
+- **BiosVersion** The version of the BIOS.
+- **BundleId** Identifier associated with the specific content bundle; should not be all zeros if the bundleID was found.
+- **ClientVersion** The version number of the software distribution client.
+- **DeviceModel** What is the device model.
+- **EventInstanceID** A globally unique identifier for event instance.
+- **EventScenario** State of call
+- **EventType** "Possible values are ""Child"", ""Bundle"", or ""Driver""."
+- **HandlerType** Indicates the kind of content (app, driver, windows patch, etc.)
+- **RevisionNumber** Unique revision number of Update
+- **ServerId** Identifier for the service to which the software distribution client is connecting, such as Windows Update and Windows Store.
+- **SystemBIOSMajorRelease** Major version of the BIOS.
+- **SystemBIOSMinorRelease** Minor version of the BIOS.
+- **UpdateId** Unique Update ID
+- **WUDeviceID** UniqueDeviceID
+- **BundleRevisionNumber** Identifies the revision number of the content bundle
+- **FlightId** The specific id of the flight the device is getting
- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client
-- **ApplicableUpdateInfo** Metadata for the updates which were detected as applicable
-- **NumberOfApplicableUpdates** The number of updates which were ultimately deemed applicable to the system after the detection process is complete
-- **WUDeviceID** The unique device ID controlled by the software distribution client
-- **RelatedCV** The previous Correlation Vector that was used before swapping with a new one
+
+
+### SoftwareUpdateClientTelemetry.DownloadCheckpoint
+
+This event provides a checkpoint between each of the Windows Update download phases for UUP content
+
+The following fields are available:
+
- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed
-- **EventInstanceID** A globally unique identifier for event instance
-- **DeviceModel** The device's model as defined in system bios
-- **BiosName** The name of the device's system bios
-- **BIOSVendor** The vendor of the device's system bios
-- **BiosVersion** The version of the device's system bios
-- **BiosReleaseDate** The release date of the device's system bios
-- **SystemBIOSMajorRelease** The major release version of the device's system system
-- **SystemBIOSMinorRelease** The minor release version of the device's system system
-- **BiosFamily** The device's family as defined in system bios
-- **BiosSKUNumber** The device's SKU as defined in system bios
+- **ExtendedStatusCode** Secondary error code for certain scenarios where StatusCode wasn't specific enough
+- **FileId** A hash that uniquely identifies a file
+- **FileName** Name of the downloaded file
+- **RelatedCV** The previous Correlation Vector that was used before swapping with a new one
+- **StatusCode** Indicates the result of a CheckForUpdates event (success, cancellation, failure code HResult)
+- **EventType** "Possible values are ""Child"", ""Bundle"", ""Relase"" or ""Driver"""
+- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client
- **ClientVersion** The version number of the software distribution client
-- **ProcessName** The process name of the caller who initiated API calls, in the event where CallerApplicationName was not provided
-- **ServiceGuid** An ID which represents which service the software distribution client is connecting to (Windows Update, Microsoft Store, etc.)
-- **StatusCode** Indicates the result code of the event (success, cancellation, failure code HResult)
-- **ExtendedStatusCode** Secondary status code for certain scenarios where StatusCode wasn't specific enough
-- **FlightRing** The ring (speed of getting builds) that a device is on if participating in flighting (pre-release builds).
-- **FlightBranch** The branch that a device is on if participating in flighting (pre-release builds).
-- **ShippingMobileOperator** The mobile operator that a device shipped on.
-- **CurrentMobileOperator** The mobile operator the device is currently connected to.
-- **HomeMobileOperator** The mobile operator that the device was originally intended to work with
-- **PhonePreviewEnabled** Indicates whether a phone was getting preview build, prior to flighting (pre-release builds) being introduced.
-- **ActivityMatchingId** Contains a unique ID identifying a single CheckForUpdates session from initialization to completion
-- **SyncType** Describes the type of scan the event was
-- **IPVersion** Indicates whether the download took place over IPv4 or IPv6
-- **NumberOfApplicationsCategoryScanEvaluated** The number of categories (apps) for which an app update scan checked
-- **ScanDurationInSeconds** The number of seconds a scan took
-- **ScanEnqueueTime** The number of seconds it took to initialize a scan
-- **NumberOfLoop** The number of round trips the scan required
-- **NumberOfUpdatesEvaluated** The total number of updates which were evaluated as a part of the scan
-- **NumberOfNewUpdatesFromServiceSync** The number of updates which were seen for the first time in this scan
-- **ServiceUrl** The environment URL a device is configured to scan with
-- **IntentPFNs** Intended application-set metadata for atomic update scenarios.
+- **FlightId** The unique identifier for each flight
+- **RevisionNumber** Unique revision number of Update
+- **ServiceGuid** An ID which represents which service the software distribution client is checking for content (Windows Update, Microsoft Store, etc.)
+- **UpdateId** Unique Update ID
+- **WUDeviceID** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue
### SoftwareUpdateClientTelemetry.UpdateMetadataIntegrity
@@ -2938,56 +2768,324 @@ This event identifies whether updates have been tampered with and protects again
The following fields are available:
- **EventScenario** The purpose of this event, such as scan started, scan succeeded, or scan failed.
-- **ServiceGuid** Identifies the service to which the software distribution client is connected, Example: Windows Update or Microsoft Store
-- **MetadataIntegrityMode** The mode of the transport metadata integrity check. 0 = unknown; 1 = ignore; 2 = audit; 3 = enforce
-- **StatusCode** The status code of the event.
- **ExtendedStatusCode** The secondary status code of the event.
-- **RevisionId** The revision ID for a specific piece of content.
-- **UpdateId** The update ID for a specific piece of content.
-- **RevisionNumber** The revision number for a specific piece of content.
-- **TimestampTokenId** The time this was created. It is encoded in a timestamp blob and will be zero if the token is malformed.
- **LeafCertId** Integral ID from the FragmentSigning data for certificate that failed.
-- **SHA256OfLeafCertPublicKey** A base64 encoding of the hash of the Base64CertData in the FragmentSigning data of the leaf certificate.
+- **MetadataIntegrityMode** The mode of the transport metadata integrity check. 0 = unknown; 1 = ignore; 2 = audit; 3 = enforce
- **MetadataSignature** A base64-encoded string of the signature associated with the update metadata (specified by revision ID).
-- **SignatureAlgorithm** The hash algorithm for the metadata signature.
+- **RevisionId** The revision ID for a specific piece of content.
+- **RevisionNumber** The revision number for a specific piece of content.
+- **ServiceGuid** Identifies the service to which the software distribution client is connected, Example: Windows Update or Windows Store
+- **SHA256OfLeafCertPublicKey** A base64 encoding of the hash of the Base64CertData in the FragmentSigning data of the leaf certificate.
- **SHA256OfTimestampToken** A base64-encoded string of hash of the timestamp token blob.
+- **SignatureAlgorithm** The hash algorithm for the metadata signature.
+- **StatusCode** The status code of the event.
+- **TimestampTokenId** The time this was created. It is encoded in a timestamp blob and will be zero if the token is malformed.
+- **UpdateId** The update ID for a specific piece of content.
+- **TimestampTokenCertThumbprint** "The thumbprint of the encoded timestamp token. "
- **ValidityWindowInDays** The validity window that's in effect when verifying the timestamp.
-- **TimestampTokenCertThumbprint** The thumbprint of the encoded timestamp token.
+- **ListOfSHA256OfIntermediateCerData** A semicolon delimited list of base64 encoding of hashes for the Base64CerData in the FragmentSigning data of an intermediate certificate.
- **RawMode** The raw unparsed mode string from the SLS response. This field is null if not applicable.
- **RawValidityWindowInDays** The raw unparsed validity window string in days of the timestamp token. This field is null if not applicable.
- **SHA256OfLeafCerData** A base64 encoding of the hash for the Base64CerData in the FragmentSigning data of the leaf certificate.
-- **ListOfSHA256OfIntermediateCerData** A semicolon delimited list of base64 encoding of hashes for the Base64CerData in the FragmentSigning data of an intermediate certificate.
- **EndpointUrl** The endpoint URL where the device obtains update metadata. This is used to distinguish between test, staging, and production environments.
- **SLSPrograms** A test program to which a device may have opted in. Example: Insider Fast
-## Update events
+### SoftwareUpdateClientTelemetry.Download
-### Update360Telemetry.UpdateAgent_DownloadRequest
-
-This event sends data during the download request phase of updating Windows.
+This event sends tracking data about the software distribution client download of the content for that update, to help keep Windows up to date.
The following fields are available:
-- **ErrorCode** The error code returned for the current download request phase.
-- **PackageCountTotal** Total number of packages needed.
-- **PackageCountRequired** Number of required packages requested.
-- **PackageCountOptional** Number of optional packages requested.
-- **ObjectId** Unique value for each Update Agent mode.
-- **SessionId** Unique value for each Update Agent mode attempt.
+- **ActiveDownloadTime** How long the download took, in seconds, excluding time where the update wasn't actively being downloaded.
+- **AppXBlockHashValidationFailureCount** A count of the number of blocks that have failed validation after being downloaded.
+- **AppXDownloadScope** Indicates the scope of the download for application content. For streaming install scenarios, AllContent - non-streaming download, RequiredOnly - streaming download requested content required for launch, AutomaticOnly - streaming download requested automatic streams for the app, and Unknown - for events sent before download scope is determined by the Windows Update client.
+- **BiosFamily** The family of the BIOS (Basic Input Output System).
+- **BiosName** The name of the device BIOS.
+- **BiosReleaseDate** The release date of the device BIOS.
+- **BiosSKUNumber** The sku number of the device BIOS.
+- **BIOSVendor** The vendor of the BIOS.
+- **BiosVersion** The version of the BIOS.
+- **BundleBytesDownloaded** How many bytes were downloaded for the specific content bundle.
+- **BundleId** Identifier associated with the specific content bundle; should not be all zeros if the bundleID was found.
+- **BundleRepeatFailFlag** Indicates whether this particular update bundle had previously failed to download.
+- **BundleRevisionNumber** Identifies the revision number of the content bundle.
+- **BytesDownloaded** How many bytes were downloaded for an individual piece of content (not the entire bundle).
+- **CachedEngineVersion** For self-initiated healing, the version of the SIH engine that is cached on the device. If the SIH engine does not exist, the value is null.
+- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client.
+- **CbsDownloadMethod** Indicates whether the download was a full-file download or a partial/delta download.
+- **CDNCountryCode** Two letter country abbreviation for the CDN's location.
+- **CDNId** ID which defines which CDN the software distribution client downloaded the content from.
+- **ClientManagedByWSUSServer** Indicates whether the client is managed by Windows Server Update Services (WSUS).
+- **ClientVersion** The version number of the software distribution client.
+- **CurrentMobileOperator** The mobile operator the device is currently connected to.
+- **DeviceModel** What is the device model.
+- **DeviceOEM** What OEM does this device belong to.
+- **DownloadPriority** Indicates whether a download happened at background, normal, or foreground priority.
+- **DownloadScenarioId** A unique ID for a given download used to tie together WU and DO events.
+- **DownloadType** Differentiates the download type of SIH downloads between Metadata and Payload downloads.
+- **Edition** Indicates the edition of Windows being used.
+- **EventInstanceID** A globally unique identifier for event instance.
+- **EventNamespaceID** Indicates whether the event succeeded or failed. Has the format EventType+Event where Event is Succeeded, Cancelled, Failed, etc.
+- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started downloading content, or whether it was cancelled, succeeded, or failed.
+- **EventType** Possible values are Child, Bundle, or Driver.
+- **ExtendedStatusCode** Secondary error code for certain scenarios where StatusCode wasn't specific enough.
+- **FeatureUpdatePause** Indicates whether feature OS updates are paused on the device.
+- **FlightBranch** The branch that a device is on if participating in flighting (pre-release builds).
+- **FlightBuildNumber** If this download was for a flight (pre-release build), this indicates the build number of that flight.
+- **FlightId** The specific id of the flight (pre-release build) the device is getting.
+- **FlightRing** The ring (speed of getting builds) that a device is on if participating in flighting (pre-release builds).
+- **HandlerType** Indicates what kind of content is being downloaded (app, driver, windows patch, etc.).
+- **HardwareId** If this download was for a driver targeted to a particular device model, this ID indicates the model of the device.
+- **HomeMobileOperator** The mobile operator that the device was originally intended to work with.
+- **HostName** The hostname URL the content is downloading from.
+- **IPVersion** Indicates whether the download took place over IPv4 or IPv6.
+- **IsAOACDevice** Is it Always On, Always Connected?
+- **IsDependentSet** Indicates whether a driver is a part of a larger System Hardware/Firmware Update
+- **IsWUfBDualScanEnabled** Indicates if Windows Update for Business dual scan is enabled on the device.
+- **IsWUfBEnabled** Indicates if Windows Update for Business is enabled on the device.
+- **NetworkCostBitMask** Indicates what kind of network the device is connected to (roaming, metered, over data cap, etc.)
+- **NetworkRestrictionStatus** "More general version of NetworkCostBitMask, specifying whether Windows considered the current network to be ""metered."""
+- **PackageFullName** The package name of the content.
+- **PhonePreviewEnabled** Indicates whether a phone was opted-in to getting preview builds, prior to flighting (pre-release builds) being introduced.
+- **PlatformRole** The PowerPlatformRole as defined on MSDN
+- **ProcessName** The process name of the caller who initiated API calls, in the event where CallerApplicationName was not provided.
+- **ProcessorArchitecture** Processor architecture of the system (x86, AMD64, ARM).
+- **QualityUpdatePause** Indicates whether quality OS updates are paused on the device.
+- **RelatedCV** The previous Correlation Vector that was used before swapping with a new one
+- **RepeatFailFlag** Indicates whether this specific piece of content had previously failed to download.
+- **RevisionNumber** Identifies the revision number of this specific piece of content.
+- **ServiceGuid** An ID which represents which service the software distribution client is installing content for (Windows Update, Windows Store, etc.).
+- **Setup360Phase** If the download is for an operating system upgrade, this datapoint indicates which phase of the upgrade is underway.
+- **ShippingMobileOperator** The mobile operator that a device shipped on.
+- **StatusCode** Indicates the result of a Download event (success, cancellation, failure code HResult).
+- **SystemBIOSMajorRelease** Major version of the BIOS.
+- **SystemBIOSMinorRelease** Minor version of the BIOS.
+- **TargetGroupId** For drivers targeted to a specific device model, this ID indicates the distribution group of devices receiving that driver.
+- **TargetingVersion** For drivers targeted to a specific device model, this is the version number of the drivers being distributed to the device.
+- **TargetMetadataVersion** For self-initiated healing, this is the target version of the SIH engine to download (if needed). If not, the value is null.
+- **ThrottlingServiceHResult** Result code (success/failure) while contacting a web service to determine whether this device should download content yet.
+- **TimeToEstablishConnection** Time (in ms) it took to establish the connection prior to beginning downloaded.
+- **TotalExpectedBytes** The total count of bytes that the download is expected to be.
+- **UpdateId** An identifier associated with the specific piece of content.
+- **UpdateImportance** Indicates whether a piece of content was marked as Important, Recommended, or Optional.
+- **UsedDO** Whether the download used the delivery optimization service.
+- **UsedSystemVolume** Indicates whether the content was downloaded to the device's main system storage drive, or an alternate storage drive.
+- **WUDeviceID** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue.
+- **WUSetting** Indicates the users' current updating settings.
+
+
+### SoftwareUpdateClientTelemetry.CheckForUpdates
+
+This event sends tracking data about the software distribution client check for content that is applicable to a device, to help keep Windows up to date
+
+The following fields are available:
+
+- **ActivityMatchingId** Contains a unique ID identifying a single CheckForUpdates session from initialization to completion.
+- **AllowCachedResults** Indicates if the scan allowed using cached results.
+- **BiosFamily** The family of the BIOS (Basic Input Output System).
+- **BiosName** The name of the device BIOS.
+- **BiosReleaseDate** The release date of the device BIOS.
+- **BiosSKUNumber** The sku number of the device BIOS.
+- **BIOSVendor** The vendor of the BIOS.
+- **BiosVersion** The version of the BIOS.
+- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client.
+- **CapabilityDetectoidGuid** The GUID for a hardware applicability detectoid that could not be evaluated.
+- **CDNCountryCode** Two letter country abbreviation for the CDN's location.
+- **CDNId** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue.
+- **ClientVersion** The version number of the software distribution client.
+- **CurrentMobileOperator** The mobile operator the device is currently connected to.
+- **DeviceModel** What is the device model.
+- **DriverError** The error code hit during a driver scan. This is 0 if no error was encountered.
+- **EventInstanceID** A globally unique identifier for event instance.
+- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed.
+- **ExtendedMetadataCabUrl** Hostname that is used to download an update.
+- **ExtendedStatusCode** Secondary error code for certain scenarios where StatusCode wasn't specific enough.
+- **FailedUpdateGuids** The GUIDs for the updates that failed to be evaluated during the scan.
+- **FailedUpdatesCount** The number of updates that failed to be evaluated during the scan.
+- **FlightBranch** The branch that a device is on if participating in flighting (pre-release builds).
+- **FlightRing** The ring (speed of getting builds) that a device is on if participating in flighting (pre-release builds).
+- **HomeMobileOperator** The mobile operator that the device was originally intended to work with.
+- **IPVersion** Indicates whether the download took place over IPv4 or IPv6
+- **IsWUfBDualScanEnabled** Indicates if Windows Update for Business dual scan is enabled on the device.
+- **IsWUfBEnabled** Indicates if Windows Update for Business is enabled on the device.
+- **MetadataIntegrityMode** The mode of the update transport metadata integrity check. 0-Unknown, 1-Ignoe, 2-Audit, 3-Enforce
+- **MSIError** The last error that was encountered during a scan for updates.
+- **NetworkConnectivityDetected** Indicates the type of network connectivity that was detected. 0 - IPv4, 1 - IPv6
+- **NumberOfApplicationsCategoryScanEvaluated** The number of categories (apps) for which an app update scan checked
+- **NumberOfLoop** The number of round trips the scan required
+- **NumberOfNewUpdatesFromServiceSync** The number of updates which were seen for the first time in this scan
+- **NumberOfUpdatesEvaluated** The total number of updates which were evaluated as a part of the scan
+- **NumFailedMetadataSignatures** The number of metadata signatures checks which failed for new metadata synced down.
+- **Online** Indicates if this was an online scan.
+- **PhonePreviewEnabled** Indicates whether a phone was getting preview build, prior to flighting (pre-release builds) being introduced.
+- **ProcessName** The process name of the caller who initiated API calls, in the event where CallerApplicationName was not provided.
+- **RelatedCV** The previous Correlation Vector that was used before swapping with a new one
+- **ScanDurationInSeconds** The number of seconds a scan took
+- **ScanEnqueueTime** The number of seconds it took to initialize a scan
+- **ServiceGuid** An ID which represents which service the software distribution client is checking for content (Windows Update, Windows Store, etc.).
+- **ServiceUrl** The environment URL a device is configured to scan with
+- **ShippingMobileOperator** The mobile operator that a device shipped on.
+- **StatusCode** Indicates the result of a CheckForUpdates event (success, cancellation, failure code HResult).
+- **SyncType** Describes the type of scan the event was
+- **SystemBIOSMajorRelease** Major version of the BIOS.
+- **SystemBIOSMinorRelease** Minor version of the BIOS.
+- **TotalNumMetadataSignatures** The total number of metadata signatures checks done for new metadata that was synced down.
+- **WUDeviceID** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue.
+- **ApplicableUpdateInfo** Metadata for the updates which were detected as applicable
+- **NumberOfApplicableUpdates** The number of updates which were ultimately deemed applicable to the system after the detection process is complete
+- **WebServiceRetryMethods** Web service method requests that needed to be retried to complete operation.
+- **BranchReadinessLevel** The servicing branch configured on the device.
+- **DeferralPolicySources** Sources for any update deferral policies defined (GPO = 0x10, MDM = 0x100, Flight = 0x1000, UX = 0x10000).
+- **DeferredUpdates** Update IDs which are currently being deferred until a later time
+- **DriverExclusionPolicy** Indicates if the policy for not including drivers with Windows Update is enabled.
+- **FeatureUpdateDeferral** The deferral period configured for feature OS updates on the device (in days).
+- **FeatureUpdatePause** Indicates whether feature OS updates are paused on the device.
+- **FeatureUpdatePausePeriod** The pause duration configured for feature OS updates on the device (in days).
+- **QualityUpdateDeferral** The deferral period configured for quality OS updates on the device (in days).
+- **QualityUpdatePause** Indicates whether quality OS updates are paused on the device.
+- **QualityUpdatePausePeriod** The pause duration configured for quality OS updates on the device (in days).
+- **IntentPFNs** Intended application-set metadata for atomic update scenarios.
+- **PausedUpdates** A list of UpdateIds which that currently being paused.
+- **PauseFeatureUpdatesEndTime** If feature OS updates are paused on the device, this is the date and time for the end of the pause time window.
+- **PauseFeatureUpdatesStartTime** If feature OS updates are paused on the device, this is the date and time for the beginning of the pause time window.
+- **PauseQualityUpdatesEndTime** If quality OS updates are paused on the device, this is the date and time for the end of the pause time window.
+- **PauseQualityUpdatesStartTime** If quality OS updates are paused on the device, this is the date and time for the beginning of the pause time window.
+- **CachedEngineVersion** For self-initiated healing, the version of the SIH engine that is cached on the device. If the SIH engine does not exist, the value is null.
+- **TargetMetadataVersion** For self-initiated healing, this is the target version of the SIH engine to download (if needed). If not, the value is null.
+- **Context** Gives context on where the error has occurred. Example: AutoEnable, GetSLSData, AddService, Misc, or Unknown
+- **DriverSyncPassPerformed** Were drivers scanned this time?
+
+
+### SoftwareUpdateClientTelemetry.Install
+
+This event sends tracking data about the software distribution client installation of the content for that update, to help keep Windows up to date.
+
+The following fields are available:
+
+- **BiosFamily** The family of the BIOS (Basic Input Output System).
+- **BiosName** The name of the device BIOS.
+- **BiosReleaseDate** The release date of the device BIOS.
+- **BiosSKUNumber** The sku number of the device BIOS.
+- **BIOSVendor** The vendor of the BIOS.
+- **BiosVersion** The version of the BIOS.
+- **BundleBytesDownloaded** How many bytes were downloaded for the specific content bundle?
+- **BundleId** Identifier associated with the specific content bundle; should not be all zeros if the bundleID was found.
+- **BundleRepeatFailFlag** Has this particular update bundle previously failed to install?
+- **BundleRevisionNumber** Identifies the revision number of the content bundle.
+- **CachedEngineVersion** For self-initiated healing, the version of the SIH engine that is cached on the device. If the SIH engine does not exist, the value is null.
+- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client.
+- **CbsDownloadMethod** Was the download a full download or a partial download?
+- **ClientManagedByWSUSServer** Is the client managed by Windows Server Update Services (WSUS)?
+- **ClientVersion** The version number of the software distribution client.
+- **CSIErrorType** The stage of CBS installation where it failed.
+- **CurrentMobileOperator** Mobile operator that device is currently connected to.
+- **DeviceModel** What is the device model.
+- **DeviceOEM** What OEM does this device belong to.
+- **DownloadPriority** The priority of the download activity.
+- **DownloadScenarioId** A unique ID for a given download used to tie together WU and DO events.
+- **DriverPingBack** Contains information about the previous driver and system state.
+- **Edition** Indicates the edition of Windows being used.
+- **EventInstanceID** A globally unique identifier for event instance.
+- **EventNamespaceID** Indicates whether the event succeeded or failed. Has the format EventType+Event where Event is Succeeded, Cancelled, Failed, etc.
+- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started installing content, or whether it was cancelled, succeeded, or failed.
+- **EventType** Possible values are Child, Bundle, or Driver.
+- **ExtendedErrorCode** The extended error code.
+- **ExtendedStatusCode** Secondary error code for certain scenarios where StatusCode wasn't specific enough.
+- **FeatureUpdatePause** Are feature OS updates paused on the device?
+- **FlightBranch** The branch that a device is on if participating in the Windows Insider Program.
+- **FlightBuildNumber** If this installation was for a Windows Insider build, this is the build number of that build.
+- **FlightId** The specific ID of the Windows Insider build the device is getting.
+- **FlightRing** The ring that a device is on if participating in the Windows Insider Program.
+- **HandlerType** Indicates what kind of content is being installed. Example: app, driver, Windows update
+- **HardwareId** If this install was for a driver targeted to a particular device model, this ID indicates the model of the device.
+- **HomeMobileOperator** The mobile operator that the device was originally intended to work with.
+- **IntentPFNs** Intended application-set metadata for atomic update scenarios.
+- **IsAOACDevice** Is it Always On, Always Connected? (Mobile device usage model)
+- **IsDependentSet** Is the driver part of a larger System Hardware/Firmware update?
+- **IsFinalOutcomeEvent** Does this event signal the end of the update/upgrade process?
+- **IsFirmware** Is this update a firmware update?
+- **IsSuccessFailurePostReboot** Did it succeed and then fail after a restart?
+- **IsWUfBDualScanEnabled** Is Windows Update for Business dual scan enabled on the device?
+- **IsWUfBEnabled** Is Windows Update for Business enabled on the device?
+- **MergedUpdate** Was the OS update and a BSP update merged for installation?
+- **MsiAction** The stage of MSI installation where it failed.
+- **MsiProductCode** The unique identifier of the MSI installer.
+- **PackageFullName** The package name of the content being installed.
+- **PhonePreviewEnabled** Indicates whether a phone was getting preview build, prior to flighting being introduced.
+- **PlatformRole** The PowerPlatformRole as defined on MSDN.
+- **ProcessName** The process name of the caller who initiated API calls, in the event where CallerApplicationName was not provided.
+- **ProcessorArchitecture** Processor architecture of the system (x86, AMD64, ARM).
+- **QualityUpdatePause** Are quality OS updates paused on the device?
+- **RelatedCV** The previous Correlation Vector that was used before swapping with a new one
+- **RepeatFailFlag** Indicates whether this specific piece of content had previously failed to install.
+- **RepeatSuccessInstallFlag** Indicates whether this specific piece of content had previously installed successful, for example if another user had already installed it.
+- **RevisionNumber** The revision number of this specific piece of content.
+- **ServiceGuid** An ID which represents which service the software distribution client is installing content for (Windows Update, Windows Store, etc.).
+- **Setup360Phase** If the install is for an operating system upgrade, indicates which phase of the upgrade is underway.
+- **ShippingMobileOperator** The mobile operator that a device shipped on.
+- **StatusCode** Indicates the result of an installation event (success, cancellation, failure code HResult).
+- **SystemBIOSMajorRelease** Major version of the BIOS.
+- **SystemBIOSMinorRelease** Minor version of the BIOS.
+- **TargetGroupId** For drivers targeted to a specific device model, this ID indicates the distribution group of devices receiving that driver.
+- **TargetingVersion** For drivers targeted to a specific device model, this is the version number of the drivers being distributed to the device.
+- **TransactionCode** The ID which represents a given MSI installation
+- **UpdateId** Unique update ID
+- **UpdateImportance** Indicates whether a piece of content was marked as Important, Recommended, or Optional.
+- **UsedSystemVolume** Indicates whether the content was downloaded and then installed from the device's main system storage drive, or an alternate storage drive.
+- **WUDeviceID** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue.
+- **WUSetting** Indicates the user's current updating settings.
+
+
+### SoftwareUpdateClientTelemetry.DownloadHeartbeat
+
+This event allows tracking of ongoing downloads and contains data to explain the current state of the download
+
+The following fields are available:
+
+- **BundleID** Identifier associated with the specific content bundle. If this value is found, it shouldn't report as all zeros
+- **BytesTotal** Total bytes to transfer for this content
+- **BytesTransferred** Total bytes transferred for this content at the time of heartbeat
+- **ConnectionStatus** Indicates the connectivity state of the device at the time of heartbeat
+- **CurrentError** Last (transient) error encountered by the active download
+- **DownloadFlags** Flags indicating if power state is ignored
+- **DownloadState** Current state of the active download for this content (queued, suspended, or progressing)
+- **IsNetworkMetered** "Indicates whether Windows considered the current network to be ?metered"""
+- **MOAppDownloadLimit** Mobile operator cap on size of application downloads, if any
+- **MOUpdateDownloadLimit** Mobile operator cap on size of operating system update downloads, if any
+- **PowerState** Indicates the power state of the device at the time of heartbeart (DC, AC, Battery Saver, or Connected Standby)
+- **RelatedCV** "The previous correlation vector that was used by the client, before swapping with a new one "
+- **ResumeCount** Number of times this active download has resumed from a suspended state
+- **ServiceID** "Identifier for the service to which the software distribution client is connecting (Windows Update, Windows Store, etc) "
+- **SuspendCount** Number of times this active download has entered a suspended state
+- **SuspendReason** Last reason for why this active download entered a suspended state
+- **CallerApplicationName** Name provided by the caller who initiated API calls into the software distribution client
+- **ClientVersion** The version number of the software distribution client
+- **EventType** "Possible values are ""Child"", ""Bundle"", or ""Driver"""
+- **FlightId** The unique identifier for each flight
+- **RevisionNumber** Identifies the revision number of this specific piece of content
+- **ServiceGuid** Identifier for the service to which the software distribution client is connecting (Windows Update, Windows Store, etc)
+- **UpdateId** "Identifier associated with the specific piece of content "
+- **WUDeviceID** "Unique device id controlled by the software distribution client "
+
+
+## Update events
+
+### Update360Telemetry.UpdateAgentPostRebootResult
+
+This event collects information for both Mobile and Desktop regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario
+
+The following fields are available:
+
+- **ErrorCode** The error code returned for the current post reboot phase
+- **FlightId** The unique identifier for each flight
+- **ObjectId** Unique value for each Update Agent mode
+- **RelatedCV** Correlation vector value generated from the latest USO scan
+- **Result** Indicates the Hresult
- **ScenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate
-- **RelatedCV** Correlation vector value generated from the latest USO scan.
-- **Result** Result of the download request phase of update.
-- **PackageSizeCanonical** Size of canonical packages in bytes
-- **PackageSizeDiff** Size of diff packages in bytes
-- **PackageSizeExpress** Size of express packages in bytes
-- **FlightId** Unique ID for each flight.
-- **UpdateId** Unique ID for each update.
-- **PackageCountTotalCanonical** Total number of canonical packages.
-- **PackageCountTotalDiff** Total number of diff packages.
-- **PackageCountTotalExpress** Total number of express packages.
-- **RangeRequestState** Represents the state of the download range request.
-- **DeletedCorruptFiles** Indicates if UpdateAgent found any corrupt payload files and whether the payload was deleted.
+- **SessionId** Unique value for each Update Agent mode attempt
+- **UpdateId** Unique ID for each update
+- **PostRebootResult** Indicates the Hresult
### Update360Telemetry.UpdateAgent_Initialize
@@ -2997,17 +3095,44 @@ This event sends data during the initialize phase of updating Windows.
The following fields are available:
- **ErrorCode** The error code returned for the current initialize phase.
-- **SessionData** Contains instructions to update agent for processing FODs and DUICs (Null for other scenarios).
-- **UpdateId** Unique ID for each update.
- **FlightId** Unique ID for each flight.
- **FlightMetadata** Contains the FlightId and the build being flighted.
- **ObjectId** Unique value for each Update Agent mode.
-- **SessionId** Unique value for each Update Agent mode attempt .
-- **ScenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate
- **RelatedCV** Correlation vector value generated from the latest USO scan.
+- **ScenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate
+- **SessionData** Contains instructions to update agent for processing FODs and DUICs (Null for other scenarios).
+- **SessionId** Unique value for each Update Agent mode attempt .
+- **UpdateId** Unique ID for each update.
- **Result** Result of the initialize phase of update. 0 = Succeeded, 1 = Failed, 2 = Cancelled, 3 = Blocked, 4 = BlockCancelled
+### Update360Telemetry.UpdateAgent_DownloadRequest
+
+This event sends data during the download request phase of updating Windows.
+
+The following fields are available:
+
+- **ErrorCode** The error code returned for the current download request phase.
+- **ObjectId** Unique value for each Update Agent mode.
+- **PackageCountOptional** Number of optional packages requested.
+- **PackageCountRequired** Number of required packages requested.
+- **PackageCountTotal** Total number of packages needed.
+- **RelatedCV** Correlation vector value generated from the latest USO scan.
+- **ScenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate
+- **SessionId** Unique value for each Update Agent mode attempt.
+- **PackageSizeCanonical** Size of canonical packages in bytes
+- **PackageSizeDiff** Size of diff packages in bytes
+- **PackageSizeExpress** Size of express packages in bytes
+- **Result** Result of the download request phase of update.
+- **FlightId** Unique ID for each flight.
+- **UpdateId** Unique ID for each update.
+- **PackageCountTotalCanonical** Total number of canonical packages.
+- **PackageCountTotalDiff** Total number of diff packages.
+- **PackageCountTotalExpress** Total number of express packages.
+- **DeletedCorruptFiles** Indicates if UpdateAgent found any corrupt payload files and whether the payload was deleted.
+- **RangeRequestState** Represents the state of the download range request.
+
+
### Update360Telemetry.UpdateAgent_Install
This event sends data during the install phase of updating Windows.
@@ -3016,10 +3141,10 @@ The following fields are available:
- **ErrorCode** The error code returned for the current install phase.
- **ObjectId** Unique value for each Update Agent mode.
-- **SessionId** Unique value for each Update Agent mode attempt.
-- **ScenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate
- **RelatedCV** Correlation vector value generated from the latest scan.
-- **Result** Result of the install phase of update. 0 = Succeeded 1 = Failed, 2 = Cancelled, 3 = Blocked, 4 = BlockCancelled
+- **ScenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate
+- **SessionId** Unique value for each Update Agent mode attempt.
+- **Result** "Result of the install phase of update. 0 = Succeeded 1 = Failed, 2 = Cancelled, 3 = Blocked, 4 = BlockCancelled "
- **FlightId** Unique ID for each flight.
- **UpdateId** Unique ID for each update.
@@ -3032,9 +3157,9 @@ The following fields are available:
- **Mode** Indicates that the Update Agent mode that has started. 1 = Initialize, 2 = DownloadRequest, 3 = Install, 4 = Commit
- **ObjectId** Unique value for each Update Agent mode.
-- **SessionId** Unique value for each Update Agent mode attempt.
-- **ScenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate
- **RelatedCV** The correlation vector value generated from the latest scan.
+- **ScenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate
+- **SessionId** Unique value for each Update Agent mode attempt.
- **FlightId** Unique ID for each flight.
- **UpdateId** Unique ID for each update.
@@ -3045,124 +3170,150 @@ This event sends data during the launching of the setup box when updating Window
The following fields are available:
-- **Quiet** Indicates whether setup is running in quiet mode. 0 = false 1 = true
- **ObjectId** Unique value for each Update Agent mode.
-- **SessionId** Unique value for each Update Agent mode attempt.
-- **ScenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate
+- **Quiet** Indicates whether setup is running in quiet mode. 0 = false 1 = true
- **RelatedCV** Correlation vector value generated from the latest scan.
+- **ScenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate
+- **SessionId** Unique value for each Update Agent mode attempt.
- **FlightId** Unique ID for each flight.
- **UpdateId** Unique ID for each update.
- **SetupMode** Setup mode 1 = predownload, 2 = install, 3 = finalize
- **SandboxSize** The size of the sandbox folder on the device.
+## Update notification events
+
+### Microsoft.Windows.UpdateNotificationPipeline.JavascriptJavascriptCriticalGenericMessage
+
+This event indicates that Javascript is reporting a schema and a set of values for critical diagnostic data.
+
+The following fields are available:
+
+- **CampaignConfigVersion** Configuration version for the current campaign
+- **CampaignID** Currently campaign that's running on UNP
+- **ConfigCatalogVersion** Current catalog version of UNP
+- **ContentVersion** Content version for the current campaign on UNP
+- **CV** Correlation vector
+- **DetectorVersion** Most recently run detector version for the current campaign on UNP
+- **GlobalEventCounter** Client-side counter that indicates the event ordering sent by the user
+- **key1** Interaction data for the UI
+- **key10** Interaction data for the UI
+- **key11** Interaction data for the UI
+- **key12** Interaction data for the UI
+- **key13** Interaction data for the UI
+- **key14** Interaction data for the UI
+- **key15** Interaction data for the UI
+- **key16** Interaction data for the UI
+- **key17** Interaction data for the UI
+- **key18** Interaction data for the UI
+- **key19** Interaction data for the UI
+- **key2** Interaction data for the UI
+- **key20** Interaction data for the UI
+- **key21** Interaction data for the UI
+- **key22** Interaction data for the UI
+- **key23** Interaction data for the UI
+- **key24** Interaction data for the UI
+- **key25** Interaction data for the UI
+- **key26** Interaction data for the UI
+- **key27** Interaction data for the UI
+- **key28** Interaction data for the UI
+- **key29** Interaction data for the UI
+- **key3** Interaction data for the UI
+- **key30** Interaction data for the UI
+- **key4** Interaction data for the UI
+- **key5** Interaction data for the UI
+- **key6** Interaction data for the UI
+- **key7** Interaction data for the UI
+- **key8** Interaction data for the UI
+- **key9** Interaction data for the UI
+- **PackageVersion** Current package version of UNP
+- **schema** Type of UI interaction
+
+
+### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignHeartbeat
+
+This event is sent at the start of each campaign, to be used as a heartbeat
+
+The following fields are available:
+
+- **CampaignConfigVersion** Configuration version for the current campaign
+- **CampaignID** Currently campaign that's running on UNP
+- **ConfigCatalogVersion** Current catalog version of UNP
+- **ContentVersion** Content version for the current campaign on UNP
+- **CV** Correlation vector
+- **DetectorVersion** Most recently run detector version for the current campaign on UNP
+- **GlobalEventCounter** Client-side counter that indicates the event ordering sent by the user
+- **PackageVersion** Current UNP package version
+
+
+### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignManagerCleaningCampaign
+
+This event indicates that the Campaign Manager is cleaning up the campaign content
+
+The following fields are available:
+
+- **CampaignConfigVersion** Configuration version for the current campaign
+- **CampaignID** Current campaign that's running on UNP
+- **ConfigCatalogVersion** Current catalog version of UNP
+- **ContentVersion** Content version for the current campaign on UNP
+- **CV** Correlation vector
+- **DetectorVersion** Most recently run detector version for the current campaign on UNP
+- **GlobalEventCounter** Client-side counter that indicates the event ordering sent by the user
+- **PackageVersion** Current UNP package version
+
+
+### Microsoft.Windows.UpdateNotificationPipeline.UnpCampaignManagerGetIsCamppaignCompleteFailed
+
+This event is sent when a campaign completion status query fails
+
+The following fields are available:
+
+- **CampaignConfigVersion** Configuration version for the current campaign
+- **CampaignID** Current campaign that's running on UNP
+- **ConfigCatalogVersion** Current catalog version of UNP
+- **ContentVersion** Content version for the current campaign on UNP
+- **CV** Correlation vector
+- **DetectorVersion** Most recently run detector version for the current campaign on UNP
+- **GlobalEventCounter** Client-side counter that indicates the event ordering sent by the user
+- **hresult** HRESULT of the failure
+- **PackageVersion** Current UNP package version
+
+
+### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignManagerHeartbeat
+
+This event is sent at the start of the CampaignManager event and is intended to be used as a heartbeat
+
+The following fields are available:
+
+- **CampaignConfigVersion** Configuration version for the current campaign
+- **CampaignID** Currently campaign that's running on UNP
+- **ConfigCatalogVersion** Current catalog version of UNP
+- **ContentVersion** Content version for the current campaign on UNP
+- **CV** Correlation vector
+- **DetectorVersion** Most recently run detector version for the current campaign on UNP
+- **GlobalEventCounter** Client-side counter that indicates the event ordering sent by the user
+- **PackageVersion** Current UNP package version
+
+
+### Microsoft.Windows.UpdateNotificationPipeline.UnpCampaignManagerRunCampaignFailed
+
+This event is sent when the Campaign Manager encounters an unexpected error while running the campaign
+
+The following fields are available:
+
+- **CampaignConfigVersion** Configuration version for the current campaign
+- **CampaignID** Currently campaign that's running on UNP
+- **ConfigCatalogVersion** Current catalog version of UNP
+- **ContentVersion** Content version for the current campaign on UNP
+- **CV** Correlation vector
+- **DetectorVersion** Most recently run detector version for the current campaign on UNP
+- **GlobalEventCounter** Client-side counter that indicates the event ordering sent by the user
+- **hresult** HRESULT of the failure#N#
+- **PackageVersion** Current UNP package version
+
+
## Upgrade events
-### Setup360Telemetry.Downlevel
-
-This event sends data indicating that the device has invoked the downlevel phase of the upgrade. It's used to help keep Windows up-to-date and secure.
-
-The following fields are available:
-
-- **ClientId** If using Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, the default value is Media360, but it can be overwritten by the caller to a unique value.
-- **InstanceId** A unique GUID that identifies each instance of setuphost.exe.
-- **ReportId** In the Windows Update scenario, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim.
-- **WuId** This is the Windows Update Client ID. In the Windows Update scenario, this is the same as the clientId.
-- **TestId** A string that uniquely identifies a group of events.
-- **State** Exit state of given Setup360 run. Example: succeeded, failed, blocked, cancelled
-- **HostOsSkuName** The operating system edition which is running Setup360 instance (downlevel OS).
-- **HostOSBuildNumber** The build number of the downlevel OS.
-- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT
-- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback
-- **Setup360Result** The result of Setup360. It's an HRESULT error code that can be used to diagnose errors.
-- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
-- **SetupVersionBuildNumber** The build number of Setup360 (build number of the target OS).
-
-
-### Setup360Telemetry.Finalize
-
-This event sends data indicating that the device has invoked the finalize phase of the upgrade, to help keep Windows up-to-date.
-
-The following fields are available:
-
-- **ClientId** With Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
-- **InstanceId** A unique GUID that identifies each instance of setuphost.exe
-- **ReportId** With Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim.
-- **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as the clientId.
-- **TestId** A string to uniquely identify a group of events.
-- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled
-- **HostOsSkuName** The OS edition which is running Setup360 instance (previous OS).
-- **HostOSBuildNumber** The build number of the previous OS.
-- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT
-- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback
-- **Setup360Result** The result of Setup360. This is an HRESULT error code that is used to diagnose errors.
-- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
-- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
-
-
-### Setup360Telemetry.OsUninstall
-
-The event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, the Setup360Telemetry.OSUninstall indicates the outcome of an OS uninstall.
-
-The following fields are available:
-
-- **ClientId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
-- **InstanceId** A unique GUID that identifies each instance of setuphost.exe.
-- **ReportId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, this is the GUID for the install.wim.
-- **WuId** Windows Update client ID.
-- **TestId** A string to uniquely identify a group of events.
-- **State** Exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled
-- **HostOsSkuName** The OS edition which is running the Setup360 instance (previous OS).
-- **HostOSBuildNumber** The build number of the previous OS.
-- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT
-- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback
-- **Setup360Result** The result of Setup360. This is an HRESULT error code that is used to diagnose errors.
-- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
-- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
-
-
-### Setup360Telemetry.PostRebootInstall
-
-This event sends data indicating that the device has invoked the postrebootinstall phase of the upgrade, to help keep Windows up-to-date.
-
-The following fields are available:
-
-- **ClientId** With Windows Update, this is the Windows Update client ID that is passed to Setup. In Media setup, the default value is Media360, but can be overwritten by the caller to a unique value.
-- **InstanceId** A unique GUID that identifies each instance of setuphost.exe.
-- **ReportId** With Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim.
-- **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as ClientId.
-- **TestId** A string to uniquely identify a group of events.
-- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled
-- **HostOsSkuName** The OS edition which is running Setup360 instance (previous OS).
-- **HostOSBuildNumber** The build number of the previous OS.
-- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT
-- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback
-- **Setup360Result** The result of Setup360. This is an HRESULT error code that's used to diagnose errors.
-- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
-- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
-
-
-### Setup360Telemetry.PreDownloadQuiet
-
-This event sends data indicating that the device has invoked the predownload quiet phase of the upgrade, to help keep Windows up to date.
-
-The following fields are available:
-
-- **ClientId** Using Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
-- **InstanceId** A unique GUID that identifies each instance of setuphost.exe
-- **ReportId** Using Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim.
-- **WuId** This is the Windows Update Client ID. Using Windows Update, this is the same as the clientId.
-- **TestId** A string to uniquely identify a group of events.
-- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, canceled
-- **HostOsSkuName** The OS edition which is running Setup360 instance (previous operating system).
-- **HostOSBuildNumber** The build number of the previous OS.
-- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT
-- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback
-- **Setup360Result** The result of Setup360. This is an HRESULT error code that is used to diagnose errors.
-- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
-- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
-
-
### Setup360Telemetry.PreDownloadUX
The event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, the Setup360Telemetry.PredownloadUX indicates the outcome of the PredownloadUX portion of the update process.
@@ -3170,75 +3321,18 @@ The event sends data regarding OS updates and upgrades from Windows 7, Windows 8
The following fields are available:
- **ClientId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
+- **HostOSBuildNumber** The build number of the previous operating system.
+- **HostOsSkuName** The OS edition which is running the Setup360 instance (previous operating system).
- **InstanceId** Unique GUID that identifies each instance of setuphost.exe.
- **ReportId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, this is the GUID for the install.wim.
-- **WuId** Windows Update client ID.
-- **TestId** A string to uniquely identify a group of events.
-- **State** The exit state of the Setup360 run. Example: succeeded, failed, blocked, cancelled
-- **HostOsSkuName** The OS edition which is running the Setup360 instance (previous operating system).
-- **HostOSBuildNumber** The build number of the previous operating system.
+- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
+- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback
+- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used to diagnose errors.
- **Setup360Scenario** The Setup360 flow type. Examplle: Boot, Media, Update, MCT
-- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback
-- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used to diagnose errors.
-- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
- **SetupVersionBuildNumber** The build number of Setup360 (build number of the target OS).
-
-
-### Setup360Telemetry.PreInstallQuiet
-
-This event sends data indicating that the device has invoked the preinstall quiet phase of the upgrade, to help keep Windows up to date.
-
-The following fields are available:
-
-- **ClientId** With Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
-- **InstanceId** A unique GUID that identifies each instance of setuphost.exe
-- **ReportId** With Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim.
-- **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as the clientId.
+- **State** The exit state of the Setup360 run. Example: succeeded, failed, blocked, cancelled
- **TestId** A string to uniquely identify a group of events.
-- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled
-- **HostOsSkuName** The OS edition which is running Setup360 instance (previous OS).
-- **HostOSBuildNumber** The build number of the previous OS.
-- **Setup360Scenario** Setup360 flow type (Boot, Media, Update, MCT)
-- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback etc.
-- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used to diagnose errors.
-- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
-- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
-
-
-### Setup360Telemetry.PreInstallUX
-
-This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, the Setup360Telemetry.PreinstallUX indicates the outcome of the PreinstallUX portion of the update process.
-
-The following fields are available:
-
-- **ClientId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
-- **InstanceId** A unique GUID that identifies each instance of setuphost.exe.
-- **ReportId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, this is the GUID for the install.wim.
- **WuId** Windows Update client ID.
-- **TestId** A string to uniquely identify a group of events.
-- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled
-- **HostOsSkuName** The OS edition which is running the Setup360 instance (previous OS).
-- **HostOSBuildNumber** The build number of the previous OS.
-- **Setup360Scenario** The Setup360 flow type, Example: Boot, Media, Update, MCT
-- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback
-- **Setup360Result** The result of Setup360. This is an HRESULT error code that is used to diagnose errors.
-- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
-- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
-
-
-### Setup360Telemetry.Setup360
-
-This event sends data about OS deployment scenarios, to help keep Windows up-to-date.
-
-The following fields are available:
-
-- **InstanceId** Retrieves a unique identifier for each instance of a setup session.
-- **ReportId** Retrieves the report ID.
-- **FlightData** Specifies a unique identifier for each group of Windows Insider builds.
-- **ScenarioId** Retrieves the deployment scenario.
-- **FieldName** Retrieves the data point.
-- **Value** Retrieves the value associated with the corresponding FieldName.
-- **ClientId** Retrieves the upgrade ID: Upgrades via Windows Update - specifies the WU clientID. All other deployment - static string.
### Setup360Telemetry.UnexpectedEvent
@@ -3248,18 +3342,221 @@ This event sends data indicating that the device has invoked the unexpected even
The following fields are available:
- **ClientId** With Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
+- **HostOSBuildNumber** The build number of the previous OS.
+- **HostOsSkuName** The OS edition which is running Setup360 instance (previous OS).
- **InstanceId** A unique GUID that identifies each instance of setuphost.exe
- **ReportId** With Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim.
-- **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as the clientId.
-- **TestId** A string to uniquely identify a group of events.
-- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled
-- **HostOsSkuName** The OS edition which is running Setup360 instance (previous OS).
-- **HostOSBuildNumber** The build number of the previous OS.
-- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT
+- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback
- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used used to diagnose errors.
-- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
+- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT
- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
+- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled
+- **TestId** A string to uniquely identify a group of events.
+- **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as the clientId.
+
+
+### Setup360Telemetry.PreInstallQuiet
+
+This event sends data indicating that the device has invoked the preinstall quiet phase of the upgrade, to help keep Windows up to date.
+
+The following fields are available:
+
+- **ClientId** With Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
+- **HostOSBuildNumber** The build number of the previous OS.
+- **HostOsSkuName** The OS edition which is running Setup360 instance (previous OS).
+- **InstanceId** A unique GUID that identifies each instance of setuphost.exe
+- **ReportId** With Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim.
+- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
+- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback etc.
+- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used to diagnose errors.
+- **Setup360Scenario** Setup360 flow type (Boot, Media, Update, MCT)
+- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
+- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled
+- **TestId** A string to uniquely identify a group of events.
+- **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as the clientId.
+
+
+### Setup360Telemetry.Finalize
+
+This event sends data indicating that the device has invoked the finalize phase of the upgrade, to help keep Windows up-to-date.
+
+The following fields are available:
+
+- **ClientId** With Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
+- **HostOSBuildNumber** The build number of the previous OS.
+- **HostOsSkuName** The OS edition which is running Setup360 instance (previous OS).
+- **InstanceId** A unique GUID that identifies each instance of setuphost.exe
+- **ReportId** With Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim.
+- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
+- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback
+- **Setup360Result** The result of Setup360. This is an HRESULT error code that is used to diagnose errors.
+- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT
+- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
+- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled
+- **TestId** A string to uniquely identify a group of events.
+- **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as the clientId.
+
+
+### Setup360Telemetry.PostRebootInstall
+
+This event sends data indicating that the device has invoked the postrebootinstall phase of the upgrade, to help keep Windows up-to-date.
+
+The following fields are available:
+
+- **ClientId** With Windows Update, this is the Windows Update client ID that is passed to Setup. In Media setup, the default value is Media360, but can be overwritten by the caller to a unique value.
+- **HostOSBuildNumber** The build number of the previous OS.
+- **HostOsSkuName** The OS edition which is running Setup360 instance (previous OS).
+- **InstanceId** A unique GUID that identifies each instance of setuphost.exe.
+- **ReportId** With Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim.
+- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
+- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback
+- **Setup360Result** The result of Setup360. This is an HRESULT error code that's used to diagnose errors.
+- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT
+- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
+- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled
+- **TestId** A string to uniquely identify a group of events.
+- **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as ClientId.
+
+
+### Setup360Telemetry.PreDownloadQuiet
+
+This event sends data indicating that the device has invoked the predownload quiet phase of the upgrade, to help keep Windows up to date.
+
+The following fields are available:
+
+- **ClientId** Using Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
+- **HostOSBuildNumber** The build number of the previous OS.
+- **HostOsSkuName** The OS edition which is running Setup360 instance (previous operating system).
+- **InstanceId** A unique GUID that identifies each instance of setuphost.exe
+- **ReportId** Using Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim.
+- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
+- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback
+- **Setup360Result** The result of Setup360. This is an HRESULT error code that is used to diagnose errors.
+- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT
+- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
+- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, canceled
+- **TestId** A string to uniquely identify a group of events.
+- **WuId** This is the Windows Update Client ID. Using Windows Update, this is the same as the clientId.
+
+
+### Setup360Telemetry.OsUninstall
+
+The event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, the Setup360Telemetry.OSUninstall indicates the outcome of an OS uninstall.
+
+The following fields are available:
+
+- **ClientId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
+- **HostOSBuildNumber** The build number of the previous OS.
+- **HostOsSkuName** The OS edition which is running the Setup360 instance (previous OS).
+- **InstanceId** A unique GUID that identifies each instance of setuphost.exe.
+- **ReportId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, this is the GUID for the install.wim.
+- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
+- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback
+- **Setup360Result** The result of Setup360. This is an HRESULT error code that is used to diagnose errors.
+- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT
+- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
+- **State** Exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled
+- **TestId** A string to uniquely identify a group of events.
+- **WuId** Windows Update client ID.
+
+
+### Setup360Telemetry.Downlevel
+
+This event sends data indicating that the device has invoked the downlevel phase of the upgrade. It's used to help keep Windows up-to-date and secure.
+
+The following fields are available:
+
+- **ClientId** If using Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, the default value is Media360, but it can be overwritten by the caller to a unique value.
+- **HostOSBuildNumber** The build number of the downlevel OS.
+- **HostOsSkuName** The operating system edition which is running Setup360 instance (downlevel OS).
+- **InstanceId** A unique GUID that identifies each instance of setuphost.exe.
+- **ReportId** In the Windows Update scenario, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim.
+- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
+- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback
+- **Setup360Result** The result of Setup360. It's an HRESULT error code that can be used to diagnose errors.
+- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT
+- **SetupVersionBuildNumber** The build number of Setup360 (build number of the target OS).
+- **State** Exit state of given Setup360 run. Example: succeeded, failed, blocked, cancelled
+- **TestId** A string that uniquely identifies a group of events.
+- **WuId** This is the Windows Update Client ID. In the Windows Update scenario, this is the same as the clientId.
+
+
+### Setup360Telemetry.PreInstallUX
+
+This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, the Setup360Telemetry.PreinstallUX indicates the outcome of the PreinstallUX portion of the update process.
+
+The following fields are available:
+
+- **ClientId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
+- **HostOSBuildNumber** The build number of the previous OS.
+- **HostOsSkuName** The OS edition which is running the Setup360 instance (previous OS).
+- **InstanceId** A unique GUID that identifies each instance of setuphost.exe.
+- **ReportId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, this is the GUID for the install.wim.
+- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
+- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback
+- **Setup360Result** The result of Setup360. This is an HRESULT error code that is used to diagnose errors.
+- **Setup360Scenario** The Setup360 flow type, Example: Boot, Media, Update, MCT
+- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
+- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled
+- **TestId** A string to uniquely identify a group of events.
+- **WuId** Windows Update client ID.
+
+
+### Setup360Telemetry.Setup360
+
+This event sends data about OS deployment scenarios, to help keep Windows up-to-date.
+
+The following fields are available:
+
+- **FieldName** Retrieves the data point.
+- **FlightData** Specifies a unique identifier for each group of Windows Insider builds.
+- **InstanceId** Retrieves a unique identifier for each instance of a setup session.
+- **ReportId** Retrieves the report ID.
+- **ScenarioId** Retrieves the deployment scenario.
+- **Value** Retrieves the value associated with the corresponding FieldName.
+- **ClientId** Retrieves the upgrade ID: Upgrades via Windows Update - specifies the WU clientID. All other deployment - static string.
+
+
+## Windows as a Service diagnostic events
+
+### Microsoft.Windows.WaaSMedic.SummaryEvent
+
+This event provides the results from the WaaSMedic engine
+
+The following fields are available:
+
+- **detectionSummary** Result of each detection that ran
+- **featureAssessmentImpact** Windows as a Service (WaaS) Assessment impact on feature updates
+- **insufficientSessions** True, if the device has enough activity to be eligible for update diagnostics. False, if otherwise
+- **isManaged** Indicates the device is managed for updates
+- **isWUConnected** Indicates the device is connected to Windows Update
+- **noMoreActions** All available WaaSMedic diagnostics have run. There are no pending diagnostics and corresponding actions
+- **qualityAssessmentImpact** Windows as a Service (WaaS) Assessment impact for quality updates
+- **remediationSummary** Result of each operation performed on a device to fix an invalid state or configuration that's preventing the device from getting updates. For example, if Windows Update service is turned off, the fix is to turn the it back on
+- **usingBackupFeatureAssessment** The WaaSMedic engine contacts Windows as a Service (WaaS) Assessment to determine whether the device is up-to-date. If WaaS Assessment isn't available, the engine falls back to backup feature assessments, which are determined programmatically on the client#N#
+- **usingBackupQualityAssessment** The WaaSMedic engine contacts Windows as a Service (WaaS) Assessment to determine whether the device is up-to-date. If WaaS Assessment isn't available, the engine falls back to backup quality assessments, which are determined programmatically on the client#N#
+- **versionString** Installed version of the WaaSMedic engine
+- **hrEngineResult** Indicates the WaaSMedic engine operation error codes
+
+
+### Microsoft.Windows.WaaSMedic.Summary
+
+This event provides the results of the WaaSMedic diagnostic run
+
+The following fields are available:
+
+- **detectionSummary** Result of each detection that ran
+- **remediationSummary** Result of each operation performed on a device to fix an invalid state or configuration that's preventing the device from getting updates. For example, if Windows Update service is turned off, the fix is to turn the it back on
+- **versionString** Installed version of the WaaSMedic engine
+- **featureAssessmentImpact** Windows as a Service (WaaS) Assessment impact on feature updates
+- **insufficientSessions** True, if the device has enough activity to be eligible for update diagnostics. False, if otherwise
+- **isManaged** Indicates the device is managed for updates
+- **isWUConnected** Indicates the device is connected to Windows Update
+- **noMoreActions** All available WaaSMedic diagnostics have run. There are no pending diagnostics and corresponding actions
+- **qualityAssessmentImpact** Windows as a Service (WaaS) Assessment impact for quality updates
+- **usingBackupFeatureAssessment** The WaaSMedic engine contacts Windows as a Service (WaaS) Assessment to determine whether the device is up-to-date. If WaaS Assessment isn't available, the engine falls back to backup feature assessments, which are determined programmatically on the client
+- **usingBackupQualityAssessment** The WaaSMedic engine contacts Windows as a Service (WaaS) Assessment to determine whether the device is up-to-date. If WaaS Assessment isn't available, the engine falls back to backup quality assessments, which are determined programmatically on the client
## Windows Error Reporting events
@@ -3270,19 +3567,19 @@ This event sends binary data from the collected dump file wheneveer a bug check
The following fields are available:
-- **ReportId** WER Report Id associated with this bug check (used for finding the corresponding report archive in Watson).
-- **BugCheckCode** Uint64 "bugcheck code" that identifies a proximate cause of the bug check.
-- **BugCheckParameter1** Uint64 parameter providing additional information.
- **BootId** Uint32 identifying the boot number for this device.
+- **BugCheckCode** "Uint64 ""bugcheck code"" that identifies a proximate cause of the bug check."
+- **BugCheckParameter1** Uint64 parameter providing additional information.
- **BugCheckParameter2** Uint64 parameter providing additional information.
-- **BugCheckParameter4** Uint64 parameter providing additional information.
- **BugCheckParameter3** Uint64 parameter providing additional information.
-- **IsValidDumpFile** True if the dump file is valid for the debugger, false otherwise
-- **DumpFileSize** Size of the dump file
+- **BugCheckParameter4** Uint64 parameter providing additional information.
- **DumpFileAttributes** Codes that identify the type of data contained in the dump file
+- **DumpFileSize** Size of the dump file
+- **IsValidDumpFile** True if the dump file is valid for the debugger, false otherwise
+- **ReportId** WER Report Id associated with this bug check (used for finding the corresponding report archive in Watson).
-## Microsoft Store events
+## Windows Store events
### Microsoft.Windows.StoreAgent.Telemetry.AbortedInstallation
@@ -3290,78 +3587,27 @@ This event is sent when an installation or update is canceled by a user or the s
The following fields are available:
-- **PFN** The product family name of the product being installed.
+- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed.
+- **AttemptNumber** Number of retry attempts before it was canceled.
+- **BundleId** The Item Bundle ID.
+- **CategoryId** The Item Category ID.
- **ClientAppId** The identity of the app that initiated this operation.
- **HResult** The result code of the last action performed before this operation.
-- **IsUpdate** Flag indicating if this is an update.
-- **AttemptNumber** Number of retry attempts before it was canceled.
-- **CategoryId** The Item Category ID.
-- **ProductId** The identity of the package or packages being installed.
+- **IntentPFNs** Intent Product Family Name
+- **IsBundle** Is this a bundle?
- **IsInteractive** Was this requested by a user?
-- **IsRemediation** Was this a remediation install?
-- **BundleId** The Item Bundle ID.
- **IsMandatory** Was this a mandatory update?
-- **SystemAttemptNumber** The total number of automatic attempts at installation before it was canceled.
-- **UserAttemptNumber** The total number of user attempts at installation before it was canceled.
+- **IsRemediation** Was this a remediation install?
- **IsRestore** Is this automatically restoring a previously acquired product?
+- **IsUpdate** Flag indicating if this is an update.
+- **IsWin32** Flag indicating if this is a Win32 app (not used).
- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
-- **IsBundle** Is this a bundle?
+- **PFN** The product family name of the product being installed.
+- **ProductId** The identity of the package or packages being installed.
+- **SystemAttemptNumber** The total number of automatic attempts at installation before it was canceled.
+- **UpdateId** Update ID (if this is an update)
+- **UserAttemptNumber** The total number of user attempts at installation before it was canceled.
- **WUContentId** The Windows Update content ID
-- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed.
-
-
-### Microsoft.Windows.StoreAgent.Telemetry.BeginGetInstalledContentIds
-
-This event is sent when an inventory of the apps installed is started to determine whether updates for those apps are available. It's used to help keep Windows up-to-date and secure.
-
-
-
-### Microsoft.Windows.StoreAgent.Telemetry.BeginUpdateMetadataPrepare
-
-This event is sent when the Store Agent cache is refreshed with any available package updates. It's used to help keep Windows up-to-date and secure.
-
-
-
-### Microsoft.Windows.StoreAgent.Telemetry.CancelInstallation
-
-This event is sent when an app update or installation is canceled while in interactive mode. This can be canceled by the user or the system. It's used to help keep Windows up-to-date and secure.
-
-The following fields are available:
-
-- **IsInteractive** Was this requested by a user?
-- **AttemptNumber** Total number of installation attempts.
-- **BundleId** The identity of the Windows Insider build that is associated with this product.
-- **PreviousHResult** The previous HResult code.
-- **ClientAppId** The identity of the app that initiated this operation.
-- **CategoryId** The identity of the package or packages being installed.
-- **PFN** The name of all packages to be downloaded and installed.
-- **ProductId** The name of the package or packages requested for installation.
-- **IsUpdate** Is this a product update?
-- **IsRemediation** Is this repairing a previous installation?
-- **RelatedCV** Correlation Vector of a previous performed action on this product.
-- **PreviousInstallState** Previous installation state before it was canceled.
-- **IsMandatory** Is this a mandatory update?
-- **SystemAttemptNumber** Total number of automatic attempts to install before it was canceled.
-- **UserAttemptNumber** Total number of user attempts to install before it was canceled.
-- **IsRestore** Is this an automatic restore of a previously acquired product?
-- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
-- **IsBundle** Is this a bundle?
-- **WUContentId** The Windows Update content ID
-- **AggregatedPackageFullNames** The names of all package or packages to be downloaded and installed.
-
-
-### Microsoft.Windows.StoreAgent.Telemetry.CompleteInstallOperationRequest
-
-This event is sent after the app installations or updates. It's used to help keep Windows up-to-date and secure
-
-The following fields are available:
-
-- **IsBundle** Is this a bundle?
-- **ProductId** The Store Product ID of the product being installed.
-- **SkuId** Specific edition of the item being installed.
-- **CatalogId** The Store Product ID of the app being installed.
-- **PackageFamilyName** The name of the package being installed.
-- **HResult** HResult code of the action being performed.
### Microsoft.Windows.StoreAgent.Telemetry.EndAcquireLicense
@@ -3370,24 +3616,28 @@ This event is sent after the license is acquired when a product is being install
The following fields are available:
-- **PFN** Product Family Name of the product being installed.
-- **HResult** HResult code to show the result of the operation (success/failure).
-- **ProductId** The Store Product ID for the product being installed.
-- **IsInteractive** Did the user initiate the installation?
+- **AggregatedPackageFullNames** Includes a set of package full names for each app that is part of an atomic set.
+- **AttemptNumber** The total number of attempts to acquire this product.
+- **BundleId** The bundle ID
- **CategoryId** The identity of the package or packages being installed.
- **ClientAppId** The identity of the app that initiated this operation.
-- **IsRemediation** Is this repairing a previous installation?
-- **UpdateId** The update ID (if this is an update)
-- **AttemptNumber** The total number of attempts to acquire this product.
-- **IsUpdate** Is this an update?
-- **IsMandatory** Is this a mandatory update?
-- **SystemAttemptNumber** The number of attempts by the system to acquire this product.
-- **UserAttemptNumber** The number of attempts by the user to acquire this product
-- **IsRestore** Is this happening after a device restore?
+- **HResult** HResult code to show the result of the operation (success/failure).
+- **IntentPFNs** Intent Product Family Name
- **IsBundle** Is this a bundle?
-- **WUContentId** The Windows Update content ID
+- **IsInteractive** Did the user initiate the installation?
+- **IsMandatory** Is this a mandatory update?
+- **IsRemediation** Is this repairing a previous installation?
+- **IsRestore** Is this happening after a device restore?
+- **IsUpdate** Is this an update?
+- **IsWin32** Flag indicating if this is a Win32app.
- **ParentBundledId** The product's parent bundle ID.
-- **AggregatedPackageFullNames** Includes a set of package full names for each app that is part of an atomic set.
+- **ParentBundleId** The parent bundle ID (if it's part of a bundle).
+- **PFN** Product Family Name of the product being installed.
+- **ProductId** The Store Product ID for the product being installed.
+- **SystemAttemptNumber** The number of attempts by the system to acquire this product.
+- **UpdateId** The update ID (if this is an update)
+- **UserAttemptNumber** The number of attempts by the user to acquire this product
+- **WUContentId** The Windows Update content ID
### Microsoft.Windows.StoreAgent.Telemetry.EndDownload
@@ -3396,26 +3646,29 @@ This event happens during the app update or installation when content is being d
The following fields are available:
-- **PFN** The Product Family Name of the app being download.
-- **IsRemediation** Is this repairing a previous installation?
-- **DownloadSize** The total size of the download.
-- **ClientAppId** The identity of the app that initiated this operation.
-- **CategoryId** The identity of the package or packages being installed.
-- **IsUpdate** Is this an update?
-- **HResult** The result code of the last action performed.
-- **IsInteractive** Is this initiated by the user?
+- **AggregatedPackageFullNames** The name of all packages to be downloaded and installed.
- **AttemptNumber** Number of retry attempts before it was canceled.
- **BundleId** The identity of the Windows Insider build associated with this product.
-- **ProductId** The Store Product ID for the product being installed.
-- **IsMandatory** Is this a mandatory installation?
-- **SystemAttemptNumber** The number of attempts by the system to download.
-- **UserAttemptNumber** The number of attempts by the user to download.
-- **IsRestore** Is this a restore of a previously acquired product?
-- **ParentBundleId** The parent bundle ID (if it's part of a bundle).
-- **IsBundle** Is this a bundle?
-- **WUContentId** The Windows Update content ID.
+- **CategoryId** The identity of the package or packages being installed.
+- **ClientAppId** The identity of the app that initiated this operation.
+- **DownloadSize** The total size of the download.
- **ExtendedHResult** Any extended HResult error codes.
-- **AggregatedPackageFullNames** The name of all packages to be downloaded and installed.
+- **HResult** The result code of the last action performed.
+- **IntentPFNs** Intent Product Family Name
+- **IsBundle** Is this a bundle?
+- **IsInteractive** Is this initiated by the user?
+- **IsMandatory** Is this a mandatory installation?
+- **IsRemediation** Is this repairing a previous installation?
+- **IsRestore** Is this a restore of a previously acquired product?
+- **IsUpdate** Is this an update?
+- **IsWin32** Flag indicating if this is a Win32 app (unused).
+- **ParentBundleId** The parent bundle ID (if it's part of a bundle).
+- **PFN** The Product Family Name of the app being download.
+- **ProductId** The Store Product ID for the product being installed.
+- **SystemAttemptNumber** The number of attempts by the system to download.
+- **UpdateId** Update ID (if this is an update)
+- **UserAttemptNumber** The number of attempts by the user to download.
+- **WUContentId** The Windows Update content ID.
### Microsoft.Windows.StoreAgent.Telemetry.EndFrameworkUpdate
@@ -3442,25 +3695,28 @@ This event is sent after a product has been installed. It's used to help keep Wi
The following fields are available:
-- **BundleId** The identity of the build associated with this product.
-- **PFN** Product Family Name of the product being installed.
-- **ClientAppId** The identity of the app that initiated this operation.
-- **CategoryId** The identity of the package or packages being installed.
-- **ProductId** The Store Product ID for the product being installed.
-- **AttemptNumber** The number of retry attempts before it was canceled.
-- **HResult** The result code of the last action performed.
-- **IsRemediation** Is this repairing a previous installation?
-- **IsInteractive** Is this an interactive installation?
-- **IsUpdate** Is this an update?
-- **IsMandatory** Is this a mandatory installation?
-- **SystemAttemptNumber** The total number of system attempts.
-- **UserAttemptNumber** The total number of user attempts.
-- **IsRestore** Is this automatically restoring a previously acquired product?
-- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
-- **IsBundle** Is this a bundle?
-- **WUContentId** The Windows Update content ID
-- **ExtendedHResult** The extended HResult error code.
- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed.
+- **AttemptNumber** The number of retry attempts before it was canceled.
+- **BundleId** The identity of the build associated with this product.
+- **CategoryId** The identity of the package or packages being installed.
+- **ClientAppId** The identity of the app that initiated this operation.
+- **ExtendedHResult** The extended HResult error code.
+- **HResult** The result code of the last action performed.
+- **IntentPFNs** Intent Product Family Name
+- **IsBundle** Is this a bundle?
+- **IsInteractive** Is this an interactive installation?
+- **IsMandatory** Is this a mandatory installation?
+- **IsRemediation** Is this repairing a previous installation?
+- **IsRestore** Is this automatically restoring a previously acquired product?
+- **IsUpdate** Is this an update?
+- **IsWin32** Flag indicating if this a Win32 app (unused).
+- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
+- **PFN** Product Family Name of the product being installed.
+- **ProductId** The Store Product ID for the product being installed.
+- **SystemAttemptNumber** The total number of system attempts.
+- **UpdateId** Update ID (if this is an update)
+- **UserAttemptNumber** The total number of user attempts.
+- **WUContentId** The Windows Update content ID
### Microsoft.Windows.StoreAgent.Telemetry.EndScanForUpdates
@@ -3469,10 +3725,10 @@ This event is sent after a scan for product updates to determine if there are pa
The following fields are available:
+- **ClientAppId** The identity of the app that initiated this operation.
- **HResult** The result code of the last action performed.
- **IsApplicability** Is this request to only check if there are any applicable packages to install?
- **IsInteractive** Is this user requested?
-- **ClientAppId** The identity of the app that initiated this operation.
- **IsOnline** Is the request doing an online check?
@@ -3482,24 +3738,27 @@ This event is sent after searching for update packages to install. It's used to
The following fields are available:
-- **IsRemediation** Is this repairing a previous installation?
-- **IsUpdate** Is this an update?
-- **ClientAppId** The identity of the app that initiated this operation.
-- **HResult** The result code of the last action performed.
-- **ProductId** The Store Product ID for the product being installed.
+- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed.
- **AttemptNumber** The total number of retry attempts before it was canceled.
-- **IsInteractive** Is this user requested?
-- **PFN** The name of the package or packages requested for install.
- **BundleId** The identity of the build associated with this product.
- **CategoryId** The identity of the package or packages being installed.
-- **IsMandatory** Is this a mandatory update?
-- **SystemAttemptNumber** The total number of system attempts.
-- **UserAttemptNumber** The total number of user attempts.
-- **IsRestore** Is this restoring previously acquired content?
-- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
+- **ClientAppId** The identity of the app that initiated this operation.
+- **HResult** The result code of the last action performed.
+- **IntentPFNs** The licensing identity of this package.
- **IsBundle** Is this a bundle?
+- **IsInteractive** Is this user requested?
+- **IsMandatory** Is this a mandatory update?
+- **IsRemediation** Is this repairing a previous installation?
+- **IsRestore** Is this restoring previously acquired content?
+- **IsUpdate** Is this an update?
+- **IsWin32** Flag indicating if this a Win32 app (unused).
+- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
+- **PFN** The name of the package or packages requested for install.
+- **ProductId** The Store Product ID for the product being installed.
+- **SystemAttemptNumber** The total number of system attempts.
+- **UpdateId** Update ID (if this is an update)
+- **UserAttemptNumber** The total number of user attempts.
- **WUContentId** The Windows Update content ID
-- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed.
### Microsoft.Windows.StoreAgent.Telemetry.EndStageUserData
@@ -3508,67 +3767,37 @@ This event is sent between download and installation to see if there is app data
The following fields are available:
-- **IsInteractive** Is this user requested?
-- **PFN** The name of the package or packages requested for install.
-- **IsUpdate** Is this an update?
-- **CategoryId** The identity of the package or packages being installed.
-- **HResult** The result code of the last action performed.
- **AttemptNumber** The total number of retry attempts before it was canceled.
-- **ProductId** The Store Product ID for the product being installed.
- **BundleId** The identity of the build associated with this product.
-- **IsRemediation** Is this repairing a previous installation?
+- **CategoryId** The identity of the package or packages being installed.
- **ClientAppId** The identity of the app that initiated this operation.
+- **HResult** The result code of the last action performed.
+- **IsBundle** Is this a bundle?
+- **IsInteractive** Is this user requested?
- **IsMandatory** Is this a mandatory update?
+- **IsRemediation** Is this repairing a previous installation?
+- **IsRestore** Is this restoring previously acquired content?
+- **IsUpdate** Is this an update?
+- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
+- **PFN** The name of the package or packages requested for install.
+- **ProductId** The Store Product ID for the product being installed.
- **SystemAttemptNumber** The total number of system attempts.
- **UserAttemptNumber** The total number of system attempts.
-- **IsRestore** Is this restoring previously acquired content?
-- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
-- **IsBundle** Is this a bundle?
- **WUContentId** The Windows Update content ID
+- **IntentPFNs** The licensing identity of this package.
- **AggregatedPackageFullNames** The name of all packages to be downloaded and installed.
-### Microsoft.Windows.StoreAgent.Telemetry.EndUpdateMetadataPrepare
-
-This event happens after a scan for available app updates. It's used to help keep Windows up-to-date and secure.
-
-The following fields are available:
-
-- **HResult** The result code of the last action performed.
-
-
-### Microsoft.Windows.StoreAgent.Telemetry.FulfillmentComplete
-
-This event is sent at the end of an app install or update and is used to track the very end of the install or update process.
-
-The following fields are available:
-
-- **ProductId** The product ID of the app that is being updated or installed.
-- **PFN** The Package Family Name of the app that is being installed or updated.
-- **FailedRetry** Was the installation or update retry successful?
-- **HResult** The HResult code of the operation.
-
-
-### Microsoft.Windows.StoreAgent.Telemetry.FulfillmentInitiate
-
-This event is sent at the beginning of an app install or update and is used to track the very beginning of the install or update process.
-
-The following fields are available:
-
-- **ProductId** The product ID of the app that is being updated or installed.
-- **PFN** The Package Family Name of the app that is being installed or updated.
-
-
### Microsoft.Windows.StoreAgent.Telemetry.InstallOperationRequest
This event happens at the beginning of the install process when an app update or new app is installed. It's used to help keep Windows up-to-date and secure.
The following fields are available:
-- **CatalogId** If this product is from a private catalog, the Store Product ID for the product being installed.
- **BundleId** The identity of the build associated with this product.
-- **SkuId** Specific edition ID being installed.
+- **CatalogId** If this product is from a private catalog, the Store Product ID for the product being installed.
- **ProductId** The Store Product ID for the product being installed.
+- **SkuId** Specific edition ID being installed.
- **VolumePath** The disk path of the installation.
@@ -3578,25 +3807,26 @@ This event is sent when a product install or update is paused either by a user o
The following fields are available:
-- **RelatedCV** Correlation Vector of a previous performed action on this product.
-- **IsRemediation** Is this repairing a previous installation?
-- **PreviousHResult** The result code of the last action performed before this operation.
-- **ProductId** The Store Product ID for the product being installed.
-- **IsUpdate** Is this an update?
-- **PreviousInstallState** Previous state before the installation or update was paused.
+- **AttemptNumber** The total number of retry attempts before it was canceled.
+- **BundleId** The identity of the build associated with this product.
- **CategoryId** The identity of the package or packages being installed.
- **ClientAppId** The identity of the app that initiated this operation.
-- **AttemptNumber** The total number of retry attempts before it was canceled.
+- **IsBundle** Is this a bundle?
- **IsInteractive** Is this user requested?
-- **BundleId** The identity of the build associated with this product.
-- **PFN** The Product Full Name.
- **IsMandatory** Is this a mandatory update?
+- **IsRemediation** Is this repairing a previous installation?
+- **IsRestore** Is this restoring previously acquired content?
+- **IsUpdate** Is this an update?
+- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
+- **PFN** The Product Full Name.
+- **PreviousHResult** The result code of the last action performed before this operation.
+- **PreviousInstallState** Previous state before the installation or update was paused.
+- **ProductId** The Store Product ID for the product being installed.
+- **RelatedCV** Correlation Vector of a previous performed action on this product.
- **SystemAttemptNumber** The total number of system attempts.
- **UserAttemptNumber** The total number of user attempts.
-- **IsRestore** Is this restoring previously acquired content?
-- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
-- **IsBundle** Is this a bundle?
- **WUContentId** The Windows Update content ID
+- **IntentPFNs** The licensing identity of this package.
- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed.
@@ -3606,48 +3836,29 @@ This event happens when a product install or update is resumed either by a user
The following fields are available:
-- **RelatedCV** Correlation Vector for the original install before it was resumed.
- **AttemptNumber** The number of retry attempts before it was canceled.
- **BundleId** The identity of the build associated with this product.
-- **PreviousHResult** The previous HResult error code.
-- **ClientAppId** The identity of the app that initiated this operation.
- **CategoryId** The identity of the package or packages being installed.
-- **PFN** The name of the package or packages requested for install.
-- **IsUpdate** Is this an update?
-- **PreviousInstallState** Previous state before the installation was paused.
-- **IsRemediation** Is this repairing a previous installation?
+- **ClientAppId** The identity of the app that initiated this operation.
+- **IsBundle** Is this a bundle?
- **IsInteractive** Is this user requested?
-- **ProductId** The Store Product ID for the product being installed.
- **IsMandatory** Is this a mandatory update?
+- **IsRemediation** Is this repairing a previous installation?
+- **IsRestore** Is this restoring previously acquired content?
+- **IsUpdate** Is this an update?
+- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
+- **PFN** The name of the package or packages requested for install.
+- **PreviousHResult** The previous HResult error code.
+- **PreviousInstallState** Previous state before the installation was paused.
+- **ProductId** The Store Product ID for the product being installed.
+- **RelatedCV** Correlation Vector for the original install before it was resumed.
- **SystemAttemptNumber** The total number of system attempts.
- **UserAttemptNumber** The total number of user attempts.
-- **IsRestore** Is this restoring previously acquired content?
-- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
-- **IsBundle** Is this a bundle?
- **WUContentId** The Windows Update content ID
+- **IntentPFNs** Intent Product Family Name
- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed.
-- **IsUserRetry** Did the user initiate the retry?
- **HResult** The result code of the last action performed before this operation.
-
-
-### Microsoft.Windows.StoreAgent.Telemetry.ResumeOperationRequest
-
-This event happens when a product install or update is resumed by a user and on installation retries. It's used to help keep Windows up-to-date and secure.
-
-The following fields are available:
-
-- **ProductId** The Store Product ID for the product being installed.
-
-
-### Microsoft.Windows.StoreAgent.Telemetry.SearchForUpdateOperationRequest
-
-This event is sent when searching for update packages to install. It's used to help keep Windows up-to-date and secure.
-
-The following fields are available:
-
-- **ProductId** The Store Product ID for the product being installed.
-- **SkuId** Specfic edition of the app being updated.
-- **CatalogId** The Store Product ID for the product being installed.
+- **IsUserRetry** Did the user initiate the retry?
### Microsoft.Windows.StoreAgent.Telemetry.UpdateAppOperationRequest
@@ -3659,68 +3870,136 @@ The following fields are available:
- **PFamN** The name of the product that is requested for update.
-## Windows Update Delivery Optimization events
+### Microsoft.Windows.StoreAgent.Telemetry.CancelInstallation
-### Microsoft.OSG.DU.DeliveryOptClient.DownloadCanceled
-
-This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads.
+This event is sent when an app update or installation is canceled while in interactive mode. This can be canceled by the user or the system. It's used to help keep Windows up-to-date and secure.
The following fields are available:
-- **bytesFromIntPeers** The number of bytes received from peers not in the same LAN or in the same group.
-- **fileID** The ID of the file being downloaded.
-- **sessionID** The ID of the file download session.
-- **scenarioID** The ID of the scenario.
-- **bytesFromCDN** The number of bytes received from a CDN source.
-- **updateID** The ID of the update being downloaded.
-- **background** Is the download being done in the background?
-- **bytesFromPeers** The number of bytes received from a peer in the same LAN.
-- **clientTelId** A random number used for device sampling.
-- **bytesFromGroupPeers** The number of bytes received from a peer in the same group.
-- **errorCode** The error code that was returned.
-- **doErrorCode** The Delivery Optimization error code that was returned.
-- **cdnErrorCodes** A list of CDN connection errors since the last FailureCDNCommunication event.
-- **cdnErrorCounts** The number of times each error in cdnErrorCodes was encountered.
-- **experimentId** When running a test, this is used to correlate events that are part of the same test.
-- **isVpn** Is the device connected to a Virtual Private Network?
-- **usedMemoryStream** Did the download use memory streaming?
+- **AttemptNumber** Total number of installation attempts.
+- **BundleId** The identity of the Windows Insider build that is associated with this product.
+- **CategoryId** The identity of the package or packages being installed.
+- **ClientAppId** The identity of the app that initiated this operation.
+- **IsBundle** Is this a bundle?
+- **IsInteractive** Was this requested by a user?
+- **IsMandatory** Is this a mandatory update?
+- **IsRemediation** Is this repairing a previous installation?
+- **IsRestore** Is this an automatic restore of a previously acquired product?
+- **IsUpdate** Is this a product update?
+- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
+- **PFN** The name of all packages to be downloaded and installed.
+- **PreviousHResult** The previous HResult code.
+- **PreviousInstallState** Previous installation state before it was canceled.
+- **ProductId** The name of the package or packages requested for installation.
+- **RelatedCV** Correlation Vector of a previous performed action on this product.
+- **SystemAttemptNumber** Total number of automatic attempts to install before it was canceled.
+- **UserAttemptNumber** Total number of user attempts to install before it was canceled.
+- **WUContentId** The Windows Update content ID
+- **IntentPFNs** Intent Product Family Name
+- **AggregatedPackageFullNames** The names of all package or packages to be downloaded and installed.
+### Microsoft.Windows.StoreAgent.Telemetry.SearchForUpdateOperationRequest
+
+This event is sent when searching for update packages to install. It's used to help keep Windows up-to-date and secure.
+
+The following fields are available:
+
+- **CatalogId** The Store Product ID for the product being installed.
+- **ProductId** The Store Product ID for the product being installed.
+- **SkuId** Specfic edition of the app being updated.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.EndUpdateMetadataPrepare
+
+This event happens after a scan for available app updates. It's used to help keep Windows up-to-date and secure.
+
+The following fields are available:
+
+- **HResult** The result code of the last action performed.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.CompleteInstallOperationRequest
+
+This event is sent after the app installations or updates. It's used to help keep Windows up-to-date and secure
+
+The following fields are available:
+
+- **CatalogId** The Store Product ID of the app being installed.
+- **HResult** HResult code of the action being performed.
+- **IsBundle** Is this a bundle?
+- **PackageFamilyName** The name of the package being installed.
+- **ProductId** The Store Product ID of the product being installed.
+- **SkuId** Specific edition of the item being installed.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.ResumeOperationRequest
+
+This event happens when a product install or update is resumed by a user and on installation retries. It's used to help keep Windows up-to-date and secure.
+
+The following fields are available:
+
+- **ProductId** The Store Product ID for the product being installed.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.FulfillmentComplete
+
+This event is sent at the end of an app install or update and is used to track the very end of the install or update process.
+
+The following fields are available:
+
+- **FailedRetry** Was the installation or update retry successful?
+- **HResult** The HResult code of the operation.
+- **PFN** The Package Family Name of the app that is being installed or updated.
+- **ProductId** The product ID of the app that is being updated or installed.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.FulfillmentInitiate
+
+This event is sent at the beginning of an app install or update and is used to track the very beginning of the install or update process.
+
+The following fields are available:
+
+- **PFN** The Package Family Name of the app that is being installed or updated.
+- **ProductId** The product ID of the app that is being updated or installed.
+
+
+## Windows Update Delivery Optimization events
+
### Microsoft.OSG.DU.DeliveryOptClient.DownloadCompleted
This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads.
The following fields are available:
-- **sessionID** The ID of the download session.
-- **scenarioID** The ID of the scenario.
-- **bytesFromIntPeers** The number of bytes received from peers not in the same LAN or in the same domain group.
-- **updateID** The ID of the update being downloaded.
-- **fileSize** The size of the file being downloaded.
-- **bytesFromCDN** The number of bytes received from a CDN source.
-- **fileID** The ID of the file being downloaded.
- **background** Is the download a background download?
-- **bytesFromPeers** The number of bytes received from a peer in the same LAN.
-- **totalTime** How long did the download take (in seconds)?
-- **restrictedUpload** Is the upload restricted?
-- **clientTelId** A random number used for device sampling.
+- **bytesFromCDN** The number of bytes received from a CDN source.
- **bytesFromGroupPeers** The number of bytes received from a peer in the same domain group.
-- **downloadMode** The download mode used for this file download session.
-- **doErrorCode** The Delivery Optimization error code that was returned.
-- **numPeers** The total number of peers used for this download.
+- **bytesFromIntPeers** The number of bytes received from peers not in the same LAN or in the same domain group.
+- **bytesFromPeers** The number of bytes received from a peer in the same LAN.
+- **bytesRequested** The total number of bytes requested for download.
- **cdnConnectionCount** The total number of connections made to the CDN.
-- **lanConnectionCount** The total number of connections made to peers in the same LAN.
-- **groupConnectionCount** The total number of connections made to peers in the same group.
-- **internetConnectionCount** The total number of connections made to peers not in the same LAN or the same group.
-- **cdnIp** The IP address of the source CDN.
-- **downlinkBps** The maximum measured available download bandwidth (in bytes per second).
-- **uplinkBps** The maximum measured available upload bandwidth (in bytes per second).
-- **downlinkUsageBps** The download speed (in bytes per second).
-- **uplinkUsageBps** The upload speed (in bytes per second).
-- **totalTimeMs** Duration of the download (in seconds).
- **cdnErrorCodes** A list of CDN connection errors since the last FailureCDNCommunication event.
- **cdnErrorCounts** The number of times each error in cdnErrorCodes was encountered.
-- **bytesRequested** The total number of bytes requested for download.
+- **cdnIp** The IP address of the source CDN.
+- **clientTelId** A random number used for device sampling.
+- **doErrorCode** The Delivery Optimization error code that was returned.
+- **downlinkBps** The maximum measured available download bandwidth (in bytes per second).
+- **downlinkUsageBps** The download speed (in bytes per second).
+- **downloadMode** The download mode used for this file download session.
+- **fileID** The ID of the file being downloaded.
+- **fileSize** The size of the file being downloaded.
+- **groupConnectionCount** The total number of connections made to peers in the same group.
+- **internetConnectionCount** The total number of connections made to peers not in the same LAN or the same group.
+- **lanConnectionCount** The total number of connections made to peers in the same LAN.
+- **numPeers** The total number of peers used for this download.
+- **restrictedUpload** Is the upload restricted?
+- **scenarioID** The ID of the scenario.
+- **sessionID** The ID of the download session.
+- **totalTimeMs** Duration of the download (in seconds).
+- **updateID** The ID of the update being downloaded.
+- **uplinkBps** The maximum measured available upload bandwidth (in bytes per second).
+- **uplinkUsageBps** The upload speed (in bytes per second).
- **experimentId** When running a test, this is used to correlate with other events that are part of the same test.
- **isVpn** Is the device connected to a Virtual Private Network?
- **usedMemoryStream** Did the download use memory streaming?
@@ -3732,47 +4011,85 @@ This event represents a temporary suspension of a download with Delivery Optimiz
The following fields are available:
-- **updateID** The ID of the update being paused.
-- **errorCode** The error code that was returned.
-- **scenarioID** The ID of the scenario.
- **background** Is the download a background download?
-- **sessionID** The ID of the download session.
- **clientTelId** A random number used for device sampling.
-- **reasonCode** The reason for pausing the download.
+- **errorCode** The error code that was returned.
- **fileID** The ID of the file being paused.
+- **reasonCode** The reason for pausing the download.
+- **scenarioID** The ID of the scenario.
+- **sessionID** The ID of the download session.
+- **updateID** The ID of the update being paused.
- **experimentId** When running a test, this is used to correlate with other events that are part of the same test.
- **isVpn** Is the device connected to a Virtual Private Network?
+### Microsoft.OSG.DU.DeliveryOptClient.JobError
+
+This event represents a Windows Update job error. It allows for investigation of top errors.
+
+The following fields are available:
+
+- **clientTelId** A random number used for device sampling.
+- **errorCode** The error code returned.
+- **experimentId** When running a test, this is used to correlate with other events that are part of the same test.
+- **fileID** The ID of the file being downloaded.
+- **jobID** The Windows Update job ID.
+
+
+### Microsoft.OSG.DU.DeliveryOptClient.DownloadCanceled
+
+This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads.
+
+The following fields are available:
+
+- **background** Is the download being done in the background?
+- **bytesFromCDN** The number of bytes received from a CDN source.
+- **bytesFromGroupPeers** The number of bytes received from a peer in the same group.
+- **bytesFromIntPeers** The number of bytes received from peers not in the same LAN or in the same group.
+- **bytesFromPeers** The number of bytes received from a peer in the same LAN.
+- **cdnErrorCodes** A list of CDN connection errors since the last FailureCDNCommunication event.
+- **cdnErrorCounts** The number of times each error in cdnErrorCodes was encountered.
+- **clientTelId** A random number used for device sampling.
+- **doErrorCode** The Delivery Optimization error code that was returned.
+- **errorCode** The error code that was returned.
+- **experimentId** When running a test, this is used to correlate events that are part of the same test.
+- **fileID** The ID of the file being downloaded.
+- **isVpn** Is the device connected to a Virtual Private Network?
+- **scenarioID** The ID of the scenario.
+- **sessionID** The ID of the file download session.
+- **updateID** The ID of the update being downloaded.
+- **usedMemoryStream** Did the download use memory streaming?
+
+
### Microsoft.OSG.DU.DeliveryOptClient.DownloadStarted
This event describes the start of a new download with Delivery Optimization. It's used to understand and address problems regarding downloads.
The following fields are available:
-- **experimentId** When running a test, this is used to correlate with other events that are part of the same test.
-- **errorCode** The error code that was returned.
-- **doErrorCode** The Delivery Optimization error code that was returned.
-- **peerID** The ID for this Delivery Optimization client.
-- **doClientVersion** The version of the Delivery Optimization client.
-- **jobID** The ID of the Windows Update job.
-- **sessionID** The ID of the download session.
-- **updateID** The ID of the update being downloaded.
-- **scenarioID** The ID of the scenario.
-- **fileID** The ID of the file being downloaded.
+- **background** Is the download a background download?
- **cdnUrl** The URL of the CDN.
+- **clientTelId** A random number used for device sampling.
+- **deviceProfile** Identifies the usage or form factor. Example: Desktop or Xbox
+- **diceRoll** The dice roll value used in sampling events.
+- **doClientVersion** The version of the Delivery Optimization client.
+- **doErrorCode** The Delivery Optimization error code that was returned.
+- **downloadMode** The download mode used for this file download session.
+- **errorCode** The error code that was returned.
+- **experimentId** When running a test, this is used to correlate with other events that are part of the same test.
+- **fileID** The ID of the file being downloaded.
- **filePath** The path where the file will be written.
- **groupID** ID for the group.
-- **background** Is the download a background download?
-- **downloadMode** The download mode used for this file download session.
-- **minFileSizePolicy** The minimum content file size policy to allow the download using Peering.
-- **diceRoll** The dice roll value used in sampling events.
-- **deviceProfile** Identifies the usage or form factor. Example: Desktop or Xbox
- **isVpn** Is the device connected to a Virtual Private Network?
-- **usedMemoryStream** Did the download use memory streaming?
-- **minDiskSizePolicyEnforced** Is the minimum disk size enforced via policy?
+- **jobID** The ID of the Windows Update job.
- **minDiskSizeGB** The minimum disk size (in GB) required for Peering.
-- **clientTelId** A random number used for device sampling.
+- **minDiskSizePolicyEnforced** Is the minimum disk size enforced via policy?
+- **minFileSizePolicy** The minimum content file size policy to allow the download using Peering.
+- **peerID** The ID for this Delivery Optimization client.
+- **scenarioID** The ID of the scenario.
+- **sessionID** The ID of the download session.
+- **updateID** The ID of the update being downloaded.
+- **usedMemoryStream** Did the download use memory streaming?
- **costFlags** A set of flags representing network cost.
@@ -3782,35 +4099,125 @@ This event represents a failure to download from a CDN with Delivery Optimizatio
The following fields are available:
+- **cdnIp** The IP address of the CDN.
+- **cdnUrl** The URL of the CDN.
+- **clientTelId** A random number used for device sampling.
+- **errorCode** The error code that was returned.
+- **errorCount** The total number of times this error code was seen since the last FailureCdnCommunication event was encountered.
+- **httpStatusCode** The HTTP status code returned by the CDN.
+- **sessionID** The ID of the download session.
+- **cdnHeaders** The HTTP headers returned by the CDN.
- **experimentId** When running a test, this is used to correlate with other events that are part of the same test.
- **fileID** The ID of the file being downloaded.
-- **errorCode** The error code that was returned.
-- **httpStatusCode** The HTTP status code returned by the CDN.
-- **errorCount** The total number of times this error code was seen since the last FailureCdnCommunication event was encountered.
-- **sessionID** The ID of the download session.
-- **cdnUrl** The URL of the CDN.
-- **cdnIp** The IP address of the CDN.
-- **cdnHeaders** The HTTP headers returned by the CDN.
-- **clientTelId** A random number used for device sampling.
- **isHeadRequest** The type of HTTP request that was sent to the CDN. Example: HEAD or GET
- **requestSize** The size of the range requested from the CDN.
- **responseSize** The size of the range response received from the CDN.
-### Microsoft.OSG.DU.DeliveryOptClient.JobError
+## Windows Update events
-This event represents a Windows Update job error. It allows for investigation of top errors.
+### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentModeStart
+
+This event sends data for the start of each mode during the process of updating device manifest assets via the UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages.
The following fields are available:
-- **jobID** The Windows Update job ID.
-- **fileID** The ID of the file being downloaded.
-- **errorCode** The error code returned.
-- **clientTelId** A random number used for device sampling.
-- **experimentId** When running a test, this is used to correlate with other events that are part of the same test.
+- **flightId** The unique identifier for each flight
+- **mode** Indicates that the Update Agent mode that has started. 1 = Initialize, 2 = DownloadRequest, 3 = Install, 4 = Commit
+- **objectId** Unique value for each Update Agent mode
+- **relatedCV** Correlation vector value generated from the latest scan
+- **scenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate
+- **sessionId** Unique value for each Update Agent mode attempt
+- **updateId** Unique ID for each update
-## Windows Update events
+### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentInitialize
+
+This event sends data for initializing a new update session for the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages
+
+The following fields are available:
+
+- **errorCode** The error code returned for the current initialize phase
+- **flightId** The unique identifier for each flight
+- **flightMetadata** Contains the FlightId and the build being flighted
+- **objectId** Unique value for each Update Agent mode
+- **relatedCV** Correlation vector value generated from the latest USO scan
+- **result** Result of the initialize phase of update. 0 = Succeeded, 1 = Failed, 2 = Cancelled, 3 = Blocked, 4 = BlockCancelled
+- **scenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate#N#
+- **sessionData** Contains instructions to update agent for processing FODs and DUICs (Null for other scenarios)
+- **sessionId** "Unique value for each Update Agent mode attempt "
+- **updateId** Unique ID for each update
+
+
+### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentCommit
+
+This event collects information regarding the final commit phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages
+
+The following fields are available:
+
+- **errorCode** The error code returned for the current session initialization
+- **flightId** The unique identifier for each flight
+- **objectId** The unique GUID for each diagnostics session
+- **relatedCV** A correlation vector value, generated from the latest USO scan
+- **result** Outcome of the initialization of the session
+- **scenarioId** Identifies the Update scenario
+- **sessionId** The unique value for each update session
+- **updateId** The unique identifier for each Update
+
+
+### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentInstall
+
+This event collects information regarding the install phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages
+
+The following fields are available:
+
+- **errorCode** The error code returned for the current install phase
+- **flightId** The unique identifier for each flight
+- **objectId** Unique value for each Update Agent mode
+- **relatedCV** Correlation vector value generated from the latest scan
+- **result** Result of the install phase of update. 0 = Succeeded 1 = Failed, 2 = Cancelled, 3 = Blocked, 4 = BlockCancelled
+- **scenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate
+- **sessionId** Unique value for each Update Agent mode attempt
+- **updateId** Unique ID for each update
+
+
+### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentDownloadRequest
+
+This event collects information regarding the download request phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages
+
+The following fields are available:
+
+- **deletedCorruptFiles** Indicates if UpdateAgent found any corrupt payload files and whether the payload was deleted
+- **errorCode** The error code returned for the current session initialization
+- **flightId** The unique identifier for each flight
+- **objectId** Unique value for each Update Agent mode
+- **packageCountOptional** Number of optional packages requested
+- **packageCountRequired** Number of required packages requested
+- **packageCountTotal** Total number of packages needed
+- **packageCountTotalCanonical** Total number of canonical packages
+- **packageCountTotalDiff** Total number of diff packages
+- **packageCountTotalExpress** Total number of express packages
+- **packageSizeCanonical** Size of canonical packages in bytes
+- **packageSizeDiff** Size of diff packages in bytes
+- **packageSizeExpress** Size of express packages in bytes
+- **rangeRequestState** Represents the state of the download range request
+- **relatedCV** Correlation vector value generated from the latest USO scan
+- **result** Result of the download request phase of update
+- **scenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate
+- **sessionId** Unique value for each Update Agent mode attempt
+- **updateId** Unique ID for each update
+
+
+### Microsoft.Windows.Update.Orchestrator.GameActive
+
+This event indicates that an enabled GameMode process prevented the device from restarting to complete an update
+
+The following fields are available:
+
+- **eventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed
+- **gameModeReason** Name of the enabled GameMode process that prevented the device from restarting to complete an update
+- **wuDeviceid** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue
+
### Microsoft.Windows.Update.DataMigrationFramework.DmfMigrationCompleted
@@ -3818,11 +4225,11 @@ This event sends data collected at the end of the Data Migration Framework (DMF)
The following fields are available:
-- **MigrationEndtime** A system timestamp of when the DMF migration completed.
-- **UpdateIds** A collection of GUIDs for updates that are associated with the DMF session.
-- **WuClientid** The GUID of the Windows Update client responsible for triggering the DMF migration.
-- **MigrationDurationinmilliseconds** How long the DMF migration took (in milliseconds).
+- **MigrationDurationInMilliseconds** How long the DMF migration took (in milliseconds)
+- **MigrationEndTime** A system timestamp of when the DMF migration completed.
- **RevisionNumbers** A collection of revision numbers for the updates associated with the DMF session.
+- **UpdateIds** A collection of GUIDs for updates that are associated with the DMF session.
+- **WuClientId** The GUID of the Windows Update client responsible for triggering the DMF migration
### Microsoft.Windows.Update.DataMigrationFramework.DmfMigrationStarted
@@ -3831,12 +4238,12 @@ This event sends data collected at the beginning of the Data Migration Framework
The following fields are available:
-- **UpdateIds** A collection of GUIDs identifying the upgrades that are running.
-- **MigrationStarttime** The timestamp representing the beginning of the DMF migration.
-- **MigrationOEMphases** The number of OEM-authored migrators scheduled to be ran by DMF for this upgrade.
-- **WuClientid** The GUID of the Windows Update client invoking DMF.
-- **MigrationMicrosoftphases** The number of Microsoft-authored migrators scheduled to be ran by DMF for this upgrade.
+- **MigrationMicrosoftPhases** Revision numbers for the updates that were installed.
+- **MigrationOEMPhases** WU Update IDs for the updates that were installed.
+- **MigrationStartTime** The timestamp representing the beginning of the DMF migration
+- **WuClientId** The GUID of the Windows Update client invoking DMF
- **RevisionNumbers** A collection of the revision numbers associated with the UpdateIds.
+- **UpdateIds** A collection of GUIDs identifying the upgrades that are running.
### Microsoft.Windows.Update.DataMigrationFramework.MigratorResult
@@ -3845,60 +4252,30 @@ This event sends DMF migrator data to help keep Windows up to date.
The following fields are available:
-- **MigratorGuid** A GUID identifying the migrator that just completed.
-- **RunDurationInSeconds** The time it took for the migrator to complete.
- **CurrentStep** This is the last step the migrator reported before returning a result. This tells us how far through the individual migrator the device was before failure.
-- **MigratorName** The name of the migrator that just completed.
-- **MigratorId** A GUID identifying the migrator that just completed.
- **ErrorCode** The result (as an HRESULT) of the migrator that just completed.
+- **MigratorId** A GUID identifying the migrator that just completed.
+- **MigratorName** The name of the migrator that just completed.
+- **RunDurationInSeconds** The time it took for the migrator to complete.
- **TotalSteps** Migrators report progress in number of completed steps against the total steps. This is the total number of steps.
-### Microsoft.Windows.Update.Orchestrator.CommitFailed
-
-This events tracks when a device needs to restart after an update but did not.
-
-The following fields are available:
-
-- **wuDeviceid** The Windows Update device GUID.
-- **errorCode** The error code that was returned.
-
-
-### Microsoft.Windows.Update.Orchestrator.Detection
-
-This event sends launch data for a Windows Update scan to help keep Windows up to date.
-
-The following fields are available:
-
-- **wuDeviceid** Unique device ID used by Windows Update.
-- **revisionNumber** Update revision number.
-- **eventScenario** End to end update session ID, or indicates the purpose of sending this event - whether because the software distribution just started installing content, or whether it was cancelled, succeeded, or failed.
-- **deferReason** Reason why the device could not check for updates.
-- **detectionBlockreason** Reason for detection not completing.
-- **interactive** Identifies if session is User Initiated.
-- **updateId** Update ID.
-- **detectionDeferreason** A log of deferral reasons for every update state.
-- **flightID** A unique update ID.
-- **updateScenarioType** The update session type.
-- **errorCode** The returned error code.
-
-
### Microsoft.Windows.Update.Orchestrator.Download
This event sends launch data for a Windows Update download to help keep Windows up to date.
The following fields are available:
+- **deferReason** Reason for download not completing
- **detectionDeferreason** Reason for download not completing
-- **wuDeviceid** Unique device ID used by Windows Update.
+- **errorCode** An error code represented as a hexadecimal value
+- **eventScenario** End to end update session ID.
+- **flightID** Unique update ID.
- **interactive** Identifies if session is user initiated.
- **revisionNumber** Update revision number.
-- **deferReason** Reason for download not completing
- **updateId** Update ID.
-- **eventScenario** End to end update session ID.
-- **errorCode** An error code represented as a hexadecimal value
-- **flightID** Unique update ID.
- **updateScenarioType** The update session type.
+- **wuDeviceid** Unique device ID used by Windows Update.
### Microsoft.Windows.Update.Orchestrator.FlightInapplicable
@@ -3907,71 +4284,29 @@ This event sends data on whether the update was applicable to the device, to hel
The following fields are available:
-- **updateId** Unique Update ID
-- **revisionNumber** Revision Number of the Update
-- **UpdateStatus** Integer that describes Update state
- **EventPublishedTime** time that the event was generated
+- **revisionNumber** Revision Number of the Update
+- **updateId** Unique Update ID
+- **UpdateStatus** Integer that describes Update state
- **wuDeviceid** Unique Device ID
- **flightID** Unique Update ID
- **updateScenarioType** The update session type.
-### Microsoft.Windows.Update.Orchestrator.InitiatingReboot
-
-This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows up to date.
-
-The following fields are available:
-
-- **revisionNumber** Revision number of the update.
-- **EventPublishedTime** Time of the event.
-- **updateId** Update ID.
-- **wuDeviceid** Unique device ID used by Windows Update.
-- **flightID** Unique update ID
-- **interactive** Indicates the reboot initiation stage of the update process was entered as a result of user action or not.
-- **rebootOutsideOfActiveHours** Indicates the timing that the reboot was to occur to ensure the correct update process and experience is provided to keep Windows up to date.
-- **uxRebootstate** Indicates the exact state of the user experience at the time the required reboot was initiated to ensure the correct update process and experience is provided to keep Windows up to date.
-- **updateScenarioType** The update session type.
-
-
-### Microsoft.Windows.Update.Orchestrator.Install
-
-This event sends launch data for a Windows Update install to help keep Windows up to date.
-
-The following fields are available:
-
-- **eventScenario** End to end update session ID.
-- **deferReason** Reason for install not completing.
-- **interactive** Identifies if session is user initiated.
-- **wuDeviceid** Unique device ID used by Windows Update.
-- **batteryLevel** Current battery capacity in mWh or percentage left.
-- **installCommitfailedtime** The time it took for a reboot to happen but the upgrade failed to progress.
-- **errorCode** The error code reppresented by a hexadecimal value.
-- **updateId** Update ID.
-- **revisionNumber** Update revision number.
-- **flightID** Unique update ID
-- **installRebootinitiatetime** The time it took for a reboot to be attempted.
-- **flightUpdate** Flight update
-- **minutesToCommit** The time it took to install updates.
-- **ForcedRebootReminderSet** A boolean value that indicates if a forced reboot will happen for updates.
-- **rebootOutsideOfActiveHours** Indicates the timing that the reboot was to occur to ensure the correct update process and experience is provided to keep Windows up to date.
-- **uxRebootstate** Indicates the exact state of the user experience at the time the required reboot was initiated to ensure the correct update process and experience is provided to keep Windows up to date.
-- **updateScenarioType** The update session type.
-
-
### Microsoft.Windows.Update.Orchestrator.PostInstall
This event sends data about lite stack devices (mobile, IOT, anything non-PC) immediately before data migration is launched to help keep Windows up to date.
The following fields are available:
-- **wuDeviceid** Unique device ID used by Windows Update.
-- **eventScenario** End to end update session ID.
-- **sessionType** Interactive vs. Background.
-- **bundleRevisionnumber** Bundle revision number.
- **batteryLevel** Current battery capacity in mWh or percentage left.
- **bundleId** Update grouping ID.
+- **bundleRevisionnumber** Bundle revision number.
- **errorCode** Hex code for the error message, to allow lookup of the specific error.
+- **eventScenario** End to end update session ID.
- **flightID** Unique update ID.
+- **sessionType** Interactive vs. Background.
+- **wuDeviceid** Unique device ID used by Windows Update.
### Microsoft.Windows.Update.Orchestrator.RebootFailed
@@ -3980,46 +4315,18 @@ This event sends information about whether an update required a reboot and reaso
The following fields are available:
-- **updateId** Update ID.
- **batteryLevel** Current battery capacity in mWh or percentage left.
-- **RebootResults** Hex code indicating failure reason. Typically, we expect this to be a specific USO generated hex code.
-- **installRebootDeferreason** Reason for reboot not occurring.
-- **revisionNumber** Update revision number.
-- **EventPublishedTime** The time that the reboot failure occurred.
- **deferReason** Reason for install not completing.
-- **wuDeviceid** Unique device ID used by Windows Update.
+- **EventPublishedTime** The time that the reboot failure occurred.
- **flightID** Unique update ID.
+- **installRebootDeferreason** Reason for reboot not occurring.
- **rebootOutsideOfActiveHours** Indicates the timing that the reboot was to occur to ensure the correct update process and experience is provided to keep Windows up to date.
-- **uxRebootstate** Indicates the exact state of the user experience at the time the required reboot was initiated to ensure the correct update process and experience is provided to keep Windows up to date.
-- **updateScenarioType** The update session type.
-
-
-### Microsoft.Windows.Update.Orchestrator.RestoreRebootTask
-
-This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows up to date.
-
-The following fields are available:
-
-- **RebootTaskRestoredTime** Time at which this reboot task was restored.
-- **wuDeviceid** Device id on which the reboot is restored
+- **RebootResults** Hex code indicating failure reason. Typically, we expect this to be a specific USO generated hex code.
- **revisionNumber** Update revision number.
- **updateId** Update ID.
-
-
-### Microsoft.Windows.Update.Orchestrator.SystemNeeded
-
-This event sends data about why a device is unable to reboot, to help keep Windows up to date.
-
-The following fields are available:
-
-- **eventScenario** End to end update session ID.
+- **updateScenarioType** The update session type.
+- **uxRebootstate** Indicates the exact state of the user experience at the time the required reboot was initiated to ensure the correct update process and experience is provided to keep Windows up to date.
- **wuDeviceid** Unique device ID used by Windows Update.
-- **systemNeededReason** Reason ID
-- **updateId** Update ID.
-- **revisionNumber** Update revision number.
-- **rebootOutsideOfActiveHours** Indicates the timing that the reboot was to occur to ensure the correct update process and experience is provided to keep Windows up to date.
-- **uxRebootstate** Indicates the exact state of the user experience at the time the required reboot was initiated to ensure the correct update process and experience is provided to keep Windows up to date.
-- **updateScenarioType** The update session type.
### Microsoft.Windows.Update.Orchestrator.UpdatePolicyCacheRefresh
@@ -4028,11 +4335,11 @@ This event sends data on whether Update Management Policies were enabled on a de
The following fields are available:
-- **wuDeviceid** Unique device ID used by Windows Update.
-- **policyCacherefreshtime** Refresh time
-- **policiesNamevaluesource** Policy Name
-- **updateInstalluxsetting** This shows whether a user has set policies via UX option
- **configuredPoliciescount** Policy Count
+- **policiesNamevaluesource** Policy Name
+- **policyCacherefreshtime** Refresh time
+- **updateInstalluxsetting** This shows whether a user has set policies via UX option
+- **wuDeviceid** Unique device ID used by Windows Update.
### Microsoft.Windows.Update.Orchestrator.UpdateRebootRequired
@@ -4041,8 +4348,8 @@ This event sends data about whether an update required a reboot to help keep Win
The following fields are available:
-- **updateId** Update ID.
- **revisionNumber** Update revision number.
+- **updateId** Update ID.
- **wuDeviceid** Unique device ID used by Windows Update.
- **flightID** Unique update ID.
- **interactive** Indicates the reboot initiation stage of the update process was entered as a result of user action or not.
@@ -4050,24 +4357,76 @@ The following fields are available:
- **updateScenarioType** The update session type.
-### Microsoft.Windows.Update.UpdateStackServicing.CheckForUpdates
+### Microsoft.Windows.Update.Ux.MusNotification.RebootScheduled
-This event sends data about the UpdateStackServicing check for updates, to help keep Windows up to date.
+This event sends data about a required reboot that is scheduled with no user interaction, to help keep Windows up to date.
The following fields are available:
-- **EventScenario** The scenario of the event. Example: Started, Failed, or Succeeded
-- **StatusCode** The HRESULT code of the operation.
-- **CallerApplicationName** The name of the USS scheduled task. Example UssScheduled or UssBoot
-- **ClientVersion** The version of the client.
-- **EventInstanceID** The USS session ID.
-- **WUDeviceID** The Windows Update device ID.
-- **ServiceGuid** The GUID of the service.
-- **BspVersion** The version of the BSP.
-- **OemName** The name of the manufacturer.
-- **DeviceName** The name of the device.
-- **CommercializationOperator** The name of the operator.
-- **DetectionVersion** The string returned from the GetDetectionVersion export of the downloaded detection DLL.
+- **activeHoursApplicable** True, If Active Hours applicable on this device. False, otherwise.
+- **forcedReboot** True, if a reboot is forced on the device. Otherwise, this is False
+- **rebootArgument** Argument for the reboot task. It also represents specific reboot related action.
+- **rebootOutsideOfActiveHours** True, if a reboot is scheduled outside of active hours. False, otherwise.
+- **rebootScheduledByUser** True, if a reboot is scheduled by user. False, if a reboot is scheduled automatically.
+- **revisionNumber** Revision number of the update that is getting installed with this reboot.
+- **scheduledRebootTime** Time of the scheduled reboot
+- **updateId** Update ID of the update that is getting installed with this reboot.
+- **wuDeviceid** Unique device ID used by Windows Update.
+- **rebootState** The state of the reboot.
+
+
+### Microsoft.Windows.Update.Orchestrator.Detection
+
+This event sends launch data for a Windows Update scan to help keep Windows up to date.
+
+The following fields are available:
+
+- **deferReason** Reason why the device could not check for updates.
+- **detectionBlockreason** Reason for detection not completing.
+- **detectionDeferreason** A log of deferral reasons for every update state.
+- **errorCode** The returned error code.
+- **eventScenario** End to end update session ID, or indicates the purpose of sending this event - whether because the software distribution just started installing content, or whether it was cancelled, succeeded, or failed.
+- **flightID** A unique update ID.
+- **interactive** Identifies if session is User Initiated.
+- **revisionNumber** Update revision number.
+- **updateId** Update ID.
+- **updateScenarioType** The update session type.
+- **wuDeviceid** Unique device ID used by Windows Update.
+
+
+### Microsoft.Windows.Update.Orchestrator.InitiatingReboot
+
+This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows up to date.
+
+The following fields are available:
+
+- **EventPublishedTime** Time of the event.
+- **revisionNumber** Revision number of the update.
+- **updateId** Update ID.
+- **wuDeviceid** Unique device ID used by Windows Update.
+- **flightID** Unique update ID
+- **interactive** Indicates the reboot initiation stage of the update process was entered as a result of user action or not.
+- **rebootOutsideOfActiveHours** Indicates the timing that the reboot was to occur to ensure the correct update process and experience is provided to keep Windows up to date.
+- **uxRebootstate** Indicates the exact state of the user experience at the time the required reboot was initiated to ensure the correct update process and experience is provided to keep Windows up to date.
+- **updateScenarioType** The update session type.
+
+
+### Microsoft.Windows.Update.Ux.MusUpdateSettings.RebootScheduled
+
+This event sends basic information for scheduling a device restart to install security updates. It's used to help keep Windows up-to-date.
+
+The following fields are available:
+
+- **activeHoursApplicable** Is the restart respecting Active Hours?
+- **rebootArgument** The arguments that are passed to the OS for the restarted.
+- **rebootOutsideOfActiveHours** Was the restart scheduled outside of Active Hours?
+- **rebootScheduledByUser** Was the restart scheduled by the user? If the value is false, the restart was scheduled by the device.
+- **rebootState** The state of the restart.
+- **revisionNumber** The revision number of the OS being updated.
+- **scheduledRebootTime** Time of the scheduled reboot
+- **updateId** The Windows Update device GUID.
+- **wuDeviceid** The Windows Update device GUID.
+- **forcedReboot** True, if a reboot is forced on the device. Otherwise, this is False
### Microsoft.Windows.Update.Ux.MusNotification.RebootNoLongerNeeded
@@ -4079,24 +4438,6 @@ The following fields are available:
- **UtcTime** The Coordinated Universal Time that the restart was no longer needed.
-### Microsoft.Windows.Update.Ux.MusNotification.RebootScheduled
-
-This event sends data about a required reboot that is scheduled with no user interaction, to help keep Windows up to date.
-
-The following fields are available:
-
-- **updateId** Update ID of the update that is getting installed with this reboot.
-- **ScheduledRebootTime** Time of the scheduled reboot.
-- **wuDeviceid** Unique device ID used by Windows Update.
-- **revisionNumber** Revision number of the update that is getting installed with this reboot.
-- **forcedreboot** True, if a reboot is forced on the device. False, otherwise.
-- **rebootArgument** Argument for the reboot task. It also represents specific reboot related action.
-- **rebootScheduledByUser** True, if a reboot is scheduled by user. False, if a reboot is scheduled automatically.
-- **activeHoursApplicable** True, If Active Hours applicable on this device. False, otherwise.
-- **rebootOutsideOfActiveHours** True, if a reboot is scheduled outside of active hours. False, otherwise.
-- **rebootState** The state of the reboot.
-
-
### Microsoft.Windows.Update.Ux.MusNotification.ToastDisplayedToScheduleReboot
This event is sent when a toast notification is shown to the user about scheduling a device restart.
@@ -4106,29 +4447,139 @@ The following fields are available:
- **UtcTime** The Coordinated Universal Time when the toast notification was shown.
-### Microsoft.Windows.Update.Ux.MusUpdateSettings.RebootScheduled
+### Microsoft.Windows.Update.Orchestrator.RestoreRebootTask
-This event sends basic information for scheduling a device restart to install security updates. It's used to help keep Windows up-to-date.
+This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows up to date.
The following fields are available:
-- **ScheduledRebootTime** The time that the device was restarted.
-- **updateId** The Windows Update device GUID.
-- **revisionNumber** The revision number of the OS being updated.
+- **RebootTaskRestoredTime** Time at which this reboot task was restored.
+- **revisionNumber** Update revision number.
+- **updateId** Update ID.
+- **wuDeviceid** Device id on which the reboot is restored
+
+
+### Microsoft.Windows.Update.Orchestrator.SystemNeeded
+
+This event sends data about why a device is unable to reboot, to help keep Windows up to date.
+
+The following fields are available:
+
+- **eventScenario** End to end update session ID.
+- **revisionNumber** Update revision number.
+- **systemNeededReason** Reason ID
+- **updateId** Update ID.
+- **wuDeviceid** Unique device ID used by Windows Update.
+- **rebootOutsideOfActiveHours** Indicates the timing that the reboot was to occur to ensure the correct update process and experience is provided to keep Windows up to date.
+- **uxRebootstate** Indicates the exact state of the user experience at the time the required reboot was initiated to ensure the correct update process and experience is provided to keep Windows up to date.
+- **updateScenarioType** The update session type.
+
+
+### Microsoft.Windows.Update.UpdateStackServicing.CheckForUpdates
+
+This event sends data about the UpdateStackServicing check for updates, to help keep Windows up to date.
+
+The following fields are available:
+
+- **BspVersion** The version of the BSP.
+- **CallerApplicationName** The name of the USS scheduled task. Example UssScheduled or UssBoot
+- **ClientVersion** The version of the client.
+- **CommercializationOperator** The name of the operator.
+- **DetectionVersion** The string returned from the GetDetectionVersion export of the downloaded detection DLL.
+- **DeviceName** The name of the device.
+- **EventInstanceID** The USS session ID.
+- **EventScenario** The scenario of the event. Example: Started, Failed, or Succeeded
+- **OemName** The name of the manufacturer.
+- **ServiceGuid** The GUID of the service.
+- **StatusCode** The HRESULT code of the operation.
+- **WUDeviceID** The Windows Update device ID.
+
+
+### Microsoft.Windows.Update.Orchestrator.CommitFailed
+
+This events tracks when a device needs to restart after an update but did not.
+
+The following fields are available:
+
+- **errorCode** The error code that was returned.
- **wuDeviceid** The Windows Update device GUID.
-- **forcedreboot** Is the restart that's being scheduled a forced restart?
-- **rebootArgument** The arguments that are passed to the OS for the restarted.
-- **rebootScheduledByUser** Was the restart scheduled by the user? If the value is false, the restart was scheduled by the device.
-- **activeHoursApplicable** Is the restart respecting Active Hours?
-- **rebootOutsideOfActiveHours** Was the restart scheduled outside of Active Hours?
-- **rebootState** The state of the restart.
-## Winlogon events
+### Microsoft.Windows.Update.Orchestrator.Install
-### Microsoft.Windows.Security.Winlogon.SetupCompleteLogon
+This event sends launch data for a Windows Update install to help keep Windows up to date.
-This event signals the completion of the setup process. It happens only once during the first logon.
+The following fields are available:
+
+- **batteryLevel** Current battery capacity in mWh or percentage left.
+- **deferReason** Reason for install not completing.
+- **eventScenario** End to end update session ID.
+- **interactive** Identifies if session is user initiated.
+- **wuDeviceid** Unique device ID used by Windows Update.
+- **flightUpdate** Flight update
+- **installRebootinitiatetime** The time it took for a reboot to be attempted.
+- **minutesToCommit** The time it took to install updates.
+- **revisionNumber** Update revision number.
+- **updateId** Update ID.
+- **errorCode** The error code reppresented by a hexadecimal value.
+- **installCommitfailedtime** The time it took for a reboot to happen but the upgrade failed to progress.
+- **flightID** Unique update ID
+- **ForcedRebootReminderSet** A boolean value that indicates if a forced reboot will happen for updates.
+- **rebootOutsideOfActiveHours** Indicates the timing that the reboot was to occur to ensure the correct update process and experience is provided to keep Windows up to date.
+- **uxRebootstate** Indicates the exact state of the user experience at the time the required reboot was initiated to ensure the correct update process and experience is provided to keep Windows up to date.
+- **updateScenarioType** The update session type.
+### Microsoft.Windows.Update.Orchestrator.PreShutdownStart
+This event is generated right before the shutdown and commit operations
+
+The following fields are available:
+
+- **wuDeviceid** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue
+
+
+### Microsoft.Windows.Update.Orchestrator.DeferRestart
+
+This event indicates that a restart required for installing updates was postponed
+
+The following fields are available:
+
+- **filteredDeferReason** Indicates the raised, but ignorable, reasons that the USO didn't restart (for example, user active or low battery)
+- **raisedDeferReason** Indicates the reason that the USO didn't restart. For example, user active or low battery
+- **wuDeviceid** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue
+- **eventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed
+
+
+### Microsoft.Windows.Update.Orchestrator.DisplayNeeded
+
+Reboot postponed due to needing a display
+
+The following fields are available:
+
+- **displayNeededReason** Reason the display is needed
+- **eventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed
+- **rebootOutsideOfActiveHours** Indicates the timing that the reboot was to occur to ensure the correct update process and experience is provided to keep Windows up to date
+- **revisionNumber** Revision number of the update
+- **updateId** Update ID
+- **updateScenarioType** The update session type
+- **uxRebootstate** Indicates the exact state of the user experience at the time the required reboot was initiated to ensure the correct update process and experience is provided to keep Windows up to date
+- **wuDeviceid** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue
+
+
+### Microsoft.Windows.Update.NotificationUx.RebootScheduled
+
+Indicates when a reboot is scheduled by the system or a user for a security, quality, or feature update
+
+The following fields are available:
+
+- **activeHoursApplicable** True, If Active Hours applicable on this device. False, otherwise
+- **rebootArgument** Argument for the reboot task. It also represents specific reboot related action
+- **rebootOutsideOfActiveHours** True, if a reboot is scheduled outside of active hours. False, otherwise
+- **rebootScheduledByUser** True, if a reboot is scheduled by user. False, if a reboot is scheduled automatically
+- **rebootState** The state of the reboot
+- **revisionNumber** Revision number of the update that is getting installed with this reboot
+- **scheduledRebootTime** Time of the scheduled reboot
+- **updateId** ID of the update that is getting installed with this reboot
+- **wuDeviceid** Unique device ID used by Windows Update
+- **scheduledRebootTimeInUTC** Time of the scheduled reboot in Coordinated Universal Time
\ No newline at end of file
diff --git a/windows/configuration/change-history-for-configure-windows-10.md b/windows/configuration/change-history-for-configure-windows-10.md
index 95fedcd1de..ce324c8cf1 100644
--- a/windows/configuration/change-history-for-configure-windows-10.md
+++ b/windows/configuration/change-history-for-configure-windows-10.md
@@ -8,17 +8,30 @@ ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: high
author: jdeckerms
-ms.date: 11/06/2017
+ms.date: 01/26/2018
---
# Change history for Configure Windows 10
This topic lists new and updated topics in the [Configure Windows 10](index.md) documentation for Windows 10 and Windows 10 Mobile.
+## January 2018
+
+New or changed topic | Description
+--- | ---
+[Create a Windows 10 kiosk that runs multiple apps](lock-down-windows-10-to-specific-apps.md) | Added videos demonstrating how to use Microsoft Intune and how to use provisioning packages to configure multi-app kiosks.
+[ConnectivityProfiles](wcd/wcd-connectivityprofiles.md) | Added settings for VPN **Native** and **Third Party** profile types.
+[Start layout XML for desktop editions of Windows 10 (reference)](start-layout-xml-desktop.md) | Clarified that the TopMFUApps elements in layoutmodification.xml are not supported in Windows 10, version 1709.
+| [Diagnostic Data Viewer Overview](diagnostic-data-viewer-overview.md) | New topic |
+[Configure Windows 10 taskbar](configure-windows-10-taskbar.md) | Added section for removing default apps from the taskbar.
+[Manage Windows 10 connection endpoints](manage-windows-endpoints-version-1709.md) | New topic for Windows 10, version 1709 that explains the purpose for connections to Microsoft services and how to manage them.
+[Configure Windows Spotlight on the lock screen](windows-spotlight.md) | Added section for resolution of custom lock screen images.
+
## November 2017
New or changed topic | Description
--- | ---
+|[Windows 10, version 1703 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md)| Added events that were added in November. |
[Create a provisioning package with multivariant settings](provisioning-packages/provisioning-multivariant.md) | Add support for desktop to [Conditions](provisioning-packages/provisioning-multivariant.md#conditions) table.
## October 2017
@@ -34,8 +47,8 @@ The topics in this library have been updated for Windows 10, version 1709 (also
- [Create a Windows 10 kiosk that runs multiple apps](lock-down-windows-10-to-specific-apps.md)
- [Multi-app kiosk XML reference](multi-app-kiosk-xml.md)
-- [Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1709.md)
-- [Windows 10, version 1709 enhanced telemetry events and fields used by Windows Analytics](EventName.md)
+- [Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields.md)
+- [Windows 10, version 1709 enhanced diagnostic data events and fields used by Windows Analytics](enhanced-diagnostic-data-windows-analytics-events-and-fields.md)
## September 2017
@@ -56,11 +69,11 @@ The topics in this library have been updated for Windows 10, version 1709 (also
## July 2017
| New or changed topic | Description |
| --- | --- |
-|[Windows 10, version 1703 Diagnostic Data](windows-diagnostic-data.md)|Updated categories and included diagnostic data.|
+|[Windows 10, version 1703 Diagnostic Data](windows-diagnostic-data-1703.md)|Updated categories and included diagnostic data.|
|[Add image for secondary tiles](start-secondary-tiles.md) | Added XML example for Edge secondary tiles and **ImportEdgeAssets** |
|[Customize and export Start layout](customize-and-export-start-layout.md) | Added explanation for tile behavior when the app is not installed |
|[Guidelines for choosing an app for assigned access](guidelines-for-assigned-access-app.md) | Added that Microsoft Edge is not supported for assigned access |
-|[Windows 10, version 1703 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields.md)|Updated several Appraiser events and added Census.Speech. |
+|[Windows 10, version 1703 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md)|Updated several Appraiser events and added Census.Speech. |
|[Manage connections from Windows operating system components to Microsoft-services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) | Updated Date & Time and Windows spotlight sections. |
## June 2017
@@ -94,5 +107,5 @@ The topics in this library have been updated for Windows 10, version 1703 (also
- [Use the Lockdown Designer app to create a Lockdown XML file](mobile-devices/mobile-lockdown-designer.md)
- [Add image for secondary tiles](start-secondary-tiles.md)
- [Provision PCs with apps](provisioning-packages/provision-pcs-with-apps.md)
-- [Windows 10, version 1703 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields.md)
-- [Windows 10, version 1703 Diagnostic Data](windows-diagnostic-data.md)
\ No newline at end of file
+- [Windows 10, version 1703 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md)
+- [Windows 10, version 1703 Diagnostic Data](windows-diagnostic-data-1703.md)
\ No newline at end of file
diff --git a/windows/configuration/configure-devices-without-mdm.md b/windows/configuration/configure-devices-without-mdm.md
index 935f14bc0d..6dbf9464c3 100644
--- a/windows/configuration/configure-devices-without-mdm.md
+++ b/windows/configuration/configure-devices-without-mdm.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: mobile, devices
author: jdeckerms
ms.localizationpriority: medium
+ms.date: 07/27/2017
---
# Configure devices without MDM
diff --git a/windows/configuration/configure-windows-10-taskbar.md b/windows/configuration/configure-windows-10-taskbar.md
index 4918e14ecb..eb38b5217a 100644
--- a/windows/configuration/configure-windows-10-taskbar.md
+++ b/windows/configuration/configure-windows-10-taskbar.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: manage
ms.sitesec: library
author: jdeckerms
ms.localizationpriority: high
+ms.date: 01/18/2018
---
# Configure Windows 10 taskbar
@@ -31,10 +32,11 @@ The following example shows how apps will be pinned: Windows default apps to the
## Configure taskbar (general)
-To configure the taskbar:
+**To configure the taskbar:**
+
1. Create the XML file.
- * If you are also [customizing the Start layout](customize-and-export-start-layout.md), use `Export-StartLayout` to create the XML, and then add the `` section from the following sample to the file.
- * If you are only configuring the taskbar, use the following sample to create a layout modification XML file.
+ * If you are also [customizing the Start layout](customize-and-export-start-layout.md), use `Export-StartLayout` to create the XML, and then add the `` section from [the following sample](#sample-taskbar-configuration-added-to-start-layout-xml-file) to the file.
+ * If you are only configuring the taskbar, use [the following sample](#sample-taskbar-configuration-xml-file) to create a layout modification XML file.
2. Edit and save the XML file. You can use [AUMID](https://go.microsoft.com/fwlink/p/?LinkId=614867) or Desktop Application Link Path to identify the apps to pin to the taskbar.
* Use `` and [AUMID](https://go.microsoft.com/fwlink/p/?LinkId=614867) to pin Universal Windows Platform apps.
* Use `` and Desktop Application Link Path to pin desktop applications.
@@ -175,6 +177,30 @@ If you only want to remove some of the default pinned apps, you would use this m
+## Remove default apps
+
+By adding `PinListPlacement="Replace"` to ``, you remove all default pinned apps.
+
+
+```xml
+
+
+
+
+
+
+
+
+
+
+
+```
+
## Configure taskbar by country or region
The following example shows you how to configure taskbars by country or region. When the layout is applied to a computer, if there is no `` node with a region tag for the current region, the first `` node that has no specified region will be applied. When you specify one or more countries or regions in a `` node, the specified apps are pinned on computers configured for any of the specified countries or regions.
@@ -299,5 +325,3 @@ The resulting taskbar for computers in any other country region:
- [Customize Windows 10 Start and taskbar with provisioning packages](customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md)
- [Customize Windows 10 Start and tasbkar with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md)
- [Changes to Start policies in Windows 10](changes-to-start-policies-in-windows-10.md)
-
-Not finding content you need? Windows 10 users, tell us what you want on [Feedback Hub](feedback-hub://?referrer=techDocsUcPage&tabid=2&contextid=897&newFeedback=true&topic=configure-windows-10-taskbar.md).
diff --git a/windows/configuration/configure-windows-telemetry-in-your-organization.md b/windows/configuration/configure-windows-diagnostic-data-in-your-organization.md
similarity index 55%
rename from windows/configuration/configure-windows-telemetry-in-your-organization.md
rename to windows/configuration/configure-windows-diagnostic-data-in-your-organization.md
index 8dd61480ff..6a85eb7c57 100644
--- a/windows/configuration/configure-windows-telemetry-in-your-organization.md
+++ b/windows/configuration/configure-windows-diagnostic-data-in-your-organization.md
@@ -1,6 +1,6 @@
---
-description: Use this article to make informed decisions about how you can configure telemetry in your organization.
-title: Configure Windows telemetry in your organization (Windows 10)
+description: Use this article to make informed decisions about how you can configure diagnostic data in your organization.
+title: Configure Windows diagnostic data in your organization (Windows 10)
keywords: privacy
ms.prod: w10
ms.mktglfcycl: manage
@@ -8,9 +8,10 @@ ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: high
author: brianlic-msft
+ms.date: 10/17/2017
---
-# Configure Windows telemetry in your organization
+# Configure Windows diagnostic data in your organization
**Applies to**
@@ -18,56 +19,54 @@ author: brianlic-msft
- Windows 10 Mobile
- Windows Server
-At Microsoft, we use Windows telemetry to inform our decisions and focus our efforts in providing the most robust, most valuable platform for your business and the people who count on Windows to enable them to be as productive as possible. Telemetry gives users a voice in the operating system’s development. This guide describes the importance of Windows telemetry and how we protect that data. Additionally, it differentiates between telemetry and functional data. It also describes the telemetry levels that Windows supports. Of course, you can choose how much telemetry is shared with Microsoft, and this guide demonstrates how.
+At Microsoft, we use Windows diagnostic data to inform our decisions and focus our efforts in providing the most robust, most valuable platform for your business and the people who count on Windows to enable them to be as productive as possible. Diagnostic data gives users a voice in the operating system’s development. This guide describes the importance of Windows diagnostic data and how we protect that data. Additionally, it differentiates between diagnostic data and functional data. It also describes the diagnostic data levels that Windows supports. Of course, you can choose how much diagnostic data is shared with Microsoft, and this guide demonstrates how.
-To frame a discussion about telemetry, it is important to understand Microsoft’s privacy principles. We earn customer trust every day by focusing on six key privacy principles as described at [privacy.microsoft.com](https://privacy.microsoft.com/). These principles guided the implementation of the Windows telemetry system in the following ways:
+To frame a discussion about diagnostic data, it is important to understand Microsoft’s privacy principles. We earn customer trust every day by focusing on six key privacy principles as described at [privacy.microsoft.com](https://privacy.microsoft.com/). These principles guided the implementation of the Windows diagnostic data system in the following ways:
-- **Control.** We offer customers control of the telemetry they share with us by providing easy-to-use management tools.
-- **Transparency.** We provide information about the telemetry that Windows and Windows Server collects so our customers can make informed decisions.
-- **Security.** We encrypt telemetry in transit from your device and protect that data at our secure data centers.
+- **Control.** We offer customers control of the diagnostic data they share with us by providing easy-to-use management tools.
+- **Transparency.** We provide information about the diagnostic data that Windows and Windows Server collects so our customers can make informed decisions.
+- **Security.** We encrypt diagnostic data in transit from your device and protect that data at our secure data centers.
- **Strong legal protections.** We respect customers’ local privacy laws and fight for legal protection of their privacy as a fundamental human right.
-- **No content-based targeting.** We take steps to avoid and minimize the collection of customer content, such as the content of files, chats, or emails, through the Windows telemetry system. Customer content inadvertently collected is kept confidential and not used for user targeting.
-- **Benefits to you.** We collect Windows telemetry to help provide you with an up-to-date, more secure, reliable and performant product, and to improve Windows for all our customers.
+- **No content-based targeting.** We take steps to avoid and minimize the collection of customer content, such as the content of files, chats, or emails, through the Windows diagnostic data system. Customer content inadvertently collected is kept confidential and not used for user targeting.
+- **Benefits to you.** We collect Windows diagnostic data to help provide you with an up-to-date, more secure, reliable and performant product, and to improve Windows for all our customers.
-This article applies to Windows and Windows Server telemetry only. Other Microsoft or third-party apps, such as System Center Configuration Manager, System Center Endpoint Protection, or System Center Data Protection Manager, might send data to their cloud services in ways that are inconsistent with this guide. Their publishers are responsible for notifying users of their privacy policies, telemetry controls, and so on. This article describes the types of telemetry we may gather, the ways you might manage it in your organization, and some examples of how telemetry can provide you with valuable insights into your enterprise deployments. Microsoft uses the data to quickly identify and address issues affecting its customers.
+This article applies to Windows and Windows Server diagnostic data only. Other Microsoft or third-party apps, such as System Center Configuration Manager, System Center Endpoint Protection, or System Center Data Protection Manager, might send data to their cloud services in ways that are inconsistent with this guide. Their publishers are responsible for notifying users of their privacy policies, diagnostic data controls, and so on. This article describes the types of diagnostic data we may gather, the ways you might manage it in your organization, and some examples of how diagnostic data can provide you with valuable insights into your enterprise deployments. Microsoft uses the data to quickly identify and address issues affecting its customers.
-Use this article to make informed decisions about how you might configure telemetry in your organization. Telemetry is a term that means different things to different people and organizations. For this article, we discuss telemetry as system data that is uploaded by the Connected User Experience and Telemetry component. The telemetry data is used to help keep Windows devices secure by identifying malware trends and other threats and to help Microsoft improve the quality of Windows and Microsoft services.
+Use this article to make informed decisions about how you might configure diagnostic data in your organization. Diagnostic data is a term that means different things to different people and organizations. For this article, we discuss diagnostic data as system data that is uploaded by the Connected User Experiences and Telemetry component. The diagnostic data data is used to help keep Windows devices secure by identifying malware trends and other threats and to help Microsoft improve the quality of Windows and Microsoft services.
We are always striving to improve our documentation and welcome your feedback. You can provide feedback by contacting telmhelp@microsoft.com.
-Not finding content you need? Windows 10 users, tell us what you want on [Feedback Hub](feedback-hub://?referrer=techDocsUcPage&tabid=2&contextid=897&newFeedback=true&topic=configure-windows-telemetry-in-your-organization.md).
-
## Overview
-In previous versions of Windows and Windows Server, Microsoft used telemetry to check for updated or new Windows Defender signatures, check whether Windows Update installations were successful, gather reliability information through the Reliability Analysis Component (RAC), and gather reliability information through the Windows Customer Experience Improvement Program (CEIP) on Windows. In Windows 10 and Windows Server 2016, you can control telemetry streams by using the Privacy option in Settings, Group Policy, or MDM.
+In previous versions of Windows and Windows Server, Microsoft used diagnostic data to check for updated or new Windows Defender signatures, check whether Windows Update installations were successful, gather reliability information through the Reliability Analysis Component (RAC), and gather reliability information through the Windows Customer Experience Improvement Program (CEIP) on Windows. In Windows 10 and Windows Server 2016, you can control diagnostic data streams by using the Privacy option in Settings, Group Policy, or MDM.
For Windows 10, we invite IT pros to join the [Windows Insider Program](http://insider.windows.com) to give us feedback on what we can do to make Windows work better for your organization.
-## Understanding Windows telemetry
+## Understanding Windows diagnostic data
Windows as a Service is a fundamental change in how Microsoft plans, builds, and delivers the operating system. Historically, we released a major Windows version every few years. The effort required to deploy large and infrequent Windows versions was substantial. That effort included updating the infrastructure to support the upgrade. Windows as a Service accelerates the cadence to provide rich updates more frequently, and these updates require substantially less effort to roll out than earlier versions of Windows. Since it provides more value to organizations in a shorter timeframe, delivering Windows as a Service is a top priority for us.
-The release cadence of Windows may be fast, so feedback is critical to its success. We rely on telemetry at each stage of the process to inform our decisions and prioritize our efforts.
+The release cadence of Windows may be fast, so feedback is critical to its success. We rely on diagnostic data at each stage of the process to inform our decisions and prioritize our efforts.
-### What is Windows telemetry?
-Windows telemetry is vital technical data from Windows devices about the device and how Windows and related software are performing. It's used in the following ways:
+### What is Windows diagnostic data?
+Windows diagnostic data is vital technical data from Windows devices about the device and how Windows and related software are performing. It's used in the following ways:
- Keep Windows up to date
- Keep Windows secure, reliable, and performant
- Improve Windows – through the aggregate analysis of the use of Windows
- Personalize Windows engagement surfaces
-Here are some specific examples of Windows telemetry data:
+Here are some specific examples of Windows diagnostic data data:
- Type of hardware being used
- Applications installed and usage details
- Reliability information on device drivers
-### What is NOT telemetry?
+### What is NOT diagnostic data?
-Telemetry can sometimes be confused with functional data. Some Windows components and apps connect to Microsoft services directly, but the data they exchange is not telemetry. For example, exchanging a user’s location for local weather or news is not an example of telemetry—it is functional data that the app or service requires to satisfy the user’s request.
+Diagnostic data can sometimes be confused with functional data. Some Windows components and apps connect to Microsoft services directly, but the data they exchange is not diagnostic data. For example, exchanging a user’s location for local weather or news is not an example of diagnostic data—it is functional data that the app or service requires to satisfy the user’s request.
-There are subtle differences between telemetry and functional data. Windows collects and sends telemetry in the background automatically. You can control how much information is gathered by setting the telemetry level. Microsoft tries to avoid collecting personal information wherever possible (for example, if a crash dump is collected and a document was in memory at the time of the crash). On the other hand, functional data can contain personal information. However, a user action, such as requesting news or asking Cortana a question, usually triggers collection and transmission of functional data.
+There are subtle differences between diagnostic data and functional data. Windows collects and sends diagnostic data in the background automatically. You can control how much information is gathered by setting the diagnostic data level. Microsoft tries to avoid collecting personal information wherever possible (for example, if a crash dump is collected and a document was in memory at the time of the crash). On the other hand, functional data can contain personal information. However, a user action, such as requesting news or asking Cortana a question, usually triggers collection and transmission of functional data.
If you’re an IT pro that wants to manage Windows functional data sent from your organization to Microsoft, see [Manage connections from Windows operating system components to Microsoft services](https://technet.microsoft.com/itpro/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services).
@@ -77,26 +76,26 @@ The following are specific examples of functional data:
- Bing searches
- Wallpaper and desktop settings synced across multiple devices
-### Telemetry gives users a voice
+### Diagnostic data gives users a voice
-Windows and Windows Server telemetry gives every user a voice in the operating system’s development and ongoing improvement. It helps us understand how Windows 10 and Windows Server 2016 behaves in the real world, focus on user priorities, and make informed decisions that benefit them. For our enterprise customers, representation in the dataset on which we will make future design decisions is a real benefit. The following sections offer real examples of these benefits.
+Windows and Windows Server diagnostic data gives every user a voice in the operating system’s development and ongoing improvement. It helps us understand how Windows 10 and Windows Server 2016 behaves in the real world, focus on user priorities, and make informed decisions that benefit them. For our enterprise customers, representation in the dataset on which we will make future design decisions is a real benefit. The following sections offer real examples of these benefits.
### Drive higher app and driver quality
-Our ability to collect telemetry that drives improvements to Windows and Windows Server helps raise the bar for app and device driver quality. Telemetry helps us to quickly identify and fix critical reliability and security issues with apps and device drivers on given configurations. For example, we can identify an app that hangs on devices using a specific version of a video driver, allowing us to work with the app and device driver vendor to quickly fix the issue. The result is less downtime and reduced costs and increased productivity associated with troubleshooting these issues.
+Our ability to collect diagnostic data that drives improvements to Windows and Windows Server helps raise the bar for app and device driver quality. Diagnostic data helps us to quickly identify and fix critical reliability and security issues with apps and device drivers on given configurations. For example, we can identify an app that hangs on devices using a specific version of a video driver, allowing us to work with the app and device driver vendor to quickly fix the issue. The result is less downtime and reduced costs and increased productivity associated with troubleshooting these issues.
-#### Real-world example of how Windows telemetry helps
-There was a version of a video driver that was crashing on some devices running Windows 10, causing the device to reboot. We detected the problem in our telemetry, and immediately contacted the third-party developer who builds the video driver. Working with the developer, we provided an updated driver to Windows Insiders within 24 hours. Based on telemetry from the Windows Insiders’ devices, we were able to validate the new version of the video driver, and rolled it out to the broad public as an update the next day. Telemetry helped us find, fix, and resolve this problem in just 48 hours, providing a better user experience and reducing costly support calls.
+#### Real-world example of how Windows diagnostic data helps
+There was a version of a video driver that was crashing on some devices running Windows 10, causing the device to reboot. We detected the problem in our diagnostic data, and immediately contacted the third-party developer who builds the video driver. Working with the developer, we provided an updated driver to Windows Insiders within 24 hours. Based on diagnostic data from the Windows Insiders’ devices, we were able to validate the new version of the video driver, and rolled it out to the broad public as an update the next day. Diagnostic data helped us find, fix, and resolve this problem in just 48 hours, providing a better user experience and reducing costly support calls.
### Improve end-user productivity
-Windows telemetry also helps Microsoft better understand how customers use (or do not use) the operating system’s features and related services. The insights we gain from this data helps us prioritize our engineering effort to directly impact our customers’ experiences. Examples are:
+Windows diagnostic data also helps Microsoft better understand how customers use (or do not use) the operating system’s features and related services. The insights we gain from this data helps us prioritize our engineering effort to directly impact our customers’ experiences. Examples are:
- **Start menu.** How do people change the Start menu layout? Do they pin other apps to it? Are there any apps that they frequently unpin? We use this dataset to adjust the default Start menu layout to better reflect people’s expectations when they turn on their device for the first time.
-- **Cortana.** We use telemetry to monitor the scalability of our cloud service, improving search performance.
-- **Application switching.** Research and observations from earlier Windows versions showed that people rarely used Alt+Tab to switch between applications. After discussing this with some users, we learned they loved the feature, saying that it would be highly productive, but they did not know about it previously. Based on this, we created the Task View button in Windows 10 to make this feature more discoverable. Later telemetry showed significantly higher usage of this feature.
+- **Cortana.** We use diagnostic data to monitor the scalability of our cloud service, improving search performance.
+- **Application switching.** Research and observations from earlier Windows versions showed that people rarely used Alt+Tab to switch between applications. After discussing this with some users, we learned they loved the feature, saying that it would be highly productive, but they did not know about it previously. Based on this, we created the Task View button in Windows 10 to make this feature more discoverable. Later diagnostic data showed significantly higher usage of this feature.
-**These examples show how the use of telemetry data enables Microsoft to build or enhance features which can help organizations increase employee productivity while lowering help desk calls.**
+**These examples show how the use of diagnostic data data enables Microsoft to build or enhance features which can help organizations increase employee productivity while lowering help desk calls.**
### Insights into your own organization
@@ -109,7 +108,7 @@ Upgrading to new operating system versions has traditionally been a challenging,
To better help customers through this difficult process, Microsoft developed Upgrade Readiness to give enterprises the tools to plan and manage the upgrade process end to end and allowing them to adopt new Windows releases more quickly and on an ongoing basis.
-With Windows telemetry enabled, Microsoft collects computer, application, and driver compatibility-related information for analysis. We then identify compatibility issues that can block your upgrade and suggest fixes when they are known to Microsoft.
+With Windows diagnostic data enabled, Microsoft collects computer, application, and driver compatibility-related information for analysis. We then identify compatibility issues that can block your upgrade and suggest fixes when they are known to Microsoft.
Use Upgrade Readiness to get:
@@ -123,50 +122,50 @@ Use Upgrade Readiness to get:
The Upgrade Readiness workflow steps you through the discovery and rationalization process until you have a list of computers that are ready to be upgraded.
-## How is telemetry data handled by Microsoft?
+## How is diagnostic data data handled by Microsoft?
### Data collection
-Windows 10 and Windows Server 2016 includes the Connected User Experience and Telemetry component, which uses Event Tracing for Windows (ETW) tracelogging technology that gathers and stores telemetry events and data. The operating system and some Microsoft management solutions, such as System Center, use the same logging technology.
+Windows 10 and Windows Server 2016 includes the Connected User Experiences and Telemetry component, which uses Event Tracing for Windows (ETW) tracelogging technology that gathers and stores diagnostic data events and data. The operating system and some Microsoft management solutions, such as System Center, use the same logging technology.
1. Operating system features and some management applications are instrumented to publish events and data. Examples of management applications include Virtual Machine Manager (VMM), Server Manager, and Storage Spaces.
2. Events are gathered using public operating system event logging and tracing APIs.
-3. You can configure the telemetry level by using MDM policy, Group Policy, or registry settings.
-4. The Connected User Experience and Telemetry component transmits the telemetry data.
+3. You can configure the diagnostic data level by using MDM policy, Group Policy, or registry settings.
+4. The Connected User Experiences and Telemetry component transmits the diagnostic data data.
-Info collected at the Enhanced and Full levels of telemetry is typically gathered at a fractional sampling rate, which can be as low as 1% of devices reporting data at those levels.
+Info collected at the Enhanced and Full levels of diagnostic data is typically gathered at a fractional sampling rate, which can be as low as 1% of devices reporting data at those levels.
### Data transmission
-All telemetry data is encrypted using SSL and uses certificate pinning during transfer from the device to the Microsoft Data Management Service. With Windows 10, data is uploaded on a schedule that is sensitive to event priority, battery use, and network cost. Real-time events, such as Windows Defender Advanced Threat Protection, are always sent immediately. Normal events are not uploaded on metered networks, unless you are on a metered server connection. On a free network, normal events can be uploaded every 4 hours if on battery, or every 15 minutes if on A/C power. Diagnostic and crash data are only uploaded on A/C power and free networks.
+All diagnostic data data is encrypted using SSL and uses certificate pinning during transfer from the device to the Microsoft Data Management Service. With Windows 10, data is uploaded on a schedule that is sensitive to event priority, battery use, and network cost. Real-time events, such as Windows Defender Advanced Threat Protection, are always sent immediately. Normal events are not uploaded on metered networks, unless you are on a metered server connection. On a free network, normal events can be uploaded every 4 hours if on battery, or every 15 minutes if on A/C power. Diagnostic and crash data are only uploaded on A/C power and free networks.
### Endpoints
The Microsoft Data Management Service routes data back to our secure cloud storage. Only Microsoft personnel with a valid business justification are permitted access.
-The following table defines the endpoints for telemetry services:
+The following table defines the endpoints for diagnostic data services:
| Service | Endpoint |
| - | - |
-| Connected User Experience and Telemetry component | v10.vortex-win.data.microsoft.com settings-win.data.microsoft.com |
+| Connected User Experiences and Telemetry component | v10.vortex-win.data.microsoft.com settings-win.data.microsoft.com |
| [Windows Error Reporting](http://msdn.microsoft.com/library/windows/desktop/bb513641.aspx) | watson.telemetry.microsoft.com |
| [Online Crash Analysis](http://msdn.microsoft.com/library/windows/desktop/ee416349.aspx) | oca.telemetry.microsoft.com |
| OneDrive app for Windows 10 | vortex.data.microsoft.com/collect/v1 |
### Data use and access
-The principle of least privileged access guides access to telemetry data. Microsoft does not share personal data of our customers with third parties, except at the customer’s discretion or for the limited purposes described in the [Privacy Statement](https://privacy.microsoft.com/privacystatement). Microsoft may share business reports with OEMs and third-party partners that include aggregated and anonymized telemetry information. Data-sharing decisions are made by an internal team including privacy, legal, and data management.
+The principle of least privileged access guides access to diagnostic data data. Microsoft does not share personal data of our customers with third parties, except at the customer’s discretion or for the limited purposes described in the [Privacy Statement](https://privacy.microsoft.com/privacystatement). Microsoft may share business reports with OEMs and third-party partners that include aggregated and anonymized diagnostic data information. Data-sharing decisions are made by an internal team including privacy, legal, and data management.
### Retention
Microsoft believes in and practices information minimization. We strive to gather only the info we need and to store it only for as long as it’s needed to provide a service or for analysis. Much of the info about how Windows and apps are functioning is deleted within 30 days. Other info may be retained longer, such as error reporting data or Microsoft Store purchase history.
-## Telemetry levels
-This section explains the different telemetry levels in Windows 10, Windows Server 2016, and System Center. These levels are available on all desktop and mobile editions of Windows 10, except for the **Security** level, which is limited to Windows 10 Enterprise, Windows 10 Education, Windows 10 Mobile Enterprise, Windows 10 IoT Core (IoT Core), and Windows Server 2016.
+## Diagnostic data levels
+This section explains the different diagnostic data levels in Windows 10, Windows Server 2016, and System Center. These levels are available on all desktop and mobile editions of Windows 10, except for the **Security** level, which is limited to Windows 10 Enterprise, Windows 10 Education, Windows 10 Mobile Enterprise, Windows 10 IoT Core (IoT Core), and Windows Server 2016.
-The telemetry data is categorized into four levels:
+The diagnostic data data is categorized into four levels:
-- **Security**. Information that’s required to help keep Windows, Windows Server, and System Center secure, including data about the Connected User Experience and Telemetry component settings, the Malicious Software Removal Tool, and Windows Defender.
+- **Security**. Information that’s required to help keep Windows, Windows Server, and System Center secure, including data about the Connected User Experiences and Telemetry component settings, the Malicious Software Removal Tool, and Windows Defender.
- **Basic**. Basic device info, including: quality-related data, app compatibility, app usage data, and data from the **Security** level.
@@ -176,20 +175,20 @@ The telemetry data is categorized into four levels:
The levels are cumulative and are illustrated in the following diagram. Also, these levels apply to all editions of Windows Server 2016.
-
+
### Security level
-The Security level gathers only the telemetry info that is required to keep Windows devices, Windows Server, and guests protected with the latest security updates. This level is only available on Windows Server 2016, Windows 10 Enterprise, Windows 10 Education, Windows 10 Mobile Enterprise, and Windows IoT Core editions.
+The Security level gathers only the diagnostic data info that is required to keep Windows devices, Windows Server, and guests protected with the latest security updates. This level is only available on Windows Server 2016, Windows 10 Enterprise, Windows 10 Education, Windows 10 Mobile Enterprise, and Windows IoT Core editions.
> [!NOTE]
> If your organization relies on Windows Update for updates, you shouldn’t use the **Security** level. Because no Windows Update information is gathered at this level, important information about update failures is not sent. Microsoft uses this information to fix the causes of those failures and improve the quality of our updates.
-Windows Server Update Services (WSUS) and System Center Configuration Manager functionality is not affected at this level, nor is telemetry data about Windows Server features or System Center gathered.
+Windows Server Update Services (WSUS) and System Center Configuration Manager functionality is not affected at this level, nor is diagnostic data data about Windows Server features or System Center gathered.
The data gathered at this level includes:
-- **Connected User Experience and Telemetry component settings**. If general telemetry data has been gathered and is queued, it is sent to Microsoft. Along with this telemetry, the Connected User Experience and Telemetry component may download a configuration settings file from Microsoft’s servers. This file is used to configure the Connected User Experience and Telemetry component itself. The data gathered by the client for this request includes OS information, device id (used to identify what specific device is requesting settings) and device class (for example, whether the device is server or desktop).
+- **Connected User Experiences and Telemetry component settings**. If general diagnostic data data has been gathered and is queued, it is sent to Microsoft. Along with this diagnostic data, the Connected User Experiences and Telemetry component may download a configuration settings file from Microsoft’s servers. This file is used to configure the Connected User Experiences and Telemetry component itself. The data gathered by the client for this request includes OS information, device id (used to identify what specific device is requesting settings) and device class (for example, whether the device is server or desktop).
- **Malicious Software Removal Tool (MSRT)** The MSRT infection report contains information, including device info and IP address.
@@ -203,15 +202,15 @@ The data gathered at this level includes:
Microsoft recommends that Windows Update, Windows Defender, and MSRT remain enabled unless the enterprise uses alternative solutions such as Windows Server Update Services, System Center Configuration Manager, or a third-party antimalware solution. Windows Update, Windows Defender, and MSRT provide core Windows functionality such as driver and OS updates, including security updates.
-For servers with default telemetry settings and no Internet connectivity, you should set the telemetry level to **Security**. This stops data gathering for events that would not be uploaded due to the lack of Internet connectivity.
+For servers with default diagnostic data settings and no Internet connectivity, you should set the diagnostic data level to **Security**. This stops data gathering for events that would not be uploaded due to the lack of Internet connectivity.
-No user content, such as user files or communications, is gathered at the **Security** telemetry level, and we take steps to avoid gathering any information that directly identifies a company or user, such as name, email address, or account ID. However, in rare circumstances, MSRT information may unintentionally contain personal information. For instance, some malware may create entries in a computer’s registry that include information such as a username, causing it to be gathered. MSRT reporting is optional and can be turned off at any time.
+No user content, such as user files or communications, is gathered at the **Security** diagnostic data level, and we take steps to avoid gathering any information that directly identifies a company or user, such as name, email address, or account ID. However, in rare circumstances, MSRT information may unintentionally contain personal information. For instance, some malware may create entries in a computer’s registry that include information such as a username, causing it to be gathered. MSRT reporting is optional and can be turned off at any time.
### Basic level
-The Basic level gathers a limited set of data that’s critical for understanding the device and its configuration. This level also includes the **Security** level data. This level helps to identify problems that can occur on a specific hardware or software configuration. For example, it can help determine if crashes are more frequent on devices with a specific amount of memory or that are running a specific driver version. The Connected User Experience and Telemetry component does not gather telemetry data about System Center, but it can transmit telemetry for other non-Windows applications if they have user consent.
+The Basic level gathers a limited set of data that’s critical for understanding the device and its configuration. This level also includes the **Security** level data. This level helps to identify problems that can occur on a specific hardware or software configuration. For example, it can help determine if crashes are more frequent on devices with a specific amount of memory or that are running a specific driver version. The Connected User Experiences and Telemetry component does not gather diagnostic data data about System Center, but it can transmit diagnostic data for other non-Windows applications if they have user consent.
-The normal upload range for the Basic telemetry level is between 109 KB - 159 KB per day, per device.
+The normal upload range for the Basic diagnostic data level is between 109 KB - 159 KB per day, per device.
The data gathered at this level includes:
@@ -233,7 +232,7 @@ The data gathered at this level includes:
- Storage attributes, such as number of drives, type, and size
-- **Connected User Experience and Telemetry component quality metrics**. Helps provide an understanding about how the Connected User Experience and Telemetry component is functioning, including % of uploaded events, dropped events, and the last upload time.
+- **Connected User Experiences and Telemetry component quality metrics**. Helps provide an understanding about how the Connected User Experiences and Telemetry component is functioning, including % of uploaded events, dropped events, and the last upload time.
- **Quality-related information**. Helps Microsoft develop a basic understanding of how a device and its operating system are performing. Some examples are the device characteristics of a Connected Standby device, the number of crashes or hangs, and application state change details, such as how much processor time and memory were used, and the total uptime for an app.
@@ -260,7 +259,7 @@ The Enhanced level gathers data about how Windows and apps are used and how they
This is the default level for Windows 10 Enterprise and Windows 10 Education editions, and the minimum level needed to quickly identify and address Windows, Windows Server, and System Center quality issues.
-The normal upload range for the Enhanced telemetry level is between 239 KB - 348 KB per day, per device.
+The normal upload range for the Enhanced diagnostic data level is between 239 KB - 348 KB per day, per device.
The data gathered at this level includes:
@@ -272,14 +271,14 @@ The data gathered at this level includes:
- **Some crash dump types**. All crash dump types, except for heap dumps and full dumps.
-If the Connected User Experience and Telemetry component detects a problem on Windows 10 that requires gathering more detailed instrumentation, the Connected User Experience and Telemetry component at the **Enhanced** telemetry level will only gather data about the events associated with the specific issue.
+If the Connected User Experiences and Telemetry component detects a problem on Windows 10 that requires gathering more detailed instrumentation, the Connected User Experiences and Telemetry component at the **Enhanced** diagnostic data level will only gather data about the events associated with the specific issue.
#### Limit Enhanced diagnostic data to the minimum required by Windows Analytics
Windows Analytics Device Health reports are powered by diagnostic data not included in the **Basic** level, such as crash reports and certain operating system events. In the past, organizations sending **Enhanced** or **Full** level diagnostic data were able to participate in Device Health. However, organizations that required detailed event and field level documentation were unable to move from **Basic** to **Enhanced**.
In Windows 10, version 1709, we introduce the **Limit Enhanced diagnostic data to the minimum required by Windows Analytics** feature. When enabled, this feature lets you send only the following subset of **Enhanced** level diagnostic data. For more info about Device Health, see the [Monitor the health of devices with Device Health](https://docs.microsoft.com/windows/deployment/update/device-health-monitor) topic.
-- **Operating system events.** Limited to a small set required for analytics reports and documented in the [Windows 10, version 1709 enhanced telemetry events and fields used by Windows Analytics](https://docs.microsoft.com/windows/configuration/eventname) topic.
+- **Operating system events.** Limited to a small set required for analytics reports and documented in the [Windows 10, version 1709 enhanced diagnostic data events and fields used by Windows Analytics](https://docs.microsoft.com/windows/configuration/eventname) topic.
- **Some crash dump types.** All crash dump types, except for heap and full dumps.
@@ -309,7 +308,7 @@ The **Full** level gathers data necessary to identify and to help fix problems,
Additionally, at this level, devices opted in to the [Windows Insider Program](http://insider.windows.com) will send events, such as reliability and app responsiveness. that can show Microsoft how pre-release binaries and features are performing. These events help us make decisions on which builds are flighted. All devices in the [Windows Insider Program](http://insider.windows.com) are automatically set to this level.
-If a device experiences problems that are difficult to identify or repeat using Microsoft’s internal testing, additional data becomes necessary. This data can include any user content that might have triggered the problem and is gathered from a small sample of devices that have both opted into the **Full** telemetry level and have exhibited the problem.
+If a device experiences problems that are difficult to identify or repeat using Microsoft’s internal testing, additional data becomes necessary. This data can include any user content that might have triggered the problem and is gathered from a small sample of devices that have both opted into the **Full** diagnostic data level and have exhibited the problem.
However, before more data is gathered, Microsoft’s privacy governance team, including privacy and other subject matter experts, must approve the diagnostics request made by a Microsoft engineer. If the request is approved, Microsoft engineers can use the following capabilities to get the information:
@@ -321,27 +320,27 @@ However, before more data is gathered, Microsoft’s privacy governance team, in
## Enterprise management
-Sharing telemetry data with Microsoft provides many benefits to enterprises, so we do not recommend turning it off. For most enterprise customers, simply adjusting the telemetry level and managing specific components is the best option.
+Sharing diagnostic data data with Microsoft provides many benefits to enterprises, so we do not recommend turning it off. For most enterprise customers, simply adjusting the diagnostic data level and managing specific components is the best option.
-Customers can set the telemetry level in both the user interface and with existing management tools. Users can change the telemetry level in the **Diagnostic data** setting. In the **Settings** app, it is in **Privacy\Feedback & diagnostics**. They can choose between Basic, Enhanced, and Full. The Security level is not available.
+Customers can set the diagnostic data level in both the user interface and with existing management tools. Users can change the diagnostic data level in the **Diagnostic data** setting. In the **Settings** app, it is in **Privacy\Feedback & diagnostics**. They can choose between Basic, Enhanced, and Full. The Security level is not available.
-IT pros can use various methods, including Group Policy and Mobile Device Management (MDM), to choose a telemetry level. If you’re using Windows 10 Enterprise, Windows 10 Education, or Windows Server 2016, the Security telemetry level is available when managing the policy. Setting the telemetry level through policy overrides users’ choices. The remainder of this section describes how to do that.
+IT pros can use various methods, including Group Policy and Mobile Device Management (MDM), to choose a diagnostic data level. If you’re using Windows 10 Enterprise, Windows 10 Education, or Windows Server 2016, the Security diagnostic data level is available when managing the policy. Setting the diagnostic data level through policy overrides users’ choices. The remainder of this section describes how to do that.
-### Manage your telemetry settings
+### Manage your diagnostic data settings
-We do not recommend that you turn off telemetry in your organization as valuable functionality may be impacted, but we recognize that in some scenarios this may be required. Use the steps in this section to do so for Windows, Windows Server, and System Center.
+We do not recommend that you turn off diagnostic data in your organization as valuable functionality may be impacted, but we recognize that in some scenarios this may be required. Use the steps in this section to do so for Windows, Windows Server, and System Center.
> [!IMPORTANT]
-> These telemetry levels only apply to Windows, Windows Server, and System Center components and apps that use the Connected User Experience and Telemetry component. Non-Windows components, such as Microsoft Office or other 3rd-party apps, may communicate with their cloud services outside of these telemetry levels. You should work with your app vendors to understand their telemetry policy, and how you can to opt in or opt out. For more information on how Microsoft Office uses telemetry, see [Overview of Office Telemetry](http://technet.microsoft.com/library/jj863580.aspx).
+> These diagnostic data levels only apply to Windows, Windows Server, and System Center components and apps that use the Connected User Experiences and Telemetry component. Non-Windows components, such as Microsoft Office or other 3rd-party apps, may communicate with their cloud services outside of these diagnostic data levels. You should work with your app vendors to understand their diagnostic data policy, and how you can to opt in or opt out. For more information on how Microsoft Office uses diagnostic data, see [Overview of Office Telemetry](http://technet.microsoft.com/library/jj863580.aspx).
-You can turn on or turn off System Center telemetry gathering. The default is on and the data gathered at this level represents what is gathered by default when System Center telemetry is turned on. However, setting the operating system telemetry level to **Basic** will turn off System Center telemetry, even if the System Center telemetry switch is turned on.
+You can turn on or turn off System Center diagnostic data gathering. The default is on and the data gathered at this level represents what is gathered by default when System Center diagnostic data is turned on. However, setting the operating system diagnostic data level to **Basic** will turn off System Center diagnostic data, even if the System Center diagnostic data switch is turned on.
-The lowest telemetry setting level supported through management policies is **Security**. The lowest telemetry setting supported through the Settings UI is **Basic**. The default telemetry setting for Windows Server 2016 is **Enhanced**.
+The lowest diagnostic data setting level supported through management policies is **Security**. The lowest diagnostic data setting supported through the Settings UI is **Basic**. The default diagnostic data setting for Windows Server 2016 is **Enhanced**.
-### Configure the operating system telemetry level
+### Configure the operating system diagnostic data level
-You can configure your operating system telemetry settings using the management tools you’re already using, such as Group Policy, MDM, or Windows Provisioning. You can also manually change your settings using Registry Editor. Setting your telemetry levels through a management policy overrides any device level settings.
+You can configure your operating system diagnostic data settings using the management tools you’re already using, such as Group Policy, MDM, or Windows Provisioning. You can also manually change your settings using Registry Editor. Setting your diagnostic data levels through a management policy overrides any device level settings.
Use the appropriate value in the table below when you configure the management policy.
@@ -353,9 +352,9 @@ Use the appropriate value in the table below when you configure the management p
| Full | Security data, basic system and quality data, enhanced insights and advanced reliability data, and full diagnostics data. | **3** |
-### Use Group Policy to set the telemetry level
+### Use Group Policy to set the diagnostic data level
-Use a Group Policy object to set your organization’s telemetry level.
+Use a Group Policy object to set your organization’s diagnostic data level.
1. From the Group Policy Management Console, go to **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds**.
@@ -363,11 +362,11 @@ Use a Group Policy object to set your organization’s telemetry level.
3. In the **Options** box, select the level that you want to configure, and then click **OK**.
-### Use MDM to set the telemetry level
+### Use MDM to set the diagnostic data level
Use the [Policy Configuration Service Provider (CSP)](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) to apply the System/AllowTelemetry MDM policy.
-### Use Registry Editor to set the telemetry level
+### Use Registry Editor to set the diagnostic data level
Use Registry Editor to manually set the registry level on each device in your organization or you can write a script to edit the registry. If a management policy already exists, such as Group Policy or MDM, it will override this registry setting.
@@ -381,25 +380,25 @@ Use Registry Editor to manually set the registry level on each device in your or
5. Click **File** > **Export**, and then save the file as a .reg file, such as **C:\\AllowTelemetry.reg**. You can run this file from a script on each device in your organization.
-### Configure System Center 2016 telemetry
+### Configure System Center 2016 diagnostic data
-For System Center 2016 Technical Preview, you can turn off System Center telemetry by following these steps:
+For System Center 2016 Technical Preview, you can turn off System Center diagnostic data by following these steps:
-- Turn off telemetry by using the System Center UI Console settings workspace.
+- Turn off diagnostic data by using the System Center UI Console settings workspace.
-- For information about turning off telemetry for Service Management Automation and Service Provider Foundation, see [How to disable telemetry for Service Management Automation and Service Provider Foundation](https://support.microsoft.com/kb/3096505).
+- For information about turning off diagnostic data for Service Management Automation and Service Provider Foundation, see [How to disable telemetry for Service Management Automation and Service Provider Foundation](https://support.microsoft.com/kb/3096505).
-### Additional telemetry controls
+### Additional diagnostic data controls
-There are a few more settings that you can turn off that may send telemetry information:
+There are a few more settings that you can turn off that may send diagnostic data information:
-- To turn off Windows Update telemetry, you have two choices. Either turn off Windows Update, or set your devices to be managed by an on premises update server, such as [Windows Server Update Services (WSUS)](http://technet.microsoft.com/library/hh852345.aspx) or [System Center Configuration Manager](http://www.microsoft.com/server-cloud/products/system-center-2012-r2-configuration-manager/).
+- To turn off Windows Update diagnostic data, you have two choices. Either turn off Windows Update, or set your devices to be managed by an on premises update server, such as [Windows Server Update Services (WSUS)](http://technet.microsoft.com/library/hh852345.aspx) or [System Center Configuration Manager](http://www.microsoft.com/server-cloud/products/system-center-2012-r2-configuration-manager/).
- Turn off **Windows Defender Cloud-based Protection** and **Automatic sample submission** in **Settings** > **Update & security** > **Windows Defender**.
- Manage the Malicious Software Removal Tool in your organization. For more info, see Microsoft KB article [891716](http://support.microsoft.com/kb/891716).
-- Turn off **Linguistic Data Collection** in **Settings** > **Privacy**. At telemetry levels **Enhanced** and **Full**, Microsoft uses Linguistic Data Collection info to improve language model features such as autocomplete, spellcheck, suggestions, input pattern recognition, and dictionary.
+- Turn off **Linguistic Data Collection** in **Settings** > **Privacy**. At diagnostic data levels **Enhanced** and **Full**, Microsoft uses Linguistic Data Collection info to improve language model features such as autocomplete, spellcheck, suggestions, input pattern recognition, and dictionary.
> [!NOTE]
> Microsoft does not intend to gather sensitive information, such as credit card numbers, usernames and passwords, email addresses, or other similarly sensitive information for Linguistic Data Collection. We guard against such events by using technologies to identify and remove sensitive information before linguistic data is sent from the user's device. If we determine that sensitive information has been inadvertently received, we delete the information.
@@ -434,4 +433,4 @@ Web Pages
- [Privacy at Microsoft](http://privacy.microsoft.com)
-Not finding content you need? Windows 10 users, tell us what you want on [Feedback Hub](feedback-hub:?tabid=2&contextid=897).
\ No newline at end of file
+
\ No newline at end of file
diff --git a/windows/configuration/cortana-at-work/cortana-at-work-crm.md b/windows/configuration/cortana-at-work/cortana-at-work-crm.md
index 1475e42e38..6b93ce1102 100644
--- a/windows/configuration/cortana-at-work/cortana-at-work-crm.md
+++ b/windows/configuration/cortana-at-work/cortana-at-work-crm.md
@@ -7,6 +7,7 @@ ms.sitesec: library
author: eross-msft
ms.localizationpriority: high
ms.author: lizross
+ms.date: 10/05/2017
---
# Set up and test Cortana with Microsoft Dynamics CRM (Preview feature) in your organization
diff --git a/windows/configuration/cortana-at-work/cortana-at-work-feedback.md b/windows/configuration/cortana-at-work/cortana-at-work-feedback.md
index acf462f7e1..9c79b266ad 100644
--- a/windows/configuration/cortana-at-work/cortana-at-work-feedback.md
+++ b/windows/configuration/cortana-at-work/cortana-at-work-feedback.md
@@ -7,6 +7,7 @@ ms.sitesec: library
author: eross-msft
ms.localizationpriority: high
ms.author: lizross
+ms.date: 10/05/2017
---
# Send feedback about Cortana at work back to Microsoft
diff --git a/windows/configuration/cortana-at-work/cortana-at-work-o365.md b/windows/configuration/cortana-at-work/cortana-at-work-o365.md
index 554f55e3eb..1b743a1911 100644
--- a/windows/configuration/cortana-at-work/cortana-at-work-o365.md
+++ b/windows/configuration/cortana-at-work/cortana-at-work-o365.md
@@ -7,6 +7,7 @@ ms.sitesec: library
author: eross-msft
ms.localizationpriority: high
ms.author: lizross
+ms.date: 10/05/2017
---
# Set up and test Cortana with Office 365 in your organization
diff --git a/windows/configuration/cortana-at-work/cortana-at-work-overview.md b/windows/configuration/cortana-at-work/cortana-at-work-overview.md
index e492f9e0bd..1621976e24 100644
--- a/windows/configuration/cortana-at-work/cortana-at-work-overview.md
+++ b/windows/configuration/cortana-at-work/cortana-at-work-overview.md
@@ -7,6 +7,7 @@ ms.sitesec: library
author: eross-msft
ms.localizationpriority: high
ms.author: lizross
+ms.date: 10/05/2017
---
# Cortana integration in your business or enterprise
diff --git a/windows/configuration/cortana-at-work/cortana-at-work-policy-settings.md b/windows/configuration/cortana-at-work/cortana-at-work-policy-settings.md
index ff0dbc4457..f411b5bc5e 100644
--- a/windows/configuration/cortana-at-work/cortana-at-work-policy-settings.md
+++ b/windows/configuration/cortana-at-work/cortana-at-work-policy-settings.md
@@ -7,6 +7,7 @@ ms.sitesec: library
author: eross-msft
ms.localizationpriority: high
ms.author: lizross
+ms.date: 10/05/2017
---
# Use Group Policy and mobile device management (MDM) settings to configure Cortana in your organization
diff --git a/windows/configuration/cortana-at-work/cortana-at-work-powerbi.md b/windows/configuration/cortana-at-work/cortana-at-work-powerbi.md
index 3859197f3d..830f7782ae 100644
--- a/windows/configuration/cortana-at-work/cortana-at-work-powerbi.md
+++ b/windows/configuration/cortana-at-work/cortana-at-work-powerbi.md
@@ -7,6 +7,7 @@ ms.sitesec: library
author: eross-msft
ms.localizationpriority: high
ms.author: lizross
+ms.date: 10/05/2017
---
# Set up and test Cortana for Power BI in your organization
diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-1.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-1.md
index c319ce2fc7..96791c86c2 100644
--- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-1.md
+++ b/windows/configuration/cortana-at-work/cortana-at-work-scenario-1.md
@@ -7,6 +7,7 @@ ms.sitesec: library
author: eross-msft
ms.localizationpriority: high
ms.author: lizross
+ms.date: 10/05/2017
---
# Test scenario 1 - Sign-in to Azure AD and use Cortana to manage the notebook
diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-2.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-2.md
index 43fcd17368..1218dc7509 100644
--- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-2.md
+++ b/windows/configuration/cortana-at-work/cortana-at-work-scenario-2.md
@@ -7,6 +7,7 @@ ms.sitesec: library
author: eross-msft
ms.localizationpriority: high
ms.author: lizross
+ms.date: 10/05/2017
---
# Test scenario 2 - Perform a quick search with Cortana at work
diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-3.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-3.md
index 9813519fad..4504ed425f 100644
--- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-3.md
+++ b/windows/configuration/cortana-at-work/cortana-at-work-scenario-3.md
@@ -7,6 +7,7 @@ ms.sitesec: library
author: eross-msft
ms.localizationpriority: high
ms.author: lizross
+ms.date: 10/05/2017
---
# Test scenario 3 - Set a reminder for a specific location using Cortana at work
diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-4.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-4.md
index dd43c46b35..d2025be11b 100644
--- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-4.md
+++ b/windows/configuration/cortana-at-work/cortana-at-work-scenario-4.md
@@ -7,6 +7,7 @@ ms.sitesec: library
author: eross-msft
ms.localizationpriority: high
ms.author: lizross
+ms.date: 10/05/2017
---
# Test scenario 4 - Use Cortana at work to find your upcoming meetings
diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-5.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-5.md
index ccc50a9ebe..7cb8d019ef 100644
--- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-5.md
+++ b/windows/configuration/cortana-at-work/cortana-at-work-scenario-5.md
@@ -7,6 +7,7 @@ ms.sitesec: library
author: eross-msft
ms.localizationpriority: high
ms.author: lizross
+ms.date: 10/05/2017
---
# Test scenario 5 - Use Cortana to send email to a co-worker
diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-6.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-6.md
index c553334d54..218fc912e2 100644
--- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-6.md
+++ b/windows/configuration/cortana-at-work/cortana-at-work-scenario-6.md
@@ -7,6 +7,7 @@ ms.sitesec: library
author: eross-msft
ms.localizationpriority: high
ms.author: lizross
+ms.date: 10/05/2017
---
# Test scenario 6 - Review a reminder suggested by Cortana based on what you’ve promised in email
diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-7.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-7.md
index 6b2b437b4e..b12e6ac6a0 100644
--- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-7.md
+++ b/windows/configuration/cortana-at-work/cortana-at-work-scenario-7.md
@@ -7,6 +7,7 @@ ms.sitesec: library
author: eross-msft
ms.localizationpriority: high
ms.author: lizross
+ms.date: 10/05/2017
---
# Test scenario 7 - Use Cortana and Windows Information Protection (WIP) to help protect your organization’s data on a device
diff --git a/windows/configuration/cortana-at-work/cortana-at-work-testing-scenarios.md b/windows/configuration/cortana-at-work/cortana-at-work-testing-scenarios.md
index 2fa3e6637d..abe0b15cb3 100644
--- a/windows/configuration/cortana-at-work/cortana-at-work-testing-scenarios.md
+++ b/windows/configuration/cortana-at-work/cortana-at-work-testing-scenarios.md
@@ -7,6 +7,7 @@ ms.sitesec: library
author: eross-msft
ms.localizationpriority: high
ms.author: lizross
+ms.date: 10/05/2017
---
# Testing scenarios using Cortana in your business or organization
diff --git a/windows/configuration/cortana-at-work/cortana-at-work-voice-commands.md b/windows/configuration/cortana-at-work/cortana-at-work-voice-commands.md
index 2f73ac7fb5..4e90a14bab 100644
--- a/windows/configuration/cortana-at-work/cortana-at-work-voice-commands.md
+++ b/windows/configuration/cortana-at-work/cortana-at-work-voice-commands.md
@@ -7,6 +7,7 @@ ms.sitesec: library
author: eross-msft
ms.localizationpriority: high
ms.author: lizross
+ms.date: 10/05/2017
---
# Set up and test custom voice commands in Cortana for your organization
diff --git a/windows/configuration/customize-and-export-start-layout.md b/windows/configuration/customize-and-export-start-layout.md
index b7631a4285..7d84bee306 100644
--- a/windows/configuration/customize-and-export-start-layout.md
+++ b/windows/configuration/customize-and-export-start-layout.md
@@ -8,6 +8,7 @@ ms.mktglfcycl: manage
ms.sitesec: library
author: jdeckerms
ms.localizationpriority: high
+ms.date: 10/16/2017
---
# Customize and export Start layout
@@ -81,7 +82,7 @@ To prepare a Start layout for export, you simply customize the Start layout on a
## Export the Start layout
-When you have the Start layout that you want your users to see, use the [Export-StartLayout](https://go.microsoft.com/fwlink/p/?LinkId=620879) cmdlet in Windows PowerShell to export the Start layout to an .xml file.
+When you have the Start layout that you want your users to see, use the [Export-StartLayout](https://docs.microsoft.com/powershell/module/startlayout/export-startlayout?view=win10-ps) cmdlet in Windows PowerShell to export the Start layout to an .xml file.
>[!IMPORTANT]
>If you include secondary Microsoft Edge tiles (tiles that link to specific websites in Microsoft Edge), see [Add custom images to Microsoft Edge secondary tiles](start-secondary-tiles.md) for instructions.
@@ -96,7 +97,7 @@ When you have the Start layout that you want your users to see, use the [Export-
In the previous command, `-path` is a required parameter that specifies the path and file name for the export file. You can specify a local path or a UNC path (for example, \\\\FileServer01\\StartLayouts\\StartLayoutMarketing.xml).
- Use a file name of your choice—for example, StartLayoutMarketing.xml. Include the .xml file name extension. The [Export-StartLayout](https://go.microsoft.com/fwlink/p/?LinkId=620879) cmdlet does not append the file name extension, and the policy settings require the extension.
+ Use a file name of your choice—for example, StartLayoutMarketing.xml. Include the .xml file name extension. The [Export-StartLayout](https://docs.microsoft.com/powershell/module/startlayout/export-startlayout?view=win10-ps) cmdlet does not append the file name extension, and the policy settings require the extension.
Example of a layout file produced by `Export-StartLayout`:
@@ -170,7 +171,6 @@ If the Start layout is applied by Group Policy or MDM, and the policy is removed
- [Customize Windows 10 Start and tasbkar with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md)
- [Changes to Start policies in Windows 10](changes-to-start-policies-in-windows-10.md)
-Not finding content you need? Windows 10 users, tell us what you want on [Feedback Hub](feedback-hub://?referrer=techDocsUcPage&tabid=2&contextid=897&newFeedback=true&topic=customize-and-export-start-layout.md).
diff --git a/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md b/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md
index 929bea684c..41f82753c8 100644
--- a/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md
+++ b/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md
@@ -9,7 +9,7 @@ ms.sitesec: library
author: jdeckerms
ms.localizationpriority: high
ms.author: jdecker
-ms.date: 10/05/2017
+ms.date: 11/15/2017
---
# Customize Windows 10 Start and taskbar with Group Policy
@@ -35,7 +35,7 @@ This topic describes how to update Group Policy settings to display a customized
## Operating system requirements
-Start and taskbar layout control using Group Policy is supported in Windows 10 Enterprise and Windows 10 Education, version 1607. Start and taskbar layout control is supported in Windows 10 Pro in Windows 10, version 1703.
+In Windows 10, version 1607, Start and taskbar layout control using Group Policy is supported in Windows 10 Enterprise and Windows 10 Education. In Windows 10, version 1703, Start and taskbar layout control using Group Policy is also supported in Windows 10 Pro.
The GPO can be configured from any computer on which the necessary ADMX and ADML files (StartMenu.admx and StartMenu.adml) for Windows 10 are installed. In Group Policy, ADMX files are used to define Registry-based policy settings in the Administrative Templates category. To find out how to create a central store for Administrative Templates files, see [article 929841, written for Windows Vista and still applicable](https://go.microsoft.com/fwlink/p/?LinkId=691687) in the Microsoft Knowledge Base.
@@ -44,7 +44,7 @@ The GPO can be configured from any computer on which the necessary ADMX and ADML
Three features enable Start and taskbar layout control:
-- The [Export-StartLayout](https://go.microsoft.com/fwlink/p/?LinkID=620879) cmdlet in Windows PowerShell exports a description of the current Start layout in .xml file format.
+- The [Export-StartLayout](https://docs.microsoft.com/powershell/module/startlayout/export-startlayout?view=win10-ps) cmdlet in Windows PowerShell exports a description of the current Start layout in .xml file format.
>[!NOTE]
>To import the layout of Start to a mounted Windows image, use the [Import-StartLayout](https://docs.microsoft.com/powershell/module/startlayout/import-startlayout) cmdlet.
@@ -130,7 +130,6 @@ After you use Group Policy to apply a customized Start and taskbar layout on a c
- [Customize Windows 10 Start and tasbkar with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md)
- [Changes to Start policies in Windows 10](changes-to-start-policies-in-windows-10.md)
-Not finding content you need? Windows 10 users, tell us what you want on [Feedback Hub](feedback-hub://?referrer=techDocsUcPage&tabid=2&contextid=897&newFeedback=true&topic=customize-windows-10-start-screens-by-using-group-policy.md).
diff --git a/windows/configuration/customize-windows-10-start-screens-by-using-mobile-device-management.md b/windows/configuration/customize-windows-10-start-screens-by-using-mobile-device-management.md
index 1447c25de9..25187b8f0a 100644
--- a/windows/configuration/customize-windows-10-start-screens-by-using-mobile-device-management.md
+++ b/windows/configuration/customize-windows-10-start-screens-by-using-mobile-device-management.md
@@ -8,6 +8,7 @@ ms.mktglfcycl: manage
ms.sitesec: library
author: jdeckerms
ms.localizationpriority: medium
+ms.date: 11/15/2017
---
# Customize Windows 10 Start and taskbar with mobile device management (MDM)
diff --git a/windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md b/windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md
index cae45faff6..c681c90ebd 100644
--- a/windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md
+++ b/windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md
@@ -8,6 +8,7 @@ ms.mktglfcycl: manage
ms.sitesec: library
author: jdeckerms
ms.localizationpriority: medium
+ms.date: 11/15/2017
---
# Customize Windows 10 Start and taskbar with provisioning packages
diff --git a/windows/configuration/diagnostic-data-viewer-overview.md b/windows/configuration/diagnostic-data-viewer-overview.md
new file mode 100644
index 0000000000..c009c6c0e2
--- /dev/null
+++ b/windows/configuration/diagnostic-data-viewer-overview.md
@@ -0,0 +1,109 @@
+---
+title: Diagnostic Data Viewer Overview (Windows 10)
+description: Use this article to use the Diagnostic Data Viewer application to review the diagnostic data sent to Microsoft by your device.
+keywords: privacy
+ms.prod: w10
+ms.mktglfcycl: manage
+ms.sitesec: library
+ms.pagetype: security
+ms.localizationpriority: high
+author: brianlic-msft
+ms.author: brianlic
+ms.date: 01/17/2018
+---
+
+# Diagnostic Data Viewer Overview
+
+**Applies to**
+
+- Windows 10, Windows Insider Preview
+
+[This information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]
+
+## Introduction
+The Diagnostic Data Viewer is a Windows app that lets you review the diagnostic data your device is sending to Microsoft, grouping the info into simple categories based on how it's used by Microsoft.
+
+## Install and Use the Diagnostic Data Viewer
+You must turn on data viewing and download the app before you can use the Diagnostic Data Viewer to review your device's diagnostic data.
+
+### Turn on data viewing
+Before you can use this tool, you must turn on data viewing in the **Settings** panel. Turning on data viewing lets Windows store your device's diagnostic data until you turn it off. Turning off data viewing stops Windows from collecting your diagnostic data and clears the existing diagnostic data from your device.
+
+**To turn on data viewing**
+1. Go to **Start**, select **Settings** > **Privacy** > **Diagnostics & feedback**.
+
+2. Under **Diagnostic data**, turn on the **If data viewing is enabled, you can see your diagnostics data** option.
+
+ 
+
+### Download the Diagnostic Data Viewer
+Download the app from the [Microsoft Store Diagnostic Data Viewer](https://www.microsoft.com/en-us/store/p/diagnostic-data-viewer/9n8wtrrsq8f7?rtc=1) page.
+
+### Start the Diagnostic Data Viewer
+You must start this app from the **Settings** panel.
+
+**To start the Diagnostic Data Viewer**
+1. Go to **Start**, select **Settings** > **Privacy** > **Diagnostics & feedback**.
+
+2. Under **Diagnostic data**, select the **Diagnostic Data Viewer** button.
+
+ 
+
+f -OR-
+
+ Go to **Start** and search for _Diagnostic Data Viewer_.
+
+3. Close the Diagnostic Data Viewer app, use your device as you normally would for a few days, and then open Diagnostic Data Viewer again to review the updated list of diagnostic data.
+
+ >[!Important]
+ >Turning on data viewing can use up to 1GB of disk space on your system drive. We strongly recommend that your turn off data viewing when you're done using the Diagnostic Data Viewer. For info about turning off data viewing, see the [Turn off data viewing](#turn-off-data-viewing) section in this article.
+
+### Use the Diagnostic Data Viewer
+The Diagnostic Data Viewer provides you with the following features to view and filter your device's diagnostic data.
+
+- **View your diagnostic events.** In the left column, you can review your diagnostic events. These events reflect activities that occurred and were sent to Microsoft.
+
+ Selecting an event opens the detailed JSON view, which provides the exact details uploaded to Microsoft. Microsoft uses this info to continually improve the Windows operating system.
+
+- **Search your diagnostic events.** The **Search** box at the top of the screen lets you search amongst all of the diagnostic event details. The returned search results include any diagnostic event that contains the matching text.
+
+ Selecting an event opens the detailed JSON view, with the matching text highlighted.
+
+- **Filter your diagnostic event categories.** The apps Menu button opens the detailed menu. In here, you'll find a list of diagnostic event categories, which define how the events are used by Microsoft.
+
+ Selecting a check box lets you filter between the diagnostic event categories.
+
+- **Help to make your Windows experience better.** Microsoft only needs diagnostic data from a small amount of devices to make big improvements to the Windows operating system and ultimately, your experience. If you’re a part of this small device group and you experience issues, Microsoft will collect the associated event diagnostic data, allowing your info to potentially help fix the issue for others.
+
+ To signify your contribution, you’ll see this icon () if your device is part of the group. In addition, if any of your diagnostic data events are sent from your device to Microsoft to help make improvements, you’ll see this icon ().
+
+- **Provide diagnostic event feedback.** The **Feedback** icon opens the Feedback Hub app, letting you provide feedback about the Diagnostic Data Viewer and the diagnostic events.
+
+ Selecting a specific event in the Diagnostic Data Viewer automatically fills in the field in the Feedback Hub. You can add your comments to the box labeled, **Give us more detail (optional)**.
+
+ >[!Important]
+ >All content in the Feedback Hub is publicly viewable. Therefore, make sure you don't put any personal info into your feedback comments.
+
+## Turn off data viewing
+When you're done reviewing your diagnostic data, you should turn of data viewing.
+
+**To turn off data viewing**
+1. Go to **Start**, select **Settings** > **Privacy** > **Diagnostics & feedback**.
+
+2. Under **Diagnostic data**, turn off the **If data viewing is enabled, you can see your diagnostics data** option.
+
+ 
+
+## View additional diagnostic data in the View problem reports tool
+You can review additional Windows Error Reporting diagnostic data in the **View problem reports** tool. This tool provides you with a summary of various crash reports that are sent to Microsoft as part of Windows Error Reporting. We use this data to find and fix specific issues that are hard to replicate and to improve the Windows operating system.
+
+**To view your Windows Error Reporting diagnostic data**
+1. Go to **Start**, select **Control Panel** > **All Control Panel Items** > **Security and Maintenance** > **Problem Reports**.
+
+- OR -
+
+ Go to **Start** and search for _Problem Reports_.
+
+ The **Review problem reports** tool opens, showing you your Windows Error Reporting reports, along with a status about whether it was sent to Microsoft.
+
+ 
diff --git a/windows/configuration/EventName.md b/windows/configuration/enhanced-diagnostic-data-windows-analytics-events-and-fields.md
similarity index 94%
rename from windows/configuration/EventName.md
rename to windows/configuration/enhanced-diagnostic-data-windows-analytics-events-and-fields.md
index c0ae1cafb0..385988b6d3 100644
--- a/windows/configuration/EventName.md
+++ b/windows/configuration/enhanced-diagnostic-data-windows-analytics-events-and-fields.md
@@ -1,27 +1,27 @@
---
-description: Use this article to learn more about the enhanced telemetry events used by Windows Analytics
+description: Use this article to learn more about the enhanced diagnostic data events used by Windows Analytics
title: Windows 10, version 1709 enhanced telemtry events and fields used by Windows Analytics (Windows 10)
-keywords: privacy, telemetry
+keywords: privacy, diagnostic data
ms.prod: w10
ms.mktglfcycl: manage
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 10/16/2017
author: jaimeo
ms.author: jaimeo
---
-# Windows 10, version 1709 enhanced telemetry events and fields used by Windows Analytics
+# Windows 10, version 1709 enhanced diagnostic data events and fields used by Windows Analytics
**Applies to**
- Windows 10, version 1709 and later
-Windows Analytics Device Health reports are powered by diagnostic data not included in the Basic level. This includes crash reports and certain OS telemetry events. Organizations sending Enhanced or Full level diagnostic data were able to participate in Device Health, but some organizations which required detailed event and field level documentation were unable to move from Basic to Enhanced.
+Windows Analytics Device Health reports are powered by diagnostic data not included in the Basic level. This includes crash reports and certain OS diagnostic data events. Organizations sending Enhanced or Full level diagnostic data were able to participate in Device Health, but some organizations which required detailed event and field level documentation were unable to move from Basic to Enhanced.
-In Windows 10, version 1709, we introduce a new feature: "Limit Enhanced diagnostic data to the minimum required by Windows Analytics". When enabled, this feature limits the operating system telemetry events included in the Enhanced level to only those described below. Note that the Enhanced level also includes limited crash reports, which are not described below. For more information on the Enhanced level, see [Configure Windows telemetry in your organization](configure-windows-telemetry-in-your-organization.md).
+In Windows 10, version 1709, we introduce a new feature: "Limit Enhanced diagnostic data to the minimum required by Windows Analytics". When enabled, this feature limits the operating system diagnostic data events included in the Enhanced level to only those described below. Note that the Enhanced level also includes limited crash reports, which are not described below. For more information on the Enhanced level, see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md).
## KernelProcess.AppStateChangeSummary
diff --git a/windows/configuration/gdpr-win10-whitepaper.md b/windows/configuration/gdpr-win10-whitepaper.md
index 434bb0239b..c7dd56e8df 100644
--- a/windows/configuration/gdpr-win10-whitepaper.md
+++ b/windows/configuration/gdpr-win10-whitepaper.md
@@ -179,7 +179,7 @@ The GDPR includes explicit requirements for breach notification where a personal
As noted in the Windows Security Center white paper, [Post Breach: Dealing with Advanced Threats](http://wincom.blob.core.windows.net/documents/Post_Breach_Dealing_with_Advanced_Threats_Whitepaper.pdf), “_Unlike pre-breach, post-breach assumes a breach has already occurred – acting as a flight recorder and Crime Scene Investigator (CSI). Post-breach provides security teams the information and toolset needed to identify, investigate, and respond to attacks that otherwise will stay undetected and below the radar._”
-#### Insightful security telemetry
+#### Insightful security diagnostic data
For nearly two decades, Microsoft has been turning threats into useful intelligence that can help fortify our platform and protect customers. Today, with the immense computing advantages afforded by the cloud, we are finding new ways to use our rich analytics engines driven by threat intelligence to protect our customers.
By applying a combination of automated and manual processes, machine learning and human experts, we can create an Intelligent Security Graph that learns from itself and evolves in real-time, reducing our collective time to detect and respond to new incidents across our products.
diff --git a/windows/configuration/images/ddv-data-viewing.png b/windows/configuration/images/ddv-data-viewing.png
new file mode 100644
index 0000000000..88f45acf3b
Binary files /dev/null and b/windows/configuration/images/ddv-data-viewing.png differ
diff --git a/windows/configuration/images/ddv-device-sample.png b/windows/configuration/images/ddv-device-sample.png
new file mode 100644
index 0000000000..8bb5d968e1
Binary files /dev/null and b/windows/configuration/images/ddv-device-sample.png differ
diff --git a/windows/configuration/images/ddv-event-sample.png b/windows/configuration/images/ddv-event-sample.png
new file mode 100644
index 0000000000..2674f139dd
Binary files /dev/null and b/windows/configuration/images/ddv-event-sample.png differ
diff --git a/windows/configuration/images/ddv-problem-reports-screen.png b/windows/configuration/images/ddv-problem-reports-screen.png
new file mode 100644
index 0000000000..d991f4c7d8
Binary files /dev/null and b/windows/configuration/images/ddv-problem-reports-screen.png differ
diff --git a/windows/configuration/images/ddv-settings-launch.png b/windows/configuration/images/ddv-settings-launch.png
new file mode 100644
index 0000000000..4d4e26c382
Binary files /dev/null and b/windows/configuration/images/ddv-settings-launch.png differ
diff --git a/windows/configuration/images/ddv-settings-off.png b/windows/configuration/images/ddv-settings-off.png
new file mode 100644
index 0000000000..12704b5e28
Binary files /dev/null and b/windows/configuration/images/ddv-settings-off.png differ
diff --git a/windows/configuration/index.md b/windows/configuration/index.md
index d3e9db3364..c462632c79 100644
--- a/windows/configuration/index.md
+++ b/windows/configuration/index.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: high
author: jdeckerms
+ms.date: 01/15/2018
---
# Configure Windows 10
@@ -18,11 +19,11 @@ Enterprises often need to apply custom configurations to devices for their users
| Topic | Description |
| --- | --- |
-| [Configure Windows telemetry in your organization](configure-windows-telemetry-in-your-organization.md) | Use this article to make informed decisions about how you can configure Windows telemetry in your organization. |
-| [Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1709.md) | Learn about diagnostic data that is collected at the basic level in Windows 10, version 1709. |
-|[Windows 10, version 1709 enhanced telemetry events and fields used by Windows Analytics](EventName.md)|Learn about diagnostic data that is collected by Windows Analytics.|
-| [Windows 10, version 1703 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields.md) | Learn about diagnostic data that is collected at the basic level in Windows 10, version 1703. |
-| [Windows 10 diagnostic data for the Full telemetry level](windows-diagnostic-data.md) | Learn about the types of data that is collected at the full level in Windows 10, version 1703 and later. |
+| [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md) | Use this article to make informed decisions about how you can configure Windows diagnostic data in your organization. |
+| [Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields.md) | Learn about diagnostic data that is collected at the basic level in Windows 10, version 1709. |
+|[Windows 10, version 1709 enhanced diagnostic data events and fields used by Windows Analytics](enhanced-diagnostic-data-windows-analytics-events-and-fields.md)|Learn about diagnostic data that is collected by Windows Analytics.|
+| [Windows 10, version 1703 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md) | Learn about diagnostic data that is collected at the basic level in Windows 10, version 1703. |
+| [Windows 10 diagnostic data for the Full diagnostic data level](windows-diagnostic-data-1703.md) | Learn about the types of data that is collected at the full level in Windows 10, version 1703 and later. |
|[Beginning your General Data Protection Regulation (GDPR) journey for Windows 10](gdpr-win10-whitepaper.md)|Learn about Windows 10 and the upcoming GDPR-compliance requirements.|
| [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) | Learn about the network connections that Windows components make to Microsoft and also the privacy settings that affect data that is shared with either Microsoft or apps and how they can be managed by an IT Pro. |
| [Manage Wi-Fi Sense in your company](manage-wifi-sense-in-enterprise.md) | Wi-Fi Sense automatically connects you to Wi-Fi, so you can get online quickly in more places. It can connect you to open Wi-Fi hotspots it knows about through crowdsourcing, or to Wi-Fi networks your contacts have shared with you by using Wi-Fi Sense. The initial settings for Wi-Fi Sense are determined by the options you chose when you first set up your PC with Windows 10. |
@@ -32,6 +33,7 @@ Enterprises often need to apply custom configurations to devices for their users
| [Configure Start, taskbar, and lock screen](start-taskbar-lockscreen.md) | A standard, customized Start layout can be useful on devices that are common to multiple users and devices that are locked down for specialized purposes. Configuring the taskbar allows the organization to pin useful apps for their employees and to remove apps that are pinned by default. |
| [Cortana integration in your business or enterprise](cortana-at-work/cortana-at-work-overview.md) | The world’s first personal digital assistant helps users get things done, even at work. Cortana includes powerful configuration options specifically to optimize for unique small to medium-sized business and enterprise environments. |
| [Configure access to Microsoft Store](stop-employees-from-using-the-windows-store.md) | IT Pros can configure access to Microsoft Store for client computers in their organization. For some organizations, business policies require blocking access to Microsoft Store. |
+| [Accessibility information for IT Pros](windows-10-accessibility-for-ITPros.md) | Windows 10 includes accessibility features that benefit all users. These features make it easier to customize the computer and give users with different abilities options to improve their experience with Windows. This topic helps IT administrators learn about built-in accessibility features. |
| [Provisioning packages for Windows 10](provisioning-packages/provisioning-packages.md) | Learn how to use the Windows Configuration Designer and provisioning packages to easily configure multiple devices. |
| [Lockdown features from Windows Embedded 8.1 Industry](lockdown-features-windows-10.md) | Many of the lockdown features available in Windows Embedded 8.1 Industry have been modified in some form for Windows 10. |
| [Change history for Configure Windows 10](change-history-for-configure-windows-10.md) | This topic lists new and updated topics in the Configure Windows 10 documentation for Windows 10 and Windows 10 Mobile. |
diff --git a/windows/configuration/kiosk-shared-pc.md b/windows/configuration/kiosk-shared-pc.md
index 420e550a78..e2c1689b92 100644
--- a/windows/configuration/kiosk-shared-pc.md
+++ b/windows/configuration/kiosk-shared-pc.md
@@ -7,6 +7,7 @@ ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
author: jdeckerms
+ms.date: 08/08/2017
---
# Configure kiosk and shared devices running Windows desktop editions
diff --git a/windows/configuration/lock-down-windows-10-applocker.md b/windows/configuration/lock-down-windows-10-applocker.md
index d4422e7212..8615847512 100644
--- a/windows/configuration/lock-down-windows-10-applocker.md
+++ b/windows/configuration/lock-down-windows-10-applocker.md
@@ -9,7 +9,7 @@ ms.sitesec: library
ms.pagetype: edu, security
author: jdeckerms
ms.localizationpriority: high
-ms.date: 10/05/2017
+ms.date: 08/14/2017
ms.author: jdecker
---
diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md
index 147389b7a9..7e5d71562c 100644
--- a/windows/configuration/lock-down-windows-10-to-specific-apps.md
+++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md
@@ -9,7 +9,7 @@ ms.sitesec: library
ms.pagetype: edu, security
author: jdeckerms
ms.localizationpriority: high
-ms.date: 10/05/2017
+ms.date: 11/26/2018
ms.author: jdecker
---
@@ -20,7 +20,11 @@ ms.author: jdecker
- Windows 10
-A [kiosk device](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) typically runs a single app, and users are prevented from accessing any features or functions on the device outside of the kiosk app. In Windows 10, version 1709, the [AssignedAccess configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) has been expanded to make it easy for administrators to create kiosks that run more than one app. You can configure multi-app kiosks using a provisioning package.
+A [kiosk device](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) typically runs a single app, and users are prevented from accessing any features or functions on the device outside of the kiosk app. In Windows 10, version 1709, the [AssignedAccess configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) has been expanded to make it easy for administrators to create kiosks that run more than one app. You can configure multi-app kiosks using Microsoft Intune or a provisioning package.
+
+Watch how to use Intune to configure a multi-app kiosk.
+
+>[!VIDEO https://www.microsoft.com/videoplayer/embed/ce9992ab-9fea-465d-b773-ee960b990c4a?autoplay=false]
>[!NOTE]
>For devices running versions of Windows 10 earlier than version 1709, you can [create AppLocker rules](lock-down-windows-10-applocker.md) to configure a multi-app kiosk.
@@ -36,6 +40,10 @@ Process:
2. [Add XML file to provisioning package](#add-xml)
3. [Apply provisioning package to device](#apply-ppkg)
+Watch how to use a provisioning package to configure a multi-app kiosk.
+
+>[!VIDEO https://www.microsoft.com/videoplayer/embed/fa125d0f-77e4-4f64-b03e-d634a4926884?autoplay=false]
+
If you don't want to use a provisioning package, you can deploy the configuration XML file using [mobile device management (MDM)](#alternate-methods) or you can configure assigned access using the [MDM Bridge WMI Provider](#bridge).
## Prerequisites
@@ -111,7 +119,7 @@ The profile **Id** is a GUID attribute to uniquely identify the profile. You can
Based on the purpose of the kiosk device, define the list of applications that are allowed to run. This list can contain both UWP apps and desktop apps. When the mult-app kiosk configuration is applied to a device, AppLocker rules will be generated to allow the apps that are listed in the configuration.
>[!NOTE]
->You cannot manage AppLocker rules that are generated by the multi-app kiosk configuration in [MMC snap-ins](https://technet.microsoft.com/library/hh994629.aspx#BKMK_Using_Snapins). Avoid applying AppLocker rules to devices running the multi-app kiosk configuration.
+>You cannot manage AppLocker rules that are generated by the multi-app kiosk configuration in [MMC snap-ins](https://technet.microsoft.com/library/hh994629.aspx#BKMK_Using_Snapins). Avoid creating AppLocker rules that conflict with AppLocker rules that are generated by the multi-app kiosk configuration.
- For UWP apps, you need to provide the App User Model ID (AUMID). [Learn how to get the AUMID](https://go.microsoft.com/fwlink/p/?LinkId=614867), or [get the AUMID from the Start Layout XML](#startlayout).
- For desktop apps, you need to specify the full path of the executable, which can contain one or more system environment variables in the form of %variableName% (i.e. %systemroot%, %windir%).
diff --git a/windows/configuration/lockdown-features-windows-10.md b/windows/configuration/lockdown-features-windows-10.md
index 1477240276..c52043f754 100644
--- a/windows/configuration/lockdown-features-windows-10.md
+++ b/windows/configuration/lockdown-features-windows-10.md
@@ -9,6 +9,7 @@ ms.sitesec: library
ms.pagetype: security
author: jdeckerms
ms.localizationpriority: high
+ms.date: 07/27/2017
---
# Lockdown features from Windows Embedded 8.1 Industry
diff --git a/windows/configuration/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/configuration/manage-connections-from-windows-operating-system-components-to-microsoft-services.md
index 4212f120c4..a34a6aa5a7 100644
--- a/windows/configuration/manage-connections-from-windows-operating-system-components-to-microsoft-services.md
+++ b/windows/configuration/manage-connections-from-windows-operating-system-components-to-microsoft-services.md
@@ -9,7 +9,7 @@ ms.sitesec: library
ms.localizationpriority: high
author: brianlic-msft
ms.author: brianlic-msft
-ms.date: 11/21/2017
+ms.date: 01/29/2018
---
# Manage connections from Windows operating system components to Microsoft services
@@ -19,20 +19,18 @@ ms.date: 11/21/2017
- Windows 10
- Windows Server 2016
-If you're looking for content on what each telemetry level means and how to configure it in your organization, see [Configure Windows telemetry in your organization](configure-windows-telemetry-in-your-organization.md).
+If you're looking for content on what each diagnostic data level means and how to configure it in your organization, see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md).
Learn about the network connections that Windows components make to Microsoft and also the privacy settings that affect data that is shared with either Microsoft or apps and how they can be managed by an IT Pro.
-If you want to minimize connections from Windows to Microsoft services, or configure particular privacy settings, this article covers the settings that you could consider. You can configure telemetry at the lowest level for your edition of Windows, and also evaluate which other connections Windows makes to Microsoft services you want to turn off in your environment from the list in this article.
+If you want to minimize connections from Windows to Microsoft services, or configure particular privacy settings, this article covers the settings that you could consider. You can configure diagnostic data at the lowest level for your edition of Windows, and also evaluate which other connections Windows makes to Microsoft services you want to turn off in your environment from the list in this article.
-You can configure telemetry at the Security level, turn off Windows Defender telemetry and MSRT reporting, and turn off all other connections to Microsoft network endpoints as described in this article to help prevent Windows from sending any data to Microsoft. There are many reasons why these communications are enabled by default, such as updating malware definitions and maintain current certificate revocation lists, which is why we strongly recommend against this. This data helps us deliver a secure, reliable, and more delightful personalized experience.
+You can configure diagnostic data at the Security level, turn off Windows Defender diagnostic data and MSRT reporting, and turn off all other connections to Microsoft network endpoints as described in this article to help prevent Windows from sending any data to Microsoft. There are many reasons why these communications are enabled by default, such as updating malware definitions and maintain current certificate revocation lists, which is why we strongly recommend against this. This data helps us deliver a secure, reliable, and more delightful personalized experience.
To help make it easier to deploy settings to restrict connections from Windows 10 to Microsoft, you can apply the [Windows Restricted Traffic Limited Functionality Baseline](https://go.microsoft.com/fwlink/?linkid=828887). This baseline was created in the same way as the [Windows security baselines](/windows/device-security/windows-security-baselines) that are often used to efficiently configure Windows to a known secure state. Running the Windows Restricted Traffic Limited Functionality Baseline on devices in your organization will allow you to quickly configure all of the settings covered in this document. However, some of the settings reduce the functionality and security configuration of your device and are therefore not recommended. Make sure should you've chosen the right settings configuration for your environment before applying. You should not extract this package to the windows\\system32 folder because it will not apply correctly. Applying this baseline is equivalent to applying the Windows 10 steps covered in this article.
We are always striving to improve our documentation and welcome your feedback. You can provide feedback by contacting telmhelp@microsoft.com.
-Not finding content you need? Windows 10 users, tell us what you want on [Feedback Hub](feedback-hub://?referrer=techDocsUcPage&tabid=2&contextid=897&newFeedback=true&topic=manage-connections-from-windows-operating-system-components-to-microsoft-services.md).
-
## What's new in Windows 10, version 1709
Here's a list of changes that were made to this article for Windows 10, version 1709:
@@ -68,10 +66,10 @@ Here's a list of changes that were made to this article for Windows 10, version
- Accounts: Block Microsoft Accounts
- Do not use diagnostic data for tailored experiences
-## Settings
+## Management options for each setting
-The following sections list the components that make network connections to Microsoft services by default. You can configure these settings to control the data that is sent to Microsoft. To prevent Windows from sending any data to Microsoft, configure telemetry at the Security level, turn off Windows Defender telemetry and MSRT reporting, and turn off all of these connections.
+The following sections list the components that make network connections to Microsoft services by default. You can configure these settings to control the data that is sent to Microsoft. To prevent Windows from sending any data to Microsoft, configure diagnostic data at the Security level, turn off Windows Defender diagnostic data and MSRT reporting, and turn off all of these connections.
If you're running Windows 10, they will be included in the next update for the Long Term Servicing Branch.
@@ -184,7 +182,7 @@ See the following table for a summary of the management settings for Windows Ser
| [21. Teredo](#bkmk-teredo) | |  |
| [28. Windows Update](#bkmk-wu) |  | |
-## Settings
+## How to configure each setting
Use the following sections for more information about how to configure each setting.
@@ -359,9 +357,12 @@ If you're running Windows 10, version 1507 or Windows 10, version 1511, create a
### 7. Insider Preview builds
The Windows Insider Preview program lets you help shape the future of Windows, be part of the community, and get early access to releases of Windows 10.
+This setting stops communication with the Windows Insider Preview service that checks for new builds.
+Windows Insider Preview builds only apply to Windows 10 and are not available for Windows Server 2016.
+
> [!NOTE]
-> This setting stops communication with the Windows Insider Preview service that checks for new builds. Windows Insider Preview builds only apply to Windows 10 and are not available for Windows Server 2016.
+> If you upgrade a device that is configured to minimize connections from Windows to Microsoft services (that is, a device configured for zero exhaust) to a Windows Insider Preview build, the Feedback & Diagnostic setting will automatically be set to **Full**. Although the diagnostic data level may initially appear as **Basic**, a few hours after the UI is refreshed or the machine is rebooted, the setting will become **Full**.
To turn off Insider Preview builds for a released version of Windows 10:
@@ -521,6 +522,7 @@ Find the Microsoft Edge Group Policy objects under **Computer Configuration** &g
| Policy | Description |
|------------------------------------------------------|-----------------------------------------------------------------------------------------------------|
+| Allow configuration updates for the Books Library | Choose whether configuration updates are done for the Books Library. Default: Not configured |
| Configure Autofill | Choose whether employees can use autofill on websites. Default: Enabled |
| Configure Do Not Track | Choose whether employees can send Do Not Track headers. Default: Disabled |
| Configure Password Manager | Choose whether employees can save passwords locally on their devices. Default: Enabled |
@@ -547,7 +549,8 @@ Alternatively, you can configure the Microsoft Group Policies using the followin
| Policy | Registry path |
| - | - |
-| Configure Autofill | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Main!Use FormSuggest REG_SZ: **no** |
+| Allow configuration updates for the Books Library | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\BooksLibrary!AllowConfigurationUpdateForBooksLibrary REG_DWORD: **0** |
+| Configure Autofill | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Main!Use FormSuggest REG_SZ: **no** |
| Configure Do Not Track | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Main!DoNotTrack REG_DWORD: 1 |
| Configure Password Manager | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Main!FormSuggest Passwords REG_SZ: **no** |
| Configure search suggestions in Address bar | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\SearchScopes!ShowSearchSuggestionsGlobal REG_DWORD: 0|
@@ -577,7 +580,7 @@ For a complete list of the Microsoft Edge policies, see [Available policies for
Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to http://www.msftconnecttest.com/connecttest.txt to determine if the device can communicate with the Internet. For more info about NCSI, see [The Network Connection Status Icon](http://blogs.technet.com/b/networking/archive/2012/12/20/the-network-connection-status-icon.aspx).
-In versions of Windows 10 prior to Windows 10, version 1607 and Windows Server 2016, the URL was http://www.msftncsi.com.
+In versions of Windows 10 prior to Windows 10, version 1607 and Windows Server 2016, the URL was [http://www.msftncsi.com]().
You can turn off NCSI by doing one of the following:
@@ -883,7 +886,7 @@ To turn off **Turn on SmartScreen Filter to check web content (URLs) that Micros
To turn off **Send Microsoft info about how I write to help us improve typing and writing in the future**:
> [!NOTE]
-> If the telemetry level is set to either **Basic** or **Security**, this is turned off automatically.
+> If the diagnostic data level is set to either **Basic** or **Security**, this is turned off automatically.
@@ -1722,7 +1725,7 @@ For Windows 10 only, you can stop Enhanced Notifications:
- Turn off the feature in the UI.
-You can also use the registry to turn off Malicious Software Reporting Tool telemetry by setting the REG\_DWORD value **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\MRT\\DontReportInfectionInformation** to 1.
+You can also use the registry to turn off Malicious Software Reporting Tool diagnostic data by setting the REG\_DWORD value **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\MRT\\DontReportInfectionInformation** to 1.
### 24. Windows Media Player
@@ -1799,7 +1802,10 @@ For more info, see [Windows Spotlight on the lock screen](windows-spotlight.md).
### 26. Microsoft Store
-You can turn off the ability to launch apps from the Microsoft Store that were preinstalled or downloaded. This will also turn off automatic app updates, and the Microsoft Store will be disabled. On Windows Server 2016, this will block Microsoft Store calls from Universal Windows Apps.
+You can turn off the ability to launch apps from the Microsoft Store that were preinstalled or downloaded.
+This will also turn off automatic app updates, and the Microsoft Store will be disabled.
+In addition, new email accounts cannot be created by clicking **Settings** > **Accounts** > **Email & app accounts** > **Add an account**.
+On Windows Server 2016, this will block Microsoft Store calls from Universal Windows Apps.
- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Store** > **Disable all apps from Microsoft Store**.
diff --git a/windows/configuration/manage-tips-and-suggestions.md b/windows/configuration/manage-tips-and-suggestions.md
index 39f2e28ac0..6d5acafa78 100644
--- a/windows/configuration/manage-tips-and-suggestions.md
+++ b/windows/configuration/manage-tips-and-suggestions.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: devices
author: jdeckerms
ms.localizationpriority: high
+ms.date: 09/20/2017
---
# Manage Windows 10 and Microsoft Store tips, tricks, and suggestions
diff --git a/windows/configuration/manage-wifi-sense-in-enterprise.md b/windows/configuration/manage-wifi-sense-in-enterprise.md
index d66b267355..9cb8223eed 100644
--- a/windows/configuration/manage-wifi-sense-in-enterprise.md
+++ b/windows/configuration/manage-wifi-sense-in-enterprise.md
@@ -9,6 +9,7 @@ ms.sitesec: library
ms.pagetype: mobile
author: eross-msft
ms.localizationpriority: medium
+ms.date: 07/27/2017
---
# Manage Wi-Fi Sense in your company
diff --git a/windows/configuration/manage-windows-endpoints-version-1709.md b/windows/configuration/manage-windows-endpoints-version-1709.md
new file mode 100644
index 0000000000..1c52da910b
--- /dev/null
+++ b/windows/configuration/manage-windows-endpoints-version-1709.md
@@ -0,0 +1,762 @@
+---
+title: Windows 10 connection endpoints
+description: Explains what Windows 10 endpoints are used for, how to turn off traffic to them, and the impact.
+keywords: privacy, manage connections to Microsoft, Windows 10, Windows Server 2016
+ms.prod: w10
+ms.mktglfcycl: manage
+ms.sitesec: library
+ms.localizationpriority: high
+author: brianlic-msft
+ms.author: brianlic-msft
+ms.date: 11/21/2017
+---
+# Manage Windows 10 connection endpoints
+
+**Applies to**
+
+- Windows 10, version 1709
+
+Some Windows components, app, and related services transfer data to Microsoft network endpoints. Some examples include:
+
+- Connecting to Microsoft Office and Windows sites to download the latest app and security updates.
+- Connecting to email servers to send and receive email.
+- Connecting to the web for every day web browsing.
+- Connecting to the cloud to store and access backups.
+- Using your location to show a weather forecast.
+
+This article lists different endpoints that are available on a clean installation of Windows 10 Enterprise, version 1709.
+Details about the different ways to control traffic to these endpoints are covered in [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md).
+Where applicable, each endpoint covered in this topic includes a link to specific details about how to control traffic to it.
+
+We used the following methodology to derive these network endpoints:
+
+1. Set up Windows 10 Enterprise, version 1709 test virtual machine using the default settings.
+2. Leave the devices running idle for a week (that is, a user is not interacting with the system/device).
+3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic.
+4. Compile reports on traffic going to public IP addresses.
+5. The test virtual machine was logged in using a local account and was not joined to a domain or Azure Active Directory.
+
+> [!NOTE]
+> Microsoft uses global load balancers that can appear in network trace-routes. For example, an endpoint for *.akadns.net might be used to load balance requests to an Azure datacenter, which can change over time.
+
+## Apps
+
+The following endpoint is used to download updates to the Weather app Live Tile.
+If you [turn off traffic to this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#live-tiles), no Live Tiles will be updated.
+
+| Source process | Protocol | Destination |
+|----------------|----------|------------|
+| explorer | HTTP | tile-service.weather.microsoft.com/en-US/livetile/preinstall?region=US&appid=C98EA5B0842DBB9405BBF071E1DA76512D21FE36&FORM=Threshold |
+
+The following endpoint is used for OneNote Live Tile.
+To turn off traffic for this endpoint, either uninstall OneNote or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore).
+If you disable the Microsoft store, other Store apps cannot be installed or updated.
+Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.
+
+| Source process | Protocol | Destination |
+|----------------|----------|------------|
+| | HTTPS | cdn.onenote.net/livetile/?Language=en-US |
+
+The following endpoints are used for Twitter updates.
+To turn off traffic for these endpoints, either uninstall Twitter or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore).
+If you disable the Microsoft store, other Store apps cannot be installed or updated.
+Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.
+
+| Source process | Protocol | Destination |
+|----------------|----------|------------|
+| | HTTPS | wildcard.twimg.com |
+| svchost.exe | | oem.twimg.com/windows/tile.xml |
+
+The following endpoint is used for Facebook updates.
+To turn off traffic for this endpoint, either uninstall Facebook or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore).
+If you disable the Microsoft store, other Store apps cannot be installed or updated.
+Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.
+
+| Source process | Protocol | Destination |
+|----------------|----------|------------|
+| | | star-mini.c10r.facebook.com |
+
+The following endpoint is used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office Online.
+To turn off traffic for this endpoint, either uninstall the Photos app or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore).
+If you disable the Microsoft store, other Store apps cannot be installed or updated.
+Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.
+
+| Source process | Protocol | Destination |
+|----------------|----------|------------|
+| WindowsApps\Microsoft.Windows.Photos | HTTPS | evoke-windowsservices-tas.msedge.net |
+
+The following endpoint is used for Candy Crush Saga updates.
+To turn off traffic for this endpoint, either uninstall Candy Crush Saga or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore).
+If you disable the Microsoft store, other Store apps cannot be installed or updated.
+Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.
+
+| Source process | Protocol | Destination |
+|----------------|----------|------------|
+| | TLS v1.2 | candycrushsoda.king.com |
+
+The following endpoint is used for by the Microsoft Wallet app.
+To turn off traffic for this endpoint, either uninstall the Wallet app or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore).
+If you disable the Microsoft store, other Store apps cannot be installed or updated.
+Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.
+
+| Source process | Protocol | Destination |
+|----------------|----------|------------|
+| system32\AppHostRegistrationVerifier.exe | HTTPS | wallet.microsoft.com |
+
+The following endpoint is used by the Groove Music app for update HTTP handler status.
+If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-apps-for-websites), apps for websites won't work and customers who visit websites (such as mediaredirect.microsoft.com) that are registered with their associated app (such as Groove Music) will stay at the website and won't be able to directly launch the app.
+
+| Source process | Protocol | Destination |
+|----------------|----------|------------|
+| system32\AppHostRegistrationVerifier.exe | HTTPS | mediaredirect.microsoft.com |
+
+## Cortana and Search
+
+The following endpoint is used to get images that are used for Microsoft Store suggestions.
+If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana), you will block images that are used for Microsoft Store suggestions.
+
+| Source process | Protocol | Destination |
+|----------------|----------|------------|
+| searchui | HTTPS | store-images.s-microsoft.com/image/apps.32524.9007199266244048.fc51fce8-175a-4525-b569-14d91f7779c3.0a720951-38e4-4e81-9804-03f833ab1d2e?format=source |
+
+The following endpoint is used to update Cortana greetings, tips, and Live Tiles.
+If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana), you will block updates to Cortana greetings, tips, and Live Tiles.
+
+| Source process | Protocol | Destination |
+|----------------|----------|------------|
+| backgroundtaskhost | HTTPS | www.bing.com/client/config?cc=US&setlang=en-US |
+
+The following endpoint is used to configure parameters, such as how often the Live Tile is updated. It's also used to activate experiments.
+If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana), parameters would not be updated and the device would no longer participate in experiments.
+
+| Source process | Protocol | Destination |
+|----------------|----------|------------|
+| backgroundtaskhost | HTTPS | www.bing.com/proactive/v2/spark?cc=US&setlang=en-US |
+
+The following endpoint is used by Cortana to report diagnostic and diagnostic data information.
+If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana), Microsoft won't be aware of issues with Cortana and won't be able to fix them.
+
+| Source process | Protocol | Destination |
+|----------------|----------|------------|
+| searchui backgroundtaskhost | HTTPS | www.bing.com/threshold/xls.aspx |
+
+## Certificates
+
+The following endpoint is used by the Automatic Root Certificates Update component to automatically check the list of trusted authorities on Windows Update to see if an update is available. It is possible to [turn off traffic to this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update), but that is not recommended because when root certificates are updated over time, applications and websites may stop working because they did not receive an updated root certificate the application uses.
+
+| Source process | Protocol | Destination |
+|----------------|----------|------------|
+| svchost | HTTP | ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?1ba0e83cae791f0d |
+
+The following endpoints are used to download certificates that are publicly known to be fraudulent.
+These settings are critical for both Windows security and the overall security of the Internet.
+We do not recommend blocking this endpoint.
+If traffic to this endpoint is turned off, Windows no longer automatically downloads certificates known to be fraudulent, which increases the attack vector on the device.
+
+| Source process | Protocol | Destination |
+|----------------|----------|------------|
+| svchost | HTTP | ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?03376e5589b4a188 |
+
+## Device authentication
+
+The following endpoint is used to authenticate a device.
+If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback), the device will not be authenticated.
+
+| Source process | Protocol | Destination |
+|----------------|----------|------------|
+| | HTTPS | login.live.com/ppsecure/deviceaddcredential.srf |
+
+## Device metadata
+
+The following endpoint is used to retrieve device metadata.
+If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-devinst), metadata will not be updated for the device.
+
+| Source process | Protocol | Destination |
+|----------------|----------|------------|
+| | | dmd.metaservices.microsoft.com.akadns.net |
+
+## Diagnostic Data
+
+The following endpoint is used by the Connected User Experiences and Telemetry component and connects to the Microsoft Data Management service.
+If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback), diagnostic and usage information, which helps Microsoft find and fix problems and improve our products and services, will not be sent back to Microsoft.
+
+| Source process | Protocol | Destination |
+|----------------|----------|------------|
+| svchost | | cy2.vortex.data.microsoft.com.akadns.net |
+
+The following endpoint is used by the Connected User Experiences and Telemetry component and connects to the Microsoft Data Management service.
+If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback), diagnostic and usage information, which helps Microsoft find and fix problems and improve our products and services, will not be sent back to Microsoft.
+
+| Source process | Protocol | Destination |
+|----------------|----------|------------|
+| svchost | | v10.vortex-win.data.microsoft.com/collect/v1 |
+
+The following endpoints are used by Windows Error Reporting.
+To turn off traffic for these endpoints, enable the following Group Policy: Administrative Templates > Windows Components > Windows Error Reporting > Disable Windows Error Reporting. This means error reporting information will not be sent back to Microsoft.
+
+| Source process | Protocol | Destination |
+|----------------|----------|------------|
+| wermgr | | watson.telemetry.microsoft.com/Telemetry.Request |
+| |TLS v1.2 |modern.watson.data.microsoft.com.akadns.net|
+
+## Font streaming
+
+The following endpoints are used to download fonts on demand.
+If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#font-streaming), you will not be able to download fonts on demand.
+
+| Source process | Protocol | Destination |
+|----------------|----------|------------|
+| svchost | | fs.microsoft.com |
+| | | fs.microsoft.com/fs/windows/config.json |
+
+## Licensing
+
+The following endpoint is used for online activation and some app licensing.
+To turn off traffic for this endpoint, disable the Windows License Manager Service. This will also block online activation and app licensing may not work.
+
+| Source process | Protocol | Destination |
+|----------------|----------|------------|
+| licensemanager | HTTPS | licensing.mp.microsoft.com/v7.0/licenses/content |
+
+## Location
+
+The following endpoint is used for location data.
+If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-location), apps cannot use location data.
+
+| Source process | Protocol | Destination |
+|----------------|----------|------------|
+| | HTTP | location-inference-westus.cloudapp.net |
+
+## Maps
+
+The following endpoint is used to check for updates to maps that have been downloaded for offline use.
+If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-offlinemaps), offline maps will not be updated.
+
+| Source process | Protocol | Destination |
+|----------------|----------|------------|
+| svchost | HTTPS | *g.akamaiedge.net |
+
+## Microsoft account
+
+The following endpoints are used for Microsoft accounts to sign in.
+If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-microsoft-account), users cannot sign in with Microsoft accounts.
+
+| Source process | Protocol | Destination |
+|----------------|----------|------------|
+| | | login.msa.akadns6.net |
+| system32\Auth.Host.exe | HTTPS | auth.gfx.ms |
+
+## Microsoft Store
+
+The following endpoint is used for the Windows Push Notification Services (WNS). WNS enables third-party developers to send toast, tile, badge, and raw updates from their own cloud service. This provides a mechanism to deliver new updates to your users in a power-efficient and dependable way.
+If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#live-tiles), push notifications will no longer work, including MDM device management, mail synchronization, settings synchronization.
+
+| Source process | Protocol | Destination |
+|----------------|----------|------------|
+| | | *.wns.windows.com |
+
+The following endpoint is used to revoke licenses for malicious apps in the Microsoft Store.
+To turn off traffic for this endpoint, either uninstall the app or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). If you disable the Microsoft store, other Microsoft Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them.
+
+| Source process | Protocol | Destination |
+|----------------|----------|------------|
+| | HTTP | storecatalogrevocation.storequality.microsoft.com/applications/revoked.json/ |
+
+The following endpoints are used to download image files that are called when applications run (Microsoft Store or Inbox MSN Apps).
+If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore), the image files won't be downloaded, and apps cannot be installed or updated from the Microsoft Store. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them.
+
+| Source process | Protocol | Destination |
+|----------------|----------|------------|
+| | HTTPS | img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1ARmA?ver=e6f4 |
+| | HTTPS | img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RWbW71?ver=c090 |
+
+The following endpoints are used to communicate with Microsoft Store.
+If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore), apps cannot be installed or updated from the Microsoft Store. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them.
+
+| Source process | Protocol | Destination |
+|----------------|----------|------------|
+| | HTTP | storeedgefd.dsx.mp.microsoft.com |
+| | HTTP | pti.store.microsoft.com |
+||TLS v1.2|cy2.\*.md.mp.microsoft.com.\*.|
+
+## Network Connection Status Indicator (NCSI)
+
+Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to this endpoint to determine if the device can communicate with the Internet.
+If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-ncsi), NCSI won't be able to determine if the device is connected to the Internet and the network status tray icon will show a warning.
+
+| Source process | Protocol | Destination |
+|----------------|----------|------------|
+| | HTTP | www.msftconnecttest.com/connecttest.txt |
+
+## Office
+
+The following endpoints are used to connect to the Office 365 portal's shared infrastructure, including Office Online. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US#BKMK_Portal-identity).
+You can turn this off by removing all Microsoft Office apps and the Mail and Calendar apps.
+If you turn off traffic for these endpoints, users won't be able to save documents to the cloud or see their recently used documents.
+
+| Source process | Protocol | Destination |
+|----------------|----------|------------|
+| | | *.a-msedge.net |
+| hxstr | | *.c-msedge.net |
+| | | *.e-msedge.net |
+| | | *.s-msedge.net |
+
+The following endpoint is used to connect to the Office 365 portal's shared infrastructure, including Office Online. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US#BKMK_Portal-identity).
+You can turn this off by removing all Microsoft Office apps and the Mail and Calendar apps.
+If you turn off traffic for this endpoint, users won't be able to save documents to the cloud or see their recently used documents.
+
+| Source process | Protocol | Destination |
+|----------------|----------|------------|
+| hxstr | | *.c-msedge.net |
+
+The following endpoint is used to connect to the Office 365 portal's shared infrastructure, including Office Online. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US#BKMK_Portal-identity).
+You can turn this off by removing all Microsoft Office apps and the Mail and Calendar apps.
+If you turn off traffic for these endpoints, users won't be able to save documents to the cloud or see their recently used documents.
+
+| Source process | Protocol | Destination |
+|----------------|----------|------------|
+| system32\Auth.Host.exe | HTTPS | outlook.office365.com |
+
+The following endpoint is OfficeHub traffic used to get the metadata of Office apps. To turn off traffic for this endpoint, either uninstall the app or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). If you disable the Microsoft store, other Microsoft Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them.
+ently used documents.
+
+| Source process | Protocol | Destination |
+|----------------|----------|------------|
+|Windows Apps\Microsoft.Windows.Photos|HTTPS|client-office365-tas.msedge.net|
+
+## OneDrive
+
+The following endpoint is a redirection service that’s used to automatically update URLs.
+If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-onedrive), anything that relies on g.live.com to get updated URL information will no longer work.
+
+| Source process | Protocol | Destination |
+|----------------|----------|------------|
+| onedrive | HTTP | g.live.com/1rewlive5skydrive/ODSUProduction |
+
+
+The following endpoint is a redirection service that’s used to automatically update URLs.
+If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-onedrive), anything that relies on g.live.com to get updated URL information will no longer work.
+
+| Source process | Protocol | Destination |
+|----------------|----------|------------|
+| onedrive | HTTPS | g.live.com/1rewlive5skydrive/OneDriveProduction?OneDriveUpdate=1303f1898483a527eab1d8f57af6 |
+
+The following endpoint is used by OneDrive for Business to download and verify app updates. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US).
+To turn off traffic for this endpoint, uninstall OneDrive for Business. In this case, your device will not able to get OneDrive for Business app updates.
+
+| Source process | Protocol | Destination |
+|----------------|----------|------------|
+| onedrive | HTTPS | oneclient.sfx.ms/PreSignInSettings/Prod/PreSignInSettingsConfig.json?OneDriveUpdate=3253474af747a19de2a72deb9a75 |
+
+## Settings
+
+The following endpoint is used as a way for apps to dynamically update their configuration. Apps such as System Initiated User Feedback and the Xbox app use it.
+If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback), an app that uses this endpoint may stop working.
+
+| Source process | Protocol | Destination |
+|----------------|----------|------------|
+| dmclient | | cy2.settings.data.microsoft.com.akadns.net |
+
+The following endpoint is used as a way for apps to dynamically update their configuration. Apps such as System Initiated User Feedback and the Xbox app use it.
+If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback), an app that uses this endpoint may stop working.
+
+| Source process | Protocol | Destination |
+|----------------|----------|------------|
+| dmclient | HTTPS | settings.data.microsoft.com |
+
+The following endpoint is used as a way for apps to dynamically update their configuration. Apps such as Windows Connected User Experiences and Telemetry component and Windows Insider Program use it.
+If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback), an app that uses this endpoint may stop working.
+
+| Source process | Protocol | Destination |
+|----------------|----------|------------|
+| svchost | HTTPS | settings-win.data.microsoft.com |
+
+## Skype
+
+The following endpoint is used to retrieve Skype configuration values. To turn off traffic for this endpoint, either uninstall the app or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). If you disable the Microsoft store, other Microsoft Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them.
+
+| Source process | Protocol | Destination |
+|----------------|----------|------------|
+|microsoft.windowscommunicationsapps.exe | HTTPS | config.edge.skype.com |
+
+
+
+## Windows Defender
+
+The following endpoint is used for Windows Defender when Cloud-based Protection is enabled.
+If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-defender), the device will not use Cloud-based Protection.
+
+| Source process | Protocol | Destination |
+|----------------|----------|------------|
+| | | wdcp.microsoft.com |
+
+The following endpoints are used for Windows Defender definition updates.
+If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-defender), definitions will not be updated.
+
+| Source process | Protocol | Destination |
+|----------------|----------|------------|
+| | | definitionupdates.microsoft.com |
+|MpCmdRun.exe|HTTPS|go.microsoft.com|
+
+## Windows Insider Preview builds
+
+The following endpoint is used to retrieve Windows Insider Preview builds.
+If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-previewbuilds), the device will not be notified about new Windows Insider Preview builds.
+
+| Source process | Protocol | Destination |
+|----------------|----------|------------|
+| | HTTPS | insiderppe.cloudapp.net/windows-app-web-link |
+
+## Windows Spotlight
+
+The following endpoints are used to retrieve Windows Spotlight metadata that describes content, such as references to image locations, as well as suggested apps, Microsoft account notifications, and Windows tips.
+If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-spotlight), Windows Spotlight will still try to deliver new lock screen images and updated content but it will fail; suggested apps, Microsoft account notifications, and Windows tips will not be downloaded. For more information, see [Windows Spotlight](windows-spotlight.md).
+
+| Source process | Protocol | Destination |
+|----------------|----------|------------|
+| backgroundtaskhost | HTTPS | arc.msn.com |
+| backgroundtaskhost | | g.msn.com.nsatc.net |
+| |TLS v1.2| *.search.msn.com |
+| | HTTPS | ris.api.iris.microsoft.com/v1/a/impression?CID=116000000000270658®ion=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=ENTERPRISE&cmdVer=10.0.15063.0&mo=&cap=&EID=&&PID=400051553&UIT=G&TargetID=700090861&AN=275357688&PG=PC000P0FR5.0000000G4I&REQASID=D17E3C737583496F8C4CE6553F7395C5&UNID=202914&ANID=&MUID=&ASID=a81b259b93e2425e801d0bb5a5ec2741&PERSID=&AUID=71FA96C64367722E210169966CE8D919&TIME=20170721T015831Z |
+| | HTTPS | query.prod.cms.rt.microsoft.com/cms/api/am/binary/RWaHxi |
+| | HTTPS | query.prod.cms.rt.microsoft.com/cms/api/am/binary/RWaML4 |
+
+## Windows Update
+
+The following endpoint is used for Windows Update downloads of apps and OS updates, including HTTP downloads or HTTP downloads blended with peers.
+If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-updates), Windows Update downloads will not be managed, as critical metadata that is used to make downloads more resilient is blocked. Downloads may be impacted by corruption (resulting in re-downloads of full files). Additionally, downloads of the same update by multiple devices on the same local network will not use peer devices for bandwidth reduction.
+
+| Source process | Protocol | Destination |
+|----------------|----------|------------|
+| svchost | HTTPS | *.prod.do.dsp.mp.microsoft.com |
+
+The following endpoints are used to download operating system patches and updates.
+If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-wu), the device will not be able to download updates for the operating system.
+
+| Source process | Protocol | Destination |
+|----------------|----------|------------|
+| svchost | | au.download.windowsupdate.com |
+| svchost | HTTP | *.windowsupdate.com |
+| | HTTP | fg.download.windowsupdate.com.c.footprint.net |
+
+The following endpoint is used by the Highwinds Content Delivery Network to perform Windows updates.
+If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-wu), the device will not perform updates.
+
+| Source process | Protocol | Destination |
+|----------------|----------|------------|
+| | | cds.d2s7q6s2.hwcdn.net |
+
+The following endpoints are used by the Verizon Content Delivery Network to perform Windows updates.
+If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-wu), the device will not perform updates.
+
+| Source process | Protocol | Destination |
+|----------------|----------|------------|
+| | HTTP | *wac.phicdn.net |
+| | | *wac.edgecastcdn.net |
+
+The following endpoint is used to download apps and Windows Insider Preview builds from the Microsoft Store. Time Limited URL (TLU) is a mechanism for protecting the content. For example, it prevents someone from copying the URL and then getting access to the app that the person has not acquired).
+If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-wu), the updating functionality on this device is essentially in a disabled state, resulting in user unable to get apps from the Store, get latest version of Windows, and so on.
+
+| Source process | Protocol | Destination |
+|----------------|----------|------------|
+| svchost | | *.tlu.dl.delivery.mp.microsoft.com.c.footprint.net |
+
+The following endpoint is used to download apps from the Microsoft Store. It's used as part of calculating the right ranges for apps.
+If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-wu), users of the device will not able to get apps from the Microsoft Store.
+
+| Source process | Protocol | Destination |
+|----------------|----------|------------|
+| svchost | | emdl.ws.microsoft.com/emdl/c/doc/ph/prod1/msdownload/update/software/defu/2017/07/1024/am_base_82267ed19fb382d07106d5f64257fb815c664b31.exe.json |
+
+The following endpoints enable connections to Windows Update, Microsoft Update, and the online services of the Store.
+If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-wu), the device will not be able to connect to Windows Update and Microsoft Update to help keep the device secure. Also, the device will not be able to acquire and update apps from the Store.
+
+| Source process | Protocol | Destination |
+|----------------|----------|------------|
+| svchost | HTTPS | fe2.update.microsoft.com/v6/ClientWebService/client.asmx |
+| svchost | | fe3.delivery.mp.microsoft.com/ClientWebService/client.asmx |
+| | | fe3.delivery.dsp.mp.microsoft.com.nsatc.net (an alias for fe3.delivery.mp.microsoft.com) |
+| svchost | HTTPS | sls.update.microsoft.com |
+
+The following endpoint is used for content regulation.
+If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-wu), the Windows Update Agent will be unable to contact the endpoint and fallback behavior will be used. This may result in content being either incorrectly downloaded or not downloaded at all.
+
+| Source process | Protocol | Destination |
+|----------------|----------|------------|
+| svchost | HTTPS | tsfe.trafficshaping.dsp.mp.microsoft.com |
+
+The following endpoints are used to download content.
+If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-wu), you will block any content from being downloaded.
+
+| Source process | Protocol | Destination |
+|----------------|----------|------------|
+| | | a122.dscd.akamai.net |
+| | | a1621.g.akamai.net |
+
+## Microsoft forward link redirection service (FWLink)
+
+The following endpoint is used by the Microsoft forward link redirection service (FWLink) to redirect permanent web links to their actual, sometimes transitory, URL. FWlinks are similar to URL shorteners, just longer.
+
+If you disable this endpoint, Windows Defender won't be able to update its malware definitions; links from Windows and other Microsoft products to the Web won't work; and PowerShell updateable Help won't update. To disable the traffic, instead disable the traffic that's getting forwarded.
+
+| Source process | Protocol | Destination |
+|----------------|----------|------------|
+|Various|HTTPS|go.microsoft.com|
+
+## Endpoints for other Windows editions
+
+In addition to the endpoints listed for Windows 10 Enterprise, the following endpoints are available on other editions of Windows 10, version 1709.
+
+## Windows 10 Home
+
+| **Destination** | **Protocol** | **Description** |
+| --- | --- | --- |
+| *.tlu.dl.delivery.mp.microsoft.com.c.footprint.net | HTTP | Enables connections to Windows Update. |
+| *.wac.phicdn.net | HTTP | Used by the Verizon Content Delivery Network to perform Windows updates. |
+| *.1.msftsrvcs.vo.llnwi.net | HTTP | Used for Windows Update downloads of apps and OS updates. |
+| *.c-msedge.net | HTTP | Used by OfficeHub to get the metadata of Office apps. |
+| *.delivery.dsp.mp.microsoft.com.nsatc.net | TLSv1.2 | Enables connections to Windows Update. |
+| *.dscd.akamai.net | HTTP | Used to download content. |
+| *.dspg.akamaiedge.net | HTTP | Used to check for updates to maps that have been downloaded for offline use. |
+| *.hwcdn.net | HTTP | Used by the Highwinds Content Delivery Network to perform Windows updates. |
+| *.m1-msedge.net | TLSv1.2 | Used by OfficeHub to get the metadata of Office apps. |
+| *.search.msn.com | TLSv1.2 | Used to retrieve Windows Spotlight metadata. |
+| *.wac.edgecastcdn.net | TLSv1.2 | Used by the Verizon Content Delivery Network to perform Windows updates. |
+| *.wns.windows.com | TLSv1.2 | Used for the Windows Push Notification Services (WNS). |
+| *prod.do.dsp.mp.microsoft.com | TLSv1.2/
+HTTPS | Used for Windows Update downloads of apps and OS updates. |
+| .g.akamaiedge.net | HTTP | Used to check for updates to maps that have been downloaded for offline use. |
+| telecommand.telemetry.microsoft.com | HTTPS | Used by Windows Error Reporting. |
+| 2.dl.delivery.mp.microsoft.com | HTTP | Enables connections to Windows Update. |
+| 2.tlu.dl.delivery.mp.microsoft.com | HTTP | Enables connections to Windows Update. |
+| arc.msn.com | HTTPS | Used to retrieve Windows Spotlight metadata. |
+| arc.msn.com.nsatc.net | TLSv1.2 | Used to retrieve Windows Spotlight metadata. |
+| a-ring.msedge.net | HTTPS | Used by OfficeHub to get the metadata of Office apps. |
+| au.download.windowsupdate.com | HTTP | Used to download operating system patches and updates. |
+| b-ring.msedge.net | HTTPS | Used by OfficeHub to get the metadata of Office apps. |
+| candycrushsoda.king.com | TLSv1.2 | Used for Candy Crush Saga updates. |
+| cdn.content.prod.cms.msn.com | HTTP | Used to retrieve Windows Spotlight metadata. |
+| cdn.onenote.net | HTTP | Used for OneNote Live Tile. |
+| client-office365-tas.msedge.net | HTTP | Used to connect to the Office 365 portal’s shared infrastructure, including Office Online. |
+| config.edge.skype.com | HTTP | Used to retrieve Skype configuration values. |
+| ctldl.windowsupdate.com | HTTP | Used to download certificates that are publicly known to be fraudulent. |
+| cy2.displaycatalog.md.mp.microsoft.com.akadns.net | TLSv1.2 | Used to communicate with Microsoft Store. |
+| cy2.licensing.md.mp.microsoft.com.akadns.net | TLSv1.2 | Used to communicate with Microsoft Store. |
+| cy2.purchase.md.mp.microsoft.com.akadns.net | TLSv1.2 | Used to communicate with Microsoft Store. |
+| cy2.settings.data.microsoft.com.akadns.net | TLSv1.2 | Used as a way for apps to dynamically update their configuration. |
+| cy2.vortex.data.microsoft.com.akadns.net | TLSv1.2 | Used to retrieve Windows Insider Preview builds. |
+| definitionupdates.microsoft.com | HTTPS | Used for Windows Defender definition updates. |
+| displaycatalog.mp.microsoft.com | HTTPS | Used to communicate with Microsoft Store. |
+| dl.delivery.mp.microsoft.com | HTTPS | Enables connections to Windows Update. |
+| dual-a-0001.a-msedge.net | TLSv1.2 | Used by OfficeHub to get the metadata of Office apps. |
+| fe2.update.microsoft.com | HTTPS | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. |
+| fe2.update.microsoft.com.nsatc.net | TLSv1.2 | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. |
+| fe3.delivery.dsp.mp.microsoft.com.nsatc.net | TLSv1.2/
+HTTPS | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. |
+| fg.download.windowsupdate.com.c.footprint.net | HTTP | Used to download operating system patches and updates. |
+| fp.msedge.net | HTTPS | Used by OfficeHub to get the metadata of Office apps. |
+| g.live.com/1rewlive5skydrive/ | HTTPS | Used by a redirection service to automatically update URLs. |
+| g.msn.com.nsatc.net | HTTP | Used to retrieve Windows Spotlight metadata. |
+| geo-prod.do.dsp.mp.microsoft.com.nsatc.net | TLSv1.2 | Enables connections to Windows Update. |
+| go.microsoft.com | HTTPS | Used by a redirection service to automatically update URLs. |
+| img-prod-cms-rt-microsoft-com.akamaized.net | HTTPS | Used to download image files that are called when applications run (Microsoft Store or Inbox MSN Apps). |
+| *.login.msa.akadns6.net | TLSv1.2 | Used for Microsoft accounts to sign in. |
+| licensing.mp.microsoft.com | HTTPS | Used for online activation and some app licensing. |
+| location-inference-westus.cloudapp.net | TLSv1.2 | Used for location data. |
+| login.live.com | HTTPS | Used to authenticate a device. |
+| mediaredirect.microsoft.com | HTTPS | Used by the Groove Music app to update HTTP handler status. |
+| modern.watson.data.microsoft.com.akadns.net | TLSv1.2 | Used by Windows Error Reporting. |
+| msftsrvcs.vo.llnwd.net | HTTP | Enables connections to Windows Update. |
+| msnbot-*.search.msn.com | TLSv1.2 | Used to retrieve Windows Spotlight metadata. |
+| oem.twimg.com | HTTPS | Used for the Twitter Live Tile. |
+| oneclient.sfx.ms | HTTPS | Used by OneDrive for Business to download and verify app updates. |
+| peer4-wst.msedge.net | HTTPS | Used by OfficeHub to get the metadata of Office apps. |
+| pti.store.microsoft.com | HTTPS | Used to communicate with Microsoft Store. |
+| pti.store.microsoft.com.unistore.akadns.net | TLSv1.2 | Used to communicate with Microsoft Store. |
+| purchase.mp.microsoft.com | HTTPS | Used to communicate with Microsoft Store. |
+| ris.api.iris.microsoft.com.akadns.net | TLSv1.2/
+HTTPS | Used to retrieve Windows Spotlight metadata. |
+| settings-win.data.microsoft.com | HTTPS | Used for Windows apps to dynamically update their configuration. |
+| sls.update.microsoft.com.nsatc.net | TLSv1.2/
+HTTPS | Enables connections to Windows Update. |
+| star-mini.c10r.facebook.com | TLSv1.2 | Used for the Facebook Live Tile. |
+| storecatalogrevocation.storequality.microsoft.com | HTTPS | Used to revoke licenses for malicious apps on the Microsoft Store. |
+| storeedgefd.dsx.mp.microsoft.com | HTTPS | Used to communicate with Microsoft Store. |
+| store-images.s-microsoft.com | HTTP | Used to get images that are used for Microsoft Store suggestions. |
+| tile-service.weather.microsoft.com | HTTP | Used to download updates to the Weather app Live Tile. |
+| tsfe.trafficshaping.dsp.mp.microsoft.com | TLSv1.2 | Used for content regulation. |
+| v10.vortex-win.data.microsoft.com | HTTPS | Used to retrieve Windows Insider Preview builds. |
+| wallet.microsoft.com | HTTPS | Used by the Microsoft Wallet app. |
+| wallet-frontend-prod-westus.cloudapp.net | TLSv1.2 | Used by the Microsoft Wallet app. |
+| watson.telemetry.microsoft.com | HTTPS | Used by Windows Error Reporting. |
+| wdcp.microsoft.akadns.net | TLSv1.2 | Used for Windows Defender when Cloud-based Protection is enabled. |
+| wildcard.twimg.com | TLSv1.2 | Used for the Twitter Live Tile. |
+| www.bing.com | HTTP | Used for updates for Cortana, apps, and Live Tiles. |
+| www.facebook.com | HTTPS | Used for the Facebook Live Tile. |
+| [www.microsoft.com](http://www.microsoft.com/) | HTTPS | Used for updates for Cortana, apps, and Live Tiles. |
+
+## Windows 10 Pro
+
+| **Destination** | **Protocol** | **Description** |
+| --- | --- | --- |
+| *.*.akamai.net | HTTP | Used to download content. |
+| *.*.akamaiedge.net | HTTP/
+TLSv1.2 | Used to check for updates to maps that have been downloaded for offline use. |
+| *.a-msedge.net | TLSv1.2 | Used by OfficeHub to get the metadata of Office apps. |
+| *.blob.core.windows.net | HTTPS | Used by Windows Update to update words used for language input methods. |
+| *.c-msedge.net | HTTP | Used by OfficeHub to get the metadata of Office apps. |
+| *.dl.delivery.mp.microsoft.com | HTTP | Enables connections to Windows Update. |
+| *.dspb.akamaiedge.net | TLSv1.2 | Used to check for updates to maps that have been downloaded for offline use. |
+| *.dspg.akamaiedge.net | TLSv1.2 | Used to check for updates to maps that have been downloaded for offline use. |
+| *.e-msedge.net | TLSv1.2 | Used by OfficeHub to get the metadata of Office apps. |
+| *.login.msa.akadns6.net | TLSv1.2 | Used for Microsoft accounts to sign in. |
+| *.s-msedge.net | TLSv1.2 | Used by OfficeHub to get the metadata of Office apps. |
+| *.telecommand.telemetry.microsoft.com.akadns.net | TLSv1.2 | Used by Windows Error Reporting. |
+| *.wac.edgecastcdn.net | TLSv1.2 | Used by the Verizon Content Delivery Network to perform Windows updates. |
+| *.wac.phicdn.net | HTTP | Used by the Verizon Content Delivery Network to perform Windows updates. |
+| *.wns.windows.com | TLSv1.2 | Used for the Windows Push Notification Services (WNS). |
+| *prod.do.dsp.mp.microsoft.com | TLSv1.2/
+HTTPS | Used for Windows Update downloads of apps and OS updates. |
+| 3.dl.delivery.mp.microsoft.com | HTTPS | Enables connections to Windows Update. |
+| 3.dl.delivery.mp.microsoft.com.c.footprint.net | HTTP | Enables connections to Windows Update. |
+| 3.tlu.dl.delivery.mp.microsoft.com | HTTP | Enables connections to Windows Update. |
+| 3.tlu.dl.delivery.mp.microsoft.com.c.footprint.net | HTTP | Enables connections to Windows Update. |
+| arc.msn.com | HTTPS | Used to retrieve Windows Spotlight metadata. |
+| arc.msn.com.nsatc.net | TLSv1.3 | Used to retrieve Windows Spotlight metadata. |
+| au.download.windowsupdate.com | HTTPS | Used to download operating system patches and updates. |
+| b-ring.msedge.net | HTTPS | Used by OfficeHub to get the metadata of Office apps. |
+| candycrushsoda.king.com | HTTPS | Used for Candy Crush Saga updates. |
+| cdn.content.prod.cms.msn.com | HTTP | Used to retrieve Windows Spotlight metadata. |
+| cdn.onenote.net | HTTPS | Used for OneNote Live Tile. |
+| client-office365-tas.msedge.net | HTTPS | Used to connect to the Office 365 portal’s shared infrastructure, including Office Online. |
+| config.edge.skype.com | HTTPS | Used to retrieve Skype configuration values. |
+| ctldl.windowsupdate.com | HTTP | Used to download certificates that are publicly known to be fraudulent. |
+| cs12.wpc.v0cdn.net | HTTP | Used by the Verizon Content Delivery Network to download content for Windows upgrades with Wireless Planning and Coordination (WPC). |
+| cy2.displaycatalog.md.mp.microsoft.com.akadns.net | TLSv1.2 | Used to communicate with Microsoft Store. |
+| cy2.settings.data.microsoft.com.akadns.net | TLSv1.2 | Used as a way for apps to dynamically update their configuration. |
+| cy2.vortex.data.microsoft.com.akadns.net | TLSv1.2 | Used to retrieve Windows Insider Preview builds. |
+| definitionupdates.microsoft.com | HTTPS | Used for Windows Defender definition updates. |
+| displaycatalog.mp.microsoft.com | HTTPS | Used to communicate with Microsoft Store. |
+| download.windowsupdate.com | HTTP | Enables connections to Windows Update. |
+| evoke-windowsservices-tas.msedge.net | HTTPS | Used by the Photos app to download configuration files, and to connect to the Office 365 portal’s shared infrastructure, including Office Online. |
+| fe2.update.microsoft.com | HTTPS | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. |
+| fe2.update.microsoft.com.nsatc.net | TLSv1.2 | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. |
+| fe3.delivery.dsp.mp.microsoft.com.nsatc.net | TLSv1.2/
+HTTPS | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. |
+| fe3.delivery.mp.microsoft.com | HTTPS | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. |
+| fg.download.windowsupdate.com.c.footprint.net | HTTP | Used to download operating system patches and updates. |
+| fp.msedge.net | HTTPS | Used by OfficeHub to get the metadata of Office apps. |
+| fs.microsoft.com | HTTPS | Used to download fonts on demand |
+| g.live.com | HTTP | Used by a redirection service to automatically update URLs. |
+| g.msn.com | HTTPS | Used to retrieve Windows Spotlight metadata. |
+| g.msn.com.nsatc.net | TLSv1.2 | Used to retrieve Windows Spotlight metadata. |
+| geo-prod.do.dsp.mp.microsoft.com | HTTPS | Enables connections to Windows Update. |
+| geover-prod.do.dsp.mp.microsoft.com | HTTPS | Enables connections to Windows Update. |
+| go.microsoft.com | HTTPS | Used by a redirection service to automatically update URLs. |
+| gpla1.wac.v2cdn.net | HTTP | Used for Baltimore CyberTrust Root traffic. . |
+| img-prod-cms-rt-microsoft-com.akamaized.net | HTTPS | Used to download image files that are called when applications run (Microsoft Store or Inbox MSN Apps). |
+| licensing.mp.microsoft.com | HTTPS | Used for online activation and some app licensing. |
+| location-inference-westus.cloudapp.net | TLSv1.2 | Used for location data. |
+| login.live.com | HTTPS | Used to authenticate a device. |
+| l-ring.msedge.net | HTTPS | Used by OfficeHub to get the metadata of Office apps. |
+| mediaredirect.microsoft.com | HTTPS | Used by the Groove Music app to update HTTP handler status. |
+| modern.watson.data.microsoft.com.akadns.net | TLSv1.2 | Used by Windows Error Reporting. |
+| msnbot-*.search.msn.com | TLSv1.2 | Used to retrieve Windows Spotlight metadata. |
+| oem.twimg.com | HTTP | Used for the Twitter Live Tile. |
+| oneclient.sfx.ms | HTTP | Used by OneDrive for Business to download and verify app updates. |
+| peer1-wst.msedge.net | HTTP | Used by OfficeHub to get the metadata of Office apps. |
+| pti.store.microsoft.com | HTTPS | Used to communicate with Microsoft Store. |
+| pti.store.microsoft.com.unistore.akadns.net | HTTPS | Used to communicate with Microsoft Store. |
+| purchase.mp.microsoft.com | HTTPS | Used to communicate with Microsoft Store. |
+| ris.api.iris.microsoft.com | HTTPS | Used to retrieve Windows Spotlight metadata. |
+| settings-win.data.microsoft.com | HTTPS | Used for Windows apps to dynamically update their configuration. |
+| sls.update.microsoft.com | HTTPS | Enables connections to Windows Update. |
+| storecatalogrevocation.storequality.microsoft.com | HTTPS | Used to revoke licenses for malicious apps on the Microsoft Store. |
+| storeedgefd.dsx.mp.microsoft.com | HTTPS | Used to communicate with Microsoft Store. |
+| store-images.s-microsoft.com | HTTPS | Used to get images that are used for Microsoft Store suggestions. |
+| store-images.s-microsoft.com | HTTPS | Used to get images that are used for Microsoft Store suggestions. |
+| telecommand.telemetry.microsoft.com | HTTPS | Used by Windows Error Reporting. |
+| tile-service.weather.microsoft.com | HTTP | Used to download updates to the Weather app Live Tile. |
+| tsfe.trafficshaping.dsp.mp.microsoft.com | HTTPS | Used for content regulation. |
+| v10.vortex-win.data.microsoft.com | HTTPS | Used to retrieve Windows Insider Preview builds. |
+| wallet.microsoft.com | HTTPS | Used by the Microsoft Wallet app. |
+| watson.telemetry.microsoft.com | HTTPS | Used by Windows Error Reporting. |
+| wdcp.microsoft.akadns.net | HTTPS | Used for Windows Defender when Cloud-based Protection is enabled. |
+| wildcard.twimg.com | TLSv1.2 | Used for the Twitter Live Tile. |
+| www.bing.com | TLSv1.2 | Used for updates for Cortana, apps, and Live Tiles. |
+| www.facebook.com | HTTPS | Used for the Facebook Live Tile. |
+| [www.microsoft.com](http://www.microsoft.com/) | HTTPS | Used for updates for Cortana, apps, and Live Tiles. |
+
+## Windows 10 Education
+
+| **Destination** | **Protocol** | **Description** |
+| --- | --- | --- |
+| *.a-msedge.net | TLSv1.2 | Used by OfficeHub to get the metadata of Office apps. |
+| *.b.akamaiedge.net | TLSv1.2 | Used to check for updates to maps that have been downloaded for offline use. |
+| *.c-msedge.net | HTTP | Used by OfficeHub to get the metadata of Office apps. |
+| *.dscb1.akamaiedge.net | HTTP | Used to check for updates to maps that have been downloaded for offline use. |
+| *.dscd.akamai.net | HTTP | Used to download content. |
+| *.dspb.akamaiedge.net | TLSv1.2 | Used to check for updates to maps that have been downloaded for offline use. |
+| *.dspw65.akamai.net | HTTP | Used to download content. |
+| *.e-msedge.net | TLSv1.2 | Used by OfficeHub to get the metadata of Office apps. |
+| *.g.akamai.net | HTTP | Used to download content. |
+| *.g.akamaiedge.net | TLSv1.2 | Used to check for updates to maps that have been downloaded for offline use. |
+| *.l.windowsupdate.com | HTTP | Enables connections to Windows Update. |
+| *.s-msedge.net | TLSv1.2 | Used by OfficeHub to get the metadata of Office apps. |
+| *.wac.phicdn.net | HTTP | Used by the Verizon Content Delivery Network to perform Windows updates |
+| *.wns.windows.com | TLSv1.2 | Used for the Windows Push Notification Services (WNS). |
+| *prod.do.dsp.mp.microsoft.com | TLSv1.2 | Used for Windows Update downloads of apps and OS updates. |
+| *prod.do.dsp.mp.microsoft.com.nsatc.net | TLSv1.2 | Used for Windows Update downloads of apps and OS updates. |
+| 3.dl.delivery.mp.microsoft.com.c.footprint.net | HTTP | Enables connections to Windows Update. |
+| 3.tlu.dl.delivery.mp.microsoft.com.c.footprint.net | HTTP | Enables connections to Windows Update. |
+| a-ring.msedge.net | HTTPS | Used by OfficeHub to get the metadata of Office apps. |
+| au.download.windowsupdate.com | HTTP | Used to download operating system patches and updates. |
+| cdn.onenote.net | HTTPS | Used for OneNote Live Tile. |
+| cds.*.hwcdn.net | HTTP | Used by the Highwinds Content Delivery Network to perform Windows updates. |
+| co4.telecommand.telemetry.microsoft.com.akadns.net | TLSv1.2 | Used by Windows Error Reporting. |
+| config.edge.skype.com | HTTPS | Used to retrieve Skype configuration values. |
+| ctldl.windowsupdate.com | HTTP | Used to download certificates that are publicly known to be fraudulent. |
+| cs12.wpc.v0cdn.net | HTTP | Used by the Verizon Content Delivery Network to download content for Windows upgrades with Wireless Planning and Coordination (WPC). |
+| cy2.displaycatalog.md.mp.microsoft.com.akadns.net | TLSv1.2 | Used to communicate with Microsoft Store. |
+| cy2.settings.data.microsoft.com.akadns.net | TLSv1.2 | Used as a way for apps to dynamically update their configuration. |
+| cy2.vortex.data.microsoft.com.akadns.net | TLSv1.2 | Used to retrieve Windows Insider Preview builds. |
+| dl.delivery.mp.microsoft.com | HTTPS | Enables connections to Windows Update. |
+| download.windowsupdate.com | HTTP | Enables connections to Windows Update. |
+| evoke-windowsservices-tas.msedge.net/ab | HTTPS | Used by the Photos app to download configuration files, and to connect to the Office 365 portal’s shared infrastructure, including Office Online. |
+| fe2.update.microsoft.com.nsatc.net | TLSv1.2 | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. |
+| fe3.delivery.dsp.mp.microsoft.com.nsatc.net | TLSv1.2 | Enables connections to Windows Update. |
+| fg.download.windowsupdate.com.c.footprint.net | HTTP | Used to download operating system patches and updates. |
+| fp.msedge.net | HTTPS | Used by OfficeHub to get the metadata of Office apps. |
+| g.msn.com.nsatc.net | HTTP/
+TLSv1.2 | Used to retrieve Windows Spotlight metadata. |
+| geo-prod.do.dsp.mp.microsoft.com.nsatc.net | TLSv1.2 | Enables connections to Windows Update. |
+| geover-prod.do.dsp.mp.microsoft.com | HTTPS | Enables connections to Windows Update. |
+| go.microsoft.com | HTTPS | Used by a redirection service to automatically update URLs. |
+| gpla1.wac.v2cdn.net | HTTP | Used for Baltimore CyberTrust Root traffic. . |
+| ipv4.login.msa.akadns6.net | TLSv1.2 | Used for Microsoft accounts to sign in. |
+| licensing.mp.microsoft.com | HTTPS | Used for online activation and some app licensing. |
+| location-inference-westus.cloudapp.net | TLSv1.2 | Used for location data. |
+| login.live.com/* | HTTPS | Used to authenticate a device. |
+| l-ring.msedge.net | HTTPS | Used by OfficeHub to get the metadata of Office apps. |
+| mediaredirect.microsoft.com | HTTPS | Used by the Groove Music app to update HTTP handler status. |
+| modern.watson.data.microsoft.com.akadns.net | TLSv1.2 | Used by Windows Error Reporting. |
+| msftconnecttest.com/* | HTTP | Used by Network Connection Status Indicator (NCSI) to detect Internet connectivity and corporate network connectivity status. |
+| msnbot-65-52-108-198.search.msn.com | TLSv1.2 | Used to retrieve Windows Spotlight metadata. |
+| oneclient.sfx.ms | HTTP | Used by OneDrive for Business to download and verify app updates. |
+| peer1-wst.msedge.net | HTTPS | Used by OfficeHub to get the metadata of Office apps. |
+| pti.store.microsoft.com.unistore.akadns.net | TLSv1.2 | Used to communicate with Microsoft Store. |
+| settings-win.data.microsoft.com | HTTPS | Used for Windows apps to dynamically update their configuration. |
+| sls.update.microsoft.com.nsatc.net | TLSv1.2 | Enables connections to Windows Update. |
+| store-images.s-microsoft.com | HTTPS | Used to get images that are used for Microsoft Store suggestions. |
+| tile-service.weather.microsoft.com | HTTP | Used to download updates to the Weather app Live Tile. |
+| telecommand.telemetry.microsoft.com | HTTPS | Used by Windows Error Reporting. |
+| tsfe.trafficshaping.dsp.mp.microsoft.com | TLSv1.2 | Used for content regulation. |
+| wallet.microsoft.com | HTTPS | Used by the Microsoft Wallet app. |
+| watson.telemetry.microsoft.com | HTTPS | Used by Windows Error Reporting. |
+| wdcp.microsoft.akadns.net | TLSv1.2 | Used for Windows Defender when Cloud-based Protection is enabled. |
+| www.bing.com | HTTPS | Used for updates for Cortana, apps, and Live Tiles. |
+
+## Related links
+
+- [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US)
+- [Network infrastructure requirements for Microsoft Intune](https://docs.microsoft.com/intune/get-started/network-infrastructure-requirements-for-microsoft-intune)
\ No newline at end of file
diff --git a/windows/configuration/mobile-devices/configure-mobile.md b/windows/configuration/mobile-devices/configure-mobile.md
index 6fe4753762..774af0e150 100644
--- a/windows/configuration/mobile-devices/configure-mobile.md
+++ b/windows/configuration/mobile-devices/configure-mobile.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: high
author: jdeckerms
+ms.date: 07/27/2017
---
# Configure Windows 10 Mobile devices
diff --git a/windows/configuration/mobile-devices/lockdown-xml.md b/windows/configuration/mobile-devices/lockdown-xml.md
index 13c5609760..aa69f4575a 100644
--- a/windows/configuration/mobile-devices/lockdown-xml.md
+++ b/windows/configuration/mobile-devices/lockdown-xml.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: security, mobile
author: jdeckerms
ms.localizationpriority: high
+ms.date: 07/27/2017
---
# Configure Windows 10 Mobile using Lockdown XML
diff --git a/windows/configuration/mobile-devices/mobile-lockdown-designer.md b/windows/configuration/mobile-devices/mobile-lockdown-designer.md
index 98d2c703e6..04669fdebf 100644
--- a/windows/configuration/mobile-devices/mobile-lockdown-designer.md
+++ b/windows/configuration/mobile-devices/mobile-lockdown-designer.md
@@ -7,6 +7,7 @@ ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
author: jdeckerms
+ms.date: 07/27/2017
---
# Use the Lockdown Designer app to create a Lockdown XML file
diff --git a/windows/configuration/mobile-devices/product-ids-in-windows-10-mobile.md b/windows/configuration/mobile-devices/product-ids-in-windows-10-mobile.md
index 839f23d947..418ff01029 100644
--- a/windows/configuration/mobile-devices/product-ids-in-windows-10-mobile.md
+++ b/windows/configuration/mobile-devices/product-ids-in-windows-10-mobile.md
@@ -9,6 +9,7 @@ ms.sitesec: library
ms.pagetype: mobile
author: jdeckerms
ms.localizationpriority: high
+ms.date: 07/27/2017
---
# Product IDs in Windows 10 Mobile
diff --git a/windows/configuration/mobile-devices/provisioning-configure-mobile.md b/windows/configuration/mobile-devices/provisioning-configure-mobile.md
index 7da86c0ac6..360fd98464 100644
--- a/windows/configuration/mobile-devices/provisioning-configure-mobile.md
+++ b/windows/configuration/mobile-devices/provisioning-configure-mobile.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: high
author: jdeckerms
+ms.date: 07/27/2017
---
# Use Windows Configuration Designer to configure Windows 10 Mobile devices
diff --git a/windows/configuration/mobile-devices/provisioning-nfc.md b/windows/configuration/mobile-devices/provisioning-nfc.md
index 1885282b41..fc11afb5d6 100644
--- a/windows/configuration/mobile-devices/provisioning-nfc.md
+++ b/windows/configuration/mobile-devices/provisioning-nfc.md
@@ -6,6 +6,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerms
ms.localizationpriority: high
+ms.date: 07/27/2017
---
# NFC-based device provisioning
diff --git a/windows/configuration/mobile-devices/provisioning-package-splitter.md b/windows/configuration/mobile-devices/provisioning-package-splitter.md
index 1e44466908..9e119420b3 100644
--- a/windows/configuration/mobile-devices/provisioning-package-splitter.md
+++ b/windows/configuration/mobile-devices/provisioning-package-splitter.md
@@ -6,6 +6,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerms
ms.localizationpriority: high
+ms.date: 07/27/2017
---
# Barcode provisioning and the package splitter tool
diff --git a/windows/configuration/mobile-devices/set-up-a-kiosk-for-windows-10-for-mobile-edition.md b/windows/configuration/mobile-devices/set-up-a-kiosk-for-windows-10-for-mobile-edition.md
index d5aadcad3e..c20161c09b 100644
--- a/windows/configuration/mobile-devices/set-up-a-kiosk-for-windows-10-for-mobile-edition.md
+++ b/windows/configuration/mobile-devices/set-up-a-kiosk-for-windows-10-for-mobile-edition.md
@@ -9,6 +9,7 @@ ms.sitesec: library
ms.pagetype: mobile
author: jdeckerms
ms.localizationpriority: high
+ms.date: 07/27/2017
---
# Set up a kiosk on Windows 10 Mobile or Windows 10 Mobile Enterprise
diff --git a/windows/configuration/mobile-devices/settings-that-can-be-locked-down.md b/windows/configuration/mobile-devices/settings-that-can-be-locked-down.md
index 1a2a59eb33..58dfbc60e2 100644
--- a/windows/configuration/mobile-devices/settings-that-can-be-locked-down.md
+++ b/windows/configuration/mobile-devices/settings-that-can-be-locked-down.md
@@ -9,6 +9,7 @@ ms.sitesec: library
ms.pagetype: mobile
author: jdeckerms
ms.localizationpriority: high
+ms.date: 07/27/2017
---
# Settings and quick actions that can be locked down in Windows 10 Mobile
diff --git a/windows/configuration/mobile-devices/start-layout-xml-mobile.md b/windows/configuration/mobile-devices/start-layout-xml-mobile.md
index f7d4204adb..064ebdc7f6 100644
--- a/windows/configuration/mobile-devices/start-layout-xml-mobile.md
+++ b/windows/configuration/mobile-devices/start-layout-xml-mobile.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: manage
ms.sitesec: library
author: jdeckerms
ms.localizationpriority: high
+ms.date: 07/27/2017
---
# Start layout XML for mobile editions of Windows 10 (reference)
diff --git a/windows/configuration/multi-app-kiosk-troubleshoot.md b/windows/configuration/multi-app-kiosk-troubleshoot.md
index 6885f2b2f7..2d5a8db9fb 100644
--- a/windows/configuration/multi-app-kiosk-troubleshoot.md
+++ b/windows/configuration/multi-app-kiosk-troubleshoot.md
@@ -9,7 +9,7 @@ ms.sitesec: library
ms.pagetype: edu, security
author: jdeckerms
ms.localizationpriority: medium
-ms.date: 10/05/2017
+ms.date: 09/27/2017
ms.author: jdecker
---
diff --git a/windows/configuration/multi-app-kiosk-xml.md b/windows/configuration/multi-app-kiosk-xml.md
index d355221ba5..8babcdefec 100644
--- a/windows/configuration/multi-app-kiosk-xml.md
+++ b/windows/configuration/multi-app-kiosk-xml.md
@@ -9,7 +9,7 @@ ms.sitesec: library
ms.pagetype: edu, security
author: jdeckerms
ms.localizationpriority: medium
-ms.date: 10/05/2017
+ms.date: 08/14/2017
ms.author: jdecker
---
diff --git a/windows/configuration/provisioning-apn.md b/windows/configuration/provisioning-apn.md
index 72b2e23caf..20fc7040aa 100644
--- a/windows/configuration/provisioning-apn.md
+++ b/windows/configuration/provisioning-apn.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: high
+ms.date: 07/27/2017
---
# Configure cellular settings for tablets and PCs
diff --git a/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers.md b/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers.md
index b62bdf4c0b..6478c68d2e 100644
--- a/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers.md
+++ b/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: manage
ms.sitesec: library
author: jdeckerms
ms.localizationpriority: medium
+ms.date: 07/27/2017
---
# Introduction to configuration service providers (CSPs) for IT pros
diff --git a/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment.md b/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment.md
index 859a33f7bd..778796176d 100644
--- a/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment.md
+++ b/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment.md
@@ -8,6 +8,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerms
ms.localizationpriority: high
+ms.date: 07/27/2017
---
# Provision PCs with common settings for initial deployment (desktop wizard)
diff --git a/windows/configuration/provisioning-packages/provision-pcs-with-apps-and-certificates.md b/windows/configuration/provisioning-packages/provision-pcs-with-apps-and-certificates.md
index 932bc297e9..56fddf9b72 100644
--- a/windows/configuration/provisioning-packages/provision-pcs-with-apps-and-certificates.md
+++ b/windows/configuration/provisioning-packages/provision-pcs-with-apps-and-certificates.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerms
ms.localizationpriority: high
+ms.date: 07/27/2017
---
# Provision PCs with apps and certificates for initial deployment (advanced provisioning)
diff --git a/windows/configuration/provisioning-packages/provision-pcs-with-apps.md b/windows/configuration/provisioning-packages/provision-pcs-with-apps.md
index a2f8ee5eb5..d933b0bc8f 100644
--- a/windows/configuration/provisioning-packages/provision-pcs-with-apps.md
+++ b/windows/configuration/provisioning-packages/provision-pcs-with-apps.md
@@ -8,7 +8,7 @@ ms.sitesec: library
author: jdeckerms
ms.localizationpriority: high
ms.author: jdecker
-ms.date: 10/05/2017
+ms.date: 09/06/2017
---
# Provision PCs with apps
diff --git a/windows/configuration/provisioning-packages/provisioning-apply-package.md b/windows/configuration/provisioning-packages/provisioning-apply-package.md
index 82ce22b422..0cabd2b0e7 100644
--- a/windows/configuration/provisioning-packages/provisioning-apply-package.md
+++ b/windows/configuration/provisioning-packages/provisioning-apply-package.md
@@ -6,6 +6,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerms
ms.localizationpriority: high
+ms.date: 08/22/2017
---
# Apply a provisioning package
diff --git a/windows/configuration/provisioning-packages/provisioning-command-line.md b/windows/configuration/provisioning-packages/provisioning-command-line.md
index 5eda051a35..8e96311282 100644
--- a/windows/configuration/provisioning-packages/provisioning-command-line.md
+++ b/windows/configuration/provisioning-packages/provisioning-command-line.md
@@ -6,6 +6,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerms
ms.localizationpriority: high
+ms.date: 07/27/2017
---
# Windows Configuration Designer command-line interface (reference)
diff --git a/windows/configuration/provisioning-packages/provisioning-create-package.md b/windows/configuration/provisioning-packages/provisioning-create-package.md
index dc25ab7ceb..76176cb430 100644
--- a/windows/configuration/provisioning-packages/provisioning-create-package.md
+++ b/windows/configuration/provisioning-packages/provisioning-create-package.md
@@ -6,6 +6,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerms
ms.localizationpriority: high
+ms.date: 07/27/2017
---
# Create a provisioning package for Windows 10
diff --git a/windows/configuration/provisioning-packages/provisioning-how-it-works.md b/windows/configuration/provisioning-packages/provisioning-how-it-works.md
index 0596ad5024..1e514987ed 100644
--- a/windows/configuration/provisioning-packages/provisioning-how-it-works.md
+++ b/windows/configuration/provisioning-packages/provisioning-how-it-works.md
@@ -6,6 +6,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerms
ms.localizationpriority: high
+ms.date: 07/27/2017
---
# How provisioning works in Windows 10
diff --git a/windows/configuration/provisioning-packages/provisioning-install-icd.md b/windows/configuration/provisioning-packages/provisioning-install-icd.md
index 9981feef89..b595b81972 100644
--- a/windows/configuration/provisioning-packages/provisioning-install-icd.md
+++ b/windows/configuration/provisioning-packages/provisioning-install-icd.md
@@ -6,6 +6,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerms
ms.localizationpriority: high
+ms.date: 10/16/2017
---
# Install Windows Configuration Designer
@@ -103,7 +104,6 @@ On devices running Windows 10, you can install [the Windows Configuration Design
- [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md)
- [Create a provisioning package with multivariant settings](provisioning-multivariant.md)
-Not finding content you need? Windows 10 users, tell us what you want on [Feedback Hub](feedback-hub://?referrer=techDocsUcPage&tabid=2&contextid=897&newFeedback=true&topic=provisioning-install-icd.md).
diff --git a/windows/configuration/provisioning-packages/provisioning-multivariant.md b/windows/configuration/provisioning-packages/provisioning-multivariant.md
index e63300657b..209590fdc6 100644
--- a/windows/configuration/provisioning-packages/provisioning-multivariant.md
+++ b/windows/configuration/provisioning-packages/provisioning-multivariant.md
@@ -6,7 +6,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerms
ms.localizationpriority: high
-ms.date: 11/06/2017
+ms.date: 11/08/2017
ms.author: jdecker
---
diff --git a/windows/configuration/provisioning-packages/provisioning-packages.md b/windows/configuration/provisioning-packages/provisioning-packages.md
index f9d607c19c..2a0a5b4e8e 100644
--- a/windows/configuration/provisioning-packages/provisioning-packages.md
+++ b/windows/configuration/provisioning-packages/provisioning-packages.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerms
ms.localizationpriority: high
+ms.date: 07/27/2017
---
# Provisioning packages for Windows 10
diff --git a/windows/configuration/provisioning-packages/provisioning-powershell.md b/windows/configuration/provisioning-packages/provisioning-powershell.md
index 27015f653b..e372caf606 100644
--- a/windows/configuration/provisioning-packages/provisioning-powershell.md
+++ b/windows/configuration/provisioning-packages/provisioning-powershell.md
@@ -6,6 +6,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerms
ms.localizationpriority: high
+ms.date: 07/27/2017
---
# PowerShell cmdlets for provisioning Windows 10 (reference)
diff --git a/windows/configuration/provisioning-packages/provisioning-script-to-install-app.md b/windows/configuration/provisioning-packages/provisioning-script-to-install-app.md
index e3de647451..2e6a4b5c10 100644
--- a/windows/configuration/provisioning-packages/provisioning-script-to-install-app.md
+++ b/windows/configuration/provisioning-packages/provisioning-script-to-install-app.md
@@ -6,6 +6,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerms
ms.localizationpriority: high
+ms.date: 07/27/2017
---
# Use a script to install a desktop app in provisioning packages
@@ -137,7 +138,7 @@ This is an example script with logging that shows how to run a powershell script
set LOGFILE=%SystemDrive%\my_powershell_script.log
echo Running my_powershell_script.ps1 in system context >> %LOGFILE%
echo Executing "PsExec.exe -accepteula -i -s cmd.exe /c powershell.exe my_powershell_script.ps1" >> %LOGFILE%
-PsExec.exe -accepteula -i -s cmd.exe /c powershell.exe my_powershell_script.ps1' >> %LOGFILE%
+PsExec.exe -accepteula -i -s cmd.exe /c 'powershell.exe my_powershell_script.ps1' >> %LOGFILE%
echo result: %ERRORLEVEL% >> %LOGFILE%
```
@@ -229,4 +230,4 @@ When you are done, [build the package](provisioning-create-package.md#build-pack
- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md)
- [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md)
- [PowerShell cmdlets for provisioning Windows 10 (reference)](provisioning-powershell.md)
-- [Create a provisioning package with multivariant settings](provisioning-multivariant.md)
\ No newline at end of file
+- [Create a provisioning package with multivariant settings](provisioning-multivariant.md)
diff --git a/windows/configuration/provisioning-packages/provisioning-uninstall-package.md b/windows/configuration/provisioning-packages/provisioning-uninstall-package.md
index 5cbafce644..06879c3b1b 100644
--- a/windows/configuration/provisioning-packages/provisioning-uninstall-package.md
+++ b/windows/configuration/provisioning-packages/provisioning-uninstall-package.md
@@ -6,6 +6,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerms
ms.localizationpriority: high
+ms.date: 07/27/2017
---
# Settings changed when you uninstall a provisioning package
diff --git a/windows/configuration/set-up-a-kiosk-for-windows-10-for-desktop-editions.md b/windows/configuration/set-up-a-kiosk-for-windows-10-for-desktop-editions.md
index 3b5752aa75..fcbf41202b 100644
--- a/windows/configuration/set-up-a-kiosk-for-windows-10-for-desktop-editions.md
+++ b/windows/configuration/set-up-a-kiosk-for-windows-10-for-desktop-editions.md
@@ -8,6 +8,7 @@ ms.mktglfcycl: manage
ms.sitesec: library
author: jdeckerms
ms.localizationpriority: high
+ms.date: 10/16/2017
---
# Set up a kiosk on Windows 10 Pro, Enterprise, or Education
@@ -432,6 +433,5 @@ For a more secure kiosk experience, we recommend that you make the following con
- [Set up a kiosk on Windows 10 Mobile or Windows 10 Mobile Enterprise](mobile-devices/set-up-a-kiosk-for-windows-10-for-mobile-edition.md)
-Not finding content you need? Windows 10 users, tell us what you want on [Feedback Hub](feedback-hub://?referrer=techDocsUcPage&tabid=2&contextid=897&newFeedback=true&topic=set-up-a-kiosk-for-windows-10-for-desktop-editions.md).
diff --git a/windows/configuration/set-up-shared-or-guest-pc.md b/windows/configuration/set-up-shared-or-guest-pc.md
index 192728ded1..196d95eb81 100644
--- a/windows/configuration/set-up-shared-or-guest-pc.md
+++ b/windows/configuration/set-up-shared-or-guest-pc.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: manage
ms.sitesec: library
author: jdeckerms
ms.localizationpriority: high
+ms.date: 07/27/2017
---
# Set up a shared or guest PC with Windows 10
@@ -49,7 +50,7 @@ Apps can take advantage of shared PC mode with the following three APIs:
- [IsEnabled](https://docs.microsoft.com/uwp/api/windows.system.profile.sharedmodesettings) - This informs apps when the PC has been configured for shared use scenarios. For example, an app might only download content on demand on a device in shared PC mode, or might skip first run experiences.
- [ShouldAvoidLocalStorage](https://docs.microsoft.com/uwp/api/windows.system.profile.sharedmodesettings) - This informs apps when the PC has been configured to not allow the user to save to the local storage of the PC. Instead, only cloud save locations should be offered by the app or saved automatically by the app.
-- [IsEducationEnvironment](https://docs.microsoft.com/uwp/api/windows.system.profile.educationsettings) - This informs apps when the PC is used in an education environment. Apps may want to handle telemetry differently or hide advertising functionality.
+- [IsEducationEnvironment](https://docs.microsoft.com/uwp/api/windows.system.profile.educationsettings) - This informs apps when the PC is used in an education environment. Apps may want to handle diagnostic data differently or hide advertising functionality.
###Customization
diff --git a/windows/configuration/start-layout-xml-desktop.md b/windows/configuration/start-layout-xml-desktop.md
index 6454a3fe7c..c02424cee9 100644
--- a/windows/configuration/start-layout-xml-desktop.md
+++ b/windows/configuration/start-layout-xml-desktop.md
@@ -7,7 +7,7 @@ ms.mktglfcycl: manage
ms.sitesec: library
author: jdeckerms
ms.author: jdecker
-ms.date: 06/13/2017
+ms.date: 01/02/2018
ms.localizationpriority: high
---
@@ -56,9 +56,9 @@ The following table lists the supported elements and attributes for the LayoutMo
| [start:Tile](#specify-start-tiles)Parent:AppendGroup | AppUserModelIDSizeRowColumn | Use to specify any of the following:- A Universal Windows app- A Windows 8 or Windows 8.1 appNote that AppUserModelID is case-sensitive. |
| start:DesktopApplicationTileParent:AppendGroup | DesktopApplicationIDDesktopApplicationLinkPathSizeRowColumn | Use to specify any of the following:- A Windows desktop application with a known AppUserModelID- An application in a known folder with a link in a legacy Start Menu folder- A Windows desktop application link in a legacy Start Menu folder- A Web link tile with an associated .url file that is in a legacy Start Menu folder |
| start:SecondaryTileParent:AppendGroup | AppUserModelIDTileIDArgumentsDisplayNameSquare150x150LogoUriShowNameOnSquare150x150LogoShowNameOnWide310x150LogoWide310x150LogoUriBackgroundColorForegroundTextIsSuggestedAppSizeRowColumn | Use to pin a Web link through a Microsoft Edge secondary tile. Note that AppUserModelID is case-sensitive. |
-| TopMFUAppsParent:LayoutModificationTemplate | n/a | Use to add up to 3 default apps to the frequently used apps section in the system area |
-| TileParent:TopMFUApps | AppUserModelID | Use with the TopMFUApps tags to specify an app with a known AppUserModelID |
-| DesktopApplicationTileParent:TopMFUApps | LinkFilePath | Use with the TopMFUApps tags to specify an app without a known AppUserModelID |
+| TopMFUAppsParent:LayoutModificationTemplate | n/a | Use to add up to 3 default apps to the frequently used apps section in the system area.**Note**: Only applies to versions of Windows 10 earlier than version 1709. In Windows 10, version 1709, you can no longer pin apps to the Most Frequently Used apps list in Start. |
+| TileParent:TopMFUApps | AppUserModelID | Use with the TopMFUApps tags to specify an app with a known AppUserModelID. **Note**: Only applies to versions of Windows 10 earlier than version 1709. In Windows 10, version 1709, you can no longer pin apps to the Most Frequently Used apps list in Start. |
+| DesktopApplicationTileParent:TopMFUApps | LinkFilePath | Use with the TopMFUApps tags to specify an app without a known AppUserModelID.**Note**: Only applies to versions of Windows 10 earlier than version 1709. In Windows 10, version 1709, you can no longer pin apps to the Most Frequently Used apps list in Start. |
| AppendOfficeSuiteParent:LayoutModificationTemplate | n/a | Use to add the in-box installed Office suite to StartDo not use this tag with AppendDownloadOfficeTile |
| AppendDownloadOfficeTileParent:LayoutModificationTemplate | n/a | Use to add a specific **Download Office** tile to a specific location in StartDo not use this tag with AppendOfficeSuite |
@@ -259,6 +259,9 @@ Secondary Microsoft Edge tiles have the same size and location behavior as a Uni
#### TopMFUApps
+>[!NOTE]
+>Only applies to versions of Windows 10 earlier than version 1709. In Windows 10, version 1709, you can no longer pin apps to the Most Frequently Used apps list in Start.
+
You can use the **TopMFUApps** tag to add up to 3 default apps to the frequently used apps section in the system area, which delivers system-driven lists to the user including important or frequently accessed system locations and recently installed apps.
You can use this tag to add:
@@ -392,10 +395,7 @@ The following sample LayoutModification.xml shows how you can configure the Star
-
-
-
-
+
```
## Use Windows Provisioning multivariant support
diff --git a/windows/configuration/start-secondary-tiles.md b/windows/configuration/start-secondary-tiles.md
index 43804a9a80..c12a8cf0c6 100644
--- a/windows/configuration/start-secondary-tiles.md
+++ b/windows/configuration/start-secondary-tiles.md
@@ -7,6 +7,7 @@ ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: high
author: jdeckerms
+ms.date: 08/07/2017
---
# Add image for secondary Microsoft Edge tiles
@@ -67,7 +68,7 @@ In Windows 10, version 1703, by using the PowerShell cmdlet `export-StartLayoutE
```
In the previous command, `-path` is a required parameter that specifies the path and file name for the export file. You can specify a local path or a UNC path (for example, \\\\FileServer01\\StartLayouts\\StartLayoutMarketing.xml).
- Use a file name of your choice—for example, StartLayoutMarketing.xml. Include the .xml file name extension. The [Export-StartLayout](https://go.microsoft.com/fwlink/p/?LinkId=620879) cmdlet does not append the file name extension, and the policy settings require the extension.
+ Use a file name of your choice—for example, StartLayoutMarketing.xml. Include the .xml file name extension. The [Export-StartLayout](https://docs.microsoft.com/powershell/module/startlayout/export-startlayout?view=win10-ps) cmdlet does not append the file name extension, and the policy settings require the extension.
3. If you’d like to change the image for a secondary tile to your own custom image, open the layout.xml file, and look for the images that the tile references.
- For example, your layout.xml contains `Square150x150LogoUri="ms-appdata:///local/PinnedTiles/21581260870/hires.png" Wide310x150LogoUri="ms-appx:///"`
diff --git a/windows/configuration/start-taskbar-lockscreen.md b/windows/configuration/start-taskbar-lockscreen.md
index 87b59d4a68..3b140ca068 100644
--- a/windows/configuration/start-taskbar-lockscreen.md
+++ b/windows/configuration/start-taskbar-lockscreen.md
@@ -7,6 +7,7 @@ ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: high
author: jdeckerms
+ms.date: 07/27/2017
---
# Configure Start layout, taskbar, and lock screen for Windows 10 PCs
diff --git a/windows/configuration/stop-employees-from-using-microsoft-store.md b/windows/configuration/stop-employees-from-using-microsoft-store.md
index 40bd27f436..318293c24d 100644
--- a/windows/configuration/stop-employees-from-using-microsoft-store.md
+++ b/windows/configuration/stop-employees-from-using-microsoft-store.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: store, mobile
author: TrudyHa
ms.localizationpriority: high
+ms.date: 10/16/2017
---
# Configure access to Microsoft Store
@@ -114,7 +115,6 @@ If you're using Microsoft Store for Business and you want employees to only see
[Manage access to private store](/microsoft-store/manage-access-to-private-store)
-Not finding content you need? Windows 10 users, tell us what you want on [Feedback Hub](feedback-hub://?referrer=techDocsUcPage&tabid=2&contextid=897&newFeedback=true&topic=stop-employees-from-using-microsoft-store.md).
diff --git a/windows/configuration/ue-v/uev-administering-uev-with-windows-powershell-and-wmi.md b/windows/configuration/ue-v/uev-administering-uev-with-windows-powershell-and-wmi.md
index 3b0c73a34d..9752c25cf2 100644
--- a/windows/configuration/ue-v/uev-administering-uev-with-windows-powershell-and-wmi.md
+++ b/windows/configuration/ue-v/uev-administering-uev-with-windows-powershell-and-wmi.md
@@ -6,6 +6,7 @@ ms.pagetype: mdop, virtualization
ms.mktglfcycl: deploy
ms.sitesec: library
ms.prod: w10
+ms.date: 04/19/2017
---
diff --git a/windows/configuration/ue-v/uev-administering-uev.md b/windows/configuration/ue-v/uev-administering-uev.md
index 2c1455ebe3..dfeb80037f 100644
--- a/windows/configuration/ue-v/uev-administering-uev.md
+++ b/windows/configuration/ue-v/uev-administering-uev.md
@@ -6,6 +6,7 @@ ms.pagetype: mdop, virtualization
ms.mktglfcycl: deploy
ms.sitesec: library
ms.prod: w10
+ms.date: 04/19/2017
---
diff --git a/windows/configuration/ue-v/uev-application-template-schema-reference.md b/windows/configuration/ue-v/uev-application-template-schema-reference.md
index 94bdd8dd75..7ee8769a77 100644
--- a/windows/configuration/ue-v/uev-application-template-schema-reference.md
+++ b/windows/configuration/ue-v/uev-application-template-schema-reference.md
@@ -6,6 +6,7 @@ ms.pagetype: mdop, virtualization
ms.mktglfcycl: deploy
ms.sitesec: library
ms.prod: w10
+ms.date: 04/19/2017
---
diff --git a/windows/configuration/ue-v/uev-changing-the-frequency-of-scheduled-tasks.md b/windows/configuration/ue-v/uev-changing-the-frequency-of-scheduled-tasks.md
index ea6d910cb6..10e15e2610 100644
--- a/windows/configuration/ue-v/uev-changing-the-frequency-of-scheduled-tasks.md
+++ b/windows/configuration/ue-v/uev-changing-the-frequency-of-scheduled-tasks.md
@@ -6,6 +6,7 @@ ms.pagetype: mdop, virtualization
ms.mktglfcycl: deploy
ms.sitesec: library
ms.prod: w10
+ms.date: 04/19/2017
---
diff --git a/windows/configuration/ue-v/uev-configuring-uev-with-group-policy-objects.md b/windows/configuration/ue-v/uev-configuring-uev-with-group-policy-objects.md
index 4476ea26b3..62ab60728d 100644
--- a/windows/configuration/ue-v/uev-configuring-uev-with-group-policy-objects.md
+++ b/windows/configuration/ue-v/uev-configuring-uev-with-group-policy-objects.md
@@ -6,6 +6,7 @@ ms.pagetype: mdop, virtualization
ms.mktglfcycl: deploy
ms.sitesec: library
ms.prod: w10
+ms.date: 04/19/2017
---
diff --git a/windows/configuration/ue-v/uev-configuring-uev-with-system-center-configuration-manager.md b/windows/configuration/ue-v/uev-configuring-uev-with-system-center-configuration-manager.md
index a0b3bf91d3..09bc5bcd87 100644
--- a/windows/configuration/ue-v/uev-configuring-uev-with-system-center-configuration-manager.md
+++ b/windows/configuration/ue-v/uev-configuring-uev-with-system-center-configuration-manager.md
@@ -6,6 +6,7 @@ ms.pagetype: mdop, virtualization
ms.mktglfcycl: deploy
ms.sitesec: library
ms.prod: w10
+ms.date: 04/19/2017
---
diff --git a/windows/configuration/ue-v/uev-deploy-required-features.md b/windows/configuration/ue-v/uev-deploy-required-features.md
index 286fc22b1e..e487d59433 100644
--- a/windows/configuration/ue-v/uev-deploy-required-features.md
+++ b/windows/configuration/ue-v/uev-deploy-required-features.md
@@ -6,6 +6,7 @@ ms.pagetype: mdop, virtualization
ms.mktglfcycl: deploy
ms.sitesec: library
ms.prod: w10
+ms.date: 04/19/2017
---
# Deploy required UE-V features
diff --git a/windows/configuration/ue-v/uev-deploy-uev-for-custom-applications.md b/windows/configuration/ue-v/uev-deploy-uev-for-custom-applications.md
index 6a44f5decc..8acad25b0c 100644
--- a/windows/configuration/ue-v/uev-deploy-uev-for-custom-applications.md
+++ b/windows/configuration/ue-v/uev-deploy-uev-for-custom-applications.md
@@ -6,6 +6,7 @@ ms.pagetype: mdop, virtualization
ms.mktglfcycl: deploy
ms.sitesec: library
ms.prod: w10
+ms.date: 04/19/2017
---
# Use UE-V with custom applications
diff --git a/windows/configuration/ue-v/uev-for-windows.md b/windows/configuration/ue-v/uev-for-windows.md
index 83dec42449..7ac31a3a1f 100644
--- a/windows/configuration/ue-v/uev-for-windows.md
+++ b/windows/configuration/ue-v/uev-for-windows.md
@@ -6,6 +6,7 @@ ms.pagetype: mdop, virtualization
ms.mktglfcycl: deploy
ms.sitesec: library
ms.prod: w10
+ms.date: 05/02/2017
---
# User Experience Virtualization (UE-V) for Windows 10 overview
diff --git a/windows/configuration/ue-v/uev-getting-started.md b/windows/configuration/ue-v/uev-getting-started.md
index f2497cb4f5..ef86f5916c 100644
--- a/windows/configuration/ue-v/uev-getting-started.md
+++ b/windows/configuration/ue-v/uev-getting-started.md
@@ -6,6 +6,7 @@ ms.pagetype: mdop, virtualization
ms.mktglfcycl: deploy
ms.sitesec: library
ms.prod: w10
+ms.date: 04/19/2017
---
# Get Started with UE-V
diff --git a/windows/configuration/ue-v/uev-manage-administrative-backup-and-restore.md b/windows/configuration/ue-v/uev-manage-administrative-backup-and-restore.md
index 4b70595e59..8a119cf39e 100644
--- a/windows/configuration/ue-v/uev-manage-administrative-backup-and-restore.md
+++ b/windows/configuration/ue-v/uev-manage-administrative-backup-and-restore.md
@@ -6,6 +6,7 @@ ms.pagetype: mdop, virtualization
ms.mktglfcycl: deploy
ms.sitesec: library
ms.prod: w10
+ms.date: 04/19/2017
---
diff --git a/windows/configuration/ue-v/uev-manage-configurations.md b/windows/configuration/ue-v/uev-manage-configurations.md
index 81dbad3d82..62bac2494e 100644
--- a/windows/configuration/ue-v/uev-manage-configurations.md
+++ b/windows/configuration/ue-v/uev-manage-configurations.md
@@ -6,6 +6,7 @@ ms.pagetype: mdop, virtualization
ms.mktglfcycl: deploy
ms.sitesec: library
ms.prod: w10
+ms.date: 04/19/2017
---
diff --git a/windows/configuration/ue-v/uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md b/windows/configuration/ue-v/uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md
index 590e4d58c3..3d94ba1e9b 100644
--- a/windows/configuration/ue-v/uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md
+++ b/windows/configuration/ue-v/uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md
@@ -6,6 +6,7 @@ ms.pagetype: mdop, virtualization
ms.mktglfcycl: deploy
ms.sitesec: library
ms.prod: w10
+ms.date: 04/19/2017
---
diff --git a/windows/configuration/ue-v/uev-managing-uev-agent-and-packages-with-windows-powershell-and-wmi.md b/windows/configuration/ue-v/uev-managing-uev-agent-and-packages-with-windows-powershell-and-wmi.md
index eeb54e2454..1dbc856d7f 100644
--- a/windows/configuration/ue-v/uev-managing-uev-agent-and-packages-with-windows-powershell-and-wmi.md
+++ b/windows/configuration/ue-v/uev-managing-uev-agent-and-packages-with-windows-powershell-and-wmi.md
@@ -6,6 +6,7 @@ ms.pagetype: mdop, virtualization
ms.mktglfcycl: deploy
ms.sitesec: library
ms.prod: w10
+ms.date: 04/19/2017
---
diff --git a/windows/configuration/ue-v/uev-migrating-settings-packages.md b/windows/configuration/ue-v/uev-migrating-settings-packages.md
index 85bb7a71b0..1ecf51a49c 100644
--- a/windows/configuration/ue-v/uev-migrating-settings-packages.md
+++ b/windows/configuration/ue-v/uev-migrating-settings-packages.md
@@ -6,6 +6,7 @@ ms.pagetype: mdop, virtualization
ms.mktglfcycl: deploy
ms.sitesec: library
ms.prod: w10
+ms.date: 04/19/2017
---
diff --git a/windows/configuration/ue-v/uev-prepare-for-deployment.md b/windows/configuration/ue-v/uev-prepare-for-deployment.md
index 825c3d7fcb..f48f1d3ceb 100644
--- a/windows/configuration/ue-v/uev-prepare-for-deployment.md
+++ b/windows/configuration/ue-v/uev-prepare-for-deployment.md
@@ -6,6 +6,7 @@ ms.pagetype: mdop, virtualization
ms.mktglfcycl: deploy
ms.sitesec: library
ms.prod: w10
+ms.date: 04/19/2017
---
# Prepare a UE-V Deployment
diff --git a/windows/configuration/ue-v/uev-release-notes-1607.md b/windows/configuration/ue-v/uev-release-notes-1607.md
index 416b8f4508..c9e9108115 100644
--- a/windows/configuration/ue-v/uev-release-notes-1607.md
+++ b/windows/configuration/ue-v/uev-release-notes-1607.md
@@ -6,6 +6,7 @@ ms.pagetype: mdop, virtualization
ms.mktglfcycl: deploy
ms.sitesec: library
ms.prod: w10
+ms.date: 04/19/2017
---
# User Experience Virtualization (UE-V) Release Notes
diff --git a/windows/configuration/ue-v/uev-security-considerations.md b/windows/configuration/ue-v/uev-security-considerations.md
index 11f3d82582..9d75709470 100644
--- a/windows/configuration/ue-v/uev-security-considerations.md
+++ b/windows/configuration/ue-v/uev-security-considerations.md
@@ -6,6 +6,7 @@ ms.pagetype: mdop, virtualization
ms.mktglfcycl: deploy
ms.sitesec: library
ms.prod: w10
+ms.date: 04/19/2017
---
diff --git a/windows/configuration/ue-v/uev-sync-methods.md b/windows/configuration/ue-v/uev-sync-methods.md
index f6f490523d..dc43199116 100644
--- a/windows/configuration/ue-v/uev-sync-methods.md
+++ b/windows/configuration/ue-v/uev-sync-methods.md
@@ -6,6 +6,7 @@ ms.pagetype: mdop, virtualization
ms.mktglfcycl: deploy
ms.sitesec: library
ms.prod: w10
+ms.date: 04/19/2017
---
# Sync Methods for UE-V
diff --git a/windows/configuration/ue-v/uev-sync-trigger-events.md b/windows/configuration/ue-v/uev-sync-trigger-events.md
index 46add6efc1..7778a731b8 100644
--- a/windows/configuration/ue-v/uev-sync-trigger-events.md
+++ b/windows/configuration/ue-v/uev-sync-trigger-events.md
@@ -6,6 +6,7 @@ ms.pagetype: mdop, virtualization
ms.mktglfcycl: deploy
ms.sitesec: library
ms.prod: w10
+ms.date: 04/19/2017
---
# Sync Trigger Events for UE-V
diff --git a/windows/configuration/ue-v/uev-synchronizing-microsoft-office-with-uev.md b/windows/configuration/ue-v/uev-synchronizing-microsoft-office-with-uev.md
index 16f88eb881..585fe8822f 100644
--- a/windows/configuration/ue-v/uev-synchronizing-microsoft-office-with-uev.md
+++ b/windows/configuration/ue-v/uev-synchronizing-microsoft-office-with-uev.md
@@ -6,6 +6,7 @@ ms.pagetype: mdop, virtualization
ms.mktglfcycl: deploy
ms.sitesec: library
ms.prod: w10
+ms.date: 04/19/2017
---
diff --git a/windows/configuration/ue-v/uev-technical-reference.md b/windows/configuration/ue-v/uev-technical-reference.md
index 20adefafdf..e01635f519 100644
--- a/windows/configuration/ue-v/uev-technical-reference.md
+++ b/windows/configuration/ue-v/uev-technical-reference.md
@@ -6,6 +6,7 @@ ms.pagetype: mdop, virtualization
ms.mktglfcycl: deploy
ms.sitesec: library
ms.prod: w10
+ms.date: 04/19/2017
---
diff --git a/windows/configuration/ue-v/uev-troubleshooting.md b/windows/configuration/ue-v/uev-troubleshooting.md
index 7d8b2174c9..c84d8f3603 100644
--- a/windows/configuration/ue-v/uev-troubleshooting.md
+++ b/windows/configuration/ue-v/uev-troubleshooting.md
@@ -6,6 +6,7 @@ ms.pagetype: mdop, virtualization
ms.mktglfcycl: deploy
ms.sitesec: library
ms.prod: w10
+ms.date: 04/19/2017
---
diff --git a/windows/configuration/ue-v/uev-upgrade-uev-from-previous-releases.md b/windows/configuration/ue-v/uev-upgrade-uev-from-previous-releases.md
index 2487df2e88..a6bed35ea3 100644
--- a/windows/configuration/ue-v/uev-upgrade-uev-from-previous-releases.md
+++ b/windows/configuration/ue-v/uev-upgrade-uev-from-previous-releases.md
@@ -6,6 +6,7 @@ ms.pagetype: mdop, virtualization
ms.mktglfcycl: deploy
ms.sitesec: library
ms.prod: w10
+ms.date: 04/19/2017
---
# Upgrade to UE-V for Windows 10
diff --git a/windows/configuration/ue-v/uev-using-uev-with-application-virtualization-applications.md b/windows/configuration/ue-v/uev-using-uev-with-application-virtualization-applications.md
index d75e4e23cf..00c4e0c9b0 100644
--- a/windows/configuration/ue-v/uev-using-uev-with-application-virtualization-applications.md
+++ b/windows/configuration/ue-v/uev-using-uev-with-application-virtualization-applications.md
@@ -6,6 +6,7 @@ ms.pagetype: mdop, virtualization
ms.mktglfcycl: deploy
ms.sitesec: library
ms.prod: w10
+ms.date: 04/19/2017
---
diff --git a/windows/configuration/ue-v/uev-whats-new-in-uev-for-windows.md b/windows/configuration/ue-v/uev-whats-new-in-uev-for-windows.md
index 983297f22c..2270745715 100644
--- a/windows/configuration/ue-v/uev-whats-new-in-uev-for-windows.md
+++ b/windows/configuration/ue-v/uev-whats-new-in-uev-for-windows.md
@@ -6,6 +6,7 @@ ms.pagetype: mdop, virtualization
ms.mktglfcycl: deploy
ms.sitesec: library
ms.prod: w10
+ms.date: 04/19/2017
---
# What's New in UE-V
diff --git a/windows/configuration/ue-v/uev-working-with-custom-templates-and-the-uev-generator.md b/windows/configuration/ue-v/uev-working-with-custom-templates-and-the-uev-generator.md
index 056526037b..408e2115ac 100644
--- a/windows/configuration/ue-v/uev-working-with-custom-templates-and-the-uev-generator.md
+++ b/windows/configuration/ue-v/uev-working-with-custom-templates-and-the-uev-generator.md
@@ -6,6 +6,7 @@ ms.pagetype: mdop, virtualization
ms.mktglfcycl: deploy
ms.sitesec: library
ms.prod: w10
+ms.date: 04/19/2017
---
diff --git a/windows/configuration/wcd/wcd-accounts.md b/windows/configuration/wcd/wcd-accounts.md
index 7e89dfdb30..5be53d2953 100644
--- a/windows/configuration/wcd/wcd-accounts.md
+++ b/windows/configuration/wcd/wcd-accounts.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 08/21/2017
+ms.date: 09/06/2017
---
# Accounts (Windows Configuration Designer reference)
diff --git a/windows/configuration/wcd/wcd-admxingestion.md b/windows/configuration/wcd/wcd-admxingestion.md
index 52223258ad..4360cfac59 100644
--- a/windows/configuration/wcd/wcd-admxingestion.md
+++ b/windows/configuration/wcd/wcd-admxingestion.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 08/21/2017
+ms.date: 09/06/2017
---
# ADMXIngestion (Windows Configuration Designer reference)
@@ -77,7 +77,7 @@ Use the following PowerShell cmdlet to remove carriage returns and line feeds fr
```PS
$path="file path"
-Get-Content $path -Raw).Replace("'r'n","") | Set-Content $path -Force
+(Get-Content $path -Raw).Replace("'r'n","") | Set-Content $path -Force
```
## Category and policy in ADMX
diff --git a/windows/configuration/wcd/wcd-applicationmanagement.md b/windows/configuration/wcd/wcd-applicationmanagement.md
index 3a1b160d46..620e90e378 100644
--- a/windows/configuration/wcd/wcd-applicationmanagement.md
+++ b/windows/configuration/wcd/wcd-applicationmanagement.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 10/17/2017
+ms.date: 09/12/2017
---
# ApplicationManagement (Windows Configuration Designer reference)
diff --git a/windows/configuration/wcd/wcd-assignedaccess.md b/windows/configuration/wcd/wcd-assignedaccess.md
index 9c310df802..683fe674f2 100644
--- a/windows/configuration/wcd/wcd-assignedaccess.md
+++ b/windows/configuration/wcd/wcd-assignedaccess.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 10/17/2017
+ms.date: 09/14/2017
---
# AssignedAccess (Windows Configuration Designer reference)
diff --git a/windows/configuration/wcd/wcd-automatictime.md b/windows/configuration/wcd/wcd-automatictime.md
index 52d9845460..703fc62918 100644
--- a/windows/configuration/wcd/wcd-automatictime.md
+++ b/windows/configuration/wcd/wcd-automatictime.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 08/21/2017
+ms.date: 09/06/2017
---
# AutomaticTime (Windows Configuration Designer reference)
diff --git a/windows/configuration/wcd/wcd-browser.md b/windows/configuration/wcd/wcd-browser.md
index a8af54b4f9..823dfa407e 100644
--- a/windows/configuration/wcd/wcd-browser.md
+++ b/windows/configuration/wcd/wcd-browser.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 08/21/2017
+ms.date: 09/06/2017
---
# Browser (Windows Configuration Designer reference)
diff --git a/windows/configuration/wcd/wcd-callandmessagingenhancement.md b/windows/configuration/wcd/wcd-callandmessagingenhancement.md
index 0ccf7992cb..09358607f5 100644
--- a/windows/configuration/wcd/wcd-callandmessagingenhancement.md
+++ b/windows/configuration/wcd/wcd-callandmessagingenhancement.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 10/17/2017
+ms.date: 09/21/2017
---
# CallAndMessagingEnhancement (Windows Configuration Designer reference)
diff --git a/windows/configuration/wcd/wcd-calling.md b/windows/configuration/wcd/wcd-calling.md
index 0b1d46a821..9870b6d32e 100644
--- a/windows/configuration/wcd/wcd-calling.md
+++ b/windows/configuration/wcd/wcd-calling.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 10/17/2017
+ms.date: 09/21/2017
---
# Calling (Windows Configuration Designer reference)
diff --git a/windows/configuration/wcd/wcd-cellcore.md b/windows/configuration/wcd/wcd-cellcore.md
index 57347d1878..dc86093dd9 100644
--- a/windows/configuration/wcd/wcd-cellcore.md
+++ b/windows/configuration/wcd/wcd-cellcore.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 10/17/2017
+ms.date: 09/21/2017
---
# CellCore (Windows Configuration Designer reference)
diff --git a/windows/configuration/wcd/wcd-cellular.md b/windows/configuration/wcd/wcd-cellular.md
index 15ff4cbc51..1e6bdf31fa 100644
--- a/windows/configuration/wcd/wcd-cellular.md
+++ b/windows/configuration/wcd/wcd-cellular.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 10/17/2017
+ms.date: 09/21/2017
---
# Cellular (Windows Configuration Designer reference)
diff --git a/windows/configuration/wcd/wcd-certificates.md b/windows/configuration/wcd/wcd-certificates.md
index 4e414b4677..34575878e2 100644
--- a/windows/configuration/wcd/wcd-certificates.md
+++ b/windows/configuration/wcd/wcd-certificates.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 08/21/2017
+ms.date: 09/06/2017
---
# Certificates (Windows Configuration Designer reference)
diff --git a/windows/configuration/wcd/wcd-cleanpc.md b/windows/configuration/wcd/wcd-cleanpc.md
index fa14dead06..0841fd7fe6 100644
--- a/windows/configuration/wcd/wcd-cleanpc.md
+++ b/windows/configuration/wcd/wcd-cleanpc.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 08/21/2017
+ms.date: 09/06/2017
---
# CleanPC (Windows Configuration Designer reference)
diff --git a/windows/configuration/wcd/wcd-connections.md b/windows/configuration/wcd/wcd-connections.md
index a996e19cfc..c7e3a5d70c 100644
--- a/windows/configuration/wcd/wcd-connections.md
+++ b/windows/configuration/wcd/wcd-connections.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 10/17/2017
+ms.date: 10/09/2017
---
# Connections (Windows Configuration Designer reference)
diff --git a/windows/configuration/wcd/wcd-connectivityprofiles.md b/windows/configuration/wcd/wcd-connectivityprofiles.md
index 2a71e900c4..0073f13e81 100644
--- a/windows/configuration/wcd/wcd-connectivityprofiles.md
+++ b/windows/configuration/wcd/wcd-connectivityprofiles.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 08/21/2017
+ms.date: 01/10/2018
---
# ConnectivityProfiles (Windows Configuration Designer reference)
@@ -114,15 +114,33 @@ Configure settings to change the default maximum transmission unit ([MTU](#mtu))
| Setting | Description |
| --- | --- |
| **ProfileType** | Choose between **Native** and **Third Party** |
-| RememberCredentials | Select whether credentials should be cached |
| AlwaysOn | Set to **True** to automatically connect the VPN at sign-in |
-| LockDown | When set to **True**:- Profile automatically becomes an "always on" profile- VPN cannot be disconnected-If the profile is not connected, the user has no network connectivity- No other profiles can be connected or modified |
| ByPassForLocal | When set to **True**, requests to local resources on the same Wi-Fi neetwork as the VPN client can bypass VPN |
| DnsSuffix | Enter one or more comma-separated DNS suffixes. The first suffix listed is usedas the primary connection-specific DNS suffix for the VPN interface. The list is added to the SuffixSearchList. |
-| TrustedNetworkDetection | Enter a comma-separated string to identify the trusted network. VPN will not connect automatically when the user is on their corporate wireless network where protected resources are directly accessible to the device. |
+| LockDown | When set to **True**:- Profile automatically becomes an "always on" profile- VPN cannot be disconnected-If the profile is not connected, the user has no network connectivity- No other profiles can be connected or modified |
| Proxy | Configure to **Automatic** or **Manual** |
| ProxyAutoConfigUrl | When **Proxy** is set to **Automatic**, enter the URL to automatically retrieve the proxy settings |
| ProxyServer | When **Proxy** is set to **Manual**, enter the proxy server address as a fully qualified hostname or enter `IP address:Port` |
+| RememberCredentials | Select whether credentials should be cached |
+| TrustedNetworkDetection | Enter a comma-separated string to identify the trusted network. VPN will not connect automatically when the user is on their corporate wireless network where protected resources are directly accessible to the device. |
+
+When **ProfileType** is set to **Native**, the following additional settings are available.
+
+Setting | Description
+--- | ---
+AuthenticationUserMethod | When you set **NativeProtocolType** to **IKEv2**, choose between **EAP** and **MSChapv2**.
+EAPConfiguration | When you set **AuthenticationUserMethod** to **EAP**, enter the HTML-encoded XML to configure EAP. For more information, see [EAP configuration](https://docs.microsoft.com/windows/client-management/mdm/eap-configuration).
+NativeProtocolType | Choose between **PPTP**, **L2TP**, **IKEv2**, and **Automatic**.
+RoutingPolicyType | Choose between **SplitTunnel**, in which traffic can go over any interface as determined by the networking stack, and **ForceTunnel**, in which all IP traffic must go over the VPN interface.
+Server | Enter the public or routable IP address or DNS name for the VPN gateway. It can point to the exteranl IP of a gateway or a virtual IP for a server farm.
+
+When **ProfileType** is set to **Third Party**, the following additional settings are available.
+
+Setting | Description
+--- |---
+PluginProfileCustomConfiguration | Enter HTML-encoded XML for SSL-VPN plug-in specific configuration, including authentication information that is deployed to the device to make it available for SSL-VPN plug-ins. Contact the plug-in provider for format and other details. Most plug-ins can also configure values based on the server negotiations as well as defaults.
+PluginProfilePackageFamilyName | Choose between **Pulse Secure VPN**, **F5 VPN Client**, and **SonicWALL Mobile Connect**.
+PluginProfileServerUrlList | Enter a comma-separated list of servers in URL, hostname, or IP format.
## WiFiSense
@@ -148,7 +166,7 @@ The **Config** settings are initial settings that can be overwritten when settin
### SystemCapabilities
-You can use these settings to configure system capabilities for Wi-Fi adapters, which is a new functionality in Windows 10. These system capabilities are added at image time to ensure that the information is at its most accurate. The capabilities allow the OS to have a better understanding of the underlying hardware that it's running on. Telemetry data is generated by the system to provide data that can be used to diagnose both software and hardware issues.
+You can use these settings to configure system capabilities for Wi-Fi adapters, which is a new functionality in Windows 10. These system capabilities are added at image time to ensure that the information is at its most accurate. The capabilities allow the OS to have a better understanding of the underlying hardware that it's running on. Diagnostic data data is generated by the system to provide data that can be used to diagnose both software and hardware issues.
| Setting | Description |
| --- | --- |
diff --git a/windows/configuration/wcd/wcd-countryandregion.md b/windows/configuration/wcd/wcd-countryandregion.md
index 84e1e611f1..cea28f29ea 100644
--- a/windows/configuration/wcd/wcd-countryandregion.md
+++ b/windows/configuration/wcd/wcd-countryandregion.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 08/21/2017
+ms.date: 09/06/2017
---
# CountryAndRegion (Windows Configuration Designer reference)
diff --git a/windows/configuration/wcd/wcd-desktopbackgroundandcolors.md b/windows/configuration/wcd/wcd-desktopbackgroundandcolors.md
index 097f2e9273..516d965076 100644
--- a/windows/configuration/wcd/wcd-desktopbackgroundandcolors.md
+++ b/windows/configuration/wcd/wcd-desktopbackgroundandcolors.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 08/21/2017
+ms.date: 09/21/2017
---
# DesktopBackgroundAndColors (Windows Configuration Designer reference)
diff --git a/windows/configuration/wcd/wcd-developersetup.md b/windows/configuration/wcd/wcd-developersetup.md
index 76c7f07631..619c43ad8f 100644
--- a/windows/configuration/wcd/wcd-developersetup.md
+++ b/windows/configuration/wcd/wcd-developersetup.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 08/21/2017
+ms.date: 09/06/2017
---
# DeveloperSetup (Windows Configuration Designer reference)
diff --git a/windows/configuration/wcd/wcd-deviceformfactor.md b/windows/configuration/wcd/wcd-deviceformfactor.md
index c9d4434a24..5651da1065 100644
--- a/windows/configuration/wcd/wcd-deviceformfactor.md
+++ b/windows/configuration/wcd/wcd-deviceformfactor.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 08/21/2017
+ms.date: 09/06/2017
---
# DeviceFormFactor (Windows Configuration Designer reference)
diff --git a/windows/configuration/wcd/wcd-deviceinfo.md b/windows/configuration/wcd/wcd-deviceinfo.md
index 28e15ade95..97e88fe617 100644
--- a/windows/configuration/wcd/wcd-deviceinfo.md
+++ b/windows/configuration/wcd/wcd-deviceinfo.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 10/17/2017
+ms.date: 09/21/2017
---
# DeviceInfo (Windows Configuration Designer reference)
diff --git a/windows/configuration/wcd/wcd-devicemanagement.md b/windows/configuration/wcd/wcd-devicemanagement.md
index a37c32bee6..48555e434c 100644
--- a/windows/configuration/wcd/wcd-devicemanagement.md
+++ b/windows/configuration/wcd/wcd-devicemanagement.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 08/21/2017
+ms.date: 09/21/2017
---
# DeviceManagement (Windows Configuration Designer reference)
diff --git a/windows/configuration/wcd/wcd-dmclient.md b/windows/configuration/wcd/wcd-dmclient.md
index 27a6b9dd36..991cf820c1 100644
--- a/windows/configuration/wcd/wcd-dmclient.md
+++ b/windows/configuration/wcd/wcd-dmclient.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 08/21/2017
+ms.date: 09/06/2017
---
# DMClient (Windows Configuration Designer reference)
diff --git a/windows/configuration/wcd/wcd-editionupgrade.md b/windows/configuration/wcd/wcd-editionupgrade.md
index 76e05d28ae..7cf47f5528 100644
--- a/windows/configuration/wcd/wcd-editionupgrade.md
+++ b/windows/configuration/wcd/wcd-editionupgrade.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 08/21/2017
+ms.date: 09/06/2017
---
# EditionUpgrade (Windows Configuration Designer reference)
diff --git a/windows/configuration/wcd/wcd-embeddedlockdownprofiles.md b/windows/configuration/wcd/wcd-embeddedlockdownprofiles.md
index 2203a1cb2b..8728978340 100644
--- a/windows/configuration/wcd/wcd-embeddedlockdownprofiles.md
+++ b/windows/configuration/wcd/wcd-embeddedlockdownprofiles.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 08/21/2017
+ms.date: 09/06/2017
---
# EmbeddedLockdownProfiles (Windows Configuration Designer reference)
diff --git a/windows/configuration/wcd/wcd-firewallconfiguration.md b/windows/configuration/wcd/wcd-firewallconfiguration.md
index df61861e90..7a3d133608 100644
--- a/windows/configuration/wcd/wcd-firewallconfiguration.md
+++ b/windows/configuration/wcd/wcd-firewallconfiguration.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 08/21/2017
+ms.date: 09/06/2017
---
# FirewallConfiguration (Windows Configuration Designer reference)
diff --git a/windows/configuration/wcd/wcd-firstexperience.md b/windows/configuration/wcd/wcd-firstexperience.md
index cf0f7c1983..a28f6531bc 100644
--- a/windows/configuration/wcd/wcd-firstexperience.md
+++ b/windows/configuration/wcd/wcd-firstexperience.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 08/21/2017
+ms.date: 09/06/2017
---
# FirstExperience (Windows Configuration Designer reference)
diff --git a/windows/configuration/wcd/wcd-folders.md b/windows/configuration/wcd/wcd-folders.md
index 08eff6065d..b2eff878f5 100644
--- a/windows/configuration/wcd/wcd-folders.md
+++ b/windows/configuration/wcd/wcd-folders.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 08/21/2017
+ms.date: 09/06/2017
---
# Folders (Windows Configuration Designer reference)
diff --git a/windows/configuration/wcd/wcd-hotspot.md b/windows/configuration/wcd/wcd-hotspot.md
index cea5973633..b94a37b66d 100644
--- a/windows/configuration/wcd/wcd-hotspot.md
+++ b/windows/configuration/wcd/wcd-hotspot.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 10/17/2017
+ms.date: 09/14/2017
---
# HotSpot (Windows Configuration Designer reference)
diff --git a/windows/configuration/wcd/wcd-initialsetup.md b/windows/configuration/wcd/wcd-initialsetup.md
index a579fca408..59ca15a3aa 100644
--- a/windows/configuration/wcd/wcd-initialsetup.md
+++ b/windows/configuration/wcd/wcd-initialsetup.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 08/21/2017
+ms.date: 09/06/2017
---
# InitialSetup (Windows Configuration Designer reference)
diff --git a/windows/configuration/wcd/wcd-internetexplorer.md b/windows/configuration/wcd/wcd-internetexplorer.md
index e3290e6905..02987bcc9a 100644
--- a/windows/configuration/wcd/wcd-internetexplorer.md
+++ b/windows/configuration/wcd/wcd-internetexplorer.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 08/21/2017
+ms.date: 09/06/2017
---
# InternetExplorer (Windows Configuration Designer reference)
diff --git a/windows/configuration/wcd/wcd-licensing.md b/windows/configuration/wcd/wcd-licensing.md
index 7ae7661ea8..d939f1c11f 100644
--- a/windows/configuration/wcd/wcd-licensing.md
+++ b/windows/configuration/wcd/wcd-licensing.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 08/21/2017
+ms.date: 09/06/2017
---
# Licensing (Windows Configuration Designer reference)
diff --git a/windows/configuration/wcd/wcd-maps.md b/windows/configuration/wcd/wcd-maps.md
index afe5f92c1c..62fc500f1b 100644
--- a/windows/configuration/wcd/wcd-maps.md
+++ b/windows/configuration/wcd/wcd-maps.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 08/21/2017
+ms.date: 09/06/2017
---
# Maps (Windows Configuration Designer reference)
diff --git a/windows/configuration/wcd/wcd-messaging.md b/windows/configuration/wcd/wcd-messaging.md
index 2f2ab14958..1e7444531d 100644
--- a/windows/configuration/wcd/wcd-messaging.md
+++ b/windows/configuration/wcd/wcd-messaging.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 10/17/2017
+ms.date: 09/21/2017
---
# Messaging (Windows Configuration Designer reference)
diff --git a/windows/configuration/wcd/wcd-modemconfigurations.md b/windows/configuration/wcd/wcd-modemconfigurations.md
index eb663dfd65..d9e44fcdec 100644
--- a/windows/configuration/wcd/wcd-modemconfigurations.md
+++ b/windows/configuration/wcd/wcd-modemconfigurations.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 10/17/2017
+ms.date: 09/12/2017
---
# ModemConfiguration (Windows Configuration Designer reference)
diff --git a/windows/configuration/wcd/wcd-multivariant.md b/windows/configuration/wcd/wcd-multivariant.md
index fa8c0d735f..040e99d17d 100644
--- a/windows/configuration/wcd/wcd-multivariant.md
+++ b/windows/configuration/wcd/wcd-multivariant.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 08/21/2017
+ms.date: 09/06/2017
---
# Multivariant (Windows Configuration Designer reference)
diff --git a/windows/configuration/wcd/wcd-networkproxy.md b/windows/configuration/wcd/wcd-networkproxy.md
index 3689226767..e14688c052 100644
--- a/windows/configuration/wcd/wcd-networkproxy.md
+++ b/windows/configuration/wcd/wcd-networkproxy.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 08/21/2017
+ms.date: 09/06/2017
---
# NetworkProxy (Windows Configuration Designer reference)
diff --git a/windows/configuration/wcd/wcd-networkqospolicy.md b/windows/configuration/wcd/wcd-networkqospolicy.md
index be9d9f4d69..a70fff2d1c 100644
--- a/windows/configuration/wcd/wcd-networkqospolicy.md
+++ b/windows/configuration/wcd/wcd-networkqospolicy.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 08/21/2017
+ms.date: 09/06/2017
---
# NetworkQoSPolicy (Windows Configuration Designer reference)
diff --git a/windows/configuration/wcd/wcd-nfc.md b/windows/configuration/wcd/wcd-nfc.md
index 1b56de1940..46fd5e425a 100644
--- a/windows/configuration/wcd/wcd-nfc.md
+++ b/windows/configuration/wcd/wcd-nfc.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 08/21/2017
+ms.date: 09/06/2017
---
# NFC (Windows Configuration Designer reference)
diff --git a/windows/configuration/wcd/wcd-oobe.md b/windows/configuration/wcd/wcd-oobe.md
index e609255e3d..e875e3889c 100644
--- a/windows/configuration/wcd/wcd-oobe.md
+++ b/windows/configuration/wcd/wcd-oobe.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 08/21/2017
+ms.date: 09/06/2017
---
# OOBE (Windows Configuration Designer reference)
diff --git a/windows/configuration/wcd/wcd-otherassets.md b/windows/configuration/wcd/wcd-otherassets.md
index ff79d72f5f..1a62876716 100644
--- a/windows/configuration/wcd/wcd-otherassets.md
+++ b/windows/configuration/wcd/wcd-otherassets.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 08/21/2017
+ms.date: 09/06/2017
---
# OtherAssets (Windows Configuration Designer reference)
diff --git a/windows/configuration/wcd/wcd-personalization.md b/windows/configuration/wcd/wcd-personalization.md
index a5aaee541d..375aeb8cd6 100644
--- a/windows/configuration/wcd/wcd-personalization.md
+++ b/windows/configuration/wcd/wcd-personalization.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 08/21/2017
+ms.date: 09/06/2017
---
# Personalization (Windows Configuration Designer reference)
diff --git a/windows/configuration/wcd/wcd-policies.md b/windows/configuration/wcd/wcd-policies.md
index 2cef9b94d5..25f5b58fc5 100644
--- a/windows/configuration/wcd/wcd-policies.md
+++ b/windows/configuration/wcd/wcd-policies.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 10/17/2017
+ms.date: 10/16/2017
---
# Policies (Windows Configuration Designer reference)
@@ -372,10 +372,10 @@ This section describes the **Policies** settings that you can configure in [prov
| [AllowExperimentation](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#system-allowexperimentation) | Determine the level that Microsoft can experiment with the product to study user preferences or device behavior. | X | X | | | |
| [AllowLocation](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#system-allowlocation) | Specify whether to allow app access to the Location service. | X | X | X | X | X |
| [AllowStorageCard](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#system-allowstoragecard) | Specify whether the user is allowed to use the storage card for device storage. | X | X | X | X | X |
-| [AllowTelemetry](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#system-allowtelemetry) | Allow the device to send diagnostic and useage telemetry data. | X | X | | | |
+| [AllowTelemetry](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#system-allowtelemetry) | Allow the device to send diagnostic and usage data. | X | X | | | |
| [AllowUserToResetPhone](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#system-allowusertoresetphone) | Allow the user to factory reset the phone. | X | X | | | |
| [DisableOneDriveFileSync](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#system-disableonedrivefilesync) | Prevent apps and features from working with files on OneDrive. | X | | | | |
-| [LimitEnhancedDiagnosticDataWindowsAnalytics](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-system#system-limitenhanceddiagnosticdatawindowsanalytics) | This policy setting, in combination with the System/AllowTelemetry policy setting, enables organizations to send Microsoft a specific set of diagnostic data for IT insights via Windows Analytics services. To enable this behavior you must enable this policy setting, and set Allow Telemetry to level 2 (Enhanced). When you configure these policy settings, a basic level of diagnostic data plus additional events that are required for Windows Analytics are sent to Microsoft. These events are documented in [Windows 10, version 1703 basic level Windows diagnostic events and fields](https://go.microsoft.com/fwlink/?linkid=847594). Enabling enhanced diagnostic data in the System/AllowTelemetry policy in combination with not configuring this policy will also send the required events for Windows Analytics, plus additional enhanced level telemetry data. This setting has no effect on computers configured to send full, basic or security level diagnostic data to Microsoft. If you disable or do not configure this policy setting, then the level of diagnostic data sent to Microsoft is determined by the System/AllowTelemetry policy. | X | X | | | |
+| [LimitEnhancedDiagnosticDataWindowsAnalytics](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-system#system-limitenhanceddiagnosticdatawindowsanalytics) | This policy setting, in combination with the System/AllowTelemetry policy setting, enables organizations to send Microsoft a specific set of diagnostic data for IT insights via Windows Analytics services. To enable this behavior you must enable this policy setting, and set Allow Telemetry to level 2 (Enhanced). When you configure these policy settings, a basic level of diagnostic data plus additional events that are required for Windows Analytics are sent to Microsoft. These events are documented in [Windows 10, version 1703 basic level Windows diagnostic events and fields](https://go.microsoft.com/fwlink/?linkid=847594). Enabling enhanced diagnostic data in the System/AllowTelemetry policy in combination with not configuring this policy will also send the required events for Windows Analytics, plus additional enhanced level diagnostic data. This setting has no effect on computers configured to send full, basic or security level diagnostic data to Microsoft. If you disable or do not configure this policy setting, then the level of diagnostic data sent to Microsoft is determined by the System/AllowTelemetry policy. | X | X | | | |
## TextInput
diff --git a/windows/configuration/wcd/wcd-provisioningcommands.md b/windows/configuration/wcd/wcd-provisioningcommands.md
index 7ab3bd2e35..6cb6f9afbf 100644
--- a/windows/configuration/wcd/wcd-provisioningcommands.md
+++ b/windows/configuration/wcd/wcd-provisioningcommands.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 08/21/2017
+ms.date: 09/06/2017
---
# ProvisioningCommands (Windows Configuration Designer reference)
diff --git a/windows/configuration/wcd/wcd-sharedpc.md b/windows/configuration/wcd/wcd-sharedpc.md
index 0cdf6b108d..91e6bc382b 100644
--- a/windows/configuration/wcd/wcd-sharedpc.md
+++ b/windows/configuration/wcd/wcd-sharedpc.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 08/21/2017
+ms.date: 10/16/2017
---
# SharedPC (Windows Configuration Designer reference)
@@ -60,4 +60,3 @@ Use these settings to configure policies for shared PC mode.
- [Set up shared or guest PC](../set-up-shared-or-guest-pc.md)
-Not finding content you need? Windows 10 users, tell us what you want on [Feedback Hub](feedback-hub://?referrer=techDocsUcPage&tabid=2&contextid=897&newFeedback=true&topic=wcd-sharedpc.md).
\ No newline at end of file
diff --git a/windows/configuration/wcd/wcd-shell.md b/windows/configuration/wcd/wcd-shell.md
index a0b581cb04..c235c4d8e1 100644
--- a/windows/configuration/wcd/wcd-shell.md
+++ b/windows/configuration/wcd/wcd-shell.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 08/21/2017
+ms.date: 09/06/2017
---
# Shell (Windows Configuration Designer reference)
diff --git a/windows/configuration/wcd/wcd-smisettings.md b/windows/configuration/wcd/wcd-smisettings.md
index df459903c7..9be7d411e7 100644
--- a/windows/configuration/wcd/wcd-smisettings.md
+++ b/windows/configuration/wcd/wcd-smisettings.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 08/21/2017
+ms.date: 09/06/2017
---
# SMISettings (Windows Configuration Designer reference)
diff --git a/windows/configuration/wcd/wcd-start.md b/windows/configuration/wcd/wcd-start.md
index 3256dea604..97c6af5208 100644
--- a/windows/configuration/wcd/wcd-start.md
+++ b/windows/configuration/wcd/wcd-start.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 08/21/2017
+ms.date: 09/06/2017
---
# Start (Windows Configuration Designer reference)
diff --git a/windows/configuration/wcd/wcd-startupapp.md b/windows/configuration/wcd/wcd-startupapp.md
index 3e9d1ca9b2..510db01214 100644
--- a/windows/configuration/wcd/wcd-startupapp.md
+++ b/windows/configuration/wcd/wcd-startupapp.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 08/21/2017
+ms.date: 09/06/2017
---
# StartupApp (Windows Configuration Designer reference)
diff --git a/windows/configuration/wcd/wcd-startupbackgroundtasks.md b/windows/configuration/wcd/wcd-startupbackgroundtasks.md
index 2e5c3fa161..8ebd2c7d1b 100644
--- a/windows/configuration/wcd/wcd-startupbackgroundtasks.md
+++ b/windows/configuration/wcd/wcd-startupbackgroundtasks.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 08/21/2017
+ms.date: 09/06/2017
---
# StartupBackgroundTasks (Windows Configuration Designer reference)
diff --git a/windows/configuration/wcd/wcd-surfacehubmanagement.md b/windows/configuration/wcd/wcd-surfacehubmanagement.md
index 4a6dbb3dd3..08a7ebf56f 100644
--- a/windows/configuration/wcd/wcd-surfacehubmanagement.md
+++ b/windows/configuration/wcd/wcd-surfacehubmanagement.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 08/21/2017
+ms.date: 09/06/2017
---
# SurfaceHubManagement (Windows Configuration Designer reference)
diff --git a/windows/configuration/wcd/wcd-tabletmode.md b/windows/configuration/wcd/wcd-tabletmode.md
index 5f454d89bb..fa5f2811ac 100644
--- a/windows/configuration/wcd/wcd-tabletmode.md
+++ b/windows/configuration/wcd/wcd-tabletmode.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 08/21/2017
+ms.date: 09/06/2017
---
# TabletMode (Windows Configuration Designer reference)
diff --git a/windows/configuration/wcd/wcd-takeatest.md b/windows/configuration/wcd/wcd-takeatest.md
index c498ffd865..ebcde22c71 100644
--- a/windows/configuration/wcd/wcd-takeatest.md
+++ b/windows/configuration/wcd/wcd-takeatest.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 08/21/2017
+ms.date: 09/06/2017
---
# TakeATest (Windows Configuration Designer reference)
diff --git a/windows/configuration/wcd/wcd-textinput.md b/windows/configuration/wcd/wcd-textinput.md
index f6f910591d..f37bea8555 100644
--- a/windows/configuration/wcd/wcd-textinput.md
+++ b/windows/configuration/wcd/wcd-textinput.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 10/17/2017
+ms.date: 09/15/2017
---
# TextInput (Windows Configuration Designer reference)
diff --git a/windows/configuration/wcd/wcd-theme.md b/windows/configuration/wcd/wcd-theme.md
index bc5710c264..d916af1dba 100644
--- a/windows/configuration/wcd/wcd-theme.md
+++ b/windows/configuration/wcd/wcd-theme.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 08/21/2017
+ms.date: 09/06/2017
---
# Theme (reference)
diff --git a/windows/configuration/wcd/wcd-unifiedwritefilter.md b/windows/configuration/wcd/wcd-unifiedwritefilter.md
index 5ba21b01a3..d8fb020e8a 100644
--- a/windows/configuration/wcd/wcd-unifiedwritefilter.md
+++ b/windows/configuration/wcd/wcd-unifiedwritefilter.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 08/21/2017
+ms.date: 09/06/2017
---
# UnifiedWriteFilter (reference)
diff --git a/windows/configuration/wcd/wcd-universalappinstall.md b/windows/configuration/wcd/wcd-universalappinstall.md
index e5fde4a704..a18abf5f59 100644
--- a/windows/configuration/wcd/wcd-universalappinstall.md
+++ b/windows/configuration/wcd/wcd-universalappinstall.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 10/17/2017
+ms.date: 10/09/2017
---
# UniversalAppInstall (reference)
diff --git a/windows/configuration/wcd/wcd-universalappuninstall.md b/windows/configuration/wcd/wcd-universalappuninstall.md
index 3c2049687f..5b860d2185 100644
--- a/windows/configuration/wcd/wcd-universalappuninstall.md
+++ b/windows/configuration/wcd/wcd-universalappuninstall.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 10/17/2017
+ms.date: 09/14/2017
---
# UniversalAppUninstall (reference)
diff --git a/windows/configuration/wcd/wcd-usberrorsoemoverride.md b/windows/configuration/wcd/wcd-usberrorsoemoverride.md
index 47596e69d3..cd08ba4359 100644
--- a/windows/configuration/wcd/wcd-usberrorsoemoverride.md
+++ b/windows/configuration/wcd/wcd-usberrorsoemoverride.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 08/21/2017
+ms.date: 09/14/2017
---
# UsbErrorsOEMOverride (reference)
diff --git a/windows/configuration/wcd/wcd-weakcharger.md b/windows/configuration/wcd/wcd-weakcharger.md
index 92f8844d81..04bb9e13f5 100644
--- a/windows/configuration/wcd/wcd-weakcharger.md
+++ b/windows/configuration/wcd/wcd-weakcharger.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 08/21/2017
+ms.date: 09/06/2017
---
# WeakCharger (reference)
diff --git a/windows/configuration/wcd/wcd-windowsteamsettings.md b/windows/configuration/wcd/wcd-windowsteamsettings.md
index 26c23a84ce..2cdf863196 100644
--- a/windows/configuration/wcd/wcd-windowsteamsettings.md
+++ b/windows/configuration/wcd/wcd-windowsteamsettings.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 08/21/2017
+ms.date: 09/06/2017
---
# WindowsTeamSettings (reference)
diff --git a/windows/configuration/wcd/wcd-wlan.md b/windows/configuration/wcd/wcd-wlan.md
index 80bbb26cf5..f584777f6d 100644
--- a/windows/configuration/wcd/wcd-wlan.md
+++ b/windows/configuration/wcd/wcd-wlan.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 08/21/2017
+ms.date: 09/06/2017
---
# WLAN (reference)
diff --git a/windows/configuration/wcd/wcd-workplace.md b/windows/configuration/wcd/wcd-workplace.md
index 8db1aa11a4..553b4f2688 100644
--- a/windows/configuration/wcd/wcd-workplace.md
+++ b/windows/configuration/wcd/wcd-workplace.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 08/21/2017
+ms.date: 09/06/2017
---
# Workplace (reference)
diff --git a/windows/configuration/wcd/wcd.md b/windows/configuration/wcd/wcd.md
index c5ab2a15e7..a3d503fd08 100644
--- a/windows/configuration/wcd/wcd.md
+++ b/windows/configuration/wcd/wcd.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: jdeckerMS
ms.localizationpriority: medium
ms.author: jdecker
-ms.date: 10/17/2017
+ms.date: 10/09/2017
---
# Windows Configuration Designer provisioning settings (reference)
diff --git a/windows/configuration/windows-10-accessibility-for-ITPros.md b/windows/configuration/windows-10-accessibility-for-ITPros.md
new file mode 100644
index 0000000000..62dae40b01
--- /dev/null
+++ b/windows/configuration/windows-10-accessibility-for-ITPros.md
@@ -0,0 +1,86 @@
+---
+title: Windows 10 accessibility information for IT Pros (Windows 10)
+description:
+ms.prod: W10
+ms.mktglfcycl: manage
+ms.sitesec: library
+author: jaimeo
+ms.localizationpriority: high
+ms.date: 01/12/2018
+---
+
+# Accessibility information for IT Professionals
+Microsoft is dedicated to making its products and services accessible and usable for everyone. Windows 10 includes accessibility features that benefit all users. These features make it easier to customize the computer and give users with different abilities options to improve their experience with Windows.
+This topic helps IT administrators learn about built-in accessibility features, and includes a few recommendations for how to support people in your organization who use these features.
+
+## General recommendations
+- **Be aware of Ease of Access settings** – Understand how people in your organization might use these settings. Help people in your organization learn how they can customize Windows 10.
+- **Do not block settings** – Avoid using Group Policy or MDM settings that override Ease of Access settings.
+- **Encourage choice** – Allow people in your organization to customize their computers based on their needs. That might mean installing an add-on for their browser, or a non-Microsoft assistive technology.
+
+## Vision
+
+| Accessibility feature | Description |
+|---------------------------|------------|
+| [Use Narrator to use devices without a screen](https://support.microsoft.com/help/22798/windows-10-narrator-get-started) | Narrator describes Windows and apps and enables you to control devices by using a keyboard, controller, or with a range of gestures on touch-supported devices.|
+| [Create accessible apps](https://developer.microsoft.com/windows/accessible-apps) | You can develop accessible apps just like Mail, Groove, and Store that work well with Narrator and other leading screen readers.|
+| Use keyboard shortcuts for [Windows](https://support.microsoft.com/help/12445/windows-keyboard-shortcuts), [Narrator](https://support.microsoft.com/en-us/help/22806), and [Magnifier](https://support.microsoft.com/en-us/help/13810) | Get the most out of Windows with shortcuts for apps and desktops.|
+| Get closer with [Magnifier](https://support.microsoft.com/help/11542/windows-use-magnifier) | Magnifier enlarges all or part of your screen and offers a variety of configuration settings.|
+| [Cursor and pointer adjustments](https://support.microsoft.com/help/27928/windows-10-make-windows-easier-to-see) | Changing the size or color of pointers or adding trails or touch feedback make it easier to follow the mouse.|
+| [Have Cortana assist](https://support.microsoft.com/help/17214/windows-10-what-is) | Cortana can handle a variety of tasks for you, including setting reminders, opening apps, finding facts, and sending emails and texts.|
+| [Dictate text and commands](https://support.microsoft.com/help/17208/windows-10-use-speech-recognition) | Windows includes speech recognition that lets you tell it what to do.|
+| [Customize the size](https://support.microsoft.com/help/27928/windows-10-make-windows-easier-to-see) of screen items | You can adjust the size of text, icons, and other screen items to make them easier to see.|
+| [Improve contrast](https://support.microsoft.com/help/27928/windows-10-make-windows-easier-to-see) | A number of high-contrast themes are available to suit your needs.|
+| [Simplify for focus](https://support.microsoft.com/help/27930) | Reducing animations and turning off background images and transparency can minimize distractions.|
+| [Keep notifications around longer](https://support.microsoft.com/help/27933/windows-10-make-windows-easier-to-hear) | If notifications aren't staying visible long enough for you to notice them, you can increase the time a notification will be displayed up to five minutes.|
+| [Read in Braille](https://support.microsoft.com/help/4004263) | Narrator supports braille displays from more than 35 manufacturers using more than 40 languages and multiple braille variants.|
+
+## Hearing
+
+| Accessibility feature | Description |
+|---------------------------|------------|
+| [Transcribe with Translator](https://www.skype.com/en/features/skype-translator) | Translator can transcribe voice to text so you won’t miss what’s being said. |
+| [Use Skype for sign language](https://www.skype.com/en/) | Skype is available on a variety of platforms and devices, so you don’t have to worry about whether your co-workers, friends and family can communicate with you.|
+| [Get visual notifications for sounds](https://support.microsoft.com/help/27933/windows-10-make-windows-easier-to-hear) | You can replace audible alerts with visual alerts.|
+| [Keep notifications around longer](https://support.microsoft.com/help/27933/windows-10-make-windows-easier-to-hear)|If notifications aren't staying visible long enough for you to notice them, you can increase the time a notification will be displayed up to five minutes.|
+| [Read spoken words with closed captioning](https://support.microsoft.com/help/21055/windows-10-closed-caption-settings) | You can customize things like color, size, and background transparency to suit your needs and tastes.|
+| [Switch to mono audio](https://support.microsoft.com/help/27933/) | Sending all sounds to both left and right channels is helpful for those with partial hearing loss or deafness in one ear.|
+
+## Physical
+
+| Accessibility feature | Description|
+|---------------------------|------------|
+| [Have Cortana assist](https://support.microsoft.com/help/17214/windows-10-what-is) | Cortana can handle a variety of tasks for you, including setting reminders, opening apps, finding facts, and sending emails and texts.|
+| [Dictate text and commands](https://support.microsoft.com/help/17208/windows-10-use-speech-recognition) | Windows includes speech recognition that lets you tell it what to do.|
+| Use the On-Screen Keyboard (OSK) | Instead of relying on a physical keyboard, you can use the [On-Screen Keyboard](https://support.microsoft.com/help/10762/windows-use-on-screen-keyboard) to type and enter data and select keys with a mouse or othet pointing device. Additionally, the OSK offers [word prediction and completion](https://support.microsoft.com/help/10762/windows-use-on-screen-keyboard).|
+| [Live Tiles](https://support.microsoft.com/help/17176/windows-10-organize-your-apps)| Because Live Tiles display constantly updated information for many apps, you don't have to bother actually opening them. You can arrange, resize, and move tiles as needed.|
+| [Keyboard assistance features](https://support.microsoft.com/help/27936)| You can personalize your keyboard to ignore repeated keys and do other helpful things if you have limited control of your hands.|
+| [Mouse Keys](https://support.microsoft.com/help/27936)|If a mouse is difficult to use, you can control the pointer by using your numeric keypad.|
+
+## Cognition
+
+| Accessibility feature | Description|
+|---------------------------|------------|
+| [Simplify for focus](https://support.microsoft.com/help/27930) | Reducing animations and turning off background images and transparency can minimize distractions.|
+| Use the On-Screen Keyboard (OSK) | Instead of relying on a physical keyboard, you can use the [On-Screen Keyboard](https://support.microsoft.com/help/10762/windows-use-on-screen-keyboard) to type and enter data and select keys with a mouse or othet pointing device. Additionally, the OSK offers [word prediction and completion](https://support.microsoft.com/help/10762/windows-use-on-screen-keyboard).|
+| [Dictate text and commands](https://support.microsoft.com/help/17208/windows-10-use-speech-recognition) | Windows includes speech recognition that lets you tell it what to do.|
+| [Use fonts that are easier to read](https://www.microsoft.com/download/details.aspx?id=50721) | Fluent Sitka Small and Fluent Calibri are fonts that address "visual crowding" by adding character and enhance word and line spacing. |
+| [Edge Reading View](https://support.microsoft.com/help/17204/windows-10-take-your-reading-with-you) | Clears distracting content from web pages so you can stay focused on what you really want to read. |
+| [Edge includes an e-book reader](https://support.microsoft.com/help/4014945) | The Microsoft Edge e-book reader includes options to increase text spacing and read text aloud to help make it easier for everyone to read and enjoy text, including people with learning differences like dyslexia and English language learners. |
+
+
+
+## Assistive technology devices built into Windows 10
+| Assistive technology | How it helps |
+|---------------------------|------------|
+| [Hear text read aloud with Narrator](https://support.microsoft.com/help/17173) | Narrator reads text on your PC screen aloud and describes events, such as notifications or calendar appointments, so you can use your PC without a display.|
+| [Use Speech Recognition]( https://support.microsoft.com/help/17208 ) | Narrator reads text on your PC screen aloud and describes events, such as notifications or calendar appointments, so you can use your PC without a display.|
+| [Save time with keyboard shortcuts]( https://support.microsoft.com/help/17189) | Keyboard shortcuts for apps and desktops.|
+
+## Additional resources
+[Windows accessibility](https://www.microsoft.com/Accessibility/windows)
+
+[Designing accessible software]( https://msdn.microsoft.com/windows/uwp/accessibility/designing-inclusive-software)
+
+[Inclusive Design](https://www.microsoft.com/design/inclusive)
+
diff --git a/windows/configuration/windows-10-start-layout-options-and-policies.md b/windows/configuration/windows-10-start-layout-options-and-policies.md
index 1dfaf43e0f..891f928d4d 100644
--- a/windows/configuration/windows-10-start-layout-options-and-policies.md
+++ b/windows/configuration/windows-10-start-layout-options-and-policies.md
@@ -8,6 +8,7 @@ ms.mktglfcycl: manage
ms.sitesec: library
author: jdeckerms
ms.localizationpriority: high
+ms.date: 10/31/2017
---
# Manage Windows 10 Start and taskbar layout
@@ -113,7 +114,7 @@ The new taskbar layout for upgrades to Windows 10, version 1607 or later, will a
- [Customize Windows 10 Start and tasbkar with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md)
- [Changes to Start policies in Windows 10](changes-to-start-policies-in-windows-10.md)
-Not finding content you need? Windows 10 users, tell us what you want on [Feedback Hub](feedback-hub://?referrer=techDocsUcPage&tabid=2&contextid=897&newFeedback=true&topic=windows-10-start-layout-options-and-policies.md).
+
diff --git a/windows/configuration/windows-diagnostic-data.md b/windows/configuration/windows-diagnostic-data-1703.md
similarity index 96%
rename from windows/configuration/windows-diagnostic-data.md
rename to windows/configuration/windows-diagnostic-data-1703.md
index 3cfd6d422a..954a8fc5e0 100644
--- a/windows/configuration/windows-diagnostic-data.md
+++ b/windows/configuration/windows-diagnostic-data-1703.md
@@ -1,6 +1,6 @@
---
-title: Windows 10 diagnostic data for the Full telemetry level (Windows 10)
-description: Use this article to learn about the types of data that is collected the the Full telemetry level.
+title: Windows 10 diagnostic data for the Full diagnostic data level (Windows 10)
+description: Use this article to learn about the types of data that is collected the the Full diagnostic data level.
keywords: privacy,Windows 10
ms.prod: w10
ms.mktglfcycl: manage
@@ -8,15 +8,15 @@ ms.sitesec: library
ms.localizationpriority: high
author: eross-msft
ms.author: lizross
-ms.date: 10/17/2017
+ms.date: 04/05/2017
---
-# Windows 10 diagnostic data for the Full telemetry level
+# Windows 10 diagnostic data for the Full diagnostic data level
**Applies to:**
- Windows 10, version 1703 and later
-Microsoft collects Windows diagnostic data to keep Windows up-to-date, secure, and operating properly. It also helps us improve Windows and, for users who have turned on “tailored experiences”, can be used to provide more relevant tips and recommendations to tailor Microsoft products to the user’s needs. This article describes all types diagnostic data collected by Windows at the Full telemetry level (inclusive of data collected at Basic), with comprehensive examples of data we collect per each type. For additional, detailed technical descriptions of Basic data items, see [Windows 10, version 1709 Basic level diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1709.md) and [Windows 10, version 1703 Basic level diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields.md).
+Microsoft collects Windows diagnostic data to keep Windows up-to-date, secure, and operating properly. It also helps us improve Windows and, for users who have turned on “tailored experiences”, can be used to provide more relevant tips and recommendations to tailor Microsoft products to the user’s needs. This article describes all types diagnostic data collected by Windows at the Full diagnostic data level (inclusive of data collected at Basic), with comprehensive examples of data we collect per each type. For additional, detailed technical descriptions of Basic data items, see [Windows 10, version 1709 Basic level diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields.md) and [Windows 10, version 1703 Basic level diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md).
The data covered in this article is grouped into the following categories:
diff --git a/windows/configuration/windows-spotlight.md b/windows/configuration/windows-spotlight.md
index 00841c6aa9..6e1b327c7d 100644
--- a/windows/configuration/windows-spotlight.md
+++ b/windows/configuration/windows-spotlight.md
@@ -8,6 +8,7 @@ ms.mktglfcycl: explore
ms.sitesec: library
author: jdeckerms
ms.localizationpriority: high
+ms.date: 01/26/2018
---
# Configure Windows Spotlight on the lock screen
@@ -24,7 +25,7 @@ For managed devices running Windows 10 Enterprise and Windows 10 Education, en
>[!NOTE]
->In Windows 10, version 1607, the lock screen background does not display if you disable the **Animate windows when minimizing and mazimizing** setting in **This PC** > **Properties** > **Advanced system settings** > **Performance settings** > **Visual Effects**, or if you enable the Group Policy setting **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Desktop Windows Manager** > **Do not allow windows animations**.
+>In Windows 10, version 1607, the lock screen background does not display if you disable the **Animate windows when minimizing and maximizing** setting in **This PC** > **Properties** > **Advanced system settings** > **Performance settings** > **Visual Effects**, or if you enable the Group Policy setting **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Desktop Windows Manager** > **Do not allow windows animations**.
>
>In Windows 10, version 1703, you can use the [Personalization CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/personalization-csp) settings to set lock screen and desktop background images.
@@ -67,19 +68,29 @@ Windows Spotlight is enabled by default. Windows 10 provides Group Policy and mo
In addition to the specific policy settings for Windows Spotlight, administrators can replace Windows Spotlight with a selected image using the Group Policy setting **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Personalization** > **Force a specific default lock screen image**.
+ >[!TIP]
+ >If you want to use a custom lock screen image that contains text, see [Resolution for custom lock screen image](#resolution-for-custom-lock-screen-image).
+
Pay attention to the checkbox in **Options**. In addition to providing the path to the lock screen image, administrators can choose to allow or **Turn off fun facts, tips, tricks, and more on lock screen**. If the checkbox is not selected, users will see the lock screen image that is defined in the policy setting, and will also see occasional messages.
+## Resolution for custom lock screen image
+A concern with custom lock screen images is how they will appear on different screen sizes and resolutions.
+
+A custom lock screen image created in 16:9 aspect ratio (1600x900) will scale properly on devices using a 16:9 resolution, such as 1280x720 or 1920x1080. On devices using other aspect ratios, such as 4:3 (1024x768) or 16:10 (1280x800), height scales correctly and width is cropped to a size equal to the aspect ratio. The image will remain centered on the screen
+
+Lock screen images created at other aspect ratios may scale and center unpredictably on your device when changing aspect ratios.
+
+The recommendation for custom lock screen images that include text (such as a legal statement) is to create the lock screen image in 16:9 resolution with text contained in the 4:3 region, allowing the text to remain visible at any aspect ratio.
## Related topics
[Manage Windows 10 Start layout options](windows-10-start-layout-options-and-policies.md)
-Not finding content you need? Windows 10 users, tell us what you want on [Feedback Hub](feedback-hub://?referrer=techDocsUcPage&tabid=2&contextid=897&newFeedback=true&topic=windows-spotlight.md).
diff --git a/windows/deployment/TOC.md b/windows/deployment/TOC.md
index 4b6e85ba51..c5ccc885d1 100644
--- a/windows/deployment/TOC.md
+++ b/windows/deployment/TOC.md
@@ -10,7 +10,9 @@
## [Resolve Windows 10 upgrade errors](upgrade/resolve-windows-10-upgrade-errors.md)
## [Deploy Windows 10](deploy.md)
-### [Overview of Windows AutoPilot](windows-10-auto-pilot.md)
+
+### [Overview of Windows AutoPilot](windows-autopilot/windows-10-autopilot.md)
+
### [Windows 10 upgrade paths](upgrade/windows-10-upgrade-paths.md)
### [Windows 10 edition upgrade](upgrade/windows-10-edition-upgrades.md)
### [Windows 10 volume license media](windows-10-media.md)
diff --git a/windows/deployment/add-store-apps-to-image.md b/windows/deployment/add-store-apps-to-image.md
index 291aa15115..d1d2c2298e 100644
--- a/windows/deployment/add-store-apps-to-image.md
+++ b/windows/deployment/add-store-apps-to-image.md
@@ -9,7 +9,7 @@ ms.sitesec: library
ms.pagetype: deploy
author: DaniHalfin
ms.author: daniha
-ms.date: 07/07/2017
+ms.date: 07/27/2017
---
# Add Microsoft Store for Business applications to a Windows 10 image
diff --git a/windows/deployment/change-history-for-deploy-windows-10.md b/windows/deployment/change-history-for-deploy-windows-10.md
index af4b28f704..bd0da028fe 100644
--- a/windows/deployment/change-history-for-deploy-windows-10.md
+++ b/windows/deployment/change-history-for-deploy-windows-10.md
@@ -32,7 +32,7 @@ New or changed topic | Description
## June 2017
| New or changed topic | Description |
|----------------------|-------------|
-| [Overview of Windows AutoPilot](windows-10-auto-pilot.md) | New |
+| [Overview of Windows AutoPilot](windows-autopilot/windows-10-autopilot.md) | New |
## April 2017
| New or changed topic | Description |
diff --git a/windows/deployment/configure-a-pxe-server-to-load-windows-pe.md b/windows/deployment/configure-a-pxe-server-to-load-windows-pe.md
index fee340161a..2a11c18c46 100644
--- a/windows/deployment/configure-a-pxe-server-to-load-windows-pe.md
+++ b/windows/deployment/configure-a-pxe-server-to-load-windows-pe.md
@@ -8,6 +8,7 @@ ms.localizationpriority: high
ms.sitesec: library
ms.pagetype: deploy
author: greg-lindsay
+ms.date: 07/27/2017
---
# Configure a PXE server to load Windows PE
diff --git a/windows/deployment/deploy-enterprise-licenses.md b/windows/deployment/deploy-enterprise-licenses.md
index dd7c44f36e..55b47713be 100644
--- a/windows/deployment/deploy-enterprise-licenses.md
+++ b/windows/deployment/deploy-enterprise-licenses.md
@@ -7,7 +7,7 @@ ms.mktglfcycl: deploy
localizationpriority: high
ms.sitesec: library
ms.pagetype: mdt
-ms.date: 10/10/2017
+ms.date: 10/18/2017
author: greg-lindsay
---
diff --git a/windows/deployment/deploy-whats-new.md b/windows/deployment/deploy-whats-new.md
index 95255b68f9..ae7ed25a99 100644
--- a/windows/deployment/deploy-whats-new.md
+++ b/windows/deployment/deploy-whats-new.md
@@ -7,7 +7,7 @@ ms.localizationpriority: high
ms.prod: w10
ms.sitesec: library
ms.pagetype: deploy
-ms.date: 08/23/2017
+ms.date: 09/19/2017
author: greg-lindsay
---
@@ -40,7 +40,7 @@ For more information, see [Windows 10 Enterprise E3 in CSP](windows-10-enterpris
Windows AutoPilot streamlines and automates the process of setting up and configuring new devices, with minimal interaction required from the end user. You can also use Windows AutoPilot to reset, repurpose and recover devices.
-Windows AutoPilot joins devices to Azure Active Directory (Azure AD), optionally enrolls into MDM services, configures security policies, and sets a custom out-of-box-experience (OOBE) for the end user. For more information, see [Overview of Windows AutoPilot](windows-10-auto-pilot.md).
+Windows AutoPilot joins devices to Azure Active Directory (Azure AD), optionally enrolls into MDM services, configures security policies, and sets a custom out-of-box-experience (OOBE) for the end user. For more information, see [Overview of Windows AutoPilot](windows-autopilot/windows-10-autopilot.md).
### Upgrade Readiness
diff --git a/windows/deployment/deploy-windows-mdt/assign-applications-using-roles-in-mdt.md b/windows/deployment/deploy-windows-mdt/assign-applications-using-roles-in-mdt.md
index b5a1920b19..4a743e6537 100644
--- a/windows/deployment/deploy-windows-mdt/assign-applications-using-roles-in-mdt.md
+++ b/windows/deployment/deploy-windows-mdt/assign-applications-using-roles-in-mdt.md
@@ -9,6 +9,7 @@ ms.localizationpriority: high
ms.sitesec: library
ms.pagetype: mdt
author: mtniehaus
+ms.date: 07/27/2017
---
# Assign applications using roles in MDT
diff --git a/windows/deployment/deploy-windows-mdt/build-a-distributed-environment-for-windows-10-deployment.md b/windows/deployment/deploy-windows-mdt/build-a-distributed-environment-for-windows-10-deployment.md
index af480bfc6a..a32404e3da 100644
--- a/windows/deployment/deploy-windows-mdt/build-a-distributed-environment-for-windows-10-deployment.md
+++ b/windows/deployment/deploy-windows-mdt/build-a-distributed-environment-for-windows-10-deployment.md
@@ -9,6 +9,7 @@ ms.localizationpriority: high
ms.sitesec: library
ms.pagetype: mdt
author: mtniehaus
+ms.date: 07/27/2017
---
# Build a distributed environment for Windows 10 deployment
diff --git a/windows/deployment/deploy-windows-mdt/configure-mdt-deployment-share-rules.md b/windows/deployment/deploy-windows-mdt/configure-mdt-deployment-share-rules.md
index ba27f0da53..25636437d5 100644
--- a/windows/deployment/deploy-windows-mdt/configure-mdt-deployment-share-rules.md
+++ b/windows/deployment/deploy-windows-mdt/configure-mdt-deployment-share-rules.md
@@ -9,6 +9,7 @@ ms.localizationpriority: high
ms.sitesec: library
ms.pagetype: mdt
author: mtniehaus
+ms.date: 07/27/2017
---
# Configure MDT deployment share rules
diff --git a/windows/deployment/deploy-windows-mdt/configure-mdt-for-userexit-scripts.md b/windows/deployment/deploy-windows-mdt/configure-mdt-for-userexit-scripts.md
index 726a04ca82..1d3d9e51d3 100644
--- a/windows/deployment/deploy-windows-mdt/configure-mdt-for-userexit-scripts.md
+++ b/windows/deployment/deploy-windows-mdt/configure-mdt-for-userexit-scripts.md
@@ -9,6 +9,7 @@ ms.localizationpriority: high
ms.sitesec: library
ms.pagetype: mdt
author: mtniehaus
+ms.date: 07/27/2017
---
# Configure MDT for UserExit scripts
diff --git a/windows/deployment/deploy-windows-mdt/configure-mdt-settings.md b/windows/deployment/deploy-windows-mdt/configure-mdt-settings.md
index 1646c5ed79..3e966ca9c1 100644
--- a/windows/deployment/deploy-windows-mdt/configure-mdt-settings.md
+++ b/windows/deployment/deploy-windows-mdt/configure-mdt-settings.md
@@ -9,6 +9,7 @@ ms.localizationpriority: high
ms.sitesec: library
ms.pagetype: mdt
author: mtniehaus
+ms.date: 07/27/2017
---
# Configure MDT settings
diff --git a/windows/deployment/deploy-windows-mdt/create-a-task-sequence-with-configuration-manager-and-mdt.md b/windows/deployment/deploy-windows-mdt/create-a-task-sequence-with-configuration-manager-and-mdt.md
index 34503a310e..522071bd52 100644
--- a/windows/deployment/deploy-windows-mdt/create-a-task-sequence-with-configuration-manager-and-mdt.md
+++ b/windows/deployment/deploy-windows-mdt/create-a-task-sequence-with-configuration-manager-and-mdt.md
@@ -9,6 +9,7 @@ ms.localizationpriority: high
ms.pagetype: mdt
ms.sitesec: library
author: mtniehaus
+ms.date: 07/27/2017
---
# Create a task sequence with Configuration Manager and MDT
diff --git a/windows/deployment/deploy-windows-mdt/create-a-windows-10-reference-image.md b/windows/deployment/deploy-windows-mdt/create-a-windows-10-reference-image.md
index b8bc4a5ce1..53297d9119 100644
--- a/windows/deployment/deploy-windows-mdt/create-a-windows-10-reference-image.md
+++ b/windows/deployment/deploy-windows-mdt/create-a-windows-10-reference-image.md
@@ -9,7 +9,7 @@ ms.localizationpriority: high
ms.sitesec: library
ms.pagetype: mdt
author: mtniehaus
-ms.date: 11/08/2017
+ms.date: 11/09/2017
---
# Create a Windows 10 reference image
@@ -646,5 +646,3 @@ After some time, you will have a Windows 10 Enterprise x64 image that is fully
[Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md)
[Configure MDT settings](configure-mdt-settings.md)
-
-Not finding content you need? Windows 10 users, tell us what you want on [Feedback Hub](feedback-hub://?referrer=techDocsUcPage&tabid=2&contextid=897&newFeedback=true&topic=create-a-windows-10-reference-image.md).
\ No newline at end of file
diff --git a/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt.md b/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt.md
index efbe5a0d36..d3ae97f74b 100644
--- a/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt.md
+++ b/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt.md
@@ -9,6 +9,7 @@ ms.localizationpriority: high
ms.sitesec: library
ms.pagetype: mdt
author: mtniehaus
+ms.date: 10/16/2017
---
# Deploy a Windows 10 image using MDT
@@ -652,5 +653,3 @@ Figure 14. The partitions when deploying an UEFI-based machine.
[Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md)
[Configure MDT settings](configure-mdt-settings.md)
-
-Not finding content you need? Windows 10 users, tell us what you want on [Feedback Hub](feedback-hub://?referrer=techDocsUcPage&tabid=2&contextid=897&newFeedback=true&topic=deploy-a-windows-10-image-using-mdt.md).
\ No newline at end of file
diff --git a/windows/deployment/deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md b/windows/deployment/deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md
index 71ba215d06..5a03190d0c 100644
--- a/windows/deployment/deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md
+++ b/windows/deployment/deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md
@@ -9,6 +9,7 @@ ms.localizationpriority: high
ms.sitesec: library
author: mtniehaus
ms.pagetype: mdt
+ms.date: 10/16/2017
---
# Deploy Windows 10 with the Microsoft Deployment Toolkit
@@ -92,5 +93,3 @@ The information in this guide is designed to help you deploy Windows 10. In ord
[Volume Activation for Windows 10](../volume-activation/volume-activation-windows-10.md)
-
-Not finding content you need? Windows 10 users, tell us what you want on [Feedback Hub](feedback-hub://?referrer=techDocsUcPage&tabid=2&contextid=897&newFeedback=true&topic=deploy-windows-10-with-the-microsoft-deployment-toolkit.md).
\ No newline at end of file
diff --git a/windows/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit.md b/windows/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit.md
index a954a1ef62..ecaf35658c 100644
--- a/windows/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit.md
+++ b/windows/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit.md
@@ -9,6 +9,7 @@ ms.localizationpriority: high
ms.sitesec: library
ms.pagetype: mdt
author: mtniehaus
+ms.date: 07/27/2017
---
# Get started with the Microsoft Deployment Toolkit (MDT)
diff --git a/windows/deployment/deploy-windows-mdt/integrate-configuration-manager-with-mdt.md b/windows/deployment/deploy-windows-mdt/integrate-configuration-manager-with-mdt.md
index 84f0f4a09e..06d29a04b6 100644
--- a/windows/deployment/deploy-windows-mdt/integrate-configuration-manager-with-mdt.md
+++ b/windows/deployment/deploy-windows-mdt/integrate-configuration-manager-with-mdt.md
@@ -9,6 +9,7 @@ ms.localizationpriority: high
ms.mktglfcycl: deploy
ms.sitesec: library
author: mtniehaus
+ms.date: 07/27/2017
---
# Integrate Configuration Manager with MDT
diff --git a/windows/deployment/deploy-windows-mdt/key-features-in-mdt.md b/windows/deployment/deploy-windows-mdt/key-features-in-mdt.md
index 7cef6c1c1c..9e5135e314 100644
--- a/windows/deployment/deploy-windows-mdt/key-features-in-mdt.md
+++ b/windows/deployment/deploy-windows-mdt/key-features-in-mdt.md
@@ -9,6 +9,7 @@ ms.localizationpriority: high
ms.sitesec: library
ms.pagetype: mdt
author: mtniehaus
+ms.date: 07/27/2017
---
# Key features in MDT
diff --git a/windows/deployment/deploy-windows-mdt/mdt-lite-touch-components.md b/windows/deployment/deploy-windows-mdt/mdt-lite-touch-components.md
index c681e75dfc..6222b6f030 100644
--- a/windows/deployment/deploy-windows-mdt/mdt-lite-touch-components.md
+++ b/windows/deployment/deploy-windows-mdt/mdt-lite-touch-components.md
@@ -9,6 +9,7 @@ ms.localizationpriority: high
ms.sitesec: library
ms.pagetype: mdt
author: mtniehaus
+ms.date: 07/27/2017
---
# MDT Lite Touch components
diff --git a/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md b/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md
index 7aa852d395..8b683b7980 100644
--- a/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md
+++ b/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md
@@ -9,6 +9,7 @@ ms.localizationpriority: high
ms.sitesec: library
ms.pagetype: mdt
author: mtniehaus
+ms.date: 07/27/2017
---
# Prepare for deployment with MDT
diff --git a/windows/deployment/deploy-windows-mdt/refresh-a-windows-7-computer-with-windows-10.md b/windows/deployment/deploy-windows-mdt/refresh-a-windows-7-computer-with-windows-10.md
index f142ee7e3f..cf0457a3f4 100644
--- a/windows/deployment/deploy-windows-mdt/refresh-a-windows-7-computer-with-windows-10.md
+++ b/windows/deployment/deploy-windows-mdt/refresh-a-windows-7-computer-with-windows-10.md
@@ -9,6 +9,7 @@ ms.localizationpriority: high
ms.sitesec: library
ms.pagetype: mdt
author: mtniehaus
+ms.date: 07/27/2017
---
# Refresh a Windows 7 computer with Windows 10
diff --git a/windows/deployment/deploy-windows-mdt/replace-a-windows-7-computer-with-a-windows-10-computer.md b/windows/deployment/deploy-windows-mdt/replace-a-windows-7-computer-with-a-windows-10-computer.md
index 88573ebf1d..974dd2dd1a 100644
--- a/windows/deployment/deploy-windows-mdt/replace-a-windows-7-computer-with-a-windows-10-computer.md
+++ b/windows/deployment/deploy-windows-mdt/replace-a-windows-7-computer-with-a-windows-10-computer.md
@@ -9,6 +9,7 @@ ms.localizationpriority: high
ms.sitesec: library
ms.pagetype: mdt
author: mtniehaus
+ms.date: 07/27/2017
---
# Replace a Windows 7 computer with a Windows 10 computer
diff --git a/windows/deployment/deploy-windows-mdt/set-up-mdt-for-bitlocker.md b/windows/deployment/deploy-windows-mdt/set-up-mdt-for-bitlocker.md
index 9f0765935d..889d6c2585 100644
--- a/windows/deployment/deploy-windows-mdt/set-up-mdt-for-bitlocker.md
+++ b/windows/deployment/deploy-windows-mdt/set-up-mdt-for-bitlocker.md
@@ -9,6 +9,7 @@ ms.localizationpriority: high
ms.sitesec: library
ms.pagetype: mdt
author: mtniehaus
+ms.date: 07/27/2017
---
# Set up MDT for BitLocker
diff --git a/windows/deployment/deploy-windows-mdt/simulate-a-windows-10-deployment-in-a-test-environment.md b/windows/deployment/deploy-windows-mdt/simulate-a-windows-10-deployment-in-a-test-environment.md
index aa93bb9261..7729c54618 100644
--- a/windows/deployment/deploy-windows-mdt/simulate-a-windows-10-deployment-in-a-test-environment.md
+++ b/windows/deployment/deploy-windows-mdt/simulate-a-windows-10-deployment-in-a-test-environment.md
@@ -9,6 +9,7 @@ ms.localizationpriority: high
ms.sitesec: library
ms.pagetype: mdt
author: mtniehaus
+ms.date: 07/27/2017
---
# Simulate a Windows 10 deployment in a test environment
diff --git a/windows/deployment/deploy-windows-mdt/use-orchestrator-runbooks-with-mdt.md b/windows/deployment/deploy-windows-mdt/use-orchestrator-runbooks-with-mdt.md
index 8b4ca7e777..a0a50f8ebc 100644
--- a/windows/deployment/deploy-windows-mdt/use-orchestrator-runbooks-with-mdt.md
+++ b/windows/deployment/deploy-windows-mdt/use-orchestrator-runbooks-with-mdt.md
@@ -9,6 +9,7 @@ ms.localizationpriority: high
ms.sitesec: library
ms.pagetype: mdt
author: mtniehaus
+ms.date: 07/27/2017
---
# Use Orchestrator runbooks with MDT
diff --git a/windows/deployment/deploy-windows-mdt/use-the-mdt-database-to-stage-windows-10-deployment-information.md b/windows/deployment/deploy-windows-mdt/use-the-mdt-database-to-stage-windows-10-deployment-information.md
index 7a24e08ad7..00b6ccc992 100644
--- a/windows/deployment/deploy-windows-mdt/use-the-mdt-database-to-stage-windows-10-deployment-information.md
+++ b/windows/deployment/deploy-windows-mdt/use-the-mdt-database-to-stage-windows-10-deployment-information.md
@@ -9,6 +9,7 @@ ms.mktglfcycl: deploy
ms.localizationpriority: high
ms.sitesec: library
author: mtniehaus
+ms.date: 07/27/2017
---
# Use the MDT database to stage Windows 10 deployment information
diff --git a/windows/deployment/deploy-windows-mdt/use-web-services-in-mdt.md b/windows/deployment/deploy-windows-mdt/use-web-services-in-mdt.md
index 3dea162597..2e184f00e8 100644
--- a/windows/deployment/deploy-windows-mdt/use-web-services-in-mdt.md
+++ b/windows/deployment/deploy-windows-mdt/use-web-services-in-mdt.md
@@ -9,6 +9,7 @@ ms.localizationpriority: high
ms.pagetype: mdt
ms.sitesec: library
author: mtniehaus
+ms.date: 07/27/2017
---
# Use web services in MDT
diff --git a/windows/deployment/deploy-windows-sccm/add-a-windows-10-operating-system-image-using-configuration-manager.md b/windows/deployment/deploy-windows-sccm/add-a-windows-10-operating-system-image-using-configuration-manager.md
index 35bf254314..7ff329f908 100644
--- a/windows/deployment/deploy-windows-sccm/add-a-windows-10-operating-system-image-using-configuration-manager.md
+++ b/windows/deployment/deploy-windows-sccm/add-a-windows-10-operating-system-image-using-configuration-manager.md
@@ -8,6 +8,7 @@ ms.mktglfcycl: deploy
ms.localizationpriority: high
ms.sitesec: library
author: mtniehaus
+ms.date: 07/27/2017
---
# Add a Windows 10 operating system image using Configuration Manager
diff --git a/windows/deployment/deploy-windows-sccm/add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md b/windows/deployment/deploy-windows-sccm/add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md
index c7900eb237..00a014c189 100644
--- a/windows/deployment/deploy-windows-sccm/add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md
+++ b/windows/deployment/deploy-windows-sccm/add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md
@@ -8,6 +8,7 @@ ms.localizationpriority: high
ms.mktglfcycl: deploy
ms.sitesec: library
author: mtniehaus
+ms.date: 07/27/2017
---
# Add drivers to a Windows 10 deployment with Windows PE using Configuration Manager
diff --git a/windows/deployment/deploy-windows-sccm/create-a-custom-windows-pe-boot-image-with-configuration-manager.md b/windows/deployment/deploy-windows-sccm/create-a-custom-windows-pe-boot-image-with-configuration-manager.md
index 162a079354..65be93e28c 100644
--- a/windows/deployment/deploy-windows-sccm/create-a-custom-windows-pe-boot-image-with-configuration-manager.md
+++ b/windows/deployment/deploy-windows-sccm/create-a-custom-windows-pe-boot-image-with-configuration-manager.md
@@ -8,6 +8,7 @@ ms.mktglfcycl: deploy
ms.localizationpriority: high
ms.sitesec: library
author: mtniehaus
+ms.date: 07/27/2017
---
# Create a custom Windows PE boot image with Configuration Manager
diff --git a/windows/deployment/deploy-windows-sccm/create-an-application-to-deploy-with-windows-10-using-configuration-manager.md b/windows/deployment/deploy-windows-sccm/create-an-application-to-deploy-with-windows-10-using-configuration-manager.md
index ad81044f04..2bd2807d8b 100644
--- a/windows/deployment/deploy-windows-sccm/create-an-application-to-deploy-with-windows-10-using-configuration-manager.md
+++ b/windows/deployment/deploy-windows-sccm/create-an-application-to-deploy-with-windows-10-using-configuration-manager.md
@@ -8,6 +8,7 @@ ms.localizationpriority: high
ms.mktglfcycl: deploy
ms.sitesec: library
author: mtniehaus
+ms.date: 07/27/2017
---
# Create an application to deploy with Windows 10 using Configuration Manager
diff --git a/windows/deployment/deploy-windows-sccm/deploy-windows-10-using-pxe-and-configuration-manager.md b/windows/deployment/deploy-windows-sccm/deploy-windows-10-using-pxe-and-configuration-manager.md
index 16a4af055b..9e891e7b54 100644
--- a/windows/deployment/deploy-windows-sccm/deploy-windows-10-using-pxe-and-configuration-manager.md
+++ b/windows/deployment/deploy-windows-sccm/deploy-windows-10-using-pxe-and-configuration-manager.md
@@ -8,6 +8,7 @@ ms.mktglfcycl: deploy
ms.localizationpriority: high
ms.sitesec: library
author: mtniehaus
+ms.date: 07/27/2017
---
# Deploy Windows 10 using PXE and Configuration Manager
diff --git a/windows/deployment/deploy-windows-sccm/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md b/windows/deployment/deploy-windows-sccm/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md
index dd501cd667..a60eef6027 100644
--- a/windows/deployment/deploy-windows-sccm/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md
+++ b/windows/deployment/deploy-windows-sccm/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md
@@ -8,6 +8,7 @@ ms.localizationpriority: high
ms.mktglfcycl: deploy
ms.sitesec: library
author: mtniehaus
+ms.date: 07/27/2017
---
# Deploy Windows 10 with System Center 2012 R2 Configuration Manager
diff --git a/windows/deployment/deploy-windows-sccm/finalize-the-os-configuration-for-windows-10-deployment-with-configuration-manager.md b/windows/deployment/deploy-windows-sccm/finalize-the-os-configuration-for-windows-10-deployment-with-configuration-manager.md
index 52181700d5..17e8b49555 100644
--- a/windows/deployment/deploy-windows-sccm/finalize-the-os-configuration-for-windows-10-deployment-with-configuration-manager.md
+++ b/windows/deployment/deploy-windows-sccm/finalize-the-os-configuration-for-windows-10-deployment-with-configuration-manager.md
@@ -8,6 +8,7 @@ ms.localizationpriority: high
ms.mktglfcycl: deploy
ms.sitesec: library
author: mtniehaus
+ms.date: 07/27/2017
---
# Finalize the operating system configuration for Windows 10 deployment with Configuration Manager
diff --git a/windows/deployment/deploy-windows-sccm/monitor-windows-10-deployment-with-configuration-manager.md b/windows/deployment/deploy-windows-sccm/monitor-windows-10-deployment-with-configuration-manager.md
index efc87d2fab..682e8df37a 100644
--- a/windows/deployment/deploy-windows-sccm/monitor-windows-10-deployment-with-configuration-manager.md
+++ b/windows/deployment/deploy-windows-sccm/monitor-windows-10-deployment-with-configuration-manager.md
@@ -8,6 +8,7 @@ ms.mktglfcycl: deploy
ms.localizationpriority: high
ms.sitesec: library
author: mtniehaus
+ms.date: 07/27/2017
---
# Monitor the Windows 10 deployment with Configuration Manager
diff --git a/windows/deployment/deploy-windows-sccm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md b/windows/deployment/deploy-windows-sccm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md
index f005cca535..f9e56afc51 100644
--- a/windows/deployment/deploy-windows-sccm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md
+++ b/windows/deployment/deploy-windows-sccm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md
@@ -8,6 +8,7 @@ ms.localizationpriority: high
ms.mktglfcycl: deploy
ms.sitesec: library
author: mtniehaus
+ms.date: 07/27/2017
---
# Prepare for Zero Touch Installation of Windows 10 with Configuration Manager
diff --git a/windows/deployment/deploy-windows-sccm/refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md b/windows/deployment/deploy-windows-sccm/refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md
index 1bd55885aa..1634b4cb97 100644
--- a/windows/deployment/deploy-windows-sccm/refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md
+++ b/windows/deployment/deploy-windows-sccm/refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md
@@ -8,6 +8,7 @@ ms.mktglfcycl: deploy
ms.localizationpriority: high
ms.sitesec: library
author: mtniehaus
+ms.date: 07/27/2017
---
# Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager
diff --git a/windows/deployment/deploy-windows-sccm/replace-a-windows-7-client-with-windows-10-using-configuration-manager.md b/windows/deployment/deploy-windows-sccm/replace-a-windows-7-client-with-windows-10-using-configuration-manager.md
index d77f096553..3168bbcccf 100644
--- a/windows/deployment/deploy-windows-sccm/replace-a-windows-7-client-with-windows-10-using-configuration-manager.md
+++ b/windows/deployment/deploy-windows-sccm/replace-a-windows-7-client-with-windows-10-using-configuration-manager.md
@@ -8,6 +8,7 @@ ms.mktglfcycl: deploy
ms.localizationpriority: high
ms.sitesec: library
author: mtniehaus
+ms.date: 07/27/2017
---
# Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager
diff --git a/windows/deployment/deploy-windows-to-go.md b/windows/deployment/deploy-windows-to-go.md
index 9cc9bc4c12..8557a2883c 100644
--- a/windows/deployment/deploy-windows-to-go.md
+++ b/windows/deployment/deploy-windows-to-go.md
@@ -8,6 +8,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: mobility
author: mtniehaus
+ms.date: 04/19/2017
---
# Deploy Windows To Go in your organization
diff --git a/windows/deployment/deploy.md b/windows/deployment/deploy.md
index cc7833708b..2040ebf2d1 100644
--- a/windows/deployment/deploy.md
+++ b/windows/deployment/deploy.md
@@ -17,11 +17,11 @@ Windows 10 upgrade options are discussed and information is provided about plann
|Topic |Description |
|------|------------|
-|[Overview of Windows AutoPilot](windows-10-auto-pilot.md) |This topic provides an overview of Windows AutoPilot deployment, a new zero-touch method for deploying Windows 10 in the enterprise. |
+|[Overview of Windows AutoPilot](windows-autopilot/windows-10-autopilot.md) |This topic provides an overview of Windows AutoPilot deployment, a new zero-touch method for deploying Windows 10 in the enterprise. |
|[Windows 10 upgrade paths](upgrade/windows-10-upgrade-paths.md) |This topic provides information about support for upgrading directly to Windows 10 from a previous operating system. |
|[Windows 10 edition upgrade](upgrade/windows-10-edition-upgrades.md) |This topic provides information about support for upgrading from one edition of Windows 10 to another. |
|[Windows 10 volume license media](windows-10-media.md) |This topic provides information about updates to volume licensing media in the current version of Windows 10. |
-|[Manage Windows upgrades with Upgrade Readiness](upgrade/manage-windows-upgrades-with-upgrade-readiness.md) |With Upgrade Readiness, enterprises now have the tools to plan and manage the upgrade process end to end, allowing them to adopt new Windows releases more quickly. With Windows telemetry enabled, Upgrade Readiness collects system, application, and driver data for analysis. We then identify compatibility issues that can block an upgrade and suggest fixes when they are known to Microsoft. The Upgrade Readiness workflow steps you through the discovery and rationalization process until you have a list of computers that are ready to be upgraded. |
+|[Manage Windows upgrades with Upgrade Readiness](upgrade/manage-windows-upgrades-with-upgrade-readiness.md) |With Upgrade Readiness, enterprises now have the tools to plan and manage the upgrade process end to end, allowing them to adopt new Windows releases more quickly. With Windows diagnostic data enabled, Upgrade Readiness collects system, application, and driver data for analysis. We then identify compatibility issues that can block an upgrade and suggest fixes when they are known to Microsoft. The Upgrade Readiness workflow steps you through the discovery and rationalization process until you have a list of computers that are ready to be upgraded. |
|[Windows 10 deployment test lab](windows-10-poc.md) |This guide contains instructions to configure a proof of concept (PoC) environment requiring a minimum amount of resources. The guide makes extensive use of Windows PowerShell and Hyper-V. Subsequent companion guides contain steps to deploy Windows 10 using the PoC environment. After completing this guide, additional guides are provided to deploy Windows 10 in the test lab using [Microsoft Deployment Toolkit](windows-10-poc-mdt.md) or [System Center Configuration Manager](windows-10-poc-sc-config-mgr.md). |
|[Plan for Windows 10 deployment](planning/index.md) | This section describes Windows 10 deployment considerations and provides information to assist in Windows 10 deployment planning. |
|[Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md) |This guide will walk you through the process of deploying Windows 10 in an enterprise environment using the Microsoft Deployment Toolkit (MDT). |
diff --git a/windows/deployment/images/upgrade-analytics-settings.png b/windows/deployment/images/upgrade-analytics-settings.png
new file mode 100644
index 0000000000..be51cd3418
Binary files /dev/null and b/windows/deployment/images/upgrade-analytics-settings.png differ
diff --git a/windows/deployment/index.md b/windows/deployment/index.md
index c43584706f..f63641d04f 100644
--- a/windows/deployment/index.md
+++ b/windows/deployment/index.md
@@ -6,7 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.localizationpriority: high
-ms.date: 10/18/2017
+ms.date: 12/13/2017
author: greg-lindsay
---
@@ -28,11 +28,11 @@ Windows 10 upgrade options are discussed and information is provided about plann
|Topic |Description |
|------|------------|
-|[Overview of Windows AutoPilot](windows-10-auto-pilot.md) |Windows AutoPilot deployment is a new cloud service from Microsoft that provides a zero touch experience for deploying Windows 10 devices. |
+|[Overview of Windows AutoPilot](windows-autopilot/windows-10-autopilot.md) |Windows AutoPilot deployment is a new cloud service from Microsoft that provides a zero touch experience for deploying Windows 10 devices. |
|[Windows 10 upgrade paths](upgrade/windows-10-upgrade-paths.md) |This topic provides information about support for upgrading directly to Windows 10 from a previous operating system. |
|[Windows 10 edition upgrade](upgrade/windows-10-edition-upgrades.md) |This topic provides information about support for upgrading from one edition of Windows 10 to another. |
|[Windows 10 volume license media](windows-10-media.md) |This topic provides information about media available in the Microsoft Volume Licensing Service Center. |
-|[Manage Windows upgrades with Upgrade Readiness](upgrade/manage-windows-upgrades-with-upgrade-readiness.md) |With Upgrade Readiness, enterprises now have the tools to plan and manage the upgrade process end to end, allowing them to adopt new Windows releases more quickly. With Windows telemetry enabled, Upgrade Readiness collects system, application, and driver data for analysis. We then identify compatibility issues that can block an upgrade and suggest fixes when they are known to Microsoft. The Upgrade Readiness workflow steps you through the discovery and rationalization process until you have a list of computers that are ready to be upgraded. |
+|[Manage Windows upgrades with Upgrade Readiness](upgrade/manage-windows-upgrades-with-upgrade-readiness.md) |With Upgrade Readiness, enterprises now have the tools to plan and manage the upgrade process end to end, allowing them to adopt new Windows releases more quickly. With Windows diagnostic data enabled, Upgrade Readiness collects system, application, and driver data for analysis. We then identify compatibility issues that can block an upgrade and suggest fixes when they are known to Microsoft. The Upgrade Readiness workflow steps you through the discovery and rationalization process until you have a list of computers that are ready to be upgraded. |
|[Windows 10 deployment test lab](windows-10-poc.md) |This guide contains instructions to configure a proof of concept (PoC) environment requiring a minimum amount of resources. The guide makes extensive use of Windows PowerShell and Hyper-V. Subsequent companion guides contain steps to deploy Windows 10 using the PoC environment. After completing this guide, additional guides are provided to deploy Windows 10 in the test lab using [Microsoft Deployment Toolkit](windows-10-poc-mdt.md) or [System Center Configuration Manager](windows-10-poc-sc-config-mgr.md). |
|[Plan for Windows 10 deployment](planning/index.md) | This section describes Windows 10 deployment considerations and provides information to assist in Windows 10 deployment planning. |
|[Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md) |This guide will walk you through the process of deploying Windows 10 in an enterprise environment using the Microsoft Deployment Toolkit (MDT). |
diff --git a/windows/deployment/mbr-to-gpt.md b/windows/deployment/mbr-to-gpt.md
index a2e4af2af5..1f0ef3d834 100644
--- a/windows/deployment/mbr-to-gpt.md
+++ b/windows/deployment/mbr-to-gpt.md
@@ -7,7 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: deploy
author: greg-lindsay
-ms.date: 10/26/2017
+ms.date: 10/27/2017
ms.localizationpriority: high
---
@@ -401,5 +401,3 @@ In this example, Disk 0 is formatted with the MBR partition style, and Disk 1 is
[Windows 10 Enterprise system requirements](https://technet.microsoft.com/en-us/windows/dn798752.aspx)
[Windows 10 Specifications](https://www.microsoft.com/en-us/windows/Windows-10-specifications)
[Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro)
-
-Not finding content you need? Windows 10 users, tell us what you want on [Feedback Hub](feedback-hub://?referrer=techDocsUcPage&tabid=2&contextid=897&newFeedback=true&topic=mbr-to-gpt.md).
\ No newline at end of file
diff --git a/windows/deployment/planning/act-technical-reference.md b/windows/deployment/planning/act-technical-reference.md
index efdc2ffb32..a84f82eb0a 100644
--- a/windows/deployment/planning/act-technical-reference.md
+++ b/windows/deployment/planning/act-technical-reference.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: plan
ms.pagetype: appcompat
ms.sitesec: library
author: eross-msft
+ms.date: 04/19/2017
---
# Application Compatibility Toolkit (ACT) Technical Reference
@@ -19,7 +20,7 @@ We've replaced the majority of functionality included in the Application Compati
Microsoft developed Upgrade Analytics in response to demand from enterprise customers looking for additional direction and details about upgrading to Windows 10. Upgrade Analytics was built taking into account multiple channels of customer feedback, testing, and Microsoft’s experience upgrading millions of devices to Windows 10.
-With Windows telemetry enabled, Upgrade Analytics collects system, application, and driver data for analysis. We then identify compatibility issues that can block an upgrade and suggest fixes when they are known to Microsoft.
+With Windows diagnostic data enabled, Upgrade Analytics collects system, application, and driver data for analysis. We then identify compatibility issues that can block an upgrade and suggest fixes when they are known to Microsoft.
Use Upgrade Analytics to get:
- A visual workflow that guides you from pilot to production
diff --git a/windows/deployment/planning/applying-filters-to-data-in-the-sua-tool.md b/windows/deployment/planning/applying-filters-to-data-in-the-sua-tool.md
index 7b716d119a..e5e9f24096 100644
--- a/windows/deployment/planning/applying-filters-to-data-in-the-sua-tool.md
+++ b/windows/deployment/planning/applying-filters-to-data-in-the-sua-tool.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: plan
ms.pagetype: appcompat
ms.sitesec: library
author: TrudyHa
+ms.date: 04/19/2017
---
# Applying Filters to Data in the SUA Tool
diff --git a/windows/deployment/planning/available-data-types-and-operators-in-compatibility-administrator.md b/windows/deployment/planning/available-data-types-and-operators-in-compatibility-administrator.md
index a83be4fbc1..4edb5f0c39 100644
--- a/windows/deployment/planning/available-data-types-and-operators-in-compatibility-administrator.md
+++ b/windows/deployment/planning/available-data-types-and-operators-in-compatibility-administrator.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: plan
ms.pagetype: appcompat
ms.sitesec: library
author: TrudyHa
+ms.date: 04/19/2017
---
# Available Data Types and Operators in Compatibility Administrator
diff --git a/windows/deployment/planning/best-practice-recommendations-for-windows-to-go.md b/windows/deployment/planning/best-practice-recommendations-for-windows-to-go.md
index 33789da365..12f92216ce 100644
--- a/windows/deployment/planning/best-practice-recommendations-for-windows-to-go.md
+++ b/windows/deployment/planning/best-practice-recommendations-for-windows-to-go.md
@@ -8,6 +8,7 @@ ms.mktglfcycl: plan
ms.pagetype: mobility
ms.sitesec: library
author: mtniehaus
+ms.date: 04/19/2017
---
# Best practice recommendations for Windows To Go
diff --git a/windows/deployment/planning/change-history-for-plan-for-windows-10-deployment.md b/windows/deployment/planning/change-history-for-plan-for-windows-10-deployment.md
index a86caa380f..7fb6d20106 100644
--- a/windows/deployment/planning/change-history-for-plan-for-windows-10-deployment.md
+++ b/windows/deployment/planning/change-history-for-plan-for-windows-10-deployment.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: plan
ms.sitesec: library
author: TrudyHa
+ms.date: 07/19/2017
---
# Change history for Plan for Windows 10 deployment
diff --git a/windows/deployment/planning/compatibility-administrator-users-guide.md b/windows/deployment/planning/compatibility-administrator-users-guide.md
index 8625f9e210..f1037f7669 100644
--- a/windows/deployment/planning/compatibility-administrator-users-guide.md
+++ b/windows/deployment/planning/compatibility-administrator-users-guide.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: plan
ms.pagetype: appcompat
ms.sitesec: library
author: TrudyHa
+ms.date: 04/19/2017
---
# Compatibility Administrator User's Guide
diff --git a/windows/deployment/planning/compatibility-fix-database-management-strategies-and-deployment.md b/windows/deployment/planning/compatibility-fix-database-management-strategies-and-deployment.md
index fe4aede4bb..c9f2ede6e2 100644
--- a/windows/deployment/planning/compatibility-fix-database-management-strategies-and-deployment.md
+++ b/windows/deployment/planning/compatibility-fix-database-management-strategies-and-deployment.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: plan
ms.pagetype: appcompat
ms.sitesec: library
author: TrudyHa
+ms.date: 04/19/2017
---
# Compatibility Fix Database Management Strategies and Deployment
diff --git a/windows/deployment/planning/compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md b/windows/deployment/planning/compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md
index a27d633a60..1e50215024 100644
--- a/windows/deployment/planning/compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md
+++ b/windows/deployment/planning/compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: plan
ms.pagetype: appcompat
ms.sitesec: library
author: TrudyHa
+ms.date: 04/19/2017
---
# Compatibility Fixes for Windows 10, Windows 8, Windows 7, and Windows Vista
diff --git a/windows/deployment/planning/creating-a-custom-compatibility-fix-in-compatibility-administrator.md b/windows/deployment/planning/creating-a-custom-compatibility-fix-in-compatibility-administrator.md
index 90b404e888..7dca25b239 100644
--- a/windows/deployment/planning/creating-a-custom-compatibility-fix-in-compatibility-administrator.md
+++ b/windows/deployment/planning/creating-a-custom-compatibility-fix-in-compatibility-administrator.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: plan
ms.pagetype: appcompat
ms.sitesec: library
author: TrudyHa
+ms.date: 04/19/2017
---
# Creating a Custom Compatibility Fix in Compatibility Administrator
diff --git a/windows/deployment/planning/creating-a-custom-compatibility-mode-in-compatibility-administrator.md b/windows/deployment/planning/creating-a-custom-compatibility-mode-in-compatibility-administrator.md
index 789f3199ca..706cc96143 100644
--- a/windows/deployment/planning/creating-a-custom-compatibility-mode-in-compatibility-administrator.md
+++ b/windows/deployment/planning/creating-a-custom-compatibility-mode-in-compatibility-administrator.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: plan
ms.pagetype: appcompat
ms.sitesec: library
author: TrudyHa
+ms.date: 04/19/2017
---
# Creating a Custom Compatibility Mode in Compatibility Administrator
diff --git a/windows/deployment/planning/creating-an-apphelp-message-in-compatibility-administrator.md b/windows/deployment/planning/creating-an-apphelp-message-in-compatibility-administrator.md
index f63dd95d8f..08565d4d49 100644
--- a/windows/deployment/planning/creating-an-apphelp-message-in-compatibility-administrator.md
+++ b/windows/deployment/planning/creating-an-apphelp-message-in-compatibility-administrator.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: plan
ms.pagetype: appcompat
ms.sitesec: library
author: TrudyHa
+ms.date: 04/19/2017
---
# Creating an AppHelp Message in Compatibility Administrator
diff --git a/windows/deployment/planning/deployment-considerations-for-windows-to-go.md b/windows/deployment/planning/deployment-considerations-for-windows-to-go.md
index a1a32d6836..5be20e25e5 100644
--- a/windows/deployment/planning/deployment-considerations-for-windows-to-go.md
+++ b/windows/deployment/planning/deployment-considerations-for-windows-to-go.md
@@ -8,6 +8,7 @@ ms.mktglfcycl: plan
ms.pagetype: mobility
ms.sitesec: library
author: mtniehaus
+ms.date: 04/19/2017
---
# Deployment considerations for Windows To Go
diff --git a/windows/deployment/planning/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator.md b/windows/deployment/planning/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator.md
index 7bcd802f03..4e1cae7893 100644
--- a/windows/deployment/planning/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator.md
+++ b/windows/deployment/planning/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: plan
ms.pagetype: appcompat
ms.sitesec: library
author: TrudyHa
+ms.date: 04/19/2017
---
# Enabling and Disabling Compatibility Fixes in Compatibility Administrator
diff --git a/windows/deployment/planning/fixing-applications-by-using-the-sua-tool.md b/windows/deployment/planning/fixing-applications-by-using-the-sua-tool.md
index bdfe9b9c63..3c962cdae2 100644
--- a/windows/deployment/planning/fixing-applications-by-using-the-sua-tool.md
+++ b/windows/deployment/planning/fixing-applications-by-using-the-sua-tool.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: plan
ms.pagetype: appcompat
ms.sitesec: library
author: TrudyHa
+ms.date: 04/19/2017
---
# Fixing Applications by Using the SUA Tool
diff --git a/windows/deployment/planning/index.md b/windows/deployment/planning/index.md
index dc4c8029ca..dc0ea6b496 100644
--- a/windows/deployment/planning/index.md
+++ b/windows/deployment/planning/index.md
@@ -8,6 +8,7 @@ ms.mktglfcycl: plan
ms.sitesec: library
ms.localizationpriority: high
author: TrudyHa
+ms.date: 07/27/2017
---
# Plan for Windows 10 deployment
diff --git a/windows/deployment/planning/installing-and-uninstalling-custom-compatibility-databases-in-compatibility-administrator.md b/windows/deployment/planning/installing-and-uninstalling-custom-compatibility-databases-in-compatibility-administrator.md
index bd057029b9..b4d640525b 100644
--- a/windows/deployment/planning/installing-and-uninstalling-custom-compatibility-databases-in-compatibility-administrator.md
+++ b/windows/deployment/planning/installing-and-uninstalling-custom-compatibility-databases-in-compatibility-administrator.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: plan
ms.pagetype: appcompat
ms.sitesec: library
author: TrudyHa
+ms.date: 04/19/2017
---
# Installing and Uninstalling Custom Compatibility Databases in Compatibility Administrator
diff --git a/windows/deployment/planning/managing-application-compatibility-fixes-and-custom-fix-databases.md b/windows/deployment/planning/managing-application-compatibility-fixes-and-custom-fix-databases.md
index a654054608..008e895d2b 100644
--- a/windows/deployment/planning/managing-application-compatibility-fixes-and-custom-fix-databases.md
+++ b/windows/deployment/planning/managing-application-compatibility-fixes-and-custom-fix-databases.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: plan
ms.pagetype: appcompat
ms.sitesec: library
author: TrudyHa
+ms.date: 04/19/2017
---
# Managing Application-Compatibility Fixes and Custom Fix Databases
diff --git a/windows/deployment/planning/prepare-your-organization-for-windows-to-go.md b/windows/deployment/planning/prepare-your-organization-for-windows-to-go.md
index a5443fb11c..a7400061d9 100644
--- a/windows/deployment/planning/prepare-your-organization-for-windows-to-go.md
+++ b/windows/deployment/planning/prepare-your-organization-for-windows-to-go.md
@@ -8,6 +8,7 @@ ms.mktglfcycl: plan
ms.pagetype: mobility
ms.sitesec: library
author: mtniehaus
+ms.date: 04/19/2017
---
# Prepare your organization for Windows To Go
diff --git a/windows/deployment/planning/searching-for-fixed-applications-in-compatibility-administrator.md b/windows/deployment/planning/searching-for-fixed-applications-in-compatibility-administrator.md
index 2488fe4e38..14766d839f 100644
--- a/windows/deployment/planning/searching-for-fixed-applications-in-compatibility-administrator.md
+++ b/windows/deployment/planning/searching-for-fixed-applications-in-compatibility-administrator.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: plan
ms.pagetype: appcompat
ms.sitesec: library
author: TrudyHa
+ms.date: 04/19/2017
---
# Searching for Fixed Applications in Compatibility Administrator
diff --git a/windows/deployment/planning/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md b/windows/deployment/planning/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md
index 34260942d9..3f3d270c30 100644
--- a/windows/deployment/planning/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md
+++ b/windows/deployment/planning/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: plan
ms.pagetype: appcompat
ms.sitesec: library
author: TrudyHa
+ms.date: 04/19/2017
---
# Searching for Installed Compatibility Fixes with the Query Tool in Compatibility Administrator
diff --git a/windows/deployment/planning/security-and-data-protection-considerations-for-windows-to-go.md b/windows/deployment/planning/security-and-data-protection-considerations-for-windows-to-go.md
index 2cce8de874..f88b37f7b6 100644
--- a/windows/deployment/planning/security-and-data-protection-considerations-for-windows-to-go.md
+++ b/windows/deployment/planning/security-and-data-protection-considerations-for-windows-to-go.md
@@ -8,6 +8,7 @@ ms.mktglfcycl: plan
ms.pagetype: mobility, security
ms.sitesec: library
author: mtniehaus
+ms.date: 04/19/2017
---
# Security and data protection considerations for Windows To Go
diff --git a/windows/deployment/planning/showing-messages-generated-by-the-sua-tool.md b/windows/deployment/planning/showing-messages-generated-by-the-sua-tool.md
index 03651875c5..70bd453926 100644
--- a/windows/deployment/planning/showing-messages-generated-by-the-sua-tool.md
+++ b/windows/deployment/planning/showing-messages-generated-by-the-sua-tool.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: plan
ms.pagetype: appcompat
ms.sitesec: library
author: TrudyHa
+ms.date: 04/19/2017
---
# Showing Messages Generated by the SUA Tool
diff --git a/windows/deployment/planning/sua-users-guide.md b/windows/deployment/planning/sua-users-guide.md
index fff7a5757e..b5b1561470 100644
--- a/windows/deployment/planning/sua-users-guide.md
+++ b/windows/deployment/planning/sua-users-guide.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: plan
ms.pagetype: appcompat
ms.sitesec: library
author: TrudyHa
+ms.date: 04/19/2017
---
# SUA User's Guide
diff --git a/windows/deployment/planning/tabs-on-the-sua-tool-interface.md b/windows/deployment/planning/tabs-on-the-sua-tool-interface.md
index 721e32bca7..ab699b8791 100644
--- a/windows/deployment/planning/tabs-on-the-sua-tool-interface.md
+++ b/windows/deployment/planning/tabs-on-the-sua-tool-interface.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: plan
ms.pagetype: appcompat
ms.sitesec: library
author: TrudyHa
+ms.date: 04/19/2017
---
# Tabs on the SUA Tool Interface
diff --git a/windows/deployment/planning/testing-your-application-mitigation-packages.md b/windows/deployment/planning/testing-your-application-mitigation-packages.md
index 5fc970623c..8a31fdc2ce 100644
--- a/windows/deployment/planning/testing-your-application-mitigation-packages.md
+++ b/windows/deployment/planning/testing-your-application-mitigation-packages.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: plan
ms.pagetype: appcompat
ms.sitesec: library
author: TrudyHa
+ms.date: 04/19/2017
---
# Testing Your Application Mitigation Packages
diff --git a/windows/deployment/planning/understanding-and-using-compatibility-fixes.md b/windows/deployment/planning/understanding-and-using-compatibility-fixes.md
index 6ab830868c..11128c476c 100644
--- a/windows/deployment/planning/understanding-and-using-compatibility-fixes.md
+++ b/windows/deployment/planning/understanding-and-using-compatibility-fixes.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: plan
ms.pagetype: appcompat
ms.sitesec: library
author: TrudyHa
+ms.date: 04/19/2017
---
# Understanding and Using Compatibility Fixes
diff --git a/windows/deployment/planning/using-the-compatibility-administrator-tool.md b/windows/deployment/planning/using-the-compatibility-administrator-tool.md
index 26bd9c4a90..a8365386e9 100644
--- a/windows/deployment/planning/using-the-compatibility-administrator-tool.md
+++ b/windows/deployment/planning/using-the-compatibility-administrator-tool.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: plan
ms.pagetype: appcompat
ms.sitesec: library
author: TrudyHa
+ms.date: 04/19/2017
---
# Using the Compatibility Administrator Tool
diff --git a/windows/deployment/planning/using-the-sdbinstexe-command-line-tool.md b/windows/deployment/planning/using-the-sdbinstexe-command-line-tool.md
index 301917b901..3c8b3aa0da 100644
--- a/windows/deployment/planning/using-the-sdbinstexe-command-line-tool.md
+++ b/windows/deployment/planning/using-the-sdbinstexe-command-line-tool.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: plan
ms.pagetype: appcompat
ms.sitesec: library
author: TrudyHa
+ms.date: 04/19/2017
---
# Using the Sdbinst.exe Command-Line Tool
diff --git a/windows/deployment/planning/using-the-sua-tool.md b/windows/deployment/planning/using-the-sua-tool.md
index df93b0550b..d49309fb72 100644
--- a/windows/deployment/planning/using-the-sua-tool.md
+++ b/windows/deployment/planning/using-the-sua-tool.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: plan
ms.pagetype: appcompat
ms.sitesec: library
author: TrudyHa
+ms.date: 04/19/2017
---
# Using the SUA Tool
diff --git a/windows/deployment/planning/using-the-sua-wizard.md b/windows/deployment/planning/using-the-sua-wizard.md
index 17703c2eb7..1ad5ba549c 100644
--- a/windows/deployment/planning/using-the-sua-wizard.md
+++ b/windows/deployment/planning/using-the-sua-wizard.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: plan
ms.pagetype: appcompat
ms.sitesec: library
author: TrudyHa
+ms.date: 04/19/2017
---
# Using the SUA Wizard
diff --git a/windows/deployment/planning/viewing-the-events-screen-in-compatibility-administrator.md b/windows/deployment/planning/viewing-the-events-screen-in-compatibility-administrator.md
index 34186e3746..fc4f7c6b99 100644
--- a/windows/deployment/planning/viewing-the-events-screen-in-compatibility-administrator.md
+++ b/windows/deployment/planning/viewing-the-events-screen-in-compatibility-administrator.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: plan
ms.pagetype: appcompat
ms.sitesec: library
author: TrudyHa
+ms.date: 04/19/2017
---
# Viewing the Events Screen in Compatibility Administrator
diff --git a/windows/deployment/planning/windows-10-compatibility.md b/windows/deployment/planning/windows-10-compatibility.md
index 9768a7c1f6..4323a49d9e 100644
--- a/windows/deployment/planning/windows-10-compatibility.md
+++ b/windows/deployment/planning/windows-10-compatibility.md
@@ -9,6 +9,7 @@ ms.pagetype: appcompat
ms.localizationpriority: high
ms.sitesec: library
author: mtniehaus
+ms.date: 07/27/2017
---
# Windows 10 compatibility
diff --git a/windows/deployment/planning/windows-10-creators-update-deprecation.md b/windows/deployment/planning/windows-10-creators-update-deprecation.md
index 97ffa2b763..b6bacd19d6 100644
--- a/windows/deployment/planning/windows-10-creators-update-deprecation.md
+++ b/windows/deployment/planning/windows-10-creators-update-deprecation.md
@@ -6,7 +6,7 @@ ms.mktglfcycl: plan
ms.localizationpriority: high
ms.sitesec: library
author: lizap
-ms.date: 10/17/2017
+ms.date: 10/09/2017
---
# Features that are removed or deprecated in Windows 10 Creators Update
diff --git a/windows/deployment/planning/windows-10-deployment-considerations.md b/windows/deployment/planning/windows-10-deployment-considerations.md
index a9cee6bc13..807aab48d4 100644
--- a/windows/deployment/planning/windows-10-deployment-considerations.md
+++ b/windows/deployment/planning/windows-10-deployment-considerations.md
@@ -8,6 +8,7 @@ ms.localizationpriority: high
ms.mktglfcycl: plan
ms.sitesec: library
author: mtniehaus
+ms.date: 07/27/2017
---
# Windows 10 deployment considerations
diff --git a/windows/deployment/planning/windows-10-enterprise-faq-itpro.md b/windows/deployment/planning/windows-10-enterprise-faq-itpro.md
index ac8ae9af63..6780c3b222 100644
--- a/windows/deployment/planning/windows-10-enterprise-faq-itpro.md
+++ b/windows/deployment/planning/windows-10-enterprise-faq-itpro.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: plan
ms.localizationpriority: high
ms.sitesec: library
author:
+ms.date: 08/18/2017
---
# Windows 10 Enterprise: FAQ for IT professionals
@@ -42,6 +43,7 @@ For many devices, drivers will be automatically installed in Windows 10 and ther
- [HP driver pack](http://www8.hp.com/us/en/ads/clientmanagement/drivers-pack.html)
- [Dell driver packs for enterprise client OS deployment](http://en.community.dell.com/techcenter/enterprise-client/w/wiki/2065.dell-command-deploy-driver-packs-for-enterprise-client-os-deployment)
- [Lenovo Configuration Manager and MDT package index](https://support.lenovo.com/us/en/documents/ht074984)
+ - [Panasonic Driver Pack for Enterprise](http://pc-dl.panasonic.co.jp/itn/drivers/driver_packages.html)
### Where can I find out if an application or device is compatible with Windows 10?
diff --git a/windows/deployment/planning/windows-10-fall-creators-deprecation.md b/windows/deployment/planning/windows-10-fall-creators-deprecation.md
index 109a612947..48e83441d1 100644
--- a/windows/deployment/planning/windows-10-fall-creators-deprecation.md
+++ b/windows/deployment/planning/windows-10-fall-creators-deprecation.md
@@ -6,7 +6,7 @@ ms.mktglfcycl: plan
ms.localizationpriority: high
ms.sitesec: library
author: lizap
-ms.date: 10/17/2017
+ms.date: 10/09/2017
---
# Features that are removed or deprecated in Windows 10 Fall Creators Update
diff --git a/windows/deployment/planning/windows-10-fall-creators-removed-features.md b/windows/deployment/planning/windows-10-fall-creators-removed-features.md
index 24c6a90c98..6cdc748b94 100644
--- a/windows/deployment/planning/windows-10-fall-creators-removed-features.md
+++ b/windows/deployment/planning/windows-10-fall-creators-removed-features.md
@@ -6,7 +6,7 @@ ms.mktglfcycl: plan
ms.localizationpriority: high
ms.sitesec: library
author: lizap
-ms.date: 10/17/2017
+ms.date: 10/09/2017
---
# Features removed or planned for replacement starting with Windows 10 Fall Creators Update (version 1709)
diff --git a/windows/deployment/planning/windows-10-infrastructure-requirements.md b/windows/deployment/planning/windows-10-infrastructure-requirements.md
index a99af27a4e..f264840e05 100644
--- a/windows/deployment/planning/windows-10-infrastructure-requirements.md
+++ b/windows/deployment/planning/windows-10-infrastructure-requirements.md
@@ -8,6 +8,7 @@ ms.mktglfcycl: plan
ms.localizationpriority: high
ms.sitesec: library
author: mtniehaus
+ms.date: 07/27/2017
---
# Windows 10 infrastructure requirements
diff --git a/windows/deployment/planning/windows-to-go-frequently-asked-questions.md b/windows/deployment/planning/windows-to-go-frequently-asked-questions.md
index 8170500400..71ff1f9db8 100644
--- a/windows/deployment/planning/windows-to-go-frequently-asked-questions.md
+++ b/windows/deployment/planning/windows-to-go-frequently-asked-questions.md
@@ -8,6 +8,7 @@ ms.mktglfcycl: deploy
ms.pagetype: mobility
ms.sitesec: library
author: mtniehaus
+ms.date: 04/19/2017
---
# Windows To Go: frequently asked questions
diff --git a/windows/deployment/planning/windows-to-go-overview.md b/windows/deployment/planning/windows-to-go-overview.md
index 4b1d981e94..1b3e1eb797 100644
--- a/windows/deployment/planning/windows-to-go-overview.md
+++ b/windows/deployment/planning/windows-to-go-overview.md
@@ -8,6 +8,7 @@ ms.mktglfcycl: deploy
ms.pagetype: mobility, edu
ms.sitesec: library
author: mtniehaus
+ms.date: 04/19/2017
---
# Windows To Go: feature overview
diff --git a/windows/deployment/update/change-history-for-update-windows-10.md b/windows/deployment/update/change-history-for-update-windows-10.md
index 05a7ab9827..6df6256b76 100644
--- a/windows/deployment/update/change-history-for-update-windows-10.md
+++ b/windows/deployment/update/change-history-for-update-windows-10.md
@@ -6,7 +6,7 @@ ms.mktglfcycl: manage
ms.sitesec: library
author: DaniHalfin
ms.author: daniha
-ms.date: 10/10/2017
+ms.date: 10/17/2017
---
# Change history for Update Windows 10
diff --git a/windows/deployment/update/device-health-get-started.md b/windows/deployment/update/device-health-get-started.md
index 5f985c13da..9350288947 100644
--- a/windows/deployment/update/device-health-get-started.md
+++ b/windows/deployment/update/device-health-get-started.md
@@ -5,7 +5,7 @@ keywords: Device Health, oms, operations management suite, prerequisites, requir
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
-ms.date: 10/17/2017
+ms.date: 11/14/2017
ms.pagetype: deploy
author: jaimeo
---
@@ -23,17 +23,17 @@ Steps are provided in sections that follow the recommended setup process:
Device Health has the following requirements:
1. Device Health is currently only compatible with Windows 10 and Windows Server 2016 devices. The solution is intended to be used with desktop devices (Windows 10 workstations and laptops).
-2. The solution requires that at least the [enhanced level of telemetry](https://technet.microsoft.com/itpro/windows/manage/configure-windows-telemetry-in-your-organization#basic-level) is enabled on all devices that are intended to be displayed in the solution. To learn more about Windows telemetry, see [Configure Windows telemetry in your organization](/windows/configuration/configure-windows-telemetry-in-your-organization).
-3. The telemetry of your organization’s Windows devices must be successfully transmitted to Microsoft. Microsoft has specified [endpoints for each of the telemetry services](https://technet.microsoft.com/itpro/windows/manage/configure-windows-telemetry-in-your-organization#endpoints), which must be whitelisted by your organization so the data can be transmitted. The following table is taken from the article on telemetry endpoints and summarizes the use of each endpoint:
+2. The solution requires that at least the [enhanced level of diagnostic data](https://technet.microsoft.com/itpro/windows/manage/configure-windows-diagnostic-data-in-your-organization#basic-level) is enabled on all devices that are intended to be displayed in the solution. To learn more about Windows diagnostic data, see [Configure Windows diagnostic data in your organization](/windows/configuration/configure-windows-diagnostic-data-in-your-organization).
+3. The diagnostic data of your organization’s Windows devices must be successfully transmitted to Microsoft. Microsoft has specified [endpoints for each of the diagnostic data services](https://technet.microsoft.com/itpro/windows/manage/configure-windows-diagnostic-data-in-your-organization#endpoints), which must be whitelisted by your organization so the data can be transmitted. The following table is taken from the article on diagnostic data endpoints and summarizes the use of each endpoint:
Service | Endpoint
--- | ---
-Connected User Experience and Telemetry component | v10.vortex-win.data.microsoft.com settings-win.data.microsoft.com
+Connected User Experiences and Telemetry component | v10.vortex-win.data.microsoft.com settings-win.data.microsoft.com
Windows Error Reporting | watson.telemetry.microsoft.com
Online Crash Analysis | oca.telemetry.microsoft.com
>[!NOTE]
-> If your deployment includes devices running Windows 10 versions prior to Windows 10, version 1703, you must **exclude** *authentication* for the endpoints listed in Step 3. Windows Error Reporting did not support authenticating proxies until Windows 10, version 1703. See [Configure Windows telemetry in your organization](/windows/configuration/configure-windows-telemetry-in-your-organization) for steps to exclude authentication for these endpoints.
+> If your deployment includes devices running Windows 10 versions prior to Windows 10, version 1703, you must **exclude** *authentication* for the endpoints listed in Step 3. Windows Error Reporting did not support authenticating proxies until Windows 10, version 1703. See [Configure Windows diagnostic data in your organization](/windows/configuration/configure-windows-diagnostic-data-in-your-organization) for steps to exclude authentication for these endpoints.
## Add Device Health to Microsoft Operations Management Suite
@@ -79,7 +79,7 @@ After you have added Device Health and devices have a Commercial ID, you will be
>[!NOTE]
>You can unsubscribe from the Device Health solution if you no longer want to monitor your organization’s devices. User device data will continue to be shared with Microsoft while the opt-in keys are set on user devices and the proxy allows traffic.
-## Deploy your Commercial ID to your Windows 10 devices and set the telemetry level
+## Deploy your Commercial ID to your Windows 10 devices and set the diagnostic data level
In order for your devices to show up in Windows Analytics: Device Health, they must be configured with your organization’s Commercial ID. This is so that Microsoft knows that a given device is a member of your organization and to feed that device’s data back to you. There are two primary methods for widespread deployment of your Commercial ID: Group Policy and Mobile Device Management (MDM).
@@ -114,7 +114,7 @@ If you need further information on Windows Error Reporting (WER) settings, see [
Devices must be able to reach the endpoints specified in the "Device Health prerequisites" section of this topic.
>[!NOTE]
-> If your deployment includes devices running Windows 10 versions prior to Windows 10, version 1703, you must **exclude** *authentication* for the endpoints listed in Step 3 of the "Device Health prerequisites" section of this topic. Windows Error Reporting did not support authenticating proxies until Windows 10, version 1703. (If you need more information about telemetry endpoints and how to manage them, see [Configure Windows telemetry in your organization](https://docs.microsoft.com/windows/configuration/configure-windows-telemetry-in-your-organization).
+> If your deployment includes devices running Windows 10 versions prior to Windows 10, version 1703, you must **exclude** *authentication* for the endpoints listed in Step 3 of the "Device Health prerequisites" section of this topic. Windows Error Reporting did not support authenticating proxies until Windows 10, version 1703. (If you need more information about diagnostic data endpoints and how to manage them, see [Configure Windows diagnostic data in your organization](https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization).
If you are using proxy server authentication, it is worth taking extra care to check the configuration. Prior to Windows 10, version 1703, WER uploads error reports in the machine context. Both user (typically authenticated) and machine (typically anonymous) contexts require access through proxy servers to the diagnostic endpoints. In Windows 10, version 1703, and later WER will attempt to use the context of the user that is logged on for proxy authentication such that only the user account requires proxy access.
diff --git a/windows/deployment/update/device-health-monitor.md b/windows/deployment/update/device-health-monitor.md
index 551585a40a..078a95742a 100644
--- a/windows/deployment/update/device-health-monitor.md
+++ b/windows/deployment/update/device-health-monitor.md
@@ -6,7 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.localizationpriority: medium
-ms.date: 10/17/2017
+ms.date: 11/14/2017
ms.pagetype: deploy
author: jaimeo
---
@@ -19,7 +19,7 @@ Device Health is the newest Windows Analytics solution that complements the exis
Like Upgrade Readiness and Update Compliance, Device Health is a solution built within Operations Management Suite (OMS), a cloud-based monitoring and automation service that has a flexible servicing subscription based on data usage and retention. This release is free for customers to try and will not incur charges on your OMS workspace for its use. For more information about OMS, see [Operations Management Suite overview](http://azure.microsoft.com/en-us/documentation/articles/operations-management-suite-overview/).
-Device Health uses Windows diagnostic data that is part of all Windows 10 devices. If you have already employed Upgrade Readiness or Update Compliance solutions, all you need to do is select Device Health from the OMS solution gallery and add it to your OMS workspace. Device Health requires enhanced telemetry, so you might need to implement this policy if you've not already done so.
+Device Health uses Windows diagnostic data that is part of all Windows 10 devices. If you have already employed Upgrade Readiness or Update Compliance solutions, all you need to do is select Device Health from the OMS solution gallery and add it to your OMS workspace. Device Health requires enhanced diagnostic data, so you might need to implement this policy if you've not already done so.
Device Health provides the following:
@@ -27,7 +27,7 @@ Device Health provides the following:
- Identification of devices that crash frequently, and therefore might need to be rebuilt or replaced
- Identification of device drivers that are causing device crashes, with suggestions of alternative versions of those drivers that might reduce the number of crashes
- Notification of Windows Information Protection misconfigurations that send prompts to end users
-- No need for new complex customized infrastructure, thanks to cloud-connected access using Windows 10 telemetry
+- No need for new complex customized infrastructure, thanks to cloud-connected access using Windows 10 diagnostic data
See the following topics in this guide for detailed information about configuring and using the Device Health solution:
@@ -56,10 +56,10 @@ The Device Health architecture and data flow is summarized by the following five
-**(1)** User computers send telemetry data to a secure Microsoft data center using the Microsoft Data Management Service.
-**(2)** Telemetry data is analyzed by the Microsoft Telemetry Service.
-**(3)** Telemetry data is pushed from the Microsoft Telemetry Service to your OMS workspace.
-**(4)** Telemetry data is available in the Device Health solution.
+**(1)** User computers send diagnostic data to a secure Microsoft data center using the Microsoft Data Management Service.
+**(2)** Diagnostic data is analyzed by the Microsoft Telemetry Service.
+**(3)** Diagnostic data is pushed from the Microsoft Telemetry Service to your OMS workspace.
+**(4)** Diagnostic data is available in the Device Health solution.
**(5)** You are now able to proactively monitor Device Health issues in your environment.
These steps are illustrated in following diagram:
@@ -67,7 +67,7 @@ These steps are illustrated in following diagram:
[](images/analytics-architecture.png)
>[!NOTE]
->This process assumes that Windows telemetry is enabled and you [have assigned your Commercial ID to devices](update-compliance-get-started.md#deploy-your-commercial-id-to-your-windows-10-devices).
+>This process assumes that Windows diagnostic data is enabled and you [have assigned your Commercial ID to devices](update-compliance-get-started.md#deploy-your-commercial-id-to-your-windows-10-devices).
diff --git a/windows/deployment/update/device-health-using.md b/windows/deployment/update/device-health-using.md
index 5892aacc02..3526ae3850 100644
--- a/windows/deployment/update/device-health-using.md
+++ b/windows/deployment/update/device-health-using.md
@@ -4,7 +4,7 @@ description: Explains how to begin usihg Device Health.
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
-ms.date: 10/17/2017
+ms.date: 10/10/2017
ms.pagetype: deploy
author: jaimeo
---
diff --git a/windows/deployment/update/index.md b/windows/deployment/update/index.md
index 4fa6463ca0..a9805be280 100644
--- a/windows/deployment/update/index.md
+++ b/windows/deployment/update/index.md
@@ -7,6 +7,7 @@ ms.sitesec: library
author: DaniHalfin
ms.localizationpriority: high
ms.author: daniha
+ms.date: 11/17/2017
---
# Update Windows 10 in the enterprise
@@ -49,4 +50,3 @@ Windows as a service provides a new way to think about building, deploying, and
>Windows servicing is changing, but for disaster recovery scenarios and bare-metal deployments of Windows 10, you still can use traditional imaging software such as System Center Configuration Manager or the Microsoft Deployment Toolkit. Using these tools to deploy Windows 10 images is similar to deploying previous versions of Windows.
>With each release of a new feature update for CB, Microsoft makes available new .iso files for use in updating your custom images. Each Windows 10 build has a finite servicing lifetime, so it’s important that images stay up to date with the latest build. For detailed information about how to deploy Windows 10 to bare-metal machines or to upgrade to Windows 10 from previous builds of Windows, see [Deploy Windows 10 with System Center 2012 R2 Configuration Manager](../deploy-windows-sccm/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md). Additionally, Windows 10 clients can move from any supported version of Windows 10 (i.e. Version 1511) to the latest version directly (i.e 1709).
-Not finding content you need? Windows 10 users, tell us what you want on [Feedback Hub](feedback-hub://?referrer=techDocsUcPage&tabid=2&contextid=897&newFeedback=true&topic=index.md).
diff --git a/windows/deployment/update/update-compliance-feature-update-status.md b/windows/deployment/update/update-compliance-feature-update-status.md
index 46de2943e8..0235ac8cea 100644
--- a/windows/deployment/update/update-compliance-feature-update-status.md
+++ b/windows/deployment/update/update-compliance-feature-update-status.md
@@ -7,7 +7,7 @@ ms.sitesec: library
ms.pagetype: deploy
author: DaniHalfin
ms.author: daniha
-ms.date: 10/17/2017
+ms.date: 10/18/2017
---
# Feature Update Status
diff --git a/windows/deployment/update/update-compliance-get-started.md b/windows/deployment/update/update-compliance-get-started.md
index 41369d98ef..ead61e2d95 100644
--- a/windows/deployment/update/update-compliance-get-started.md
+++ b/windows/deployment/update/update-compliance-get-started.md
@@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: deploy
author: DaniHalfin
ms.author: daniha
-ms.date: 10/17/2017
+ms.date: 10/13/2017
---
# Get started with Update Compliance
@@ -24,19 +24,19 @@ Steps are provided in sections that follow the recommended setup process:
Update Compliance has the following requirements:
1. Update Compliance is currently only compatible with Windows 10 devices. The solution is intended to be used with desktop devices (Windows 10 workstations and laptops).
-2. The solution requires that Windows 10 telemetry is enabled on all devices that are intended to be displayed in the solution. These devices must have at least the [basic level of telemetry](https://technet.microsoft.com/itpro/windows/manage/configure-windows-telemetry-in-your-organization#basic-level) enabled. To learn more about Windows telemetry, see [Configure Windows telemetry in your organization](/windows/configuration/configure-windows-telemetry-in-your-organization).
-3. The telemetry of your organization’s Windows devices must be successfully transmitted to Microsoft. Microsoft has specified [endpoints for each of the telemetry services](https://technet.microsoft.com/itpro/windows/manage/configure-windows-telemetry-in-your-organization#endpoints), which must be whitelisted by your organization so the data can be transmitted. The following table is taken from the article on telemetry endpoints and summarizes the use of each endpoint:
+2. The solution requires that Windows 10 diagnostic data is enabled on all devices that are intended to be displayed in the solution. These devices must have at least the [basic level of diagnostic data](/configuration/configure-windows-diagnostic-data-in-your-organization#basic-level) enabled. To learn more about Windows diagnostic data, see [Configure Windows diagnostic data in your organization](/windows/configuration/configure-windows-diagnostic-data-in-your-organization).
+3. The diagnostic data of your organization’s Windows devices must be successfully transmitted to Microsoft. Microsoft has specified [endpoints for each of the diagnostic data services](/configuration/configure-windows-diagnostic-data-in-your-organization#endpoints), which must be whitelisted by your organization so the data can be transmitted. The following table is taken from the article on diagnostic data endpoints and summarizes the use of each endpoint:
Service | Endpoint
--- | ---
- Connected User Experience and Telemetry component | v10.vortex-win.data.microsoft.com settings-win.data.microsoft.com
+ Connected User Experiences and Telemetry component | v10.vortex-win.data.microsoft.com settings-win.data.microsoft.com
Windows Error Reporting | watson.telemetry.microsoft.com
Online Crash Analysis | oca.telemetry.microsoft.com
4. To use Windows Defender Antivirus Assessment, devices must be protected by Windows Defender AV (and not a 3rd party AV program), and must have enabled [cloud-delivered protection](/windows/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus). See the [Troublehsoot Windows Defender Antivirus reporting](/windows/threat-protection/windows-defender-antivirus/troubleshoot-reporting.md) topic for help on ensuring the configuration is correct.
- For endpoints running Windows 10, version 1607 or earlier, [Windows telemetry must also be set to **Enhanced**](https://docs.microsoft.com/en-us/windows/configuration/configure-windows-telemetry-in-your-organization#enhanced-level), to be compatible with Windows Defender Antivirus.
+ For endpoints running Windows 10, version 1607 or earlier, [Windows diagnostic data must also be set to **Enhanced**](https://docs.microsoft.com/en-us/windows/configuration/configure-windows-diagnostic-data-in-your-organization#enhanced-level), to be compatible with Windows Defender Antivirus.
See the [Windows Defender Antivirus in Windows 10](/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10) content library for more information on enabling, configuring, and validating Windows Defender AV.
@@ -74,7 +74,7 @@ If you are not yet using OMS, use the following steps to subscribe to OMS Update
9. Click **Subscribe** to subscribe to OMS Update Compliance. You will then need to distribute your Commercial ID across all your organization’s devices. More information on the Commercial ID is provided below.
- 
+ 
After you are subscribed to OMS Update Compliance and your devices have a Commercial ID, you will begin receiving data. It will typically take 24 hours for the first data to begin appearing. The following section explains how to deploy your Commercial ID to your Windows 10 devices.
diff --git a/windows/deployment/update/update-compliance-monitor.md b/windows/deployment/update/update-compliance-monitor.md
index 95e64fcee6..cc368c6633 100644
--- a/windows/deployment/update/update-compliance-monitor.md
+++ b/windows/deployment/update/update-compliance-monitor.md
@@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: deploy
author: DaniHalfin
ms.author: daniha
-ms.date: 10/17/2017
+ms.date: 10/13/2017
---
# Monitor Windows Updates and Windows Defender Antivirus with Update Compliance
@@ -19,7 +19,7 @@ With Windows 10, organizations need to change the way they approach monitoring a
Update Compliance is a solution built within Operations Management Suite (OMS), a cloud-based monitoring and automation service which has a flexible servicing subscription based off data usage/retention. For more information about OMS, see [Operations Management Suite overview](http://azure.microsoft.com/documentation/articles/operations-management-suite-overview/).
-Update Compliance uses the Windows telemetry that is part of all Windows 10 devices. It collects system data including update installation progress, Windows Update for Business (WUfB) configuration data, Windows Defender Antivirus data, and other update-specific information, and then sends this data privately to a secure cloud to be stored for analysis and usage within the solution.
+Update Compliance uses the Windows diagnostic data that is part of all Windows 10 devices. It collects system data including update installation progress, Windows Update for Business (WUfB) configuration data, Windows Defender Antivirus data, and other update-specific information, and then sends this data privately to a secure cloud to be stored for analysis and usage within the solution.
Update Compliance provides the following:
@@ -28,7 +28,7 @@ Update Compliance provides the following:
- The ability to track protection and threat status for Windows Defender Antivirus-enabled devices
- An overview of WUfB deferral configurations (Windows 10 Anniversary Update [1607] and later)
- Powerful built-in [log analytics](https://www.microsoft.com/en-us/cloud-platform/insight-and-analytics?WT.srch=1&WT.mc_id=AID529558_SEM_%5B_uniqid%5D&utm_source=Bing&utm_medium=CPC&utm_term=log%20analytics&utm_campaign=Hybrid_Cloud_Management) to create useful custom queries
-- Cloud-connected access utilizing Windows 10 telemetry means no need for new complex, customized infrastructure
+- Cloud-connected access utilizing Windows 10 diagnostic data means no need for new complex, customized infrastructure
See the following topics in this guide for detailed information about configuring and using the Update Compliance solution:
@@ -43,10 +43,10 @@ An overview of the processes used by the Update Compliance solution is provided
The Update Compliance architecture and data flow is summarized by the following five-step process:
-**(1)** User computers send telemetry data to a secure Microsoft data center using the Microsoft Data Management Service.
-**(2)** Telemetry data is analyzed by the Update Compliance Data Service.
-**(3)** Telemetry data is pushed from the Update Compliance Data Service to your OMS workspace.
-**(4)** Telemetry data is available in the Update Compliance solution.
+**(1)** User computers send diagnostic data to a secure Microsoft data center using the Microsoft Data Management Service.
+**(2)** Diagnostic data is analyzed by the Update Compliance Data Service.
+**(3)** Diagnostic data is pushed from the Update Compliance Data Service to your OMS workspace.
+**(4)** Diagnostic data is available in the Update Compliance solution.
**(5)** You are able to monitor and troubleshoot Windows updates and Windows Defender AV in your environment.
These steps are illustrated in following diagram:
@@ -54,7 +54,7 @@ These steps are illustrated in following diagram:
>[!NOTE]
->This process assumes that Windows telemetry is enabled and you [have assigned your Commercial ID to devices](update-compliance-get-started.md#deploy-your-commercial-id-to-your-windows-10-devices).
+>This process assumes that Windows diagnostic data is enabled and you [have assigned your Commercial ID to devices](update-compliance-get-started.md#deploy-your-commercial-id-to-your-windows-10-devices).
diff --git a/windows/deployment/update/update-compliance-need-attention.md b/windows/deployment/update/update-compliance-need-attention.md
index 5aefff3779..c22ccf1812 100644
--- a/windows/deployment/update/update-compliance-need-attention.md
+++ b/windows/deployment/update/update-compliance-need-attention.md
@@ -7,7 +7,7 @@ ms.sitesec: library
ms.pagetype: deploy
author: DaniHalfin
ms.author: daniha
-ms.date: 10/17/2017
+ms.date: 10/13/2017
---
# Need Attention!
diff --git a/windows/deployment/update/update-compliance-perspectives.md b/windows/deployment/update/update-compliance-perspectives.md
index f039195996..e3fe9c0bb9 100644
--- a/windows/deployment/update/update-compliance-perspectives.md
+++ b/windows/deployment/update/update-compliance-perspectives.md
@@ -7,7 +7,7 @@ ms.sitesec: library
ms.pagetype: deploy
author: DaniHalfin
ms.author: daniha
-ms.date: 10/17/2017
+ms.date: 10/13/2017
---
# Perspectives
diff --git a/windows/deployment/update/update-compliance-security-update-status.md b/windows/deployment/update/update-compliance-security-update-status.md
index b361f73d30..969c2e6d55 100644
--- a/windows/deployment/update/update-compliance-security-update-status.md
+++ b/windows/deployment/update/update-compliance-security-update-status.md
@@ -7,7 +7,7 @@ ms.sitesec: library
ms.pagetype: deploy
author: DaniHalfin
ms.author: daniha
-ms.date: 10/17/2017
+ms.date: 10/13/2017
---
# Security Update Status
diff --git a/windows/deployment/update/update-compliance-using.md b/windows/deployment/update/update-compliance-using.md
index 07e1970441..fe2d443d21 100644
--- a/windows/deployment/update/update-compliance-using.md
+++ b/windows/deployment/update/update-compliance-using.md
@@ -7,7 +7,7 @@ ms.sitesec: library
ms.pagetype: deploy
author: DaniHalfin
ms.author: daniha
-ms.date: 10/17/2017
+ms.date: 10/13/2017
---
# Use Update Compliance
@@ -16,7 +16,7 @@ In this section you'll learn how to use Update Compliance to monitor your device
Update Compliance:
-- Uses telemetry gathered from user devices to form an all-up view of Windows 10 devices in your organization.
+- Uses diagnostic data gathered from user devices to form an all-up view of Windows 10 devices in your organization.
- Enables you to maintain a high-level perspective on the progress and status of updates across all devices.
- Provides a workflow that can be used to quickly identify which devices require attention.
- Enables you to track deployment compliance targets for updates.
diff --git a/windows/deployment/update/update-compliance-wd-av-status.md b/windows/deployment/update/update-compliance-wd-av-status.md
index 0f4b1fa78f..0d7eaadd5a 100644
--- a/windows/deployment/update/update-compliance-wd-av-status.md
+++ b/windows/deployment/update/update-compliance-wd-av-status.md
@@ -7,7 +7,7 @@ ms.sitesec: library
ms.pagetype: deploy
author: DaniHalfin
ms.author: daniha
-ms.date: 10/17/2017
+ms.date: 10/13/2017
---
# Windows Defender AV Status
diff --git a/windows/deployment/update/waas-configure-wufb.md b/windows/deployment/update/waas-configure-wufb.md
index 359e53ea6f..f705f7b85f 100644
--- a/windows/deployment/update/waas-configure-wufb.md
+++ b/windows/deployment/update/waas-configure-wufb.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: DaniHalfin
ms.localizationpriority: high
ms.author: daniha
-ms.date: 07/27/2017
+ms.date: 10/13/2017
---
# Configure Windows Update for Business
@@ -28,7 +28,7 @@ ms.date: 07/27/2017
You can use Group Policy or your mobile device management (MDM) service to configure Windows Update for Business settings for your devices. The sections in this topic provide the Group Policy and MDM policies for Windows 10, version 1511 and above. The MDM policies use the OMA-URI setting from the [Policy CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962.aspx).
>[!IMPORTANT]
->For Windows Update for Business policies to be honored, the Telemetry level of the device must be set to **1 (Basic)** or higher. If it is set to **0 (Security)**, Windows Update for Business policies will have no effect. For instructions, see [Configure the operating system telemetry level](https://technet.microsoft.com/en-us/itpro/windows/manage/configure-windows-telemetry-in-your-organization#configure-the-operating-system-telemetry-level).
+>For Windows Update for Business policies to be honored, the Diagnostic Data level of the device must be set to **1 (Basic)** or higher. If it is set to **0 (Security)**, Windows Update for Business policies will have no effect. For instructions, see [Configure the operating system diagnostic data level](https://technet.microsoft.com/en-us/itpro/windows/manage/configure-windows-diagnostic-data-in-your-organization#configure-the-operating-system-diagnostic-data-level).
Some Windows Update for Business policies are not applicable or behave differently for devices running Windows 10 Mobile Enterprise. Specifically, policies pertaining to Feature Updates will not be applied to Windows 10 Mobile Enterprise. All Windows 10 Mobile updates are recognized as Quality Updates, and can only be deferred or paused using the Quality Update policy settings. Additional information is provided in this topic and in [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md).
diff --git a/windows/deployment/update/waas-delivery-optimization.md b/windows/deployment/update/waas-delivery-optimization.md
index f4ad73d713..4c9151a55f 100644
--- a/windows/deployment/update/waas-delivery-optimization.md
+++ b/windows/deployment/update/waas-delivery-optimization.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: JaimeO
ms.localizationpriority: high
ms.author: jaimeo
-ms.date: 11/13/2017
+ms.date: 11/21/2017
---
# Configure Delivery Optimization for Windows 10 updates
diff --git a/windows/deployment/update/waas-manage-updates-configuration-manager.md b/windows/deployment/update/waas-manage-updates-configuration-manager.md
index bb937f6456..ad496df8a2 100644
--- a/windows/deployment/update/waas-manage-updates-configuration-manager.md
+++ b/windows/deployment/update/waas-manage-updates-configuration-manager.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: DaniHalfin
ms.localizationpriority: high
ms.author: daniha
-ms.date: 07/27/2017
+ms.date: 10/16/2017
---
# Deploy Windows 10 updates using System Center Configuration Manager
@@ -329,4 +329,3 @@ With the task sequence created, you’re ready to deploy it. If you’re using t
- [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md)
- [Manage device restarts after updates](waas-restart.md)
-Not finding content you need? Windows 10 users, tell us what you want on [Feedback Hub](feedback-hub://?referrer=techDocsUcPage&tabid=2&contextid=897&newFeedback=true&topic=waas-manage-updates-configuration-manager.md).
diff --git a/windows/deployment/update/waas-manage-updates-wsus.md b/windows/deployment/update/waas-manage-updates-wsus.md
index 92a51de4ab..11d1c8bbbd 100644
--- a/windows/deployment/update/waas-manage-updates-wsus.md
+++ b/windows/deployment/update/waas-manage-updates-wsus.md
@@ -7,6 +7,7 @@ ms.sitesec: library
author: DaniHalfin
ms.localizationpriority: high
ms.author: daniha
+ms.date: 10/16/2017
---
# Deploy Windows 10 updates using Windows Server Update Services (WSUS)
@@ -354,5 +355,3 @@ Now that you have the All Windows 10 Upgrades view, complete the following steps
- [Walkthrough: use Intune to configure Windows Update for Business](waas-wufb-intune.md)
- [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md)
- [Manage device restarts after updates](waas-restart.md)
-
-Not finding content you need? Windows 10 users, tell us what you want on [Feedback Hub](feedback-hub://?referrer=techDocsUcPage&tabid=2&contextid=897&newFeedback=true&topic=waas-manage-updates-wsus.md).
\ No newline at end of file
diff --git a/windows/deployment/update/waas-manage-updates-wufb.md b/windows/deployment/update/waas-manage-updates-wufb.md
index 483cb640ad..e26cc352fc 100644
--- a/windows/deployment/update/waas-manage-updates-wufb.md
+++ b/windows/deployment/update/waas-manage-updates-wufb.md
@@ -7,6 +7,7 @@ ms.sitesec: library
author: DaniHalfin
ms.localizationpriority: high
ms.author: daniha
+ms.date: 10/13/2017
---
# Deploy updates using Windows Update for Business
@@ -120,7 +121,7 @@ Windows Update for Business was first made available in Windows 10, version 1511
## Monitor Windows Updates using Update Compliance
-Update Compliance, now **available in public preview**, provides a holistic view of OS update compliance, update deployment progress, and failure troubleshooting for Windows 10 devices. This new service uses telemetry data including installation progress, Windows Update configuration, and other information to provide such insights, at no extra cost and without additional infrastructure requirements. Whether used with Windows Update for Business or other management tools, you can be assured that your devices are properly updated.
+Update Compliance, now **available in public preview**, provides a holistic view of OS update compliance, update deployment progress, and failure troubleshooting for Windows 10 devices. This new service uses diagnostic data including installation progress, Windows Update configuration, and other information to provide such insights, at no extra cost and without additional infrastructure requirements. Whether used with Windows Update for Business or other management tools, you can be assured that your devices are properly updated.
diff --git a/windows/deployment/update/waas-mobile-updates.md b/windows/deployment/update/waas-mobile-updates.md
index 9234f54996..b167f78eb1 100644
--- a/windows/deployment/update/waas-mobile-updates.md
+++ b/windows/deployment/update/waas-mobile-updates.md
@@ -7,6 +7,7 @@ ms.sitesec: library
author: DaniHalfin
ms.localizationpriority: high
ms.author: daniha
+ms.date: 07/27/2017
---
# Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile
diff --git a/windows/deployment/update/waas-optimize-windows-10-updates.md b/windows/deployment/update/waas-optimize-windows-10-updates.md
index 899f98788b..d694f2ff14 100644
--- a/windows/deployment/update/waas-optimize-windows-10-updates.md
+++ b/windows/deployment/update/waas-optimize-windows-10-updates.md
@@ -7,6 +7,7 @@ ms.sitesec: library
author: DaniHalfin
ms.localizationpriority: high
ms.author: daniha
+ms.date: 07/27/2017
---
# Optimize Windows 10 update delivery
diff --git a/windows/deployment/update/waas-overview.md b/windows/deployment/update/waas-overview.md
index dbcd6f6436..3452191682 100644
--- a/windows/deployment/update/waas-overview.md
+++ b/windows/deployment/update/waas-overview.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: DaniHalfin
ms.localizationpriority: high
ms.author: daniha
-ms.date: 07/27/2017
+ms.date: 10/16/2017
---
# Overview of Windows as a service
@@ -45,7 +45,7 @@ One of the biggest challenges for organizations when it comes to deploying a new
Application compatibility testing has historically been a burden when approaching a Windows deployment or upgrade. With Windows 10, application compatibility from the perspective of desktop applications, websites, and apps built on the Universal Windows Platform (UWP) has improved tremendously. Microsoft understands the challenges organizations experienced when they migrated from the Windows XP operating system to Windows 7 and has been working to make Windows 10 upgrades a much better experience.
-Most Windows 7–compatible desktop applications will be compatible with Windows 10 straight out of the box. Windows 10 achieved such high compatibility because the changes in the existing Win32 application programming interfaces were minimal. Combined with valuable feedback via the Windows Insider Program and telemetry data, this level of compatibility can be maintained through each feature update. As for websites, Windows 10 includes Internet Explorer 11 and its backward-compatibility modes for legacy websites. Finally, UWP apps follow a compatibility story similar to desktop applications, so most of them will be compatible with Windows 10.
+Most Windows 7–compatible desktop applications will be compatible with Windows 10 straight out of the box. Windows 10 achieved such high compatibility because the changes in the existing Win32 application programming interfaces were minimal. Combined with valuable feedback via the Windows Insider Program and diagnostic data, this level of compatibility can be maintained through each feature update. As for websites, Windows 10 includes Internet Explorer 11 and its backward-compatibility modes for legacy websites. Finally, UWP apps follow a compatibility story similar to desktop applications, so most of them will be compatible with Windows 10.
For the most important business-critical applications, organizations should still perform testing on a regular basis to validate compatibility with new builds. For remaining applications, consider validating them as part of a pilot deployment process to reduce the time spent on compatibility testing. If it’s unclear whether an application is compatible with Windows 10, IT pros can either consult with the ISV or check the supported software directory at [http://www.readyforwindows.com](http://www.readyforwindows.com).
@@ -199,5 +199,4 @@ With all these options, which an organization chooses depends on the resources,
- [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md)
- [Walkthrough: use Intune to configure Windows Update for Business](waas-wufb-intune.md)
- [Manage device restarts after updates](waas-restart.md)
-
-Not finding content you need? Windows 10 users, tell us what you want on [Feedback Hub](feedback-hub://?referrer=techDocsUcPage&tabid=2&contextid=897&newFeedback=true&topic=waas-overview.md).
\ No newline at end of file
+
\ No newline at end of file
diff --git a/windows/deployment/update/waas-restart.md b/windows/deployment/update/waas-restart.md
index 807d2f4a3d..b4ad48ad0e 100644
--- a/windows/deployment/update/waas-restart.md
+++ b/windows/deployment/update/waas-restart.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: DaniHalfin
ms.localizationpriority: high
ms.author: daniha
-ms.date: 07/05/2017
+ms.date: 07/27/2017
---
# Manage device restarts after updates
@@ -24,7 +24,7 @@ You can use Group Policy settings, mobile device management (MDM) or Registry (n
## Schedule update installation
-In Group Policy, within **Configure Automatic Updates**, you can configure a forced restart after a specified instllation time.
+In Group Policy, within **Configure Automatic Updates**, you can configure a forced restart after a specified installation time.
To set the time, you need to go to **Configure Automatic Updates**, select option **4 - Auto download and schedule the install**, and then enter a time in the **Scheduled install time** dropdown. Alternatively, you can specify that installation will occur during the automatic maintenance time (configured using **Computer Configuration\Administrative Templates\Windows Components\Maintenance Scheduler**).
diff --git a/windows/deployment/update/waas-servicing-channels-windows-10-updates.md b/windows/deployment/update/waas-servicing-channels-windows-10-updates.md
index 8637dbf7c4..b311f101b7 100644
--- a/windows/deployment/update/waas-servicing-channels-windows-10-updates.md
+++ b/windows/deployment/update/waas-servicing-channels-windows-10-updates.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: DaniHalfin
ms.localizationpriority: high
ms.author: daniha
-ms.date: 07/27/2017
+ms.date: 10/13/2017
---
# Assign devices to servicing channels for Windows 10 updates
@@ -23,7 +23,7 @@ ms.date: 07/27/2017
>[!TIP]
>If you're not familiar with the Windows 10 servicing or release channels, read [Servicing Channels](waas-overview.md#servicing-channels) first.
>
->Due to [naming changes](waas-overview.md#naming-changes), older terms like CB,CBB and LTSB may still be displayed in some of our products.
+>Due to [naming changes](waas-overview.md#naming-changes), older terms like CB, CBB and LTSB may still be displayed in some of our products.
Semi-Annual Channel (Targeted) is the default servicing channel for all Windows 10 devices except those with the LTSB edition installed. The following table shows the servicing channels available to each edition of Windows 10.
@@ -46,7 +46,7 @@ Semi-Annual Channel (Targeted) is the default servicing channel for all Windows
## Assign devices to Semi-Annual Channel
>[!IMPORTANT]
->Due to [naming changes](waas-overview.md#naming-changes), older terms like CB,CBB and LTSB may still be displayed in some of our products.
+>Due to [naming changes](waas-overview.md#naming-changes), older terms like CB, CBB and LTSB may still be displayed in some of our products.
>
>In the following settings CB refers to Semi-Annual Channel (Targeted), while CBB refers to Semi-Annual Channel.
@@ -220,5 +220,3 @@ By enabling the Group Policy setting under **Computer Configuration\Administrati
- [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md)
- [Walkthrough: use Intune to configure Windows Update for Business](waas-wufb-intune.md)
- [Manage device restarts after updates](waas-restart.md)
-
-
diff --git a/windows/deployment/update/waas-servicing-strategy-windows-10-updates.md b/windows/deployment/update/waas-servicing-strategy-windows-10-updates.md
index c6cd1ca434..7a37b53aa7 100644
--- a/windows/deployment/update/waas-servicing-strategy-windows-10-updates.md
+++ b/windows/deployment/update/waas-servicing-strategy-windows-10-updates.md
@@ -7,6 +7,7 @@ ms.sitesec: library
author: DaniHalfin
ms.localizationpriority: high
ms.author: daniha
+ms.date: 07/27/2017
---
# Prepare servicing strategy for Windows 10 updates
diff --git a/windows/deployment/update/waas-windows-insider-for-business-aad.md b/windows/deployment/update/waas-windows-insider-for-business-aad.md
index 053b5bb5b7..d03c9855b6 100644
--- a/windows/deployment/update/waas-windows-insider-for-business-aad.md
+++ b/windows/deployment/update/waas-windows-insider-for-business-aad.md
@@ -7,6 +7,7 @@ ms.sitesec: library
author: DaniHalfin
ms.localizationpriority: high
ms.author: daniha
+ms.date: 10/16/2017
---
# Windows Insider Program for Business using Azure Active Directory
diff --git a/windows/deployment/update/waas-windows-insider-for-business-faq.md b/windows/deployment/update/waas-windows-insider-for-business-faq.md
index 169e3ed2eb..c2cd8cc848 100644
--- a/windows/deployment/update/waas-windows-insider-for-business-faq.md
+++ b/windows/deployment/update/waas-windows-insider-for-business-faq.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: DaniHalfin
ms.localizationpriority: high
ms.author: daniha
-ms.date: 10/17/2017
+ms.date: 10/24/2017
---
# Windows Insider Program for Business Frequently Asked Questions
diff --git a/windows/deployment/update/waas-windows-insider-for-business.md b/windows/deployment/update/waas-windows-insider-for-business.md
index 94c1ade630..b105a54d56 100644
--- a/windows/deployment/update/waas-windows-insider-for-business.md
+++ b/windows/deployment/update/waas-windows-insider-for-business.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: DaniHalfin
ms.localizationpriority: high
ms.author: daniha
-ms.date: 10/17/2017
+ms.date: 10/27/2017
---
# Windows Insider Program for Business
diff --git a/windows/deployment/update/waas-wu-settings.md b/windows/deployment/update/waas-wu-settings.md
index 8e83c58fd6..a4286f5300 100644
--- a/windows/deployment/update/waas-wu-settings.md
+++ b/windows/deployment/update/waas-wu-settings.md
@@ -7,7 +7,7 @@ ms.sitesec: library
author: DaniHalfin
ms.localizationpriority: high
ms.author: daniha
-ms.date: 05/16/2017
+ms.date: 07/27/2017
---
# Manage additional Windows Update settings
diff --git a/windows/deployment/update/waas-wufb-group-policy.md b/windows/deployment/update/waas-wufb-group-policy.md
index 139a173b93..c4763cac37 100644
--- a/windows/deployment/update/waas-wufb-group-policy.md
+++ b/windows/deployment/update/waas-wufb-group-policy.md
@@ -7,6 +7,7 @@ ms.sitesec: library
author: DaniHalfin
ms.localizationpriority: high
ms.author: daniha
+ms.date: 07/27/2017
---
# Walkthrough: use Group Policy to configure Windows Update for Business
diff --git a/windows/deployment/update/waas-wufb-intune.md b/windows/deployment/update/waas-wufb-intune.md
index 5faa58e16a..6d421a99de 100644
--- a/windows/deployment/update/waas-wufb-intune.md
+++ b/windows/deployment/update/waas-wufb-intune.md
@@ -7,6 +7,7 @@ ms.sitesec: library
author: DaniHalfin
ms.localizationpriority: high
ms.author: daniha
+ms.date: 07/27/2017
---
# Walkthrough: use Microsoft Intune to configure Windows Update for Business
diff --git a/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness.md b/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness.md
index c2744bd544..bd9b717522 100644
--- a/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness.md
+++ b/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness.md
@@ -3,6 +3,7 @@ title: Manage Windows upgrades with Upgrade Readiness (Windows 10)
description: Provides an overview of the process of managing Windows upgrades with Upgrade Readiness.
ms.prod: w10
author: greg-lindsay
+ms.date: 04/25/2017
---
# Manage Windows upgrades with Upgrade Readiness
@@ -13,7 +14,7 @@ With the release of Upgrade Readiness, enterprises now have the tools to plan an
Microsoft developed Upgrade Readiness in response to demand from enterprise customers looking for additional direction and details about upgrading to Windows 10. Upgrade Readiness was built taking into account multiple channels of customer feedback, testing, and Microsoft’s experience upgrading millions of devices to Windows 10.
-With Windows telemetry enabled, Upgrade Readiness collects system, application, and driver data for analysis. We then identify compatibility issues that can block an upgrade and suggest fixes when they are known to Microsoft.
+With Windows diagnostic data enabled, Upgrade Readiness collects system, application, and driver data for analysis. We then identify compatibility issues that can block an upgrade and suggest fixes when they are known to Microsoft.
Use Upgrade Readiness to get:
@@ -27,11 +28,11 @@ Use Upgrade Readiness to get:
The Upgrade Readiness workflow steps you through the discovery and rationalization process until you have a list of computers that are ready to be upgraded.
-**Important** For system, application, and driver data to be shared with Microsoft, you must configure user computers to send data. For information about what telemetry data Microsoft collects and how that data is used and protected by Microsoft, see:
+**Important** For system, application, and driver data to be shared with Microsoft, you must configure user computers to send data. For information about what diagnostic data Microsoft collects and how that data is used and protected by Microsoft, see:
-- [Configure Windows telemetry in your organization](/windows/configuration/configure-windows-telemetry-in-your-organization)
+- [Configure Windows diagnostic data in your organization](/windows/configuration/configure-windows-diagnostic-data-in-your-organization)
- [Manage connections from Windows operating system components to Microsoft services](/windows/configuration/manage-connections-from-windows-operating-system-components-to-microsoft-services)
-- [Windows 7, Windows 8, and Windows 8.1 appraiser telemetry events and fields](https://go.microsoft.com/fwlink/?LinkID=822965)
+- [Windows 7, Windows 8, and Windows 8.1 appraiser diagnostic data events and fields](https://go.microsoft.com/fwlink/?LinkID=822965)
##**Related topics**
diff --git a/windows/deployment/upgrade/resolve-windows-10-upgrade-errors.md b/windows/deployment/upgrade/resolve-windows-10-upgrade-errors.md
index e601c4391e..858ea4aed7 100644
--- a/windows/deployment/upgrade/resolve-windows-10-upgrade-errors.md
+++ b/windows/deployment/upgrade/resolve-windows-10-upgrade-errors.md
@@ -7,7 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: deploy
author: greg-lindsay
-ms.date: 10/10/2017
+ms.date: 01/26/2018
ms.localizationpriority: high
---
@@ -69,7 +69,7 @@ The following steps can resolve many Windows upgrade problems.
chkdsk /F
-
Attept to restore and repair system files by typing the following commands at an elevated command prompt. It may take several minutes for the command operations to be completed. For more information, see [Repair a Windows Image](https://msdn.microsoft.com/windows/hardware/commercialize/manufacture/desktop/repair-a-windows-image).
+
Attempt to restore and repair system files by typing the following commands at an elevated command prompt. It may take several minutes for the command operations to be completed. For more information, see [Repair a Windows Image](https://msdn.microsoft.com/windows/hardware/commercialize/manufacture/desktop/repair-a-windows-image).
DISM.exe /Online /Cleanup-image /Restorehealth
sfc /scannow
@@ -105,15 +105,23 @@ Note: If only a result code is returned, this can be because a tool is being use
Result codes can be matched to the type of error encountered. To match a result code to an error:
-1. Identify the error code type, either Win32 or NTSTATUS, using the first hexidecimal digit:
- 8 = Win32 error code (ex: 0x**8**0070070)
- C = NTSTATUS value (ex: 0x**C**1900107)
-2. Write down the last 4 digits of the error code (ex: 0x8007**0070** = 0070). These digits correspond to the last 16 bits of the [HRESULT](https://msdn.microsoft.com/en-us/library/cc231198.aspx) or the [NTSTATUS](https://msdn.microsoft.com/en-us/library/cc231200.aspx) structure.
-3. Based on the type of error code determined in the first step, match the 4 digits derived from the second step to either a [Win32 error code](https://msdn.microsoft.com/en-us/library/cc231199.aspx), or an [NTSTATUS value](https://msdn.microsoft.com/en-us/library/cc704588.aspx).
+1. Identify the error code type as either Win32 or NTSTATUS using the first hexadecimal digit:
+ **8** = Win32 error code (ex: 0x**8**0070070)
+ **C** = NTSTATUS value (ex: 0x**C**1900107)
+2. Write down the last 4 digits of the error code (ex: 0x8007**0070** = 0070). These digits are the actual error code type as defined in the [HRESULT](https://msdn.microsoft.com/en-us/library/cc231198.aspx) or the [NTSTATUS](https://msdn.microsoft.com/en-us/library/cc231200.aspx) structure. Other digits in the code identify things such as the device type that produced the error.
+3. Based on the type of error code determined in the first step (Win32 or NTSTATUS), match the 4 digits derived from the second step to either a Win32 error code or NTSTATUS value using the following links:
+ - [Win32 error code](https://msdn.microsoft.com/en-us/library/cc231199.aspx)
+ - [NTSTATUS value](https://msdn.microsoft.com/en-us/library/cc704588.aspx)
-For example:
-- 0x80070070 = Win32 = 0070 = 0x00000070 = ERROR_DISK_FULL
-- 0xC1900107 = NTSTATUS = 0107 = 0x00000107 = STATUS_SOME_NOT_MAPPED
+Examples:
+- 0x80070070
+ - Based on the "8" this is a Win32 error code
+ - The last four digits are 0070, so look up 0x00000070 in the [Win32 error code](https://msdn.microsoft.com/en-us/library/cc231199.aspx) table
+ - The error is: **ERROR_DISK_FULL**
+- 0xC1900107
+ - Based on the "C" this is an NTSTATUS error code
+ - The last four digits are 0107, so look up 0x00000107 in the [NTSTATUS value](https://msdn.microsoft.com/en-us/library/cc704588.aspx) table
+ - The error is: **STATUS_SOME_NOT_MAPPED**
Some result codes are self-explanatory, whereas others are more generic and require further analysis. In the examples shown above, ERROR_DISK_FULL indicates that the hard drive is full and additional room is needed to complete Windows upgrade. The message STATUS_SOME_NOT_MAPPED is more ambiguous, and means that an action is pending. In this case, the action pending is often the cleanup operation from a previous installation attempt, which can be resolved with a system reboot.
@@ -412,7 +420,7 @@ The device install log is particularly helpful if rollback occurs during the sys
Cause
A driver has caused an illegal operation.
Windows was not able to migrate the driver, resulting in a rollback of the operating system.
- This is a safeOS boot failure, typically caused by drivers or non-Microsoft disk encryption software.
+ This is a SafeOS boot failure, typically caused by drivers or non-Microsoft disk encryption software.
@@ -515,7 +523,7 @@ Disconnect all peripheral devices that are connected to the system, except for t
Info SP Rollback: Showing splash window with restoring text: Restoring your previous version of Windows.
- Typically there is a a dump file for the crash to analyze. If you are not equipped to debug the dump, then attempt the following basic troubleshooting procedures:
+ Typically, there is a dump file for the crash to analyze. If you are not equipped to debug the dump, then attempt the following basic troubleshooting procedures:
1. Make sure you have enough disk space.
2. If a driver is identified in the bug check message, disable the driver or check with the manufacturer for driver updates.
@@ -571,7 +579,7 @@ For more information, see [How to perform a clean boot in Windows](https://suppo
Code
-800040005 - 0x20007
+80040005 - 0x20007
@@ -684,7 +692,7 @@ The installation failed in the FIRST_BOOT phase with an error during MIGRATE_DAT
Mitigation
-[Analyze log files](#analyze-log-files) in order to determine the files or registry entires that are blocking data migration.
+[Analyze log files](#analyze-log-files) in order to determine the files or registry entries that are blocking data migration.
This error can be due to a problem with user profiles. It can occur due to corrupt registry entries under **HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList** or invalid files in the **\\Users** directory.
@@ -878,8 +886,8 @@ Download and run the media creation tool. See [Download windows 10](https://www.
0x8007007E
-
Occurs when update synchronization fails because you do not have hotfix 3095113 installed before you enable update synchronization. Specifically, the CopyToCache operation fails on clients that have already downlaoded the upgrade because Windows Server Update Services has bad metadata related to the upgrade. It can occur when you are using standalone Windows Server Update Services or when WSUS is integrated with System Center Configuration Manager.
-
Use the following steps to repair Windows Server Update Services. You must run these steps on each WSUS server that synched metadate before you installed the hotfix.
+
Occurs when update synchronization fails because you do not have hotfix 3095113 installed before you enable update synchronization. Specifically, the CopyToCache operation fails on clients that have already downloaded the upgrade because Windows Server Update Services has bad metadata related to the upgrade. It can occur when you are using standalone Windows Server Update Services or when WSUS is integrated with System Center Configuration Manager.
+
Use the following steps to repair Windows Server Update Services. You must run these steps on each WSUS server that synched metadata before you installed the hotfix.
Stop the Windows Update service. Sign in as a user with administrative privileges, and then do the following:
@@ -964,5 +972,3 @@ Alternatively, re-create installation media the [Media Creation Tool](https://ww
[Windows 10 Specifications](https://www.microsoft.com/en-us/windows/Windows-10-specifications)
[Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro)
[Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821)
-
-Not finding content you need? Windows 10 users, tell us what you want on [Feedback Hub](feedback-hub://?referrer=techDocsUcPage&tabid=2&contextid=897&newFeedback=true&topic=resolve-windows-10-upgrade-errors.md).
\ No newline at end of file
diff --git a/windows/deployment/upgrade/troubleshoot-upgrade-readiness.md b/windows/deployment/upgrade/troubleshoot-upgrade-readiness.md
index bb0caaf247..a837d861dc 100644
--- a/windows/deployment/upgrade/troubleshoot-upgrade-readiness.md
+++ b/windows/deployment/upgrade/troubleshoot-upgrade-readiness.md
@@ -3,6 +3,7 @@ title: Troubleshoot Upgrade Readiness (Windows 10)
description: Provides troubleshooting information for Upgrade Readiness.
ms.prod: w10
author: greg-lindsay
+ms.date: 04/19/2017
---
# Troubleshoot Upgrade Readiness
@@ -23,16 +24,16 @@ If you still don’t see data in Upgrade Readiness, follow these steps:
## Disable Upgrade Readiness
-If you want to stop using Upgrade Readiness and stop sending telemetry data to Microsoft, follow these steps:
+If you want to stop using Upgrade Readiness and stop sending diagnostic data data to Microsoft, follow these steps:
1. Unsubscribe from the Upgrade Readiness solution in the OMS portal. In the OMS portal, go to **Settings** > **Connected Sources** > **Windows Telemetry** and choose the **Unsubscribe** option.
-2. Disable the Commercial Data Opt-in Key on computers running Windows 7 SP1 or 8.1. On computers running Windows 10, set the telemetry level to **Security**:
+2. Disable the Commercial Data Opt-in Key on computers running Windows 7 SP1 or 8.1. On computers running Windows 10, set the diagnostic data level to **Security**:
**Windows 7 and Windows 8.1**: Delete CommercialDataOptIn registry property from *HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection*
- **Windows 10**: Follow the instructions in the [Configure Windows telemetry in your organization](https://technet.microsoft.com/itpro/windows/manage/configure-windows-telemetry-in-your-organization#enterprise-management) topic.
+ **Windows 10**: Follow the instructions in the [Configure Windows diagnostic data in your organization](/configuration/configure-windows-diagnostic-data-in-your-organization.md) topic.
3. If you enabled **Internet Explorer Site Discovery**, you can disable Internet Explorer data collection by setting the *IEDataOptIn* registry key to value "0". The IEDataOptIn key can be found under: *HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection*.
4. You can also remove the “CommercialId” key from: "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection". **This is an optional step**.
diff --git a/windows/deployment/upgrade/upgrade-readiness-additional-insights.md b/windows/deployment/upgrade/upgrade-readiness-additional-insights.md
index 40b6f4fcb0..5c45338c1d 100644
--- a/windows/deployment/upgrade/upgrade-readiness-additional-insights.md
+++ b/windows/deployment/upgrade/upgrade-readiness-additional-insights.md
@@ -3,6 +3,7 @@ title: Upgrade Readiness - Additional insights
description: Explains additional features of Upgrade Readiness.
ms.prod: w10
author: greg-lindsay
+ms.date: 10/26/2017
---
# Upgrade Readiness - Additional insights
@@ -17,7 +18,7 @@ This topic provides information on additional features that are available in Upg
The site discovery feature in Upgrade Readiness provides an inventory of web sites that are accessed by client computers using Internet Explorer on Windows 7, Windows 8.1, and Windows 10. Site discovery does not include sites that are accessed using other Web browsers, such as Microsoft Edge. Site inventory information is provided as optional data related to upgrading to Windows 10 and Internet Explorer 11, and is meant to help prioritize compatibility testing for web applications. You can make more informed decisions about testing based on usage data.
> [!NOTE]
-> Site discovery data is disabled by default; you can find documentation on what is collected in the [Windows 7, Windows 8, and Windows 8.1 appraiser telemetry events and fields](https://go.microsoft.com/fwlink/?LinkID=822965). After you turn on this feature, data is collected on all sites visited by Internet Explorer, except during InPrivate sessions. In addition, data will be collected on all sites visited by Microsoft Edge on computers running Windows 10 version 1803 (including Insider Preview builds) or newer. The data collection process is silent, without notification to the employee. You are responsible for ensuring that your use of this feature complies with all applicable local laws and regulatory requirements, including any requirements to provide notice to employees.
+> Site discovery data is disabled by default; you can find documentation on what is collected in the [Windows 7, Windows 8, and Windows 8.1 appraiser diagnostic data events and fields](https://go.microsoft.com/fwlink/?LinkID=822965). After you turn on this feature, data is collected on all sites visited by Internet Explorer, except during InPrivate sessions. In addition, data will be collected on all sites visited by Microsoft Edge on computers running Windows 10 version 1803 (including Insider Preview builds) or newer. The data collection process is silent, without notification to the employee. You are responsible for ensuring that your use of this feature complies with all applicable local laws and regulatory requirements, including any requirements to provide notice to employees.
### Install prerequisite security update for Internet Explorer
@@ -26,7 +27,7 @@ Ensure the following prerequisites are met before using site discovery:
1. Install the prerequisite KBs to add Site Discovery support and the latest fixes from the [Microsoft Update Catalog](http://www.catalog.update.microsoft.com/home.aspx). Install the following:
- For Windows 7 and Windows 8.1 - March, 2017 (or later) Security Monthly Rollup
- For Windows 10 - Cumulative Update for Windows 10 Version 1607 (KB4015217) (or later)
-2. Enable Internet Explorer data collection, which is disabled by default. The best way to enable it is to modify the [Upgrade Readiness deployment script](upgrade-readiness-deployment-script.md) to allow Internet Explorer data collection before you run it. In addition, to enable Site Discovery on Windows 10 you must set computers to the **Enhanced Telemetry Level** for the Feedback and Diagnostics setting (Privacy > Feedback & Diagnostics settings), and enable **Page Prediction within Internet Explorer 11**.
+2. Enable Internet Explorer data collection, which is disabled by default. The best way to enable it is to modify the [Upgrade Readiness deployment script](upgrade-readiness-deployment-script.md) to allow Internet Explorer data collection before you run it. In addition, to enable Site Discovery on Windows 10 you must set computers to the **Enhanced** diagnostic data level for the Feedback and Diagnostics setting (Privacy > Feedback & Diagnostics settings), and enable **Page Prediction within Internet Explorer 11**.
If you do not plan to use the Upgrade Readiness deployment script to enable Site discovery, you must create the following registry entry.
diff --git a/windows/deployment/upgrade/upgrade-readiness-architecture.md b/windows/deployment/upgrade/upgrade-readiness-architecture.md
index ae5949405f..fd7e2605ab 100644
--- a/windows/deployment/upgrade/upgrade-readiness-architecture.md
+++ b/windows/deployment/upgrade/upgrade-readiness-architecture.md
@@ -3,11 +3,12 @@ title: Upgrade Readiness architecture (Windows 10)
description: Describes Upgrade Readiness architecture.
ms.prod: w10
author: greg-lindsay
+ms.date: 04/25/2017
---
# Upgrade Readiness architecture
-Microsoft analyzes system, application, and driver telemetry data to help you determine when computers are upgrade-ready, allowing you to simplify and accelerate Windows upgrades in your organization. The diagram below illustrates how Upgrade Readiness components work together in a typical installation.
+Microsoft analyzes system, application, and driver diagnostic data to help you determine when computers are upgrade-ready, allowing you to simplify and accelerate Windows upgrades in your organization. The diagram below illustrates how Upgrade Readiness components work together in a typical installation.
@@ -46,13 +47,13 @@ Important: You can use either a Microsoft Account or a Work or School account to
Upgrade Readiness can be integrated with your installation of Configuration Manager. For more information, see [Integrate Upgrade Readiness with System Center Configuration Manager](https://docs.microsoft.com/sccm/core/clients/manage/upgrade/upgrade-analytics).
-## Telemetry and data sharing
+## Diagnostic data and data sharing
After you’ve signed in to Operations Management Suite and added the Upgrade Readiness solution to your workspace, you’ll need to complete the following tasks to allow user computer data to be shared with and assessed by Upgrade Readiness.
-See [Windows 7, Windows 8, and Windows 8.1 appraiser telemetry events and fields](https://go.microsoft.com/fwlink/?LinkID=822965) for more information about what user computer data Upgrade Readiness collects and assesses. See [Configure Windows telemetry in your organization](/windows/configuration/configure-windows-telemetry-in-your-organization) for more information about how Microsoft uses Windows telemetry data.
+See [Windows 7, Windows 8, and Windows 8.1 appraiser diagnostic data events and fields](https://go.microsoft.com/fwlink/?LinkID=822965) for more information about what user computer data Upgrade Readiness collects and assesses. See [Configure Windows diagnostic data in your organization](/windows/configuration/configure-windows-diagnostic-data-in-your-organization) for more information about how Microsoft uses Windows diagnostic data.
-**Whitelist telemetry endpoints.** To enable telemetry data to be sent to Microsoft, you’ll need to whitelist the following Microsoft telemetry endpoints on your proxy server or firewall. You may need to get approval from your security group to do this.
+**Whitelist diagnostic data endpoints.** To enable diagnostic data to be sent to Microsoft, you’ll need to whitelist the following Microsoft endpoints on your proxy server or firewall. You may need to get approval from your security group to do this.
`https://v10.vortex-win.data.microsoft.com/collect/v1`
`https://vortex-win.data.microsoft.com/health/keepalive`
@@ -67,7 +68,7 @@ See [Windows 7, Windows 8, and Windows 8.1 appraiser telemetry events and fields
**Subscribe your OMS workspace to Upgrade Readiness.** For Upgrade Readiness to receive and display upgrade readiness data from Microsoft, you’ll need to subscribe your OMS workspace to Upgrade Readiness.
-**Enable telemetry and connect data sources.** To allow Upgrade Readiness to collect system, application, and driver data and assess your organization’s upgrade readiness, communication must be established between Upgrade Readiness and user computers. You’ll need to connect Upgrade Readiness to your data sources and enable telemetry to establish communication.
+**Enable diagnostic data and connect data sources.** To allow Upgrade Readiness to collect system, application, and driver data and assess your organization’s upgrade readiness, communication must be established between Upgrade Readiness and user computers. You’ll need to connect Upgrade Readiness to your data sources and enable diagnostic data to establish communication.
**Deploy compatibility update and related KBs.** The compatibility update KB scans your systems and enables application usage tracking. If you don’t already have this KB installed, you can download the applicable version from the Microsoft Update Catalog or deploy it using Windows Server Update Services (WSUS) or your software distribution solution, such as System Center Configuration Manager.
@@ -81,7 +82,7 @@ Before you get started configuring Upgrade Anatlyics, review the following tips
**Upgrade Readiness does not support on-premises Windows deployments.** Upgrade Readiness is built as a cloud service, which allows Upgrade Readiness to provide you with insights based on the data from user computers and other Microsoft compatibility services. Cloud services are easy to get up and running and are cost-effective because there is no requirement to physically implement and maintain services on-premises.
-**In-region data storage requirements.** Windows telemetry data from user computers is encrypted, sent to, and processed at Microsoft-managed secure data centers located in the US. Our analysis of the upgrade readiness-related data is then provided to you through the Upgrade Readiness solution in the Microsoft Operations Management Suite (OMS) portal. At the time this topic is being published, only OMS workspaces created in the East US and West Europe are supported. We’re adding support for additional regions and we’ll update this information when new international regions are supported.
+**In-region data storage requirements.** Windows diagnostic data from user computers is encrypted, sent to, and processed at Microsoft-managed secure data centers located in the US. Our analysis of the upgrade readiness-related data is then provided to you through the Upgrade Readiness solution in the Microsoft Operations Management Suite (OMS) portal. At the time this topic is being published, only OMS workspaces created in the East US and West Europe are supported. We’re adding support for additional regions and we’ll update this information when new international regions are supported.
### Tips
diff --git a/windows/deployment/upgrade/upgrade-readiness-resolve-issues.md b/windows/deployment/upgrade/upgrade-readiness-resolve-issues.md
index 731feea00e..58ffa25e69 100644
--- a/windows/deployment/upgrade/upgrade-readiness-resolve-issues.md
+++ b/windows/deployment/upgrade/upgrade-readiness-resolve-issues.md
@@ -3,6 +3,7 @@ title: Upgrade Readiness - Resolve application and driver issues (Windows 10)
description: Describes how to resolve application and driver issues that can occur during an upgrade with Upgrade Readiness.
ms.prod: w10
author: jaimeo
+ms.date: 08/31/2017
---
# Upgrade Readiness - Step 2: Resolve app and driver issues
@@ -140,7 +141,7 @@ Applications and drivers that are meet certain criteria to be considered low ris
The first row reports the number of your apps that have an official statement of support on Windows 10 from the software vendor, so you can be confident that they will work on your target operating system.
-The second row (**Apps that are "Highly adopted"**) shows apps that have a ReadyForWindows status of "Highly adopted". This means that they have been installed on at least 100,000 commercial Windows 10 devices, and that Microsoft has not detected significant issues with the app in telemetry. Since these apps are prevalent in the ecosystem at large, you can be confident that they will work in your environment as well.
+The second row (**Apps that are "Highly adopted"**) shows apps that have a ReadyForWindows status of "Highly adopted". This means that they have been installed on at least 100,000 commercial Windows 10 devices, and that Microsoft has not detected significant issues with the app in diagnostic data. Since these apps are prevalent in the ecosystem at large, you can be confident that they will work in your environment as well.
Each row of the blade uses a different criterion to filter your apps or drivers. You can view a list of applications that meet the criterion by clicking into a row of the blade. For example, if you click the row that says "Apps that are 'Highly adopted'", the result is a list of apps that have a ReadyForWindows status of "Highly adopted". From here, you can bulk-select the results, select **Ready to upgrade**, and then click **Save**. This will mark all apps meeting the "Highly adopted" criterion as "Ready to upgrade"--no further validation is required. Any applications that you have marked as *Mission critical* or *Business critical* are filtered out, as well as any app that has an issue known to Microsoft. This allows you to work with apps in bulk without having to worry about missing a critical app.
diff --git a/windows/deployment/upgrade/upgrade-readiness-upgrade-overview.md b/windows/deployment/upgrade/upgrade-readiness-upgrade-overview.md
index 860f86c5bb..d74712221f 100644
--- a/windows/deployment/upgrade/upgrade-readiness-upgrade-overview.md
+++ b/windows/deployment/upgrade/upgrade-readiness-upgrade-overview.md
@@ -3,6 +3,7 @@ title: Upgrade Readiness - Upgrade Overview (Windows 10)
description: Displays the total count of computers sharing data and upgraded.
ms.prod: w10
author: greg-lindsay
+ms.date: 08/15/2017
---
# Upgrade Readiness - Upgrade overview
@@ -53,7 +54,7 @@ Select **Total computers** for a list of computers and details about them, inclu
- Computer model
- Operating system version and build
- Count of system requirement, application, and driver issues per computer
-- Upgrade assessment based on analysis of computer telemetry data
+- Upgrade assessment based on analysis of computer diagnostic data
- Upgrade decision status
Select **Total applications** for a list of applications discovered on user computers and details about them, including:
diff --git a/windows/deployment/upgrade/upgrade-to-windows-10-with-system-center-configuraton-manager.md b/windows/deployment/upgrade/upgrade-to-windows-10-with-system-center-configuraton-manager.md
index f0e227a621..68f4b268ec 100644
--- a/windows/deployment/upgrade/upgrade-to-windows-10-with-system-center-configuraton-manager.md
+++ b/windows/deployment/upgrade/upgrade-to-windows-10-with-system-center-configuraton-manager.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.localizationpriority: high
ms.mktglfcycl: deploy
author: mtniehaus
+ms.date: 07/27/2017
---
# Perform an in-place upgrade to Windows 10 using Configuration Manager
diff --git a/windows/deployment/upgrade/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md b/windows/deployment/upgrade/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md
index 85e7a02389..33606a3b67 100644
--- a/windows/deployment/upgrade/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md
+++ b/windows/deployment/upgrade/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md
@@ -9,6 +9,7 @@ ms.localizationpriority: high
ms.sitesec: library
ms.pagetype: mdt
author: mtniehaus
+ms.date: 07/27/2017
---
# Perform an in-place upgrade to Windows 10 with MDT
diff --git a/windows/deployment/upgrade/upgrade-windows-phone-8-1-to-10.md b/windows/deployment/upgrade/upgrade-windows-phone-8-1-to-10.md
index 1a3d373bbe..2b4648d629 100644
--- a/windows/deployment/upgrade/upgrade-windows-phone-8-1-to-10.md
+++ b/windows/deployment/upgrade/upgrade-windows-phone-8-1-to-10.md
@@ -8,6 +8,7 @@ ms.localizationpriority: high
ms.sitesec: library
ms.pagetype: mdt
author: Jamiejdt
+ms.date: 07/27/2017
---
# Upgrade a Windows Phone 8.1 to Windows 10 Mobile with Mobile Device Management (MDM)
diff --git a/windows/deployment/upgrade/use-upgrade-readiness-to-manage-windows-upgrades.md b/windows/deployment/upgrade/use-upgrade-readiness-to-manage-windows-upgrades.md
index e074aad404..f0f332312c 100644
--- a/windows/deployment/upgrade/use-upgrade-readiness-to-manage-windows-upgrades.md
+++ b/windows/deployment/upgrade/use-upgrade-readiness-to-manage-windows-upgrades.md
@@ -3,13 +3,14 @@ title: Use Upgrade Readiness to manage Windows upgrades (Windows 10)
description: Describes how to use Upgrade Readiness to manage Windows upgrades.
ms.prod: w10
author: jaimeo
+ms.date: 08/30/2017
---
# Use Upgrade Readiness to manage Windows upgrades
You can use Upgrade Readiness to prioritize and work through application and driver issues, assign and track issue resolution status, and identify computers that are ready to upgrade. Upgrade Readiness enables you to deploy Windows with confidence, knowing that you’ve addressed potential blocking issues.
-- Based on telemetry data from user computers, Upgrade Readiness identifies application and driver compatibility issues that may block Windows upgrades, allowing you to make data-driven decisions about your organization’s upgrade readiness.
+- Based on diagnostic data from user computers, Upgrade Readiness identifies application and driver compatibility issues that may block Windows upgrades, allowing you to make data-driven decisions about your organization’s upgrade readiness.
- Information is refreshed daily so you can monitor upgrade progress. Any changes your team makes, such as assigning application importance and marking applications as ready to upgrade, are reflected 24 hours after you make them.
When you are ready to begin the upgrade process, a workflow is provided to guide you through critical high-level tasks.
diff --git a/windows/deployment/upgrade/windows-10-edition-upgrades.md b/windows/deployment/upgrade/windows-10-edition-upgrades.md
index c1f05fe42e..359c1cb9bc 100644
--- a/windows/deployment/upgrade/windows-10-edition-upgrades.md
+++ b/windows/deployment/upgrade/windows-10-edition-upgrades.md
@@ -8,6 +8,7 @@ ms.localizationpriority: high
ms.sitesec: library
ms.pagetype: mobile
author: greg-lindsay
+ms.date: 01/18/2018
---
# Windows 10 edition upgrade
@@ -40,7 +41,7 @@ X = unsupported
-->
| Edition upgrade | Using mobile device management (MDM) | Using a provisioning package | Using a command-line tool | Using Microsoft Store for Business or PC | Entering a product key manually | Purchasing a license from the Microsoft Store |
-|-----------------| ------------------------------------ | ---- ----------------------- | ------------------------- | -------------------------------------- | ----------------------------------- | --------------------------------------------- |
+|-----------------| ------------------------------------ | --------------------------- | ------------------------- | -------------------------------------- | ----------------------------------- | --------------------------------------------- |
| **Home > Pro** |  |  |  |  |  |  |
| **Home > Pro for Workstations** |  |  |  |  |  |  |
| **Home > Pro Education** |  |  |  |  |  |  |
@@ -62,7 +63,7 @@ X = unsupported
| **Mobile > Mobile Enterprise** |  | |  |  |  |  |
> [!NOTE]
-> Each desktop edition in the table also has an N and KN edition. These editions have had media-related functionality removed. Devices with N or KN editions installed can be upgraded to corresponding N or KN editions using the same methods.
+> Each desktop edition in the table also has an N and KN SKU. These editions have had media-related functionality removed. Devices with N or KN SKUs installed can be upgraded to corresponding N or KN SKUs using the same methods.
## Upgrade using mobile device management (MDM)
@@ -113,4 +114,4 @@ If you do not have a product key, you can upgrade your edition of Windows 10 th
**Note** If you are a Windows 10 Home N or Windows 10 Home KN user and have trouble finding your applicable upgrade in the Microsoft Store, click [here](ms-windows-store://windowsupgrade/).
-
\ No newline at end of file
+
diff --git a/windows/deployment/upgrade/windows-10-upgrade-paths.md b/windows/deployment/upgrade/windows-10-upgrade-paths.md
index ea708741a6..4ac4288fcb 100644
--- a/windows/deployment/upgrade/windows-10-upgrade-paths.md
+++ b/windows/deployment/upgrade/windows-10-upgrade-paths.md
@@ -7,6 +7,7 @@ ms.sitesec: library
ms.localizationpriority: high
ms.pagetype: mobile
author: greg-lindsay
+ms.date: 01/18/2018
---
# Windows 10 upgrade paths
@@ -21,7 +22,7 @@ This topic provides a summary of available upgrade paths to Windows 10. You can
>**Windows 10 LTSB**: The upgrade paths displayed below do not apply to Windows 10 LTSB. In-place upgrade from Windows 7 or Windows 8.1 to Windows 10 LTSB is not supported. (Note that Windows 10 LTSB 2015 did not block this upgrade path. This was corrected in the Windows 10 LTSB 2016 release, which will now only allow data-only and clean install options.)
->**Windows N/KN**: Windows "N" and "KN" editions follow the same upgrade paths shown below. If the pre-upgrade and post-upgrade editions are not the same type (e.g. Windows 8.1 Pro N to Windows 10 Pro), personal data will be kept but applications and settings will be removed during the upgrade process.
+>**Windows N/KN**: Windows "N" and "KN" SKUs follow the same upgrade paths shown below. If the pre-upgrade and post-upgrade editions are not the same type (e.g. Windows 8.1 Pro N to Windows 10 Pro), personal data will be kept but applications and settings will be removed during the upgrade process.
✔ = Full upgrade is supported including personal data, settings, and applications.
D = Edition downgrade; personal data is maintained, applications and settings are removed.
@@ -337,8 +338,6 @@ D = Edition downgrade; personal data is maintained, applications and settings ar
[Windows 10 deployment scenarios](../windows-10-deployment-scenarios.md)
[Windows upgrade and migration considerations](windows-upgrade-and-migration-considerations.md)
-Not finding content you need? Windows 10 users, tell us what you want on [Feedback Hub](feedback-hub://?referrer=techDocsUcPage&tabid=2&contextid=897&newFeedback=true&topic=windows-10-upgrade-paths.md).
-
diff --git a/windows/deployment/upgrade/windows-upgrade-and-migration-considerations.md b/windows/deployment/upgrade/windows-upgrade-and-migration-considerations.md
index f0d196dfd1..a16c0e1719 100644
--- a/windows/deployment/upgrade/windows-upgrade-and-migration-considerations.md
+++ b/windows/deployment/upgrade/windows-upgrade-and-migration-considerations.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: greg-lindsay
+ms.date: 11/17/2017
---
# Windows upgrade and migration considerations
diff --git a/windows/deployment/usmt/getting-started-with-the-user-state-migration-tool.md b/windows/deployment/usmt/getting-started-with-the-user-state-migration-tool.md
index 8dae688326..7414694368 100644
--- a/windows/deployment/usmt/getting-started-with-the-user-state-migration-tool.md
+++ b/windows/deployment/usmt/getting-started-with-the-user-state-migration-tool.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: greg-lindsay
+ms.date: 04/19/2017
---
# Getting Started with the User State Migration Tool (USMT)
diff --git a/windows/deployment/usmt/migrate-application-settings.md b/windows/deployment/usmt/migrate-application-settings.md
index bdcb63af32..8f7ffec7b1 100644
--- a/windows/deployment/usmt/migrate-application-settings.md
+++ b/windows/deployment/usmt/migrate-application-settings.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: greg-lindsay
+ms.date: 04/19/2017
---
# Migrate Application Settings
diff --git a/windows/deployment/usmt/migration-store-types-overview.md b/windows/deployment/usmt/migration-store-types-overview.md
index 9ee233402b..9d396de135 100644
--- a/windows/deployment/usmt/migration-store-types-overview.md
+++ b/windows/deployment/usmt/migration-store-types-overview.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: greg-lindsay
+ms.date: 04/19/2017
---
# Migration Store Types Overview
diff --git a/windows/deployment/usmt/offline-migration-reference.md b/windows/deployment/usmt/offline-migration-reference.md
index c7c6c03af0..bb58e9867d 100644
--- a/windows/deployment/usmt/offline-migration-reference.md
+++ b/windows/deployment/usmt/offline-migration-reference.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: greg-lindsay
+ms.date: 04/19/2017
---
# Offline Migration Reference
diff --git a/windows/deployment/usmt/understanding-migration-xml-files.md b/windows/deployment/usmt/understanding-migration-xml-files.md
index c03bc14e24..b7c52607a1 100644
--- a/windows/deployment/usmt/understanding-migration-xml-files.md
+++ b/windows/deployment/usmt/understanding-migration-xml-files.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: greg-lindsay
+ms.date: 04/19/2017
---
# Understanding Migration XML Files
diff --git a/windows/deployment/usmt/usmt-best-practices.md b/windows/deployment/usmt/usmt-best-practices.md
index 4e43629a12..40967a0ee3 100644
--- a/windows/deployment/usmt/usmt-best-practices.md
+++ b/windows/deployment/usmt/usmt-best-practices.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: greg-lindsay
+ms.date: 04/19/2017
---
# USMT Best Practices
diff --git a/windows/deployment/usmt/usmt-choose-migration-store-type.md b/windows/deployment/usmt/usmt-choose-migration-store-type.md
index 5938b48748..4551589ccd 100644
--- a/windows/deployment/usmt/usmt-choose-migration-store-type.md
+++ b/windows/deployment/usmt/usmt-choose-migration-store-type.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: greg-lindsay
+ms.date: 04/19/2017
---
# Choose a Migration Store Type
diff --git a/windows/deployment/usmt/usmt-command-line-syntax.md b/windows/deployment/usmt/usmt-command-line-syntax.md
index 22cf9c33aa..53367d6cb0 100644
--- a/windows/deployment/usmt/usmt-command-line-syntax.md
+++ b/windows/deployment/usmt/usmt-command-line-syntax.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: greg-lindsay
+ms.date: 04/19/2017
---
# User State Migration Tool (USMT) Command-line Syntax
diff --git a/windows/deployment/usmt/usmt-common-issues.md b/windows/deployment/usmt/usmt-common-issues.md
index 7213b01b6c..67ac98fcad 100644
--- a/windows/deployment/usmt/usmt-common-issues.md
+++ b/windows/deployment/usmt/usmt-common-issues.md
@@ -5,7 +5,7 @@ ms.assetid: 5a37e390-8617-4768-9eee-50397fbbb2e1
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
-ms.date: 09/07/2017
+ms.date: 09/19/2017
author: greg-lindsay
---
diff --git a/windows/deployment/usmt/usmt-common-migration-scenarios.md b/windows/deployment/usmt/usmt-common-migration-scenarios.md
index 9262ef9b0f..0cf81e4fed 100644
--- a/windows/deployment/usmt/usmt-common-migration-scenarios.md
+++ b/windows/deployment/usmt/usmt-common-migration-scenarios.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: greg-lindsay
+ms.date: 04/19/2017
---
# Common Migration Scenarios
diff --git a/windows/deployment/usmt/usmt-configxml-file.md b/windows/deployment/usmt/usmt-configxml-file.md
index 4484c03e2d..549a863089 100644
--- a/windows/deployment/usmt/usmt-configxml-file.md
+++ b/windows/deployment/usmt/usmt-configxml-file.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: greg-lindsay
+ms.date: 04/19/2017
---
# Config.xml File
diff --git a/windows/deployment/usmt/usmt-conflicts-and-precedence.md b/windows/deployment/usmt/usmt-conflicts-and-precedence.md
index 3b570d51e5..5facab35e2 100644
--- a/windows/deployment/usmt/usmt-conflicts-and-precedence.md
+++ b/windows/deployment/usmt/usmt-conflicts-and-precedence.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: greg-lindsay
+ms.date: 04/19/2017
---
# Conflicts and Precedence
diff --git a/windows/deployment/usmt/usmt-custom-xml-examples.md b/windows/deployment/usmt/usmt-custom-xml-examples.md
index 4d60c4903c..69d78fbd54 100644
--- a/windows/deployment/usmt/usmt-custom-xml-examples.md
+++ b/windows/deployment/usmt/usmt-custom-xml-examples.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: greg-lindsay
+ms.date: 04/19/2017
---
# Custom XML Examples
diff --git a/windows/deployment/usmt/usmt-customize-xml-files.md b/windows/deployment/usmt/usmt-customize-xml-files.md
index 30930f05ad..affa696a95 100644
--- a/windows/deployment/usmt/usmt-customize-xml-files.md
+++ b/windows/deployment/usmt/usmt-customize-xml-files.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: greg-lindsay
+ms.date: 04/19/2017
---
# Customize USMT XML Files
diff --git a/windows/deployment/usmt/usmt-determine-what-to-migrate.md b/windows/deployment/usmt/usmt-determine-what-to-migrate.md
index 27ad2ea86d..bdae639513 100644
--- a/windows/deployment/usmt/usmt-determine-what-to-migrate.md
+++ b/windows/deployment/usmt/usmt-determine-what-to-migrate.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: greg-lindsay
+ms.date: 04/19/2017
---
# Determine What to Migrate
diff --git a/windows/deployment/usmt/usmt-estimate-migration-store-size.md b/windows/deployment/usmt/usmt-estimate-migration-store-size.md
index a331a99c09..ac8107db57 100644
--- a/windows/deployment/usmt/usmt-estimate-migration-store-size.md
+++ b/windows/deployment/usmt/usmt-estimate-migration-store-size.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: greg-lindsay
+ms.date: 04/19/2017
---
# Estimate Migration Store Size
diff --git a/windows/deployment/usmt/usmt-exclude-files-and-settings.md b/windows/deployment/usmt/usmt-exclude-files-and-settings.md
index 975f11e54a..7f45010a75 100644
--- a/windows/deployment/usmt/usmt-exclude-files-and-settings.md
+++ b/windows/deployment/usmt/usmt-exclude-files-and-settings.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: greg-lindsay
+ms.date: 04/19/2017
---
# Exclude Files and Settings
diff --git a/windows/deployment/usmt/usmt-extract-files-from-a-compressed-migration-store.md b/windows/deployment/usmt/usmt-extract-files-from-a-compressed-migration-store.md
index c679d58b27..ff5a96e50d 100644
--- a/windows/deployment/usmt/usmt-extract-files-from-a-compressed-migration-store.md
+++ b/windows/deployment/usmt/usmt-extract-files-from-a-compressed-migration-store.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: greg-lindsay
+ms.date: 04/19/2017
---
# Extract Files from a Compressed USMT Migration Store
diff --git a/windows/deployment/usmt/usmt-faq.md b/windows/deployment/usmt/usmt-faq.md
index 715340a82d..42ff54b6cf 100644
--- a/windows/deployment/usmt/usmt-faq.md
+++ b/windows/deployment/usmt/usmt-faq.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: greg-lindsay
+ms.date: 04/19/2017
---
# Frequently Asked Questions
diff --git a/windows/deployment/usmt/usmt-general-conventions.md b/windows/deployment/usmt/usmt-general-conventions.md
index 020557c402..3cbed8dac0 100644
--- a/windows/deployment/usmt/usmt-general-conventions.md
+++ b/windows/deployment/usmt/usmt-general-conventions.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: greg-lindsay
+ms.date: 04/19/2017
---
# General Conventions
diff --git a/windows/deployment/usmt/usmt-hard-link-migration-store.md b/windows/deployment/usmt/usmt-hard-link-migration-store.md
index 699fe76632..6c3a39cbad 100644
--- a/windows/deployment/usmt/usmt-hard-link-migration-store.md
+++ b/windows/deployment/usmt/usmt-hard-link-migration-store.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: greg-lindsay
+ms.date: 04/19/2017
---
# Hard-Link Migration Store
diff --git a/windows/deployment/usmt/usmt-how-it-works.md b/windows/deployment/usmt/usmt-how-it-works.md
index 0c274924a6..f5ebecc8eb 100644
--- a/windows/deployment/usmt/usmt-how-it-works.md
+++ b/windows/deployment/usmt/usmt-how-it-works.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: greg-lindsay
+ms.date: 04/19/2017
---
# How USMT Works
diff --git a/windows/deployment/usmt/usmt-how-to.md b/windows/deployment/usmt/usmt-how-to.md
index 1a22d71262..f3e4659b75 100644
--- a/windows/deployment/usmt/usmt-how-to.md
+++ b/windows/deployment/usmt/usmt-how-to.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: greg-lindsay
+ms.date: 04/19/2017
---
# User State Migration Tool (USMT) How-to topics
diff --git a/windows/deployment/usmt/usmt-identify-application-settings.md b/windows/deployment/usmt/usmt-identify-application-settings.md
index 5fa216f2b3..c924cce50b 100644
--- a/windows/deployment/usmt/usmt-identify-application-settings.md
+++ b/windows/deployment/usmt/usmt-identify-application-settings.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: greg-lindsay
+ms.date: 04/19/2017
---
# Identify Applications Settings
diff --git a/windows/deployment/usmt/usmt-identify-file-types-files-and-folders.md b/windows/deployment/usmt/usmt-identify-file-types-files-and-folders.md
index 49766ca745..ded6a59f34 100644
--- a/windows/deployment/usmt/usmt-identify-file-types-files-and-folders.md
+++ b/windows/deployment/usmt/usmt-identify-file-types-files-and-folders.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: greg-lindsay
+ms.date: 04/19/2017
---
# Identify File Types, Files, and Folders
diff --git a/windows/deployment/usmt/usmt-identify-operating-system-settings.md b/windows/deployment/usmt/usmt-identify-operating-system-settings.md
index 27fd8c0c25..6695528a7c 100644
--- a/windows/deployment/usmt/usmt-identify-operating-system-settings.md
+++ b/windows/deployment/usmt/usmt-identify-operating-system-settings.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: greg-lindsay
+ms.date: 04/19/2017
---
# Identify Operating System Settings
diff --git a/windows/deployment/usmt/usmt-identify-users.md b/windows/deployment/usmt/usmt-identify-users.md
index 6d081727c3..58fe715cfb 100644
--- a/windows/deployment/usmt/usmt-identify-users.md
+++ b/windows/deployment/usmt/usmt-identify-users.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: greg-lindsay
+ms.date: 04/19/2017
---
# Identify Users
diff --git a/windows/deployment/usmt/usmt-include-files-and-settings.md b/windows/deployment/usmt/usmt-include-files-and-settings.md
index 411525684e..31cb94e46d 100644
--- a/windows/deployment/usmt/usmt-include-files-and-settings.md
+++ b/windows/deployment/usmt/usmt-include-files-and-settings.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: greg-lindsay
+ms.date: 04/19/2017
---
# Include Files and Settings
diff --git a/windows/deployment/usmt/usmt-loadstate-syntax.md b/windows/deployment/usmt/usmt-loadstate-syntax.md
index 36c3dfb311..522972b99b 100644
--- a/windows/deployment/usmt/usmt-loadstate-syntax.md
+++ b/windows/deployment/usmt/usmt-loadstate-syntax.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: greg-lindsay
+ms.date: 04/19/2017
---
# LoadState Syntax
diff --git a/windows/deployment/usmt/usmt-log-files.md b/windows/deployment/usmt/usmt-log-files.md
index 9796591745..ba63a86235 100644
--- a/windows/deployment/usmt/usmt-log-files.md
+++ b/windows/deployment/usmt/usmt-log-files.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: greg-lindsay
+ms.date: 04/19/2017
---
# Log Files
diff --git a/windows/deployment/usmt/usmt-migrate-efs-files-and-certificates.md b/windows/deployment/usmt/usmt-migrate-efs-files-and-certificates.md
index d4e2db536f..ea1fda6f15 100644
--- a/windows/deployment/usmt/usmt-migrate-efs-files-and-certificates.md
+++ b/windows/deployment/usmt/usmt-migrate-efs-files-and-certificates.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: greg-lindsay
+ms.date: 04/19/2017
---
# Migrate EFS Files and Certificates
diff --git a/windows/deployment/usmt/usmt-migrate-user-accounts.md b/windows/deployment/usmt/usmt-migrate-user-accounts.md
index 6c87c9b043..5007823608 100644
--- a/windows/deployment/usmt/usmt-migrate-user-accounts.md
+++ b/windows/deployment/usmt/usmt-migrate-user-accounts.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: greg-lindsay
+ms.date: 04/19/2017
---
# Migrate User Accounts
diff --git a/windows/deployment/usmt/usmt-migration-store-encryption.md b/windows/deployment/usmt/usmt-migration-store-encryption.md
index 1e8ea1a8e0..f1e7205880 100644
--- a/windows/deployment/usmt/usmt-migration-store-encryption.md
+++ b/windows/deployment/usmt/usmt-migration-store-encryption.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: greg-lindsay
+ms.date: 04/19/2017
---
# Migration Store Encryption
diff --git a/windows/deployment/usmt/usmt-overview.md b/windows/deployment/usmt/usmt-overview.md
index 121ae0c810..d07f18d62b 100644
--- a/windows/deployment/usmt/usmt-overview.md
+++ b/windows/deployment/usmt/usmt-overview.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: greg-lindsay
+ms.date: 10/16/2017
---
# User State Migration Tool (USMT) Overview
@@ -46,9 +47,6 @@ There are some scenarios in which the use of USMT is not recommended. These incl
## Related topics
- [User State Migration Tool (USMT) Technical Reference](usmt-technical-reference.md)
-Not finding content you need? Windows 10 users, tell us what you want on [Feedback Hub](feedback-hub://?referrer=techDocsUcPage&tabid=2&contextid=897&newFeedback=true&topic=usmt-overview.md).
-
-
diff --git a/windows/deployment/usmt/usmt-plan-your-migration.md b/windows/deployment/usmt/usmt-plan-your-migration.md
index 2b6ce76d7f..d8cbeb6f28 100644
--- a/windows/deployment/usmt/usmt-plan-your-migration.md
+++ b/windows/deployment/usmt/usmt-plan-your-migration.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: greg-lindsay
+ms.date: 04/19/2017
---
# Plan Your Migration
diff --git a/windows/deployment/usmt/usmt-recognized-environment-variables.md b/windows/deployment/usmt/usmt-recognized-environment-variables.md
index edebf602f1..e83a3bc015 100644
--- a/windows/deployment/usmt/usmt-recognized-environment-variables.md
+++ b/windows/deployment/usmt/usmt-recognized-environment-variables.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: greg-lindsay
+ms.date: 04/19/2017
---
# Recognized Environment Variables
diff --git a/windows/deployment/usmt/usmt-reference.md b/windows/deployment/usmt/usmt-reference.md
index 753146d6b9..782c80df15 100644
--- a/windows/deployment/usmt/usmt-reference.md
+++ b/windows/deployment/usmt/usmt-reference.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: greg-lindsay
+ms.date: 04/19/2017
---
# User State Migration Toolkit (USMT) Reference
diff --git a/windows/deployment/usmt/usmt-requirements.md b/windows/deployment/usmt/usmt-requirements.md
index e96eb8e095..daa83b02e6 100644
--- a/windows/deployment/usmt/usmt-requirements.md
+++ b/windows/deployment/usmt/usmt-requirements.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: greg-lindsay
+ms.date: 05/03/2017
---
# USMT Requirements
diff --git a/windows/deployment/usmt/usmt-reroute-files-and-settings.md b/windows/deployment/usmt/usmt-reroute-files-and-settings.md
index 99dd2eb09c..b34f25672c 100644
--- a/windows/deployment/usmt/usmt-reroute-files-and-settings.md
+++ b/windows/deployment/usmt/usmt-reroute-files-and-settings.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: greg-lindsay
+ms.date: 04/19/2017
---
# Reroute Files and Settings
diff --git a/windows/deployment/usmt/usmt-resources.md b/windows/deployment/usmt/usmt-resources.md
index e77c799af7..bd334fc553 100644
--- a/windows/deployment/usmt/usmt-resources.md
+++ b/windows/deployment/usmt/usmt-resources.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: greg-lindsay
+ms.date: 04/19/2017
---
# USMT Resources
diff --git a/windows/deployment/usmt/usmt-return-codes.md b/windows/deployment/usmt/usmt-return-codes.md
index 001654314d..287ac6ffc7 100644
--- a/windows/deployment/usmt/usmt-return-codes.md
+++ b/windows/deployment/usmt/usmt-return-codes.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: greg-lindsay
+ms.date: 04/19/2017
---
# Return Codes
diff --git a/windows/deployment/usmt/usmt-scanstate-syntax.md b/windows/deployment/usmt/usmt-scanstate-syntax.md
index 5083385534..2443952b25 100644
--- a/windows/deployment/usmt/usmt-scanstate-syntax.md
+++ b/windows/deployment/usmt/usmt-scanstate-syntax.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: greg-lindsay
+ms.date: 04/19/2017
---
# ScanState Syntax
diff --git a/windows/deployment/usmt/usmt-technical-reference.md b/windows/deployment/usmt/usmt-technical-reference.md
index c3d796217c..352c1e7ae7 100644
--- a/windows/deployment/usmt/usmt-technical-reference.md
+++ b/windows/deployment/usmt/usmt-technical-reference.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: greg-lindsay
+ms.date: 04/19/2017
---
# User State Migration Tool (USMT) Technical Reference
diff --git a/windows/deployment/usmt/usmt-test-your-migration.md b/windows/deployment/usmt/usmt-test-your-migration.md
index 39297b3207..72194933a6 100644
--- a/windows/deployment/usmt/usmt-test-your-migration.md
+++ b/windows/deployment/usmt/usmt-test-your-migration.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: greg-lindsay
+ms.date: 04/19/2017
---
# Test Your Migration
diff --git a/windows/deployment/usmt/usmt-topics.md b/windows/deployment/usmt/usmt-topics.md
index cec208e28b..ee6c7f1409 100644
--- a/windows/deployment/usmt/usmt-topics.md
+++ b/windows/deployment/usmt/usmt-topics.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: greg-lindsay
+ms.date: 04/19/2017
---
# User State Migration Tool (USMT) Overview Topics
diff --git a/windows/deployment/usmt/usmt-troubleshooting.md b/windows/deployment/usmt/usmt-troubleshooting.md
index 33296077f4..b3588b8bab 100644
--- a/windows/deployment/usmt/usmt-troubleshooting.md
+++ b/windows/deployment/usmt/usmt-troubleshooting.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: greg-lindsay
+ms.date: 04/19/2017
---
# User State Migration Tool (USMT) Troubleshooting
diff --git a/windows/deployment/usmt/usmt-utilities.md b/windows/deployment/usmt/usmt-utilities.md
index 08df5661f2..7d636d1d1a 100644
--- a/windows/deployment/usmt/usmt-utilities.md
+++ b/windows/deployment/usmt/usmt-utilities.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: greg-lindsay
+ms.date: 04/19/2017
---
# UsmtUtils Syntax
diff --git a/windows/deployment/usmt/usmt-what-does-usmt-migrate.md b/windows/deployment/usmt/usmt-what-does-usmt-migrate.md
index 02e64c33e8..ab7bbe5661 100644
--- a/windows/deployment/usmt/usmt-what-does-usmt-migrate.md
+++ b/windows/deployment/usmt/usmt-what-does-usmt-migrate.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: greg-lindsay
+ms.date: 09/12/2017
---
# What does USMT migrate?
diff --git a/windows/deployment/usmt/usmt-xml-elements-library.md b/windows/deployment/usmt/usmt-xml-elements-library.md
index 4257b3e9d6..46ec2a4af2 100644
--- a/windows/deployment/usmt/usmt-xml-elements-library.md
+++ b/windows/deployment/usmt/usmt-xml-elements-library.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: greg-lindsay
+ms.date: 04/19/2017
---
# XML Elements Library
diff --git a/windows/deployment/usmt/usmt-xml-reference.md b/windows/deployment/usmt/usmt-xml-reference.md
index 4023b52759..f613485b42 100644
--- a/windows/deployment/usmt/usmt-xml-reference.md
+++ b/windows/deployment/usmt/usmt-xml-reference.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: greg-lindsay
+ms.date: 04/19/2017
---
# USMT XML Reference
diff --git a/windows/deployment/usmt/verify-the-condition-of-a-compressed-migration-store.md b/windows/deployment/usmt/verify-the-condition-of-a-compressed-migration-store.md
index ee16be2715..277b89ff90 100644
--- a/windows/deployment/usmt/verify-the-condition-of-a-compressed-migration-store.md
+++ b/windows/deployment/usmt/verify-the-condition-of-a-compressed-migration-store.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: greg-lindsay
+ms.date: 04/19/2017
---
# Verify the Condition of a Compressed Migration Store
diff --git a/windows/deployment/usmt/xml-file-requirements.md b/windows/deployment/usmt/xml-file-requirements.md
index 100306e84d..a85b173f69 100644
--- a/windows/deployment/usmt/xml-file-requirements.md
+++ b/windows/deployment/usmt/xml-file-requirements.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: greg-lindsay
+ms.date: 04/19/2017
---
# XML File Requirements
diff --git a/windows/deployment/vda-subscription-activation.md b/windows/deployment/vda-subscription-activation.md
index 25d0f04961..f3d15623c6 100644
--- a/windows/deployment/vda-subscription-activation.md
+++ b/windows/deployment/vda-subscription-activation.md
@@ -7,7 +7,7 @@ ms.mktglfcycl: deploy
localizationpriority: high
ms.sitesec: library
ms.pagetype: mdt
-ms.date: 11/14/2017
+ms.date: 12/05/2017
author: greg-lindsay
---
@@ -47,7 +47,7 @@ For examples of activation issues, see [Troubleshoot the user experience](https:
3. At an elevated command prompt, type **sysdm.cpl** and press ENTER.
4. On the Remote tab, choose **Allow remote connections to this computer** and then click **Select Users**.
5. Click **Add**, type **Authenticated users**, and then click **OK** three times.
-6. Follow the instructions to use sysprep at [Steps to generalize a VHD](https://docs.microsoft.com/azure/virtual-machines/windows/prepare-for-upload-vhd-image#steps-to-generalize-a-vhd).
+6. Follow the instructions to use sysprep at [Steps to generalize a VHD](https://docs.microsoft.com/azure/virtual-machines/windows/prepare-for-upload-vhd-image#steps-to-generalize-a-vhd) and then start the VM again.
7. [Install Windows Configuration Designer](/windows/configuration/provisioning-packages/provisioning-install-icd).
8. Open Windows Configuration Designer and click **Provison desktop services**.
9. Under **Name**, type **Desktop AD Enrollment Pro GVLK**, click **Finish**, and then on the **Set up device** page enter a device name.
@@ -90,7 +90,6 @@ For Azure AD-joined VMs, follow the same instructions (above) as for [Active Dir
2. At an elevated command prompt, type **sysdm.cpl** and press ENTER.
3. On the Remote tab, choose **Allow remote connections to this computer** and then click **Select Users**.
4. Click **Add**, type **Authenticated users**, and then click **OK** three times.
-(https://docs.microsoft.com/azure/virtual-machines/windows/prepare-for-upload-vhd-image#steps-to-generalize-a-vhd).
5. [Install Windows Configuration Designer](/windows/configuration/provisioning-packages/provisioning-install-icd).
6. Open Windows Configuration Designer and click **Provison desktop services**.
7. Under **Name**, type **Desktop Bulk Enrollment Token Pro GVLK**, click **Finish**, and then on the **Set up device** page enter a device name.
diff --git a/windows/deployment/volume-activation/activate-forest-by-proxy-vamt.md b/windows/deployment/volume-activation/activate-forest-by-proxy-vamt.md
index b4ee02d408..394e9dbac2 100644
--- a/windows/deployment/volume-activation/activate-forest-by-proxy-vamt.md
+++ b/windows/deployment/volume-activation/activate-forest-by-proxy-vamt.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: activation
author: jdeckerms
+ms.date: 04/25/2017
---
# Activate by Proxy an Active Directory Forest
diff --git a/windows/deployment/volume-activation/activate-forest-vamt.md b/windows/deployment/volume-activation/activate-forest-vamt.md
index 3e03e5a68b..9673148fa4 100644
--- a/windows/deployment/volume-activation/activate-forest-vamt.md
+++ b/windows/deployment/volume-activation/activate-forest-vamt.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: activation
author: jdeckerms
+ms.date: 04/25/2017
---
# Activate an Active Directory Forest Online
diff --git a/windows/deployment/volume-activation/activate-using-active-directory-based-activation-client.md b/windows/deployment/volume-activation/activate-using-active-directory-based-activation-client.md
index 095d461e1e..63c093a2e9 100644
--- a/windows/deployment/volume-activation/activate-using-active-directory-based-activation-client.md
+++ b/windows/deployment/volume-activation/activate-using-active-directory-based-activation-client.md
@@ -9,6 +9,7 @@ ms.sitesec: library
ms.pagetype: activation
author: greg-lindsay
ms.localizationpriority: high
+ms.date: 07/27/2017
---
# Activate using Active Directory-based activation
diff --git a/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md b/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md
index 28325dc349..1560a368a5 100644
--- a/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md
+++ b/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md
@@ -9,6 +9,7 @@ ms.sitesec: library
ms.pagetype: activation
author: jdeckerms
ms.localizationpriority: high
+ms.date: 10/16/2017
---
# Activate using Key Management Service
@@ -138,4 +139,4 @@ For detailed instructions, see [Update that enables Windows 8.1 and Windows 8 KM
## See also
- [Volume Activation for Windows 10](volume-activation-windows-10.md)
-Not finding content you need? Windows 10 users, tell us what you want on [Feedback Hub](feedback-hub://?referrer=techDocsUcPage&tabid=2&contextid=897&newFeedback=true&topic=activate-using-key-management-service-vamt.md).
+
diff --git a/windows/deployment/volume-activation/activate-windows-10-clients-vamt.md b/windows/deployment/volume-activation/activate-windows-10-clients-vamt.md
index 2a3c80b8b2..f47e202d37 100644
--- a/windows/deployment/volume-activation/activate-windows-10-clients-vamt.md
+++ b/windows/deployment/volume-activation/activate-windows-10-clients-vamt.md
@@ -9,6 +9,7 @@ ms.sitesec: library
ms.pagetype: activation
author: jdeckerms
ms.localizationpriority: high
+ms.date: 07/27/2017
---
# Activate clients running Windows 10
diff --git a/windows/deployment/volume-activation/active-directory-based-activation-overview.md b/windows/deployment/volume-activation/active-directory-based-activation-overview.md
index 7eced02f55..e64be6f39d 100644
--- a/windows/deployment/volume-activation/active-directory-based-activation-overview.md
+++ b/windows/deployment/volume-activation/active-directory-based-activation-overview.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: activation
author: greg-lindsay
+ms.date: 04/19/2017
---
# Active Directory-Based Activation Overview
diff --git a/windows/deployment/volume-activation/add-manage-products-vamt.md b/windows/deployment/volume-activation/add-manage-products-vamt.md
index 70623ebb01..d3f1736d57 100644
--- a/windows/deployment/volume-activation/add-manage-products-vamt.md
+++ b/windows/deployment/volume-activation/add-manage-products-vamt.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: activation
author: jdeckerms
+ms.date: 04/25/2017
---
# Add and Manage Products
diff --git a/windows/deployment/volume-activation/add-remove-computers-vamt.md b/windows/deployment/volume-activation/add-remove-computers-vamt.md
index 5efb1a8409..14eb6d93b5 100644
--- a/windows/deployment/volume-activation/add-remove-computers-vamt.md
+++ b/windows/deployment/volume-activation/add-remove-computers-vamt.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
author: jdeckerms
ms.pagetype: activation
+ms.date: 04/25/2017
---
# Add and Remove Computers
diff --git a/windows/deployment/volume-activation/add-remove-product-key-vamt.md b/windows/deployment/volume-activation/add-remove-product-key-vamt.md
index 61f1cd59da..dbc43dacd5 100644
--- a/windows/deployment/volume-activation/add-remove-product-key-vamt.md
+++ b/windows/deployment/volume-activation/add-remove-product-key-vamt.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: activation
author: jdeckerms
+ms.date: 04/25/2017
---
# Add and Remove a Product Key
diff --git a/windows/deployment/volume-activation/appendix-information-sent-to-microsoft-during-activation-client.md b/windows/deployment/volume-activation/appendix-information-sent-to-microsoft-during-activation-client.md
index ca6ec523b8..63b927fef1 100644
--- a/windows/deployment/volume-activation/appendix-information-sent-to-microsoft-during-activation-client.md
+++ b/windows/deployment/volume-activation/appendix-information-sent-to-microsoft-during-activation-client.md
@@ -9,6 +9,7 @@ ms.sitesec: library
ms.pagetype: activation
author: jdeckerms
ms.localizationpriority: medium
+ms.date: 07/27/2017
---
# Appendix: Information sent to Microsoft during activation
**Applies to**
diff --git a/windows/deployment/volume-activation/configure-client-computers-vamt.md b/windows/deployment/volume-activation/configure-client-computers-vamt.md
index 6168096a40..bc6d81502b 100644
--- a/windows/deployment/volume-activation/configure-client-computers-vamt.md
+++ b/windows/deployment/volume-activation/configure-client-computers-vamt.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: activation
author: jdeckerms
+ms.date: 04/25/2017
---
# Configure Client Computers
diff --git a/windows/deployment/volume-activation/import-export-vamt-data.md b/windows/deployment/volume-activation/import-export-vamt-data.md
index 91604fe914..761457d1c2 100644
--- a/windows/deployment/volume-activation/import-export-vamt-data.md
+++ b/windows/deployment/volume-activation/import-export-vamt-data.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: activation
author: jdeckerms
+ms.date: 04/25/2017
---
# Import and Export VAMT Data
diff --git a/windows/deployment/volume-activation/install-configure-vamt.md b/windows/deployment/volume-activation/install-configure-vamt.md
index d141c48130..fa8dea6ac1 100644
--- a/windows/deployment/volume-activation/install-configure-vamt.md
+++ b/windows/deployment/volume-activation/install-configure-vamt.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: activation
author: jdeckerms
ms.localizationpriority: high
+ms.date: 07/27/2017
---
# Install and Configure VAMT
diff --git a/windows/deployment/volume-activation/install-kms-client-key-vamt.md b/windows/deployment/volume-activation/install-kms-client-key-vamt.md
index 1aecc1fd56..8f079268b5 100644
--- a/windows/deployment/volume-activation/install-kms-client-key-vamt.md
+++ b/windows/deployment/volume-activation/install-kms-client-key-vamt.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: activation
author: jdeckerms
ms.localizationpriority: high
+ms.date: 07/27/2017
---
# Install a KMS Client Key
diff --git a/windows/deployment/volume-activation/install-product-key-vamt.md b/windows/deployment/volume-activation/install-product-key-vamt.md
index 623f14c7bd..6956e71431 100644
--- a/windows/deployment/volume-activation/install-product-key-vamt.md
+++ b/windows/deployment/volume-activation/install-product-key-vamt.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: activation
author: jdeckerms
ms.localizationpriority: high
+ms.date: 07/27/2017
---
# Install a Product Key
diff --git a/windows/deployment/volume-activation/install-vamt.md b/windows/deployment/volume-activation/install-vamt.md
index f20fa8522a..1fb488e7ea 100644
--- a/windows/deployment/volume-activation/install-vamt.md
+++ b/windows/deployment/volume-activation/install-vamt.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: activation
author: jdeckerms
ms.localizationpriority: high
+ms.date: 07/27/2017
---
# Install VAMT
diff --git a/windows/deployment/volume-activation/introduction-vamt.md b/windows/deployment/volume-activation/introduction-vamt.md
index 06e3d0da40..d527c0e57a 100644
--- a/windows/deployment/volume-activation/introduction-vamt.md
+++ b/windows/deployment/volume-activation/introduction-vamt.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: activation
author: jdeckerms
+ms.date: 04/25/2017
---
# Introduction to VAMT
diff --git a/windows/deployment/volume-activation/kms-activation-vamt.md b/windows/deployment/volume-activation/kms-activation-vamt.md
index ed9eb06fee..d399375158 100644
--- a/windows/deployment/volume-activation/kms-activation-vamt.md
+++ b/windows/deployment/volume-activation/kms-activation-vamt.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: activation
author: jdeckerms
+ms.date: 04/25/2017
---
# Perform KMS Activation
diff --git a/windows/deployment/volume-activation/local-reactivation-vamt.md b/windows/deployment/volume-activation/local-reactivation-vamt.md
index 00e5d02250..81d2deb8aa 100644
--- a/windows/deployment/volume-activation/local-reactivation-vamt.md
+++ b/windows/deployment/volume-activation/local-reactivation-vamt.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: activation
author: jdeckerms
+ms.date: 04/25/2017
---
# Perform Local Reactivation
diff --git a/windows/deployment/volume-activation/manage-activations-vamt.md b/windows/deployment/volume-activation/manage-activations-vamt.md
index ff91afb865..29aee68fac 100644
--- a/windows/deployment/volume-activation/manage-activations-vamt.md
+++ b/windows/deployment/volume-activation/manage-activations-vamt.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: activation
author: jdeckerms
+ms.date: 04/25/2017
---
# Manage Activations
diff --git a/windows/deployment/volume-activation/manage-product-keys-vamt.md b/windows/deployment/volume-activation/manage-product-keys-vamt.md
index dd978d039a..4e51082561 100644
--- a/windows/deployment/volume-activation/manage-product-keys-vamt.md
+++ b/windows/deployment/volume-activation/manage-product-keys-vamt.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: activation
author: jdeckerms
+ms.date: 04/25/2017
---
# Manage Product Keys
diff --git a/windows/deployment/volume-activation/manage-vamt-data.md b/windows/deployment/volume-activation/manage-vamt-data.md
index 5062e4e819..b71b5629d9 100644
--- a/windows/deployment/volume-activation/manage-vamt-data.md
+++ b/windows/deployment/volume-activation/manage-vamt-data.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: activation
author: jdeckerms
+ms.date: 04/25/2017
---
# Manage VAMT Data
diff --git a/windows/deployment/volume-activation/monitor-activation-client.md b/windows/deployment/volume-activation/monitor-activation-client.md
index ffe55fe3ad..14bf4f8a02 100644
--- a/windows/deployment/volume-activation/monitor-activation-client.md
+++ b/windows/deployment/volume-activation/monitor-activation-client.md
@@ -9,6 +9,7 @@ ms.sitesec: library
ms.pagetype: activation
author: greg-lindsay
ms.localizationpriority: medium
+ms.date: 07/27/2017
---
# Monitor activation
diff --git a/windows/deployment/volume-activation/online-activation-vamt.md b/windows/deployment/volume-activation/online-activation-vamt.md
index adfdc41abf..ec04a095dd 100644
--- a/windows/deployment/volume-activation/online-activation-vamt.md
+++ b/windows/deployment/volume-activation/online-activation-vamt.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: activation
author: jdeckerms
+ms.date: 04/25/2017
---
# Perform Online Activation
diff --git a/windows/deployment/volume-activation/plan-for-volume-activation-client.md b/windows/deployment/volume-activation/plan-for-volume-activation-client.md
index 92299edb2e..a1e9503aee 100644
--- a/windows/deployment/volume-activation/plan-for-volume-activation-client.md
+++ b/windows/deployment/volume-activation/plan-for-volume-activation-client.md
@@ -9,6 +9,7 @@ ms.sitesec: library
ms.pagetype: activation
author: jdeckerms
ms.localizationpriority: medium
+ms.date: 09/27/2017
---
# Plan for volume activation
diff --git a/windows/deployment/volume-activation/proxy-activation-vamt.md b/windows/deployment/volume-activation/proxy-activation-vamt.md
index 62def8d290..8b1fda4134 100644
--- a/windows/deployment/volume-activation/proxy-activation-vamt.md
+++ b/windows/deployment/volume-activation/proxy-activation-vamt.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: activation
author: jdeckerms
+ms.date: 04/25/2017
---
# Perform Proxy Activation
diff --git a/windows/deployment/volume-activation/remove-products-vamt.md b/windows/deployment/volume-activation/remove-products-vamt.md
index 5d72e09b0c..54d63f20f6 100644
--- a/windows/deployment/volume-activation/remove-products-vamt.md
+++ b/windows/deployment/volume-activation/remove-products-vamt.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: activation
author: jdeckerms
+ms.date: 04/25/2017
---
# Remove Products
diff --git a/windows/deployment/volume-activation/scenario-kms-activation-vamt.md b/windows/deployment/volume-activation/scenario-kms-activation-vamt.md
index 6643bb09c6..1b3ee09ca7 100644
--- a/windows/deployment/volume-activation/scenario-kms-activation-vamt.md
+++ b/windows/deployment/volume-activation/scenario-kms-activation-vamt.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: activation
author: jdeckerms
+ms.date: 04/25/2017
---
# Scenario 3: KMS Client Activation
diff --git a/windows/deployment/volume-activation/scenario-online-activation-vamt.md b/windows/deployment/volume-activation/scenario-online-activation-vamt.md
index 2d818a946e..04b2b6ea5d 100644
--- a/windows/deployment/volume-activation/scenario-online-activation-vamt.md
+++ b/windows/deployment/volume-activation/scenario-online-activation-vamt.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: activation
author: jdeckerms
+ms.date: 04/25/2017
---
# Scenario 1: Online Activation
diff --git a/windows/deployment/volume-activation/scenario-proxy-activation-vamt.md b/windows/deployment/volume-activation/scenario-proxy-activation-vamt.md
index 4298e90b11..a57fcad150 100644
--- a/windows/deployment/volume-activation/scenario-proxy-activation-vamt.md
+++ b/windows/deployment/volume-activation/scenario-proxy-activation-vamt.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: activation
author: jdeckerms
+ms.date: 04/25/2017
---
# Scenario 2: Proxy Activation
diff --git a/windows/deployment/volume-activation/update-product-status-vamt.md b/windows/deployment/volume-activation/update-product-status-vamt.md
index caf624b267..81108e69e4 100644
--- a/windows/deployment/volume-activation/update-product-status-vamt.md
+++ b/windows/deployment/volume-activation/update-product-status-vamt.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: activation
author: jdeckerms
+ms.date: 04/25/2017
---
# Update Product Status
diff --git a/windows/deployment/volume-activation/use-the-volume-activation-management-tool-client.md b/windows/deployment/volume-activation/use-the-volume-activation-management-tool-client.md
index b81e84356d..8f850d750a 100644
--- a/windows/deployment/volume-activation/use-the-volume-activation-management-tool-client.md
+++ b/windows/deployment/volume-activation/use-the-volume-activation-management-tool-client.md
@@ -9,6 +9,7 @@ ms.sitesec: library
ms.pagetype: activation
author: jdeckerms
ms.localizationpriority: high
+ms.date: 07/27/2017
---
# Use the Volume Activation Management Tool
diff --git a/windows/deployment/volume-activation/use-vamt-in-windows-powershell.md b/windows/deployment/volume-activation/use-vamt-in-windows-powershell.md
index b461b29aa7..ff1efca6bc 100644
--- a/windows/deployment/volume-activation/use-vamt-in-windows-powershell.md
+++ b/windows/deployment/volume-activation/use-vamt-in-windows-powershell.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: activation
author: jdeckerms
+ms.date: 04/25/2017
---
# Use VAMT in Windows PowerShell
diff --git a/windows/deployment/volume-activation/vamt-known-issues.md b/windows/deployment/volume-activation/vamt-known-issues.md
index b2eaf3b2bc..99dd5123f7 100644
--- a/windows/deployment/volume-activation/vamt-known-issues.md
+++ b/windows/deployment/volume-activation/vamt-known-issues.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: activation
author: jdeckerms
+ms.date: 04/25/2017
---
# VAMT Known Issues
diff --git a/windows/deployment/volume-activation/vamt-requirements.md b/windows/deployment/volume-activation/vamt-requirements.md
index 6e4a94c8e3..f595695c11 100644
--- a/windows/deployment/volume-activation/vamt-requirements.md
+++ b/windows/deployment/volume-activation/vamt-requirements.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: activation
author: jdeckerms
+ms.date: 04/25/2017
---
# VAMT Requirements
diff --git a/windows/deployment/volume-activation/vamt-step-by-step.md b/windows/deployment/volume-activation/vamt-step-by-step.md
index 7d6fd78f4d..7678851556 100644
--- a/windows/deployment/volume-activation/vamt-step-by-step.md
+++ b/windows/deployment/volume-activation/vamt-step-by-step.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: activation
author: jdeckerms
+ms.date: 04/25/2017
---
# VAMT Step-by-Step Scenarios
diff --git a/windows/deployment/volume-activation/volume-activation-management-tool.md b/windows/deployment/volume-activation/volume-activation-management-tool.md
index e315f32f6f..17df92c0e9 100644
--- a/windows/deployment/volume-activation/volume-activation-management-tool.md
+++ b/windows/deployment/volume-activation/volume-activation-management-tool.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: activation
author: jdeckerms
+ms.date: 04/25/2017
---
# Volume Activation Management Tool (VAMT) Technical Reference
diff --git a/windows/deployment/volume-activation/volume-activation-windows-10.md b/windows/deployment/volume-activation/volume-activation-windows-10.md
index d7cc0b2c2a..be90c6bedc 100644
--- a/windows/deployment/volume-activation/volume-activation-windows-10.md
+++ b/windows/deployment/volume-activation/volume-activation-windows-10.md
@@ -9,6 +9,7 @@ ms.sitesec: library
ms.pagetype: activation
author: jdeckerms
ms.localizationpriority: high
+ms.date: 07/27/2017
---
# Volume Activation for Windows 10
diff --git a/windows/deployment/windows-10-architecture-posters.md b/windows/deployment/windows-10-architecture-posters.md
index 93173ce925..9e30d5461e 100644
--- a/windows/deployment/windows-10-architecture-posters.md
+++ b/windows/deployment/windows-10-architecture-posters.md
@@ -4,7 +4,7 @@ description: Provides architural planning posters for Windows 10 in the enterpri
ms.prod: w10
ms.author: elizapo
author: lizap
-ms.date: 09/28/2017
+ms.date: 09/28/2017
ms.tgt_pltfrm: na
ms.topic: article
ms.localizationpriority: low
diff --git a/windows/deployment/windows-10-deployment-scenarios.md b/windows/deployment/windows-10-deployment-scenarios.md
index 1b9607c9b5..bab7d12f57 100644
--- a/windows/deployment/windows-10-deployment-scenarios.md
+++ b/windows/deployment/windows-10-deployment-scenarios.md
@@ -7,7 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.localizationpriority: high
ms.sitesec: library
-ms.date: 11/7/2017
+ms.date: 01/10/2018
author: greg-lindsay
---
@@ -16,19 +16,140 @@ author: greg-lindsay
**Applies to**
- Windows 10
-To successfully deploy the Windows 10 operating system in your organization, it is important to understand the different ways that it can be deployed, especially now that there are new scenarios to consider. Choosing among these scenarios, and understanding the key capabilities and limitations of each, is a key task.
+To successfully deploy the Windows 10 operating system in your organization, it is important to understand the different ways that it can be deployed, especially now that there are new scenarios to consider. Choosing among these scenarios, and understanding the capabilities and limitations of each, is a key task.
-## Windows AutoPilot
+The following table summarizes various Windows 10 deployment scenarios. The scenarios are each assigned to one of three categories.
+- Modern deployment methods are recommended unless you have a specific need to use a different procedure.
+- Dynamic deployment methods enable you to configure applications and settings for specific use cases.
+- Traditional deployment methods use tools such as Microsoft Deployment Toolkit (MDT) and System Center Configuration Manager.
+
+
+
Category
+
Scenario
+
Description
+
More information
+
Modern
+
+
+[Windows AutoPilot](#windows-autopilot)
+
+ Customize the out-of-box-experience (OOBE) for your organization, and deploy a new system with apps and settings already configured.
+
+
+
+
+
+>[!IMPORTANT]
+>The Windows AutoPilot and Subscription Activation scenarios require that the beginning OS be Windows 10 version 1703, or later.
+>Except for clean install scenarios such as traditional bare metal and Windows AutoPilot, all the methods described can optionally migrate apps and settings to the new OS.
+
+## Modern deployment methods
+
+Modern deployment methods embrace both traditional on-prem and cloud services to deliver a simple, streamlined, cost effective deployment experience.
+
+### Windows AutoPilot
Windows AutoPilot is a new suite of capabilities designed to simplify and modernize the deployment and management of new Windows 10 PCs. Windows AutoPilot enables IT professionals to customize the Out of Box Experience (OOBE) for Windows 10 PCs and provide end users with a fully configured new Windows 10 device after just a few clicks. There are no images to deploy, no drivers to inject, and no infrastructure to manage. Users can go through the deployment process independently, without the need consult their IT administrator.
For more information about Windows AutoPilot, see [Overview of Windows AutoPilot](https://docs.microsoft.com/en-us/windows/deployment/windows-10-auto-pilot) and [Modernizing Windows deployment with Windows AutoPilot](https://blogs.technet.microsoft.com/windowsitpro/2017/06/29/modernizing-windows-deployment-with-windows-autopilot/).
-## Windows 10 Subscription Activation
-
-Windows 10 Subscription Activation is a modern deployment method that enables you to change the SKU from Pro to Enterprise with no keys and no reboots. For more information about Subscription Activation, see [Windows 10 Subscription Activation](https://docs.microsoft.com/en-us/windows/deployment/windows-10-enterprise-subscription-activation).
-
-## In-place upgrade
+### In-place upgrade
For existing computers running Windows 7, Windows 8, or Windows 8.1, the recommended path for organizations deploying Windows 10 leverages the Windows installation program (Setup.exe) to perform an in-place upgrade, which automatically preserves all data, settings, applications, and drivers from the existing operating system version. This requires the least IT effort, because there is no need for any complex deployment infrastructure.
@@ -53,26 +174,27 @@ There are some situations where you cannot use in-place upgrade; in these situat
- Updating existing images. While it might be tempting to try to upgrade existing Windows 7, Windows 8, or Windows 8.1 images to Windows 10 by installing the old image, upgrading it, and then recapturing the new Windows 10 image, this is not supported – preparing an upgraded OS for imaging (using Sysprep.exe) is not supported and will not work when it detects the upgraded OS.
- Dual-boot and multi-boot systems. The upgrade process is designed for devices running a single OS; if using dual-boot or multi-boot systems with multiple operating systems (not leveraging virtual machines for the second and subsequent operating systems), additional care should be taken.
+
## Dynamic provisioning
For new PCs, organizations have historically replaced the version of Windows included on the device with their own custom Windows image, because this was often faster and easier than leveraging the preinstalled version. But this is an added expense due to the time and effort required. With the new dynamic provisioning capabilities and tools provided with Windows 10, it is now possible to avoid this.
The goal of dynamic provisioning is to take a new PC out of the box, turn it on, and transform it into a productive organization device, with minimal time and effort. The types of transformations that are available include:
-- Changing the Windows edition with a single reboot. For organizations that have Software Assurance for Windows, it is easy to change a device from Windows 10 Pro to Windows 10 Enterprise, just by specifying an appropriate product or setup key. When the device restarts, all of the Windows 10 Enterprise features will be enabled.
+### Windows 10 Subscription Activation
-- Configuring the device with VPN and Wi-Fi connections that may be needed to gain access to organization resources.
-- Installation of additional apps needed for organization functions.
-- Configuration of common Windows settings to ensure compliance with organization policies.
-- Enrollment of the device in a mobile device management (MDM) solution, such as Microsoft Intune.
+Windows 10 Subscription Activation is a modern deployment method that enables you to change the SKU from Pro to Enterprise with no keys and no reboots. For more information about Subscription Activation, see [Windows 10 Subscription Activation](https://docs.microsoft.com/en-us/windows/deployment/windows-10-enterprise-subscription-activation).
-There are two primary dynamic provisioning scenarios:
-- **Azure Active Directory (Azure AD) Join with automatic mobile device management (MDM) enrollment.** In this scenario, the organization member just needs to provide their work or school user ID and password; the device can then be automatically joined to Azure Active Directory and enrolled in a mobile device management (MDM) solution with no additional user interaction. Once done, the MDM solution can finish configuring the device as needed.
+### Azure Active Directory (AAD) join with automatic mobile device management (MDM) enrollment
-- **Provisioning package configuration.** Using the [Windows Imaging and Configuration Designer (ICD)](https://go.microsoft.com/fwlink/p/?LinkId=619358), IT administrators can create a self-contained package that contains all of the configuration, settings, and apps that need to be applied to a machine. These packages can then be deployed to new PCs through a variety of means, typically by IT professionals. For more information, see [Configure devices without MDM](/windows/configuration/configure-devices-without-mdm).
+In this scenario, the organization member just needs to provide their work or school user ID and password; the device can then be automatically joined to Azure Active Directory and enrolled in a mobile device management (MDM) solution with no additional user interaction. Once done, the MDM solution can finish configuring the device as needed. For more information, see [Azure Active Directory integration with MDM](https://docs.microsoft.com/en-us/windows/client-management/mdm/azure-active-directory-integration-with-mdm).
-Either way, these scenarios can be used to enable “choose your own device” (CYOD) programs where the organization’s users can pick their own PC and not be restricted to a small list of approved or certified models (programs that are difficult to implement using traditional deployment scenarios).
+### Provisioning package configuration
+
+Using the [Windows Imaging and Configuration Designer (ICD)](https://go.microsoft.com/fwlink/p/?LinkId=619358), IT administrators can create a self-contained package that contains all of the configuration, settings, and apps that need to be applied to a machine. These packages can then be deployed to new PCs through a variety of means, typically by IT professionals. For more information, see [Configure devices without MDM](/windows/configuration/configure-devices-without-mdm).
+
+These scenarios can be used to enable “choose your own device” (CYOD) programs where the organization’s users can pick their own PC and not be restricted to a small list of approved or certified models (programs that are difficult to implement using traditional deployment scenarios).
While the initial Windows 10 release includes a variety of provisioning settings and deployment mechanisms, these will continue to be enhanced and extended based on feedback from organizations. As with all Windows features, organizations can submit suggestions for additional features through the Windows Feedback app or through their Microsoft Support contacts.
@@ -90,8 +212,9 @@ The traditional deployment scenario can be divided into different sub-scenarios.
- **Computer replace.** A replacement of the old machine with a new machine (with user-state migration and an optional full WIM image backup).
-###New computer
-This scenario occurs when you have a blank machine you need to deploy, or an existing machine you want to wipe and redeploy without needing to preserve any existing data. The setup starts from a boot media, using CD, USB, ISO, or Pre-Boot Execution Environment (PXE). You can also generate a full offline media that includes all the files needed for a client deployment, allowing you to deploy without having to connect to a central deployment share. The target can be a physical computer, a virtual machine, or a Virtual Hard Disk (VHD) running on a physical computer (boot from VHD).
+### New computer
+
+Also called a "bare metal" deployment. This scenario occurs when you have a blank machine you need to deploy, or an existing machine you want to wipe and redeploy without needing to preserve any existing data. The setup starts from a boot media, using CD, USB, ISO, or Pre-Boot Execution Environment (PXE). You can also generate a full offline media that includes all the files needed for a client deployment, allowing you to deploy without having to connect to a central deployment share. The target can be a physical computer, a virtual machine, or a Virtual Hard Disk (VHD) running on a physical computer (boot from VHD).
The deployment process for the new machine scenario is as follows:
@@ -105,7 +228,8 @@ The deployment process for the new machine scenario is as follows:
After taking these steps, the computer is ready for use.
-###Computer refresh
+### Computer refresh
+
A refresh is sometimes called wipe-and-load. The process is normally initiated in the running operating system. User data and settings are backed up and restored later as part of the deployment process. The target can be the same as for the new computer scenario.
The deployment process for the wipe-and-load scenario is as follows:
@@ -124,7 +248,8 @@ The deployment process for the wipe-and-load scenario is as follows:
After taking these steps, the machine is ready for use.
-###Computer replace
+### Computer replace
+
A computer replace is similar to the refresh scenario. However, since we are replacing the machine, we divide this scenario into two main tasks: backup of the old client and bare-metal deployment of the new client. As with the refresh scenario, user data and settings are backed up and restored.
The deployment process for the replace scenario is as follows:
@@ -136,6 +261,7 @@ The deployment process for the replace scenario is as follows:
**Note** In some situations, you can use the replace scenario even if the target is the same machine. For example, you can use replace if you want to modify the disk layout from the master boot record (MBR) to the GUID partition table (GPT), which will allow you to take advantage of the Unified Extensible Firmware Interface (UEFI) functionality. You can also use replace if the disk needs to be repartitioned since user data needs to be transferred off the disk.
## Related topics
+
- [Upgrade to Windows 10 with the Microsoft Deployment Toolkit](upgrade/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md)
- [Upgrade to Windows 10 with System Center Configuration Manager](upgrade/upgrade-to-windows-10-with-system-center-configuraton-manager.md)
- [Deploy Windows 10 with System Center 2012 R2 Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkId=620230)
@@ -143,5 +269,3 @@ The deployment process for the replace scenario is as follows:
- [Windows setup technical reference](https://go.microsoft.com/fwlink/p/?LinkId=619357)
- [Windows Imaging and Configuration Designer](https://go.microsoft.com/fwlink/p/?LinkId=619358)
- [UEFI firmware](https://go.microsoft.com/fwlink/p/?LinkId=619359)
-
-Not finding content you need? Windows 10 users, tell us what you want on [Feedback Hub](feedback-hub://?referrer=techDocsUcPage&tabid=2&contextid=897&newFeedback=true&topic=windows-10-deployment-scenarios.md).
\ No newline at end of file
diff --git a/windows/deployment/windows-10-deployment-tools-reference.md b/windows/deployment/windows-10-deployment-tools-reference.md
index d6f852cae5..624e9bf703 100644
--- a/windows/deployment/windows-10-deployment-tools-reference.md
+++ b/windows/deployment/windows-10-deployment-tools-reference.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: greg-lindsay
+ms.date: 07/12/2017
---
# Windows 10 deployment tools
diff --git a/windows/deployment/windows-10-deployment-tools.md b/windows/deployment/windows-10-deployment-tools.md
index 7401e4d251..b9b4727e55 100644
--- a/windows/deployment/windows-10-deployment-tools.md
+++ b/windows/deployment/windows-10-deployment-tools.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: greg-lindsay
+ms.date: 10/16/2017
---
# Windows 10 deployment tools
@@ -21,5 +22,3 @@ Learn about the tools available to deploy Windows 10.
|[Deploy Windows To Go in your organization](deploy-windows-to-go.md) |This topic helps you to deploy Windows To Go in your organization. Before you begin deployment, make sure that you have reviewed the topics [Windows To Go: feature overview](planning/windows-to-go-overview.md) and [Prepare your organization for Windows To Go](planning/prepare-your-organization-for-windows-to-go.md) to ensure that you have the correct hardware and are prepared to complete the deployment. You can then use the steps in this topic to start your Windows To Go deployment. |
|[Volume Activation Management Tool (VAMT) Technical Reference](volume-activation/volume-activation-management-tool.md) |The Volume Activation Management Tool (VAMT) enables network administrators and other IT professionals to automate and centrally manage the Windows®, Microsoft® Office, and select other Microsoft products volume and retail-activation process. |
|[User State Migration Tool (USMT) Technical Reference](usmt/usmt-technical-reference.md) |The User State Migration Tool (USMT) 10.0 is included with the Windows Assessment and Deployment Kit (Windows ADK) for Windows 10. USMT provides a highly customizable user-profile migration experience for IT professionals |
-
-Not finding content you need? Windows 10 users, tell us what you want on [Feedback Hub](feedback-hub://?referrer=techDocsUcPage&tabid=2&contextid=897&newFeedback=true&topic=windows-10-deployment-tools.md).
\ No newline at end of file
diff --git a/windows/deployment/windows-10-deployment-workflow.md b/windows/deployment/windows-10-deployment-workflow.md
new file mode 100644
index 0000000000..5ac7695ecb
--- /dev/null
+++ b/windows/deployment/windows-10-deployment-workflow.md
@@ -0,0 +1,14 @@
+---
+title: Windows 10 deployment workflow
+description: Scenarios, methods, tools, and requirements for deploying Windows 10.
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.localizationpriority: high
+ms.pagetype: deploy
+ms.sitesec: library
+author: greg-lindsay
+ms.date: 12/4/2017
+---
+
+# Windows 10 deployment workflow
+
diff --git a/windows/deployment/windows-10-enterprise-e3-overview.md b/windows/deployment/windows-10-enterprise-e3-overview.md
index 5f663ae222..b0665c415e 100644
--- a/windows/deployment/windows-10-enterprise-e3-overview.md
+++ b/windows/deployment/windows-10-enterprise-e3-overview.md
@@ -7,7 +7,7 @@ ms.mktglfcycl: deploy
ms.localizationpriority: high
ms.sitesec: library
ms.pagetype: mdt
-ms.date: 08/23/2017
+ms.date: 08/24/2017
author: greg-lindsay
---
diff --git a/windows/deployment/windows-10-enterprise-subscription-activation.md b/windows/deployment/windows-10-enterprise-subscription-activation.md
index cfafe38c9a..f7f5d176dd 100644
--- a/windows/deployment/windows-10-enterprise-subscription-activation.md
+++ b/windows/deployment/windows-10-enterprise-subscription-activation.md
@@ -7,7 +7,7 @@ ms.mktglfcycl: deploy
localizationpriority: high
ms.sitesec: library
ms.pagetype: mdt
-ms.date: 10/18/2017
+ms.date: 10/20/2017
author: greg-lindsay
---
diff --git a/windows/deployment/windows-10-media.md b/windows/deployment/windows-10-media.md
index 67e3b2e2b4..06767dad8e 100644
--- a/windows/deployment/windows-10-media.md
+++ b/windows/deployment/windows-10-media.md
@@ -5,7 +5,7 @@ keywords: deploy, upgrade, update, software, media
ms.prod: w10
ms.mktglfcycl: plan
ms.localizationpriority: high
-ms.date: 10/18/2017
+ms.date: 10/20/2017
ms.sitesec: library
author: greg-lindsay
---
diff --git a/windows/deployment/windows-10-poc-mdt.md b/windows/deployment/windows-10-poc-mdt.md
index 8c3ca200ef..c85238f4c2 100644
--- a/windows/deployment/windows-10-poc-mdt.md
+++ b/windows/deployment/windows-10-poc-mdt.md
@@ -7,7 +7,7 @@ ms.sitesec: library
ms.pagetype: deploy
keywords: deployment, automate, tools, configure, mdt
ms.localizationpriority: high
-ms.date: 10/10/2017
+ms.date: 10/11/2017
author: greg-lindsay
---
diff --git a/windows/deployment/windows-10-poc-sc-config-mgr.md b/windows/deployment/windows-10-poc-sc-config-mgr.md
index 0d51134732..7d845a6584 100644
--- a/windows/deployment/windows-10-poc-sc-config-mgr.md
+++ b/windows/deployment/windows-10-poc-sc-config-mgr.md
@@ -7,7 +7,7 @@ ms.sitesec: library
ms.pagetype: deploy
keywords: deployment, automate, tools, configure, sccm
ms.localizationpriority: high
-ms.date: 10/10/2017
+ms.date: 10/11/2017
author: greg-lindsay
---
diff --git a/windows/deployment/windows-10-poc.md b/windows/deployment/windows-10-poc.md
index 9e55510904..4ac1cc5a28 100644
--- a/windows/deployment/windows-10-poc.md
+++ b/windows/deployment/windows-10-poc.md
@@ -7,7 +7,7 @@ ms.sitesec: library
ms.pagetype: deploy
keywords: deployment, automate, tools, configure, mdt, sccm
ms.localizationpriority: high
-ms.date: 10/10/2017
+ms.date: 11/16/2017
author: greg-lindsay
---
diff --git a/windows/deployment/windows-adk-scenarios-for-it-pros.md b/windows/deployment/windows-adk-scenarios-for-it-pros.md
index 154981a4b6..bfb29c4630 100644
--- a/windows/deployment/windows-adk-scenarios-for-it-pros.md
+++ b/windows/deployment/windows-adk-scenarios-for-it-pros.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.localizationpriority: high
ms.sitesec: library
author: greg-lindsay
+ms.date: 07/27/2017
---
# Windows ADK for Windows 10 scenarios for IT Pros
diff --git a/windows/deployment/windows-autopilot/TOC.md b/windows/deployment/windows-autopilot/TOC.md
new file mode 100644
index 0000000000..865fa18cce
--- /dev/null
+++ b/windows/deployment/windows-autopilot/TOC.md
@@ -0,0 +1,8 @@
+# [Overview of Windows AutoPilot](windows-10-autopilot.md)
+
+## [The Windows AutoPilot Deployment Program in Microsoft Store for Business](https://docs.microsoft.com/microsoft-store/add-profile-to-devices#manage-autopilot-deployment-profiles)
+## [The Windows AutoPilot Deployment Program in Microsoft Intune](https://docs.microsoft.com/intune/enrollment-autopilot)
+## [The Windows AutoPilot Deployment Program in Microsoft 365 Business & Office 365 Admin portal](https://support.office.com/article/Create-and-edit-AutoPilot-profiles-5cf7139e-cfa1-4765-8aad-001af1c74faa)
+## [The Windows AutoPilot Deployment Program in Partner Center](https://msdn.microsoft.com/partner-center/autopilot)
+## [Demo the Windows AutoPilot Deployment Program on a Virtual Machine](windows-10-autopilot-demo-vm.md)
+
diff --git a/windows/deployment/windows-autopilot/images/autopilot-aad-configure.jpg b/windows/deployment/windows-autopilot/images/autopilot-aad-configure.jpg
new file mode 100644
index 0000000000..3a16c0f219
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/autopilot-aad-configure.jpg differ
diff --git a/windows/deployment/windows-autopilot/images/autopilot-aad-mdm.jpg b/windows/deployment/windows-autopilot/images/autopilot-aad-mdm.jpg
new file mode 100644
index 0000000000..3a8f1578cb
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/autopilot-aad-mdm.jpg differ
diff --git a/windows/deployment/windows-autopilot/images/autopilot-devices-add.jpg b/windows/deployment/windows-autopilot/images/autopilot-devices-add.jpg
new file mode 100644
index 0000000000..137b6ca431
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/autopilot-devices-add.jpg differ
diff --git a/windows/deployment/windows-autopilot/images/autopilot-intune-profile-add.jpg b/windows/deployment/windows-autopilot/images/autopilot-intune-profile-add.jpg
new file mode 100644
index 0000000000..bc4bed8920
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/autopilot-intune-profile-add.jpg differ
diff --git a/windows/deployment/windows-autopilot/images/autopilot-intune-profile-assign.jpg b/windows/deployment/windows-autopilot/images/autopilot-intune-profile-assign.jpg
new file mode 100644
index 0000000000..7604382113
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/autopilot-intune-profile-assign.jpg differ
diff --git a/windows/deployment/windows-autopilot/images/autopilot-intune-profile-configure.jpg b/windows/deployment/windows-autopilot/images/autopilot-intune-profile-configure.jpg
new file mode 100644
index 0000000000..c3c5307ce4
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/autopilot-intune-profile-configure.jpg differ
diff --git a/windows/deployment/windows-autopilot/images/autopilot-intune-sync.jpg b/windows/deployment/windows-autopilot/images/autopilot-intune-sync.jpg
new file mode 100644
index 0000000000..a2717c68be
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/autopilot-intune-sync.jpg differ
diff --git a/windows/deployment/windows-autopilot/images/autopilot-oobe.jpg b/windows/deployment/windows-autopilot/images/autopilot-oobe.jpg
new file mode 100644
index 0000000000..bb2d641155
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/autopilot-oobe.jpg differ
diff --git a/windows/deployment/windows-autopilot/images/autopilot-reset-progress.jpg b/windows/deployment/windows-autopilot/images/autopilot-reset-progress.jpg
new file mode 100644
index 0000000000..dbf0e3b3ae
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/autopilot-reset-progress.jpg differ
diff --git a/windows/deployment/windows-autopilot/images/autopilot-reset-prompt.jpg b/windows/deployment/windows-autopilot/images/autopilot-reset-prompt.jpg
new file mode 100644
index 0000000000..9ed75a9db9
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/autopilot-reset-prompt.jpg differ
diff --git a/windows/deployment/windows-autopilot/windows-10-autopilot-demo-vm.md b/windows/deployment/windows-autopilot/windows-10-autopilot-demo-vm.md
new file mode 100644
index 0000000000..505982b0d1
--- /dev/null
+++ b/windows/deployment/windows-autopilot/windows-10-autopilot-demo-vm.md
@@ -0,0 +1,209 @@
+---
+title: Demo the Windows AutoPilot Deployment Program on a Virtual Machine
+description: Step-by-step instructions on how to set-up a Virtual Machine with a Windows AutoPilot deployment
+keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.localizationpriority: high
+ms.sitesec: library
+ms.pagetype: deploy
+author: DaniHalfin
+ms.author: daniha
+ms.date: 12/21/2017
+---
+
+# Demo the Windows AutoPilot Deployment Program on a Virtual Machine
+
+**Applies to**
+
+- Windows 10
+
+In this topic you'll learn how to set-up a Windows AutoPilot deployment for a Virtual Machine using Hyper-V.
+
+## Prerequisites
+
+These are the thing you'll need on your device to get started:
+* Installation media for the latest version of Windows 10 Professional or Enterprise (ISO file)
+* Internet access (see [Network connectivity requirements](windows-10-autopilot.md#network-connectivity-requirements))
+* Hypervisor needs to be unoccupied, or used by Hyper-V, as we will be using Hyper-V to create the Virtual Machine
+
+See additional prerequisites in the [Windows AutoPilot overview topic](windows-10-autopilot.md#prerequisites).
+
+## Create your Virtual Machine
+
+### Enable Hyper-V
+The first thing to do, is to enable the Hyper-V feature on your device.
+>[!IMPORTANT]
+>If you already have Hyper-V enabled, skip this step.
+
+Open a PowerShell prompt **as an administrator** and run the following:
+```powershell
+Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V -All
+```
+
+You will be prompted to restart your device, so save all your work and restart it before you continue.
+
+### Create and start your demo Virtual Machine
+
+Now that Hyper-V is enabled, proceed to create your Virtual Machine.
+
+Open a PowerShell prompt **as an administrator** and run the following:
+```powershell
+New-VMSwitch -Name AutoPilotExternal -NetAdapterName -AllowManagementOS $true
+New-VM -Name WindowsAutoPilot -MemoryStartupBytes 2GB -BootDevice VHD -NewVHDPath .\VMs\WindowsAutoPilot.vhdx -Path .\VMData -NewVHDSizeBytes 80GB -Generation 2 -Switch AutoPilotExternal
+Add-VMDvdDrive -Path -VMName WindowsAutoPilot
+Start-VM -VMName WindowsAutoPilot
+```
+
+>[!IMPORTANT]
+>Make sure to replace <*Name of Network Adapter with internet access*> and <*Path to Windows 10 ISO*> with the appropriate values.
+>Additionally, note that all Virtual Machine related data will be created under the current path in your PowerShell prompt. Consider navigating into a new folder before running the above.
+
+### Install Windows 10
+
+Now that the Virtual Machine was created and started, open **Hyper-V Manager** and connect to the **WindowsAutoPilot** Virtual Machine.
+Make sure the Virtual Machine booted from the installation media you've provided and complete the Windows installation process.
+
+Once the installation is complete, create a checkpoint. You will create multiple checkpoints throughout this process, which you can later use to go through the process again.
+
+To create the checkpoint, open a PowerShell prompt **as an administrator** and run the following:
+```powershell
+Checkpoint-VM -Name WindowsAutoPilot -SnapshotName "Finished Windows install"
+```
+
+## Capture your Virtual Machine's hardware ID
+
+On the newly created Virtual Machine, open a PowerShell prompt **as an administrator** and run the following:
+```powershell
+md c:\HWID
+Set-Location c:\HWID
+Set-ExecutionPolicy Unrestricted
+Install-Script -Name Get-WindowsAutoPilotInfo
+Get-WindowsAutoPilotInfo.ps1 -OutputFile AutoPilotHWID.csv
+```
+
+>[!NOTE]
+>Accept all prompts while running the above cmdlets.
+
+### Mount the Virtual Hard Drive (VHD)
+
+To gain access to the AutoPilotHWID.csv that contains the hardware ID, stop the Virtual Machine to unlock the Virtual Hard Drive.
+
+To do that, on your device (**not** on the Virtual Machine), open a PowerShell prompt **as an administrator** and run the following:
+```powershell
+Stop-VM -VMName WindowsAutoPilot
+```
+
+Once the Virtual Machine has stopped, create a checkpoint:
+```powershell
+Checkpoint-VM -Name WindowsAutoPilot -SnapshotName "HWID captured"
+```
+
+With the checkpoint created, continue to mount the VHD:
+```powershell
+Mount-VHD -path (Get-VMHardDiskDrive -VMName WindowsAutoPilot).Path
+```
+
+Once mounted, navigate to the new drive and copy **AutoPilotHWID.csv** to a location on your device.
+
+Before you proceed, unmount the VHD to unlock it and start the Virtual Machine:
+```powershell
+Dismount-VHD -path (Get-VMHardDiskDrive -VMName WindowsAutoPilot).Path
+Start-VM -VMName WindowsAutoPilot
+```
+
+## Reset Virtual Machine back to Out-Of-Box-Experience (OOBE)
+
+With the hardware ID captured, prepare your Virtual Machine for Windows AutoPilot deployment by resetting it back to OOBE.
+
+On the Virtual Machine, go to **Settings > Update & Security > Recovery** and click on **Get started** under **Reset this PC**.
+Select **Remove everything** and **Just remove my files**. Finally, click on **Reset**.
+
+
+
+Resetting your Virtual Machine can take a while. Proceed to the next steps while your Virtual Machine is resetting.
+
+
+
+## Configure company branding
+
+>[!IMPORTANT]
+>If you already have company branding configured in Azure Active Directory, you can skip this step.
+
+Navigate to [Company branding in Azure Active Directory](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/LoginTenantBranding).
+
+>[!IMPORTANT]
+>Make sure to sign-in with a Global Administrator account.
+
+Click on **Configure** and configure any type of company branding you'd like to see during the OOBE.
+
+
+
+Once finished, click **Save**.
+
+>[!NOTE]
+>Changes to company branding can take up to 30 minutes to apply.
+
+
+## Configure Microsoft Intune auto-enrollment
+
+>[!IMPORTANT]
+>If you already have MDM auto-enrollment configured in Azure Active Directory, you can skip this step.
+
+Navigate to [Mobility (MDM and MAM) in Azure Active Directory](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Mobility) and select **Microsoft Intune**.
+
+For the purposes of this demo, select **All** under the **MDM user scope** and click **Save**.
+
+
+
+## Register your Virtual Machine to your organization
+
+Navigate to [Microsoft Store for Business device management](https://businessstore.microsoft.com/en-us/manage/devices). Click on **Add devices** and select the **AutoPilotHWID.csv** you've saved earlier. A message will appear indicating your request is being processed. Wait a few moments before refreshing to see your Virtual Machine added.
+
+
+
+## Create and assign a Windows AutoPilot deployment profile
+
+Navigate to [Windows enrollment in Microsoft Intune](https://portal.azure.com/#blade/Microsoft_Intune_Enrollment/OverviewBlade/windowsEnrollment).
+
+Make sure to sync the device you've just registered, by clicking on **Devices** under **Windows Autopilot Deployment Program (Preview)** and selecting **Sync**. Wait a few moments before refreshing to see your Virtual Machine added.
+
+
+
+### Create a Windows AutoPilot deployment profile
+
+Click on **Deployment profiles** under **Windows Autopilot Deployment Program (Preview)** and select **Create profile**.
+
+
+
+In the **Create profile** blade, set the name to **AutoPilot Intune Demo**, click on **Out-of-box experience (OOBE)** and configure the following:
+| Setting name | Value |
+|---|---|
+|Privacy Settings|Hide|
+|End user license agreement (EULA)|Hide|
+|User account type|Standard|
+
+Click on **Save** and **Create**.
+
+
+
+### Assign a Windows AutoPilot deployment profile
+
+With the deployment profile created, go back to **Devices** under **Windows Autopilot Deployment Program (Preview)** and select your Virtual Machine. Click on **Assign profile** and in the **Assign Profile** blade select **AutoPilot Intune Demo** under the **AutoPilot profile**. Click on **Assign**.
+
+
+
+Wait a few minutes for all changes to apply.
+
+## See Windows AutoPilot in action
+
+By now, your Virtual Machine should be back to OOBE. Make sure to wait at least 30 minutes from the time you've [configured company branding](#configure-company-branding)
+, otherwise those changes might not show up.
+
+Once you select a language and a keyboard layout, your company branded sign-in screen should appear. Provide your Azure Active Directory credentials and you're all done.
+
+
+
+Windows AutoPilot will now take over to automatically join your Virtual Machine into Azure Active Directory and enroll it to Microsoft Intune. Use the checkpoints you've created to go through this process again with different settings.
+
+Missing something in this topic? Windows 10 users, tell us what you want on [Feedback Hub](feedback-hub://?referrer=techDocsUcPage&tabid=2&contextid=897&newFeedback=true&topic=windows-10-autopilot-demo-vm.md).
\ No newline at end of file
diff --git a/windows/deployment/windows-10-auto-pilot.md b/windows/deployment/windows-autopilot/windows-10-autopilot.md
similarity index 77%
rename from windows/deployment/windows-10-auto-pilot.md
rename to windows/deployment/windows-autopilot/windows-10-autopilot.md
index a292123501..86055c3cf1 100644
--- a/windows/deployment/windows-10-auto-pilot.md
+++ b/windows/deployment/windows-autopilot/windows-10-autopilot.md
@@ -1,145 +1,131 @@
----
-title: Overview of Windows AutoPilot
-description: This topic goes over Windows AutoPilot and how it helps setup OOBE Windows 10 devices.
-keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.localizationpriority: high
-ms.sitesec: library
-ms.pagetype: deploy
-author: DaniHalfin
-ms.author: daniha
-ms.date: 11/30/2017
----
-
-# Overview of Windows AutoPilot
-
-**Applies to**
-
-- Windows 10
-
-Windows AutoPilot is a collection of technologies used to set up and pre-configure new devices, getting them ready for productive use. In addition, you can use Windows AutoPilot to reset, repurpose and recover devices.
-This solution enables an IT department to achieve the above with little to no infrastructure to manage, with a process that's easy and simple.
-
-## Benefits of Windows AutoPilot
-
-Traditionally, IT pros spend a lot of time on building and customizing images that will later be deployed to devices with a perfectly good OS already installed on them. Windows AutoPilot introduces a new approach.
-
-From the users' perspective, it only takes a few simple operations to make their device ready to use.
-
-From the IT pros' perspective, the only interaction required from the end user, is to connect to a network and to verify their credentials. Everything past that is automated.
-
-Windows AutoPilot allows you to:
-* Automatically join devices to Azure Active Directory (Azure AD)
-* Auto-enroll devices into MDM services, such as Microsoft Intune ([*Requires an Azure AD Premium subscription*](#prerequisites))
-* Restrict the Administrator account creation
-* Create and auto-assign devices to configuration groups based on a device's profile
-* Customize OOBE content specific to the organization
-
-### Prerequisites
-
-* [Devices must be registered to the organization](#registering-devices-to-your-organization)
-* [Company branding needs to be configured](#configure-company-branding-for-oobe)
-* [Network connectivity to cloud services used by Windows AutoPilot](#network-connectivity-requirements)
-* Devices have to be pre-installed with Windows 10 Professional, Enterprise or Education, of version 1703 or later
-* Devices must have access to the internet
-* [Azure AD Premium P1 or P2](https://www.microsoft.com/cloud-platform/azure-active-directory-features)
-* Microsoft Intune or other MDM services to manage your devices
-
-## Windows AutoPilot Scenarios
-
-### Cloud-Driven
-
-The Cloud-Driven scenario enables you to pre-register devices through the Windows AutoPilot Deployment Program. Your devices will be fully configured with no additional intervention required on the users' side.
-
-#### The Windows AutoPilot Deployment Program experience
-
-The end user unboxes and turns on a new device. What follows are a few simple configuration steps:
-* Select a language and keyboard layout
-* Connect to the network
-* Provide email address (the email address of the user's Azure AD account) and password
-
-Multiple additional settings are skipped here, since the device automatically recognizes that [it belongs to an organization](#registering-devices-to-your-organization). Following this process the device is joined to Azure AD, enrolled in Microsoft Intune (or any other MDM service).
-
-MDM enrollment ensures policies are applied, apps are installed and setting are configured on the device. Windows Update for Business applies the latest updates to ensure the device is up to date.
-
-
-
-
-#### Registering devices to your organization
-
-In order to register devices, you will need to acquire their hardware ID and register it. We are actively working with various hardware vendors to enable them to provide the required information to you, or upload it on your behalf.
-
-If you would like to capture that information by yourself, you can use the [Get-WindowsAutoPilotInfo PowerShell script](https://www.powershellgallery.com/packages/Get-WindowsAutoPilotInfo), which will generate a .csv file with the device's hardware ID.
-
->[!NOTE]
->This PowerShell script requires elevated permissions.
-
-By uploading this information to the Microsoft Store for Business or Partner Center admin portal, you'll be able to assign devices to your organization.
-Additional options and customization is available through these portals to pre-configure the devices.
-
-For information on how to upload device information, see [Microsoft Store for Business](https://docs.microsoft.com/microsoft-store/add-profile-to-devices#add-devices-and-apply-autopilot-deployment-profile) or [Partner Center](https://msdn.microsoft.com/partner-center/autopilot) guidance.
-
-#### OOBE customization
-
-Deployment profiles are used to configure the Out-Of-the-Box-Experience (OOBE) on devices deployed through the Windows AutoPilot Deployment Program.
-
-These are the OOBE customization options available for Windows 10, starting with version 1703:
-* Skipping Work or Home usage selection (*Automatic*)
-* Skipping OEM registration, OneDrive and Cortana (*Automatic*)
-* Skipping privacy settings
-* Skipping EULA (*staring with Windows 10, version 1709*)
-* Preventing the account used to set-up the device from getting local administrator permissions
-
-We are working to add additional options to further personalize and streamline the setup experience in future releases.
-
-To configure and apply deployment profiles, see guidance for the various available administration options:
-* [Microsoft Store for Business](https://docs.microsoft.com/microsoft-store/add-profile-to-devices#manage-autopilot-deployment-profiles)
-* [Microsoft Intune](https://docs.microsoft.com/intune/enrollment-autopilot)
-* [Microsoft 365 Business & Office 365 Admin](https://support.office.com/article/Create-and-edit-AutoPilot-profiles-5cf7139e-cfa1-4765-8aad-001af1c74faa)
-* [Partner Center](https://msdn.microsoft.com/partner-center/autopilot)
-
-##### Configure company branding for OOBE
-
-In order for your company branding to appear during the OOBE, you'll need to configure it in Azure Active Directory first.
-
-See [Add company branding to your directory](https://docs.microsoft.com/azure/active-directory/customize-branding#add-company-branding-to-your-directory), to configure these settings.
-
-#### Network connectivity requirements
-
-The Windows AutoPilot Deployment Program uses a number of cloud services to get your devices to a productive state. This means those services need to be accessible from devices registered as Windows Autopilot devices.
-
-To manage devices behind firewalls and proxy servers, the following URLs need to be accessible:
-
-* https://go.microsoft.com
-* https://login.microsoftonline.com
-* https://login.live.com
-* https://account.live.com
-* https://signup.live.com
-* https://licensing.mp.microsoft.com
-* https://licensing.md.mp.microsoft.com
-* ctldl.windowsupdate.com
-* download.windowsupdate.com
-
->[!NOTE]
->Where not explicitly specified, both HTTPS (443) and HTTP (80) need to be accessible.
-
->[!TIP]
->If you're auto-enrolling your devices into Microsoft Intune, or deploying Microsoft Office, make sure you follow the networking guidlines for [Microsoft Intune](https://docs.microsoft.com/en-us/intune/network-bandwidth-use#network-communication-requirements) and [Office 365](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2).
-
-### IT-Driven
-
-If you are planning to configure devices with traditional on-premises or cloud-based solutions, the [Windows Configuration Designer](https://www.microsoft.com/store/p/windows-configuration-designer/9nblggh4tx22) can be used to help automate the process. This is more suited to scenarios in which you require a higher level of control over the provisioning process. For more information on creating provisioning packages with Windows Configuration Designer, see [Create a provisioning package for Windows 10](/windows/configuration/provisioning-packages/provisioning-create-package).
-
-### Teacher-Driven
-
-If you're an IT pro or a technical staff member at a school, your scenario might be simpler. The [Set Up School PCs](http://www.microsoft.com/store/p/set-up-school-pcs/9nblggh4ls40) app can be used to quickly set up PCs for students and will get you to a productive state faster and simpler. Please see [Use the Set up School PCs app](https://docs.microsoft.com/education/windows/use-set-up-school-pcs-app) for all the details.
-
-## Ensuring your device can be auto-enrolled to MDM
-
-In order for your devices to be auto-enrolled into MDM management, MDM auto-enrollment needs to be configured in Azure AD. To do that with Intune, please see [Enroll Windows devices for Microsoft Intune](https://docs.microsoft.com/intune/windows-enroll). For other MDM vendors, please consult your vendor for further details.
-
->[!NOTE]
->MDM auto-enrollment requires an Azure AD Premium P1 or P2 subscription.
-
-Not finding content you need? Windows 10 users, tell us what you want on [Feedback Hub](feedback-hub://?referrer=techDocsUcPage&tabid=2&contextid=897&newFeedback=true&topic=windows-10-auto-pilot.md).
+---
+title: Overview of Windows AutoPilot
+description: This topic goes over Windows AutoPilot and how it helps setup OOBE Windows 10 devices.
+keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.localizationpriority: high
+ms.sitesec: library
+ms.pagetype: deploy
+author: DaniHalfin
+ms.author: daniha
+ms.date: 12/13/2017
+---
+
+# Overview of Windows AutoPilot
+
+**Applies to**
+
+- Windows 10
+
+Windows AutoPilot is a collection of technologies used to set up and pre-configure new devices, getting them ready for productive use. In addition, you can use Windows AutoPilot to reset, repurpose and recover devices.
+This solution enables an IT department to achieve the above with little to no infrastructure to manage, with a process that's easy and simple.
+
+## Benefits of Windows AutoPilot
+
+Traditionally, IT pros spend a lot of time on building and customizing images that will later be deployed to devices with a perfectly good OS already installed on them. Windows AutoPilot introduces a new approach.
+
+From the users' perspective, it only takes a few simple operations to make their device ready to use.
+
+From the IT pros' perspective, the only interaction required from the end user, is to connect to a network and to verify their credentials. Everything past that is automated.
+
+## Windows AutoPilot Scenarios
+
+### Cloud-Driven
+
+The Cloud-Driven scenario enables you to pre-register devices through the Windows AutoPilot Deployment Program. Your devices will be fully configured with no additional intervention required on the users' side.
+
+#### The Windows AutoPilot Deployment Program experience
+
+The Windows AutoPilot Deployment Program enables you to:
+* Automatically join devices to Azure Active Directory (Azure AD)
+* Auto-enroll devices into MDM services, such as Microsoft Intune ([*Requires an Azure AD Premium subscription*](#prerequisites))
+* Restrict the Administrator account creation
+* Create and auto-assign devices to configuration groups based on a device's profile
+* Customize OOBE content specific to the organization
+
+##### Prerequisites
+
+* [Devices must be registered to the organization](#device-registration-and-oobe-customization)
+* [Company branding needs to be configured](#configure-company-branding-for-oobe)
+* [Network connectivity to cloud services used by Windows AutoPilot](#network-connectivity-requirements)
+* Devices have to be pre-installed with Windows 10 Professional, Enterprise or Education, of version 1703 or later
+* Devices must have access to the internet
+* [Azure AD Premium P1 or P2](https://www.microsoft.com/cloud-platform/azure-active-directory-features)
+* [Users must be allowed to join devices into Azure AD](https://docs.microsoft.com/azure/active-directory/device-management-azure-portal)
+* Microsoft Intune or other MDM services to manage your devices
+
+The end-user unboxes and turns on a new device. What follows are a few simple configuration steps:
+* Select a language and keyboard layout
+* Connect to the network
+* Provide email address (the email address of the user's Azure AD account) and password
+
+Multiple additional settings are skipped here, since the device automatically recognizes that [it belongs to an organization](#registering-devices-to-your-organization). Following this process the device is joined to Azure AD, enrolled in Microsoft Intune (or any other MDM service).
+
+MDM enrollment ensures policies are applied, apps are installed and setting are configured on the device. Windows Update for Business applies the latest updates to ensure the device is up to date.
+
+
+
+
+#### Device registration and OOBE customization
+
+In order to register devices, you will need to acquire their hardware ID and register it. We are actively working with various hardware vendors to enable them to provide the required information to you, or upload it on your behalf.
+
+If you would like to capture that information by yourself, you can use the [Get-WindowsAutoPilotInfo PowerShell script](https://www.powershellgallery.com/packages/Get-WindowsAutoPilotInfo), which will generate a .csv file with the device's hardware ID.
+
+Once devices are registered, these are the OOBE customization options available for Windows 10, starting with version 1703:
+* Skipping Work or Home usage selection (*Automatic*)
+* Skipping OEM registration, OneDrive and Cortana (*Automatic*)
+* Skipping privacy settings
+* Skipping EULA (*starting with Windows 10, version 1709*)
+* Preventing the account used to set-up the device from getting local administrator permissions
+
+For guidance on how to register devices, configure and apply deployment profiles, follow one of the available administration options:
+* [Microsoft Store for Business](https://docs.microsoft.com/microsoft-store/add-profile-to-devices#manage-autopilot-deployment-profiles)
+* [Microsoft Intune](https://docs.microsoft.com/intune/enrollment-autopilot)
+* [Microsoft 365 Business & Office 365 Admin](https://support.office.com/article/Create-and-edit-AutoPilot-profiles-5cf7139e-cfa1-4765-8aad-001af1c74faa)
+* [Partner Center](https://msdn.microsoft.com/partner-center/autopilot)
+
+##### Configure company branding for OOBE
+
+In order for your company branding to appear during the OOBE, you'll need to configure it in Azure Active Directory first.
+
+See [Add company branding to your directory](https://docs.microsoft.com/azure/active-directory/customize-branding#add-company-branding-to-your-directory), to configure these settings.
+
+##### Configure MDM auto-enrollment in Microsoft Intune
+
+In order for your devices to be auto-enrolled into MDM management, MDM auto-enrollment needs to be configured in Azure AD. To do that with Microsoft Intune, please see [Enroll Windows devices for Microsoft Intune](https://docs.microsoft.com/intune/windows-enroll). For other MDM vendors, please consult your vendor for further details.
+
+>[!NOTE]
+>MDM auto-enrollment requires an Azure AD Premium P1 or P2 subscription.
+
+#### Network connectivity requirements
+
+The Windows AutoPilot Deployment Program uses a number of cloud services to get your devices to a productive state. This means those services need to be accessible from devices registered as Windows Autopilot devices.
+
+To manage devices behind firewalls and proxy servers, the following URLs need to be accessible:
+
+* https://go.microsoft.com
+* https://login.microsoftonline.com
+* https://login.live.com
+* https://account.live.com
+* https://signup.live.com
+* https://licensing.mp.microsoft.com
+* https://licensing.md.mp.microsoft.com
+* ctldl.windowsupdate.com
+* download.windowsupdate.com
+
+>[!NOTE]
+>Where not explicitly specified, both HTTPS (443) and HTTP (80) need to be accessible.
+
+>[!TIP]
+>If you're auto-enrolling your devices into Microsoft Intune, or deploying Microsoft Office, make sure you follow the networking guidlines for [Microsoft Intune](https://docs.microsoft.com/en-us/intune/network-bandwidth-use#network-communication-requirements) and [Office 365](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2).
+
+### IT-Driven
+
+If you are planning to configure devices with traditional on-premises or cloud-based solutions, the [Windows Configuration Designer](https://www.microsoft.com/store/p/windows-configuration-designer/9nblggh4tx22) can be used to help automate the process. This is more suited to scenarios in which you require a higher level of control over the provisioning process. For more information on creating provisioning packages with Windows Configuration Designer, see [Create a provisioning package for Windows 10](/windows/configuration/provisioning-packages/provisioning-create-package).
+
+### Teacher-Driven
+
+If you're an IT pro or a technical staff member at a school, your scenario might be simpler. The [Set Up School PCs](http://www.microsoft.com/store/p/set-up-school-pcs/9nblggh4ls40) app can be used to quickly set up PCs for students and will get you to a productive state faster and simpler. Please see [Use the Set up School PCs app](https://docs.microsoft.com/education/windows/use-set-up-school-pcs-app) for all the details.
+
diff --git a/windows/deployment/windows-deployment-scenarios-and-tools.md b/windows/deployment/windows-deployment-scenarios-and-tools.md
index 8290d3383d..6ac888a69b 100644
--- a/windows/deployment/windows-deployment-scenarios-and-tools.md
+++ b/windows/deployment/windows-deployment-scenarios-and-tools.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: mtniehaus
+ms.date: 07/12/2017
---
# Windows 10 deployment scenarios and tools
diff --git a/windows/device-security/TOC.md b/windows/device-security/TOC.md
index 13af847a45..5bfecea364 100644
--- a/windows/device-security/TOC.md
+++ b/windows/device-security/TOC.md
@@ -112,14 +112,14 @@
## [Control the health of Windows 10-based devices](protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md)
## [Device Guard deployment guide](device-guard/device-guard-deployment-guide.md)
-### [Introduction to Device Guard: virtualization-based security and code integrity policies](device-guard/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md)
+### [Introduction to Device Guard: virtualization-based security and WDAC](device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md)
### [Requirements and deployment planning guidelines for Device Guard](device-guard/requirements-and-deployment-planning-guidelines-for-device-guard.md)
### [Planning and getting started on the Device Guard deployment process](device-guard/planning-and-getting-started-on-the-device-guard-deployment-process.md)
-### [Deploy Device Guard: deploy code integrity policies](device-guard/deploy-device-guard-deploy-code-integrity-policies.md)
-#### [Optional: Create a code signing certificate for code integrity policies](device-guard/optional-create-a-code-signing-certificate-for-code-integrity-policies.md)
-#### [Deploy code integrity policies: policy rules and file rules](device-guard/deploy-code-integrity-policies-policy-rules-and-file-rules.md)
-#### [Deploy code integrity policies: steps](device-guard/deploy-code-integrity-policies-steps.md)
-#### [Deploy catalog files to support code integrity policies](device-guard/deploy-catalog-files-to-support-code-integrity-policies.md)
+### [Deploy WDAC](device-guard/deploy-windows-defender-application-control.md)
+#### [Optional: Create a code signing certificate for WDAC](device-guard/optional-create-a-code-signing-certificate-for-windows-defender-application-control.md)
+#### [Deploy WDAC: policy rules and file rules](device-guard/deploy-windows-defender-application-control-policy-rules-and-file-rules.md)
+#### [Steps to deploy WDAC](device-guard/steps-to-deploy-windows-defender-application-control.md)
+#### [Deploy catalog files to support WDAC](device-guard/deploy-catalog-files-to-support-windows-defender-application-control.md)
#### [Deploy Managed Installer for Device Guard](device-guard/deploy-managed-installer-for-device-guard.md)
### [Deploy Device Guard: enable virtualization-based security](device-guard/deploy-device-guard-enable-virtualization-based-security.md)
diff --git a/windows/device-security/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md b/windows/device-security/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md
index 9898cd57e6..cf8105dc69 100644
--- a/windows/device-security/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md
+++ b/windows/device-security/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Add rules for packaged apps to existing AppLocker rule-set
diff --git a/windows/device-security/applocker/administer-applocker.md b/windows/device-security/applocker/administer-applocker.md
index 327c091fee..4898c621a2 100644
--- a/windows/device-security/applocker/administer-applocker.md
+++ b/windows/device-security/applocker/administer-applocker.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Administer AppLocker
diff --git a/windows/device-security/applocker/applocker-architecture-and-components.md b/windows/device-security/applocker/applocker-architecture-and-components.md
index 1d788081eb..3544866752 100644
--- a/windows/device-security/applocker/applocker-architecture-and-components.md
+++ b/windows/device-security/applocker/applocker-architecture-and-components.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# AppLocker architecture and components
diff --git a/windows/device-security/applocker/applocker-functions.md b/windows/device-security/applocker/applocker-functions.md
index 1f4bac9193..9210e50905 100644
--- a/windows/device-security/applocker/applocker-functions.md
+++ b/windows/device-security/applocker/applocker-functions.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# AppLocker functions
diff --git a/windows/device-security/applocker/applocker-overview.md b/windows/device-security/applocker/applocker-overview.md
index aed33bd5c2..1af9eefb4c 100644
--- a/windows/device-security/applocker/applocker-overview.md
+++ b/windows/device-security/applocker/applocker-overview.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: high
author: brianlic-msft
+ms.date: 10/16/2017
---
# AppLocker
@@ -135,4 +136,3 @@ For reference in your security planning, the following table identifies the base
| [AppLocker deployment guide](applocker-policies-deployment-guide.md) | This topic for IT professionals introduces the concepts and describes the steps required to deploy AppLocker policies. |
| [AppLocker technical reference](applocker-technical-reference.md) | This overview topic for IT professionals provides links to the topics in the technical reference. |
-Not finding content you need? Windows 10 users, tell us what you want on [Feedback Hub](feedback-hub://?referrer=techDocsUcPage&tabid=2&contextid=897&newFeedback=true&topic=applocker-overview.md).
\ No newline at end of file
diff --git a/windows/device-security/applocker/applocker-policies-deployment-guide.md b/windows/device-security/applocker/applocker-policies-deployment-guide.md
index c229df7483..0687ca1fc2 100644
--- a/windows/device-security/applocker/applocker-policies-deployment-guide.md
+++ b/windows/device-security/applocker/applocker-policies-deployment-guide.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
diff --git a/windows/device-security/applocker/applocker-policies-design-guide.md b/windows/device-security/applocker/applocker-policies-design-guide.md
index afac5cb15b..b83c242b59 100644
--- a/windows/device-security/applocker/applocker-policies-design-guide.md
+++ b/windows/device-security/applocker/applocker-policies-design-guide.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# AppLocker design guide
diff --git a/windows/device-security/applocker/applocker-policy-use-scenarios.md b/windows/device-security/applocker/applocker-policy-use-scenarios.md
index 6c6e1335bb..09a77338da 100644
--- a/windows/device-security/applocker/applocker-policy-use-scenarios.md
+++ b/windows/device-security/applocker/applocker-policy-use-scenarios.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# AppLocker policy use scenarios
diff --git a/windows/device-security/applocker/applocker-processes-and-interactions.md b/windows/device-security/applocker/applocker-processes-and-interactions.md
index d19b4571b0..3089c59df8 100644
--- a/windows/device-security/applocker/applocker-processes-and-interactions.md
+++ b/windows/device-security/applocker/applocker-processes-and-interactions.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# AppLocker processes and interactions
diff --git a/windows/device-security/applocker/applocker-settings.md b/windows/device-security/applocker/applocker-settings.md
index 09db2282ac..5ba8623822 100644
--- a/windows/device-security/applocker/applocker-settings.md
+++ b/windows/device-security/applocker/applocker-settings.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# AppLocker settings
diff --git a/windows/device-security/applocker/applocker-technical-reference.md b/windows/device-security/applocker/applocker-technical-reference.md
index b5b962a6d7..dcc657973f 100644
--- a/windows/device-security/applocker/applocker-technical-reference.md
+++ b/windows/device-security/applocker/applocker-technical-reference.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# AppLocker technical reference
diff --git a/windows/device-security/applocker/configure-an-applocker-policy-for-audit-only.md b/windows/device-security/applocker/configure-an-applocker-policy-for-audit-only.md
index 03221fef8b..58bfcf7ebb 100644
--- a/windows/device-security/applocker/configure-an-applocker-policy-for-audit-only.md
+++ b/windows/device-security/applocker/configure-an-applocker-policy-for-audit-only.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Configure an AppLocker policy for audit only
diff --git a/windows/device-security/applocker/configure-an-applocker-policy-for-enforce-rules.md b/windows/device-security/applocker/configure-an-applocker-policy-for-enforce-rules.md
index b0c0d7c0ee..66187c838a 100644
--- a/windows/device-security/applocker/configure-an-applocker-policy-for-enforce-rules.md
+++ b/windows/device-security/applocker/configure-an-applocker-policy-for-enforce-rules.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Configure an AppLocker policy for enforce rules
diff --git a/windows/device-security/applocker/configure-exceptions-for-an-applocker-rule.md b/windows/device-security/applocker/configure-exceptions-for-an-applocker-rule.md
index f71b399f0b..a72ff3932a 100644
--- a/windows/device-security/applocker/configure-exceptions-for-an-applocker-rule.md
+++ b/windows/device-security/applocker/configure-exceptions-for-an-applocker-rule.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Add exceptions for an AppLocker rule
diff --git a/windows/device-security/applocker/configure-the-appLocker-reference-device.md b/windows/device-security/applocker/configure-the-appLocker-reference-device.md
index 61dbae6818..16266b4bae 100644
--- a/windows/device-security/applocker/configure-the-appLocker-reference-device.md
+++ b/windows/device-security/applocker/configure-the-appLocker-reference-device.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Configure the AppLocker reference device
diff --git a/windows/device-security/applocker/configure-the-application-identity-service.md b/windows/device-security/applocker/configure-the-application-identity-service.md
index 92fb37f9dd..73a7463d29 100644
--- a/windows/device-security/applocker/configure-the-application-identity-service.md
+++ b/windows/device-security/applocker/configure-the-application-identity-service.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: brianlic-msft
+ms.date: 09/21/2017
---
# Configure the Application Identity service
diff --git a/windows/device-security/applocker/create-a-rule-for-packaged-apps.md b/windows/device-security/applocker/create-a-rule-for-packaged-apps.md
index e2dfbd96a7..e40454320d 100644
--- a/windows/device-security/applocker/create-a-rule-for-packaged-apps.md
+++ b/windows/device-security/applocker/create-a-rule-for-packaged-apps.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Create a rule for packaged apps
diff --git a/windows/device-security/applocker/create-a-rule-that-uses-a-file-hash-condition.md b/windows/device-security/applocker/create-a-rule-that-uses-a-file-hash-condition.md
index a7249454f8..699a7c233a 100644
--- a/windows/device-security/applocker/create-a-rule-that-uses-a-file-hash-condition.md
+++ b/windows/device-security/applocker/create-a-rule-that-uses-a-file-hash-condition.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Create a rule that uses a file hash condition
diff --git a/windows/device-security/applocker/create-a-rule-that-uses-a-path-condition.md b/windows/device-security/applocker/create-a-rule-that-uses-a-path-condition.md
index 1c60d5de26..30344b2d69 100644
--- a/windows/device-security/applocker/create-a-rule-that-uses-a-path-condition.md
+++ b/windows/device-security/applocker/create-a-rule-that-uses-a-path-condition.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Create a rule that uses a path condition
diff --git a/windows/device-security/applocker/create-a-rule-that-uses-a-publisher-condition.md b/windows/device-security/applocker/create-a-rule-that-uses-a-publisher-condition.md
index a36f9277e4..77e783422f 100644
--- a/windows/device-security/applocker/create-a-rule-that-uses-a-publisher-condition.md
+++ b/windows/device-security/applocker/create-a-rule-that-uses-a-publisher-condition.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Create a rule that uses a publisher condition
diff --git a/windows/device-security/applocker/create-applocker-default-rules.md b/windows/device-security/applocker/create-applocker-default-rules.md
index c4a5905eee..55249cd6d8 100644
--- a/windows/device-security/applocker/create-applocker-default-rules.md
+++ b/windows/device-security/applocker/create-applocker-default-rules.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Create AppLocker default rules
diff --git a/windows/device-security/applocker/create-list-of-applications-deployed-to-each-business-group.md b/windows/device-security/applocker/create-list-of-applications-deployed-to-each-business-group.md
index 215c091908..58f90360cf 100644
--- a/windows/device-security/applocker/create-list-of-applications-deployed-to-each-business-group.md
+++ b/windows/device-security/applocker/create-list-of-applications-deployed-to-each-business-group.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Create a list of apps deployed to each business group
diff --git a/windows/device-security/applocker/create-your-applocker-planning-document.md b/windows/device-security/applocker/create-your-applocker-planning-document.md
index 43d92ab3a8..4f0f43ced7 100644
--- a/windows/device-security/applocker/create-your-applocker-planning-document.md
+++ b/windows/device-security/applocker/create-your-applocker-planning-document.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Create your AppLocker planning document
diff --git a/windows/device-security/applocker/create-your-applocker-policies.md b/windows/device-security/applocker/create-your-applocker-policies.md
index bea50a3693..1153bc66a2 100644
--- a/windows/device-security/applocker/create-your-applocker-policies.md
+++ b/windows/device-security/applocker/create-your-applocker-policies.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Create Your AppLocker policies
diff --git a/windows/device-security/applocker/create-your-applocker-rules.md b/windows/device-security/applocker/create-your-applocker-rules.md
index d7a36fa59b..b86eb4c12e 100644
--- a/windows/device-security/applocker/create-your-applocker-rules.md
+++ b/windows/device-security/applocker/create-your-applocker-rules.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Create Your AppLocker rules
diff --git a/windows/device-security/applocker/delete-an-applocker-rule.md b/windows/device-security/applocker/delete-an-applocker-rule.md
index e818e08680..ffbec0bb55 100644
--- a/windows/device-security/applocker/delete-an-applocker-rule.md
+++ b/windows/device-security/applocker/delete-an-applocker-rule.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Delete an AppLocker rule
diff --git a/windows/device-security/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting.md b/windows/device-security/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting.md
index 365a343e7a..0e6056ffe2 100644
--- a/windows/device-security/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting.md
+++ b/windows/device-security/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Deploy AppLocker policies by using the enforce rules setting
diff --git a/windows/device-security/applocker/deploy-the-applocker-policy-into-production.md b/windows/device-security/applocker/deploy-the-applocker-policy-into-production.md
index 576d4c610d..2df842862c 100644
--- a/windows/device-security/applocker/deploy-the-applocker-policy-into-production.md
+++ b/windows/device-security/applocker/deploy-the-applocker-policy-into-production.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Deploy the AppLocker policy into production
diff --git a/windows/device-security/applocker/determine-group-policy-structure-and-rule-enforcement.md b/windows/device-security/applocker/determine-group-policy-structure-and-rule-enforcement.md
index 9d33fcc296..34d351396b 100644
--- a/windows/device-security/applocker/determine-group-policy-structure-and-rule-enforcement.md
+++ b/windows/device-security/applocker/determine-group-policy-structure-and-rule-enforcement.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Determine the Group Policy structure and rule enforcement
diff --git a/windows/device-security/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer.md b/windows/device-security/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer.md
index a1b50fe0f8..65cb27bc2f 100644
--- a/windows/device-security/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer.md
+++ b/windows/device-security/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Determine which apps are digitally signed on a reference device
diff --git a/windows/device-security/applocker/determine-your-application-control-objectives.md b/windows/device-security/applocker/determine-your-application-control-objectives.md
index 90a1979777..a73fc8b1cd 100644
--- a/windows/device-security/applocker/determine-your-application-control-objectives.md
+++ b/windows/device-security/applocker/determine-your-application-control-objectives.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Determine your application control objectives
diff --git a/windows/device-security/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md b/windows/device-security/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md
index 3f2d01bceb..3e7efbb672 100644
--- a/windows/device-security/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md
+++ b/windows/device-security/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: brianlic-msft
+ms.date: 09/21/2017
---
# Display a custom URL message when users try to run a blocked app
diff --git a/windows/device-security/applocker/dll-rules-in-applocker.md b/windows/device-security/applocker/dll-rules-in-applocker.md
index 913e1d22ee..be67db5038 100644
--- a/windows/device-security/applocker/dll-rules-in-applocker.md
+++ b/windows/device-security/applocker/dll-rules-in-applocker.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# DLL rules in AppLocker
diff --git a/windows/device-security/applocker/document-group-policy-structure-and-applocker-rule-enforcement.md b/windows/device-security/applocker/document-group-policy-structure-and-applocker-rule-enforcement.md
index 3837b7f34e..3843a798c0 100644
--- a/windows/device-security/applocker/document-group-policy-structure-and-applocker-rule-enforcement.md
+++ b/windows/device-security/applocker/document-group-policy-structure-and-applocker-rule-enforcement.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
author: brianlic-msft
ms.pagetype: security
+ms.date: 09/21/2017
---
# Document the Group Policy structure and AppLocker rule enforcement
diff --git a/windows/device-security/applocker/document-your-application-control-management-processes.md b/windows/device-security/applocker/document-your-application-control-management-processes.md
index 30b683d9ff..a0b879a4c5 100644
--- a/windows/device-security/applocker/document-your-application-control-management-processes.md
+++ b/windows/device-security/applocker/document-your-application-control-management-processes.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Document your application control management processes
diff --git a/windows/device-security/applocker/document-your-application-list.md b/windows/device-security/applocker/document-your-application-list.md
index aef9a1f741..faeb7da296 100644
--- a/windows/device-security/applocker/document-your-application-list.md
+++ b/windows/device-security/applocker/document-your-application-list.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Document your app list
diff --git a/windows/device-security/applocker/document-your-applocker-rules.md b/windows/device-security/applocker/document-your-applocker-rules.md
index 2d3cc52b44..ffaaf96936 100644
--- a/windows/device-security/applocker/document-your-applocker-rules.md
+++ b/windows/device-security/applocker/document-your-applocker-rules.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Document your AppLocker rules
diff --git a/windows/device-security/applocker/edit-an-applocker-policy.md b/windows/device-security/applocker/edit-an-applocker-policy.md
index 2854dbeb1c..a09df7e857 100644
--- a/windows/device-security/applocker/edit-an-applocker-policy.md
+++ b/windows/device-security/applocker/edit-an-applocker-policy.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Edit an AppLocker policy
diff --git a/windows/device-security/applocker/edit-applocker-rules.md b/windows/device-security/applocker/edit-applocker-rules.md
index a121fc5b1f..5ade426b41 100644
--- a/windows/device-security/applocker/edit-applocker-rules.md
+++ b/windows/device-security/applocker/edit-applocker-rules.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Edit AppLocker rules
diff --git a/windows/device-security/applocker/enable-the-dll-rule-collection.md b/windows/device-security/applocker/enable-the-dll-rule-collection.md
index e322711136..5593a53034 100644
--- a/windows/device-security/applocker/enable-the-dll-rule-collection.md
+++ b/windows/device-security/applocker/enable-the-dll-rule-collection.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Enable the DLL rule collection
diff --git a/windows/device-security/applocker/enforce-applocker-rules.md b/windows/device-security/applocker/enforce-applocker-rules.md
index e79128491d..4fba782a8d 100644
--- a/windows/device-security/applocker/enforce-applocker-rules.md
+++ b/windows/device-security/applocker/enforce-applocker-rules.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Enforce AppLocker rules
diff --git a/windows/device-security/applocker/executable-rules-in-applocker.md b/windows/device-security/applocker/executable-rules-in-applocker.md
index 566d3c7e76..bac088407a 100644
--- a/windows/device-security/applocker/executable-rules-in-applocker.md
+++ b/windows/device-security/applocker/executable-rules-in-applocker.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Executable rules in AppLocker
diff --git a/windows/device-security/applocker/export-an-applocker-policy-from-a-gpo.md b/windows/device-security/applocker/export-an-applocker-policy-from-a-gpo.md
index a3ed1a08c2..b442b268b0 100644
--- a/windows/device-security/applocker/export-an-applocker-policy-from-a-gpo.md
+++ b/windows/device-security/applocker/export-an-applocker-policy-from-a-gpo.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Export an AppLocker policy from a GPO
diff --git a/windows/device-security/applocker/export-an-applocker-policy-to-an-xml-file.md b/windows/device-security/applocker/export-an-applocker-policy-to-an-xml-file.md
index 13b496fe45..d4fdf2d40e 100644
--- a/windows/device-security/applocker/export-an-applocker-policy-to-an-xml-file.md
+++ b/windows/device-security/applocker/export-an-applocker-policy-to-an-xml-file.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Export an AppLocker policy to an XML file
diff --git a/windows/device-security/applocker/how-applocker-works-techref.md b/windows/device-security/applocker/how-applocker-works-techref.md
index 3de55c8243..da6e9d1a9c 100644
--- a/windows/device-security/applocker/how-applocker-works-techref.md
+++ b/windows/device-security/applocker/how-applocker-works-techref.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# How AppLocker works
diff --git a/windows/device-security/applocker/import-an-applocker-policy-from-another-computer.md b/windows/device-security/applocker/import-an-applocker-policy-from-another-computer.md
index 2d1b3617ef..2ffbc23507 100644
--- a/windows/device-security/applocker/import-an-applocker-policy-from-another-computer.md
+++ b/windows/device-security/applocker/import-an-applocker-policy-from-another-computer.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Import an AppLocker policy from another computer
diff --git a/windows/device-security/applocker/import-an-applocker-policy-into-a-gpo.md b/windows/device-security/applocker/import-an-applocker-policy-into-a-gpo.md
index f3d0a7dc0c..f3bef329a4 100644
--- a/windows/device-security/applocker/import-an-applocker-policy-into-a-gpo.md
+++ b/windows/device-security/applocker/import-an-applocker-policy-into-a-gpo.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Import an AppLocker policy into a GPO
diff --git a/windows/device-security/applocker/maintain-applocker-policies.md b/windows/device-security/applocker/maintain-applocker-policies.md
index f35b3a4551..7142e3a68e 100644
--- a/windows/device-security/applocker/maintain-applocker-policies.md
+++ b/windows/device-security/applocker/maintain-applocker-policies.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Maintain AppLocker policies
diff --git a/windows/device-security/applocker/manage-packaged-apps-with-applocker.md b/windows/device-security/applocker/manage-packaged-apps-with-applocker.md
index b56ac2b7d7..3522e95463 100644
--- a/windows/device-security/applocker/manage-packaged-apps-with-applocker.md
+++ b/windows/device-security/applocker/manage-packaged-apps-with-applocker.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Manage packaged apps with AppLocker
diff --git a/windows/device-security/applocker/merge-applocker-policies-by-using-set-applockerpolicy.md b/windows/device-security/applocker/merge-applocker-policies-by-using-set-applockerpolicy.md
index 9fb22206f3..62d120be4b 100644
--- a/windows/device-security/applocker/merge-applocker-policies-by-using-set-applockerpolicy.md
+++ b/windows/device-security/applocker/merge-applocker-policies-by-using-set-applockerpolicy.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Merge AppLocker policies by using Set-ApplockerPolicy
diff --git a/windows/device-security/applocker/merge-applocker-policies-manually.md b/windows/device-security/applocker/merge-applocker-policies-manually.md
index da3bd37a55..9becb2ec65 100644
--- a/windows/device-security/applocker/merge-applocker-policies-manually.md
+++ b/windows/device-security/applocker/merge-applocker-policies-manually.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Merge AppLocker policies manually
diff --git a/windows/device-security/applocker/monitor-application-usage-with-applocker.md b/windows/device-security/applocker/monitor-application-usage-with-applocker.md
index 3460b00c1d..23c4b6e8af 100644
--- a/windows/device-security/applocker/monitor-application-usage-with-applocker.md
+++ b/windows/device-security/applocker/monitor-application-usage-with-applocker.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Monitor app usage with AppLocker
diff --git a/windows/device-security/applocker/optimize-applocker-performance.md b/windows/device-security/applocker/optimize-applocker-performance.md
index efb9e9f766..a9c80b2eac 100644
--- a/windows/device-security/applocker/optimize-applocker-performance.md
+++ b/windows/device-security/applocker/optimize-applocker-performance.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Optimize AppLocker performance
diff --git a/windows/device-security/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker.md b/windows/device-security/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker.md
index 18f3f6fa64..685667b11c 100644
--- a/windows/device-security/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker.md
+++ b/windows/device-security/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 10/13/2017
---
# Packaged apps and packaged app installer rules in AppLocker
diff --git a/windows/device-security/applocker/plan-for-applocker-policy-management.md b/windows/device-security/applocker/plan-for-applocker-policy-management.md
index c1a3752333..fa323ebe0a 100644
--- a/windows/device-security/applocker/plan-for-applocker-policy-management.md
+++ b/windows/device-security/applocker/plan-for-applocker-policy-management.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Plan for AppLocker policy management
diff --git a/windows/device-security/applocker/refresh-an-applocker-policy.md b/windows/device-security/applocker/refresh-an-applocker-policy.md
index e654e73a1b..6812987ac1 100644
--- a/windows/device-security/applocker/refresh-an-applocker-policy.md
+++ b/windows/device-security/applocker/refresh-an-applocker-policy.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Refresh an AppLocker policy
diff --git a/windows/device-security/applocker/requirements-for-deploying-applocker-policies.md b/windows/device-security/applocker/requirements-for-deploying-applocker-policies.md
index e8e021aab1..7d0bc2af2c 100644
--- a/windows/device-security/applocker/requirements-for-deploying-applocker-policies.md
+++ b/windows/device-security/applocker/requirements-for-deploying-applocker-policies.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Requirements for deploying AppLocker policies
diff --git a/windows/device-security/applocker/requirements-to-use-applocker.md b/windows/device-security/applocker/requirements-to-use-applocker.md
index a4114f89bb..96c05fcdee 100644
--- a/windows/device-security/applocker/requirements-to-use-applocker.md
+++ b/windows/device-security/applocker/requirements-to-use-applocker.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: high
author: brianlic-msft
+ms.date: 09/21/2017
---
# Requirements to use AppLocker
@@ -36,9 +37,10 @@ The following table show the on which operating systems AppLocker features are s
| - | - | - | - | - |
| Windows 10| Yes| Yes| Packaged apps Executable Windows Installer Script DLL| You can use the [AppLocker CSP](http://msdn.microsoft.com/library/windows/hardware/dn920019.aspx) to configure AppLocker policies on any edition of Windows 10. You can only manage AppLocker with Group Policy on devices running Windows 10 Enterprise, Windows 10 Education, and Windows Server 2016. |
| Windows Server 2016 Windows Server 2012 R2 Windows Server 2012| Yes| Yes| Packaged apps Executable Windows Installer Script DLL| |
-| Windows 8.1| Yes| Yes| Packaged apps Executable Windows Installer Script DLL| Only the Enterprise edition supports AppLocker|
+| Windows 8.1 Pro| Yes| No| N/A||
+| Windows 8.1 Enterprise| Yes| Yes| Packaged apps Executable Windows Installer Script DLL| |
| Windows RT 8.1| No| No| N/A||
-| Windows 8 Pro| No| No| N/A||
+| Windows 8 Pro| Yes| No| N/A||
| Windows 8 Enterprise| Yes| Yes| Packaged apps Executable Windows Installer Script DLL||
| Windows RT| No| No| N/A| |
| Windows Server 2008 R2 Standard| Yes| Yes| Executable Windows Installer Script DLL| Packaged app rules will not be enforced.|
diff --git a/windows/device-security/applocker/run-the-automatically-generate-rules-wizard.md b/windows/device-security/applocker/run-the-automatically-generate-rules-wizard.md
index e75cea6f95..39ac2f8cc8 100644
--- a/windows/device-security/applocker/run-the-automatically-generate-rules-wizard.md
+++ b/windows/device-security/applocker/run-the-automatically-generate-rules-wizard.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Run the Automatically Generate Rules wizard
diff --git a/windows/device-security/applocker/script-rules-in-applocker.md b/windows/device-security/applocker/script-rules-in-applocker.md
index f3f8717563..d31c811eb4 100644
--- a/windows/device-security/applocker/script-rules-in-applocker.md
+++ b/windows/device-security/applocker/script-rules-in-applocker.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Script rules in AppLocker
diff --git a/windows/device-security/applocker/security-considerations-for-applocker.md b/windows/device-security/applocker/security-considerations-for-applocker.md
index e8648d0354..a1189105f5 100644
--- a/windows/device-security/applocker/security-considerations-for-applocker.md
+++ b/windows/device-security/applocker/security-considerations-for-applocker.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Security considerations for AppLocker
diff --git a/windows/device-security/applocker/select-types-of-rules-to-create.md b/windows/device-security/applocker/select-types-of-rules-to-create.md
index 01004b57ab..0590a63b72 100644
--- a/windows/device-security/applocker/select-types-of-rules-to-create.md
+++ b/windows/device-security/applocker/select-types-of-rules-to-create.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Select the types of rules to create
diff --git a/windows/device-security/applocker/test-an-applocker-policy-by-using-test-applockerpolicy.md b/windows/device-security/applocker/test-an-applocker-policy-by-using-test-applockerpolicy.md
index 207597f3b2..6c210aa053 100644
--- a/windows/device-security/applocker/test-an-applocker-policy-by-using-test-applockerpolicy.md
+++ b/windows/device-security/applocker/test-an-applocker-policy-by-using-test-applockerpolicy.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Test an AppLocker policy by using Test-AppLockerPolicy
diff --git a/windows/device-security/applocker/test-and-update-an-applocker-policy.md b/windows/device-security/applocker/test-and-update-an-applocker-policy.md
index 4c0cfb3d2f..ec71166da6 100644
--- a/windows/device-security/applocker/test-and-update-an-applocker-policy.md
+++ b/windows/device-security/applocker/test-and-update-an-applocker-policy.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Test and update an AppLocker policy
diff --git a/windows/device-security/applocker/tools-to-use-with-applocker.md b/windows/device-security/applocker/tools-to-use-with-applocker.md
index 41f6908931..fe25d088f2 100644
--- a/windows/device-security/applocker/tools-to-use-with-applocker.md
+++ b/windows/device-security/applocker/tools-to-use-with-applocker.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Tools to use with AppLocker
diff --git a/windows/device-security/applocker/understand-applocker-enforcement-settings.md b/windows/device-security/applocker/understand-applocker-enforcement-settings.md
index c5552f0544..009f8a35ab 100644
--- a/windows/device-security/applocker/understand-applocker-enforcement-settings.md
+++ b/windows/device-security/applocker/understand-applocker-enforcement-settings.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Understand AppLocker enforcement settings
diff --git a/windows/device-security/applocker/understand-applocker-policy-design-decisions.md b/windows/device-security/applocker/understand-applocker-policy-design-decisions.md
index 815d29dbd1..5655cb2189 100644
--- a/windows/device-security/applocker/understand-applocker-policy-design-decisions.md
+++ b/windows/device-security/applocker/understand-applocker-policy-design-decisions.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 10/13/2017
---
# Understand AppLocker policy design decisions
diff --git a/windows/device-security/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md b/windows/device-security/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md
index 76be28c269..8c9da9bfcd 100644
--- a/windows/device-security/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md
+++ b/windows/device-security/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Understand AppLocker rules and enforcement setting inheritance in Group Policy
diff --git a/windows/device-security/applocker/understand-the-applocker-policy-deployment-process.md b/windows/device-security/applocker/understand-the-applocker-policy-deployment-process.md
index ba135fa083..07a4161fda 100644
--- a/windows/device-security/applocker/understand-the-applocker-policy-deployment-process.md
+++ b/windows/device-security/applocker/understand-the-applocker-policy-deployment-process.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Understand the AppLocker policy deployment process
diff --git a/windows/device-security/applocker/understanding-applocker-allow-and-deny-actions-on-rules.md b/windows/device-security/applocker/understanding-applocker-allow-and-deny-actions-on-rules.md
index cab8554448..b216fa6fa5 100644
--- a/windows/device-security/applocker/understanding-applocker-allow-and-deny-actions-on-rules.md
+++ b/windows/device-security/applocker/understanding-applocker-allow-and-deny-actions-on-rules.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Understanding AppLocker allow and deny actions on rules
diff --git a/windows/device-security/applocker/understanding-applocker-default-rules.md b/windows/device-security/applocker/understanding-applocker-default-rules.md
index 506b5b73f2..7b9bbb1637 100644
--- a/windows/device-security/applocker/understanding-applocker-default-rules.md
+++ b/windows/device-security/applocker/understanding-applocker-default-rules.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Understanding AppLocker default rules
diff --git a/windows/device-security/applocker/understanding-applocker-rule-behavior.md b/windows/device-security/applocker/understanding-applocker-rule-behavior.md
index c2b0777b71..4ec88b21fc 100644
--- a/windows/device-security/applocker/understanding-applocker-rule-behavior.md
+++ b/windows/device-security/applocker/understanding-applocker-rule-behavior.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Understanding AppLocker rule behavior
diff --git a/windows/device-security/applocker/understanding-applocker-rule-collections.md b/windows/device-security/applocker/understanding-applocker-rule-collections.md
index 04b78ce9ba..7e6d3a3a64 100644
--- a/windows/device-security/applocker/understanding-applocker-rule-collections.md
+++ b/windows/device-security/applocker/understanding-applocker-rule-collections.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Understanding AppLocker rule collections
diff --git a/windows/device-security/applocker/understanding-applocker-rule-condition-types.md b/windows/device-security/applocker/understanding-applocker-rule-condition-types.md
index e96ad95beb..e2a66c497c 100644
--- a/windows/device-security/applocker/understanding-applocker-rule-condition-types.md
+++ b/windows/device-security/applocker/understanding-applocker-rule-condition-types.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Understanding AppLocker rule condition types
diff --git a/windows/device-security/applocker/understanding-applocker-rule-exceptions.md b/windows/device-security/applocker/understanding-applocker-rule-exceptions.md
index 0020f81022..c7817633da 100644
--- a/windows/device-security/applocker/understanding-applocker-rule-exceptions.md
+++ b/windows/device-security/applocker/understanding-applocker-rule-exceptions.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Understanding AppLocker rule exceptions
@@ -19,7 +20,9 @@ This topic describes the result of applying AppLocker rule exceptions to rule co
You can apply AppLocker rules to individual users or a group of users. If you apply a rule to a group of users, all users in that group are affected by that rule. If you need to allow a subset of a user group to use an app, you can create a special rule for that subset.
-For example, the rule "Allow Everyone to run Windows except Registry Editor" allows everyone in the organization to run Windows but does not allow anyone to run Registry Editor. The effect of this rule would prevent users such as help desk personnel from running a program that is necessary for their support tasks. To resolve this problem, create a second rule that applies to the Helpdesk user group: "Allow Helpdesk to run Registry Editor." If you create a deny rule that does not allow any users to run Registry Editor, the deny rule will override the second rule that allows the Helpdesk user group to run Registry Editor.
+For example, the rule "Allow Everyone to run Windows except Registry Editor" allows Everyone to run Windows binaries, but does not allow anyone to run Registry Editor (by adding %WINDIR%\regedit.exe as a Path Exception of the rule).
+The effect of this rule would prevent users such as Helpdesk personnel from running the Registry Editor, a program that is necessary for their support tasks.
+To resolve this problem, create a second rule that applies to the Helpdesk user group: "Allow Helpdesk to run Registry Editor" and add %WINDIR%\regedit.exe as an allowed path. If you create a deny rule that does not allow any users to run Registry Editor, the deny rule will override the second rule that allows the Helpdesk user group to run Registry Editor.
## Related topics
diff --git a/windows/device-security/applocker/understanding-the-file-hash-rule-condition-in-applocker.md b/windows/device-security/applocker/understanding-the-file-hash-rule-condition-in-applocker.md
index 2eacfe3d74..31ac2a2881 100644
--- a/windows/device-security/applocker/understanding-the-file-hash-rule-condition-in-applocker.md
+++ b/windows/device-security/applocker/understanding-the-file-hash-rule-condition-in-applocker.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Understanding the file hash rule condition in AppLocker
diff --git a/windows/device-security/applocker/understanding-the-path-rule-condition-in-applocker.md b/windows/device-security/applocker/understanding-the-path-rule-condition-in-applocker.md
index a8e2676908..1b711c83d1 100644
--- a/windows/device-security/applocker/understanding-the-path-rule-condition-in-applocker.md
+++ b/windows/device-security/applocker/understanding-the-path-rule-condition-in-applocker.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Understanding the path rule condition in AppLocker
diff --git a/windows/device-security/applocker/understanding-the-publisher-rule-condition-in-applocker.md b/windows/device-security/applocker/understanding-the-publisher-rule-condition-in-applocker.md
index 8cbf42f94e..b584cf1375 100644
--- a/windows/device-security/applocker/understanding-the-publisher-rule-condition-in-applocker.md
+++ b/windows/device-security/applocker/understanding-the-publisher-rule-condition-in-applocker.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Understanding the publisher rule condition in AppLocker
diff --git a/windows/device-security/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md b/windows/device-security/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md
index 38f498aaaa..0f8cc64fbc 100644
--- a/windows/device-security/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md
+++ b/windows/device-security/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md
@@ -8,6 +8,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Use a reference device to create and maintain AppLocker policies
diff --git a/windows/device-security/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain.md b/windows/device-security/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain.md
index aae35f5e9c..71bfcb91e5 100644
--- a/windows/device-security/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain.md
+++ b/windows/device-security/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Use AppLocker and Software Restriction Policies in the same domain
diff --git a/windows/device-security/applocker/use-the-applocker-windows-powershell-cmdlets.md b/windows/device-security/applocker/use-the-applocker-windows-powershell-cmdlets.md
index 4bdbfc5015..30a919b546 100644
--- a/windows/device-security/applocker/use-the-applocker-windows-powershell-cmdlets.md
+++ b/windows/device-security/applocker/use-the-applocker-windows-powershell-cmdlets.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Use the AppLocker Windows PowerShell cmdlets
diff --git a/windows/device-security/applocker/using-event-viewer-with-applocker.md b/windows/device-security/applocker/using-event-viewer-with-applocker.md
index cfd2f5dd66..19b0fe1159 100644
--- a/windows/device-security/applocker/using-event-viewer-with-applocker.md
+++ b/windows/device-security/applocker/using-event-viewer-with-applocker.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Using Event Viewer with AppLocker
diff --git a/windows/device-security/applocker/using-software-restriction-policies-and-applocker-policies.md b/windows/device-security/applocker/using-software-restriction-policies-and-applocker-policies.md
index c080b99c1f..09a6f698ed 100644
--- a/windows/device-security/applocker/using-software-restriction-policies-and-applocker-policies.md
+++ b/windows/device-security/applocker/using-software-restriction-policies-and-applocker-policies.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Use Software Restriction Policies and AppLocker policies
diff --git a/windows/device-security/applocker/what-is-applocker.md b/windows/device-security/applocker/what-is-applocker.md
index 6fe751c8cb..3f65a1e334 100644
--- a/windows/device-security/applocker/what-is-applocker.md
+++ b/windows/device-security/applocker/what-is-applocker.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# What Is AppLocker?
diff --git a/windows/device-security/applocker/windows-installer-rules-in-applocker.md b/windows/device-security/applocker/windows-installer-rules-in-applocker.md
index 550fac37bc..544b30162f 100644
--- a/windows/device-security/applocker/windows-installer-rules-in-applocker.md
+++ b/windows/device-security/applocker/windows-installer-rules-in-applocker.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Windows Installer rules in AppLocker
diff --git a/windows/device-security/applocker/working-with-applocker-policies.md b/windows/device-security/applocker/working-with-applocker-policies.md
index 9932ebcb85..2c487d8854 100644
--- a/windows/device-security/applocker/working-with-applocker-policies.md
+++ b/windows/device-security/applocker/working-with-applocker-policies.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Working with AppLocker policies
diff --git a/windows/device-security/applocker/working-with-applocker-rules.md b/windows/device-security/applocker/working-with-applocker-rules.md
index 38fb27d6e8..4cb0d0390a 100644
--- a/windows/device-security/applocker/working-with-applocker-rules.md
+++ b/windows/device-security/applocker/working-with-applocker-rules.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/21/2017
---
# Working with AppLocker rules
diff --git a/windows/device-security/auditing/advanced-security-audit-policy-settings.md b/windows/device-security/auditing/advanced-security-audit-policy-settings.md
index dd4bf9d8d5..b45cf1d6fb 100644
--- a/windows/device-security/auditing/advanced-security-audit-policy-settings.md
+++ b/windows/device-security/auditing/advanced-security-audit-policy-settings.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Advanced security audit policy settings
diff --git a/windows/device-security/auditing/advanced-security-auditing-faq.md b/windows/device-security/auditing/advanced-security-auditing-faq.md
index 9ccd526c9d..68c258302e 100644
--- a/windows/device-security/auditing/advanced-security-auditing-faq.md
+++ b/windows/device-security/auditing/advanced-security-auditing-faq.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Advanced security auditing FAQ
diff --git a/windows/device-security/auditing/advanced-security-auditing.md b/windows/device-security/auditing/advanced-security-auditing.md
index bdec74db1c..d1512606c8 100644
--- a/windows/device-security/auditing/advanced-security-auditing.md
+++ b/windows/device-security/auditing/advanced-security-auditing.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Advanced security audit policies
diff --git a/windows/device-security/auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events.md b/windows/device-security/auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events.md
index 736833b790..9c98ed3fe1 100644
--- a/windows/device-security/auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events.md
+++ b/windows/device-security/auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Appendix A: Security monitoring recommendations for many audit events
diff --git a/windows/device-security/auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md b/windows/device-security/auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md
index fd5dcf7155..4e87f11954 100644
--- a/windows/device-security/auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md
+++ b/windows/device-security/auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Apply a basic audit policy on a file or folder
diff --git a/windows/device-security/auditing/audit-account-lockout.md b/windows/device-security/auditing/audit-account-lockout.md
index 5aa153c7ac..3683fa438c 100644
--- a/windows/device-security/auditing/audit-account-lockout.md
+++ b/windows/device-security/auditing/audit-account-lockout.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit Account Lockout
diff --git a/windows/device-security/auditing/audit-application-generated.md b/windows/device-security/auditing/audit-application-generated.md
index fa461c2535..cd1ac383af 100644
--- a/windows/device-security/auditing/audit-application-generated.md
+++ b/windows/device-security/auditing/audit-application-generated.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit Application Generated
diff --git a/windows/device-security/auditing/audit-application-group-management.md b/windows/device-security/auditing/audit-application-group-management.md
index 7991c5a92d..3a2fc3505b 100644
--- a/windows/device-security/auditing/audit-application-group-management.md
+++ b/windows/device-security/auditing/audit-application-group-management.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit Application Group Management
diff --git a/windows/device-security/auditing/audit-audit-policy-change.md b/windows/device-security/auditing/audit-audit-policy-change.md
index 3baaef2ff0..b0735ee0ca 100644
--- a/windows/device-security/auditing/audit-audit-policy-change.md
+++ b/windows/device-security/auditing/audit-audit-policy-change.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit Audit Policy Change
diff --git a/windows/device-security/auditing/audit-authentication-policy-change.md b/windows/device-security/auditing/audit-authentication-policy-change.md
index 3096a5187c..6046ee0176 100644
--- a/windows/device-security/auditing/audit-authentication-policy-change.md
+++ b/windows/device-security/auditing/audit-authentication-policy-change.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit Authentication Policy Change
diff --git a/windows/device-security/auditing/audit-authorization-policy-change.md b/windows/device-security/auditing/audit-authorization-policy-change.md
index 665bdbe166..5641c9c572 100644
--- a/windows/device-security/auditing/audit-authorization-policy-change.md
+++ b/windows/device-security/auditing/audit-authorization-policy-change.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit Authorization Policy Change
diff --git a/windows/device-security/auditing/audit-central-access-policy-staging.md b/windows/device-security/auditing/audit-central-access-policy-staging.md
index d2c7077220..024a2259ca 100644
--- a/windows/device-security/auditing/audit-central-access-policy-staging.md
+++ b/windows/device-security/auditing/audit-central-access-policy-staging.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit Central Access Policy Staging
diff --git a/windows/device-security/auditing/audit-certification-services.md b/windows/device-security/auditing/audit-certification-services.md
index c41330e98c..9b92554529 100644
--- a/windows/device-security/auditing/audit-certification-services.md
+++ b/windows/device-security/auditing/audit-certification-services.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit Certification Services
diff --git a/windows/device-security/auditing/audit-computer-account-management.md b/windows/device-security/auditing/audit-computer-account-management.md
index c127ebd500..62a01d3e22 100644
--- a/windows/device-security/auditing/audit-computer-account-management.md
+++ b/windows/device-security/auditing/audit-computer-account-management.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit Computer Account Management
diff --git a/windows/device-security/auditing/audit-credential-validation.md b/windows/device-security/auditing/audit-credential-validation.md
index a6e23ecd47..95709c4776 100644
--- a/windows/device-security/auditing/audit-credential-validation.md
+++ b/windows/device-security/auditing/audit-credential-validation.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit Credential Validation
diff --git a/windows/device-security/auditing/audit-detailed-directory-service-replication.md b/windows/device-security/auditing/audit-detailed-directory-service-replication.md
index 19aef271fa..ffc71c1158 100644
--- a/windows/device-security/auditing/audit-detailed-directory-service-replication.md
+++ b/windows/device-security/auditing/audit-detailed-directory-service-replication.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit Detailed Directory Service Replication
diff --git a/windows/device-security/auditing/audit-detailed-file-share.md b/windows/device-security/auditing/audit-detailed-file-share.md
index 436399addb..72734d1a85 100644
--- a/windows/device-security/auditing/audit-detailed-file-share.md
+++ b/windows/device-security/auditing/audit-detailed-file-share.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit Detailed File Share
diff --git a/windows/device-security/auditing/audit-directory-service-access.md b/windows/device-security/auditing/audit-directory-service-access.md
index 039b10f684..e30c56fdb8 100644
--- a/windows/device-security/auditing/audit-directory-service-access.md
+++ b/windows/device-security/auditing/audit-directory-service-access.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit Directory Service Access
diff --git a/windows/device-security/auditing/audit-directory-service-changes.md b/windows/device-security/auditing/audit-directory-service-changes.md
index 67d519f452..c454d36c11 100644
--- a/windows/device-security/auditing/audit-directory-service-changes.md
+++ b/windows/device-security/auditing/audit-directory-service-changes.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit Directory Service Changes
diff --git a/windows/device-security/auditing/audit-directory-service-replication.md b/windows/device-security/auditing/audit-directory-service-replication.md
index de877d1d2d..db82ae0c8d 100644
--- a/windows/device-security/auditing/audit-directory-service-replication.md
+++ b/windows/device-security/auditing/audit-directory-service-replication.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit Directory Service Replication
diff --git a/windows/device-security/auditing/audit-distribution-group-management.md b/windows/device-security/auditing/audit-distribution-group-management.md
index b140fd81cc..82e9d57a4e 100644
--- a/windows/device-security/auditing/audit-distribution-group-management.md
+++ b/windows/device-security/auditing/audit-distribution-group-management.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit Distribution Group Management
diff --git a/windows/device-security/auditing/audit-dpapi-activity.md b/windows/device-security/auditing/audit-dpapi-activity.md
index a17a929770..9b19a0afa1 100644
--- a/windows/device-security/auditing/audit-dpapi-activity.md
+++ b/windows/device-security/auditing/audit-dpapi-activity.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit DPAPI Activity
diff --git a/windows/device-security/auditing/audit-file-share.md b/windows/device-security/auditing/audit-file-share.md
index 05c490cf67..caf010e6a3 100644
--- a/windows/device-security/auditing/audit-file-share.md
+++ b/windows/device-security/auditing/audit-file-share.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit File Share
diff --git a/windows/device-security/auditing/audit-file-system.md b/windows/device-security/auditing/audit-file-system.md
index ea941fc892..c7b96db83b 100644
--- a/windows/device-security/auditing/audit-file-system.md
+++ b/windows/device-security/auditing/audit-file-system.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit File System
diff --git a/windows/device-security/auditing/audit-filtering-platform-connection.md b/windows/device-security/auditing/audit-filtering-platform-connection.md
index 96d8bbd8c3..ea50e9d98c 100644
--- a/windows/device-security/auditing/audit-filtering-platform-connection.md
+++ b/windows/device-security/auditing/audit-filtering-platform-connection.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit Filtering Platform Connection
diff --git a/windows/device-security/auditing/audit-filtering-platform-packet-drop.md b/windows/device-security/auditing/audit-filtering-platform-packet-drop.md
index 093fd674de..56eb441cdd 100644
--- a/windows/device-security/auditing/audit-filtering-platform-packet-drop.md
+++ b/windows/device-security/auditing/audit-filtering-platform-packet-drop.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit Filtering Platform Packet Drop
diff --git a/windows/device-security/auditing/audit-filtering-platform-policy-change.md b/windows/device-security/auditing/audit-filtering-platform-policy-change.md
index ec8d3374dd..f56147cb4c 100644
--- a/windows/device-security/auditing/audit-filtering-platform-policy-change.md
+++ b/windows/device-security/auditing/audit-filtering-platform-policy-change.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit Filtering Platform Policy Change
diff --git a/windows/device-security/auditing/audit-group-membership.md b/windows/device-security/auditing/audit-group-membership.md
index f3424483bb..d35bf2344b 100644
--- a/windows/device-security/auditing/audit-group-membership.md
+++ b/windows/device-security/auditing/audit-group-membership.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit Group Membership
diff --git a/windows/device-security/auditing/audit-handle-manipulation.md b/windows/device-security/auditing/audit-handle-manipulation.md
index c1a20800e5..a6c151bdfa 100644
--- a/windows/device-security/auditing/audit-handle-manipulation.md
+++ b/windows/device-security/auditing/audit-handle-manipulation.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit Handle Manipulation
diff --git a/windows/device-security/auditing/audit-ipsec-driver.md b/windows/device-security/auditing/audit-ipsec-driver.md
index 628d86b063..698d063e78 100644
--- a/windows/device-security/auditing/audit-ipsec-driver.md
+++ b/windows/device-security/auditing/audit-ipsec-driver.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit IPsec Driver
diff --git a/windows/device-security/auditing/audit-ipsec-extended-mode.md b/windows/device-security/auditing/audit-ipsec-extended-mode.md
index 83cc51ddc1..40cec9f6a3 100644
--- a/windows/device-security/auditing/audit-ipsec-extended-mode.md
+++ b/windows/device-security/auditing/audit-ipsec-extended-mode.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit IPsec Extended Mode
diff --git a/windows/device-security/auditing/audit-ipsec-main-mode.md b/windows/device-security/auditing/audit-ipsec-main-mode.md
index d06d0749d0..ce0f818a58 100644
--- a/windows/device-security/auditing/audit-ipsec-main-mode.md
+++ b/windows/device-security/auditing/audit-ipsec-main-mode.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit IPsec Main Mode
diff --git a/windows/device-security/auditing/audit-ipsec-quick-mode.md b/windows/device-security/auditing/audit-ipsec-quick-mode.md
index 6259aa5962..38545197ce 100644
--- a/windows/device-security/auditing/audit-ipsec-quick-mode.md
+++ b/windows/device-security/auditing/audit-ipsec-quick-mode.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit IPsec Quick Mode
diff --git a/windows/device-security/auditing/audit-kerberos-authentication-service.md b/windows/device-security/auditing/audit-kerberos-authentication-service.md
index 0565b58eef..89da3df49c 100644
--- a/windows/device-security/auditing/audit-kerberos-authentication-service.md
+++ b/windows/device-security/auditing/audit-kerberos-authentication-service.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit Kerberos Authentication Service
diff --git a/windows/device-security/auditing/audit-kerberos-service-ticket-operations.md b/windows/device-security/auditing/audit-kerberos-service-ticket-operations.md
index 5b9d7f1874..bab3c845c3 100644
--- a/windows/device-security/auditing/audit-kerberos-service-ticket-operations.md
+++ b/windows/device-security/auditing/audit-kerberos-service-ticket-operations.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit Kerberos Service Ticket Operations
diff --git a/windows/device-security/auditing/audit-kernel-object.md b/windows/device-security/auditing/audit-kernel-object.md
index 9815bc9a13..9fa2b580ab 100644
--- a/windows/device-security/auditing/audit-kernel-object.md
+++ b/windows/device-security/auditing/audit-kernel-object.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit Kernel Object
diff --git a/windows/device-security/auditing/audit-logoff.md b/windows/device-security/auditing/audit-logoff.md
index 152a1a0770..e9a0c01254 100644
--- a/windows/device-security/auditing/audit-logoff.md
+++ b/windows/device-security/auditing/audit-logoff.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit Logoff
diff --git a/windows/device-security/auditing/audit-logon.md b/windows/device-security/auditing/audit-logon.md
index 99a4cb6528..a5e0c95234 100644
--- a/windows/device-security/auditing/audit-logon.md
+++ b/windows/device-security/auditing/audit-logon.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit Logon
diff --git a/windows/device-security/auditing/audit-mpssvc-rule-level-policy-change.md b/windows/device-security/auditing/audit-mpssvc-rule-level-policy-change.md
index 7ac4228370..3fb772b9df 100644
--- a/windows/device-security/auditing/audit-mpssvc-rule-level-policy-change.md
+++ b/windows/device-security/auditing/audit-mpssvc-rule-level-policy-change.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit MPSSVC Rule-Level Policy Change
diff --git a/windows/device-security/auditing/audit-network-policy-server.md b/windows/device-security/auditing/audit-network-policy-server.md
index f1cdad1e90..11287bd65d 100644
--- a/windows/device-security/auditing/audit-network-policy-server.md
+++ b/windows/device-security/auditing/audit-network-policy-server.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit Network Policy Server
diff --git a/windows/device-security/auditing/audit-non-sensitive-privilege-use.md b/windows/device-security/auditing/audit-non-sensitive-privilege-use.md
index ebc770c912..1d4cac3e10 100644
--- a/windows/device-security/auditing/audit-non-sensitive-privilege-use.md
+++ b/windows/device-security/auditing/audit-non-sensitive-privilege-use.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit Non Sensitive Privilege Use
diff --git a/windows/device-security/auditing/audit-other-account-logon-events.md b/windows/device-security/auditing/audit-other-account-logon-events.md
index 194e56d11b..522cbbbda0 100644
--- a/windows/device-security/auditing/audit-other-account-logon-events.md
+++ b/windows/device-security/auditing/audit-other-account-logon-events.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit Other Account Logon Events
diff --git a/windows/device-security/auditing/audit-other-account-management-events.md b/windows/device-security/auditing/audit-other-account-management-events.md
index 20b82aa409..a4e42c2134 100644
--- a/windows/device-security/auditing/audit-other-account-management-events.md
+++ b/windows/device-security/auditing/audit-other-account-management-events.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit Other Account Management Events
diff --git a/windows/device-security/auditing/audit-other-logonlogoff-events.md b/windows/device-security/auditing/audit-other-logonlogoff-events.md
index cceda79c69..20c7e57792 100644
--- a/windows/device-security/auditing/audit-other-logonlogoff-events.md
+++ b/windows/device-security/auditing/audit-other-logonlogoff-events.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit Other Logon/Logoff Events
diff --git a/windows/device-security/auditing/audit-other-object-access-events.md b/windows/device-security/auditing/audit-other-object-access-events.md
index ed9fe36ec9..7a65861136 100644
--- a/windows/device-security/auditing/audit-other-object-access-events.md
+++ b/windows/device-security/auditing/audit-other-object-access-events.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 05/29/2017
---
# Audit Other Object Access Events
diff --git a/windows/device-security/auditing/audit-other-policy-change-events.md b/windows/device-security/auditing/audit-other-policy-change-events.md
index 81cb8c52aa..caedc86292 100644
--- a/windows/device-security/auditing/audit-other-policy-change-events.md
+++ b/windows/device-security/auditing/audit-other-policy-change-events.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit Other Policy Change Events
diff --git a/windows/device-security/auditing/audit-other-privilege-use-events.md b/windows/device-security/auditing/audit-other-privilege-use-events.md
index a411c1b6b4..7bbf1b96ea 100644
--- a/windows/device-security/auditing/audit-other-privilege-use-events.md
+++ b/windows/device-security/auditing/audit-other-privilege-use-events.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit Other Privilege Use Events
diff --git a/windows/device-security/auditing/audit-other-system-events.md b/windows/device-security/auditing/audit-other-system-events.md
index 91f62b06de..66a9f4fa1a 100644
--- a/windows/device-security/auditing/audit-other-system-events.md
+++ b/windows/device-security/auditing/audit-other-system-events.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit Other System Events
diff --git a/windows/device-security/auditing/audit-pnp-activity.md b/windows/device-security/auditing/audit-pnp-activity.md
index bef34f8715..3e7f6054e9 100644
--- a/windows/device-security/auditing/audit-pnp-activity.md
+++ b/windows/device-security/auditing/audit-pnp-activity.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit PNP Activity
diff --git a/windows/device-security/auditing/audit-process-creation.md b/windows/device-security/auditing/audit-process-creation.md
index 9616b172bf..91ce6e4269 100644
--- a/windows/device-security/auditing/audit-process-creation.md
+++ b/windows/device-security/auditing/audit-process-creation.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit Process Creation
diff --git a/windows/device-security/auditing/audit-process-termination.md b/windows/device-security/auditing/audit-process-termination.md
index 493f39cc30..26bdfd3335 100644
--- a/windows/device-security/auditing/audit-process-termination.md
+++ b/windows/device-security/auditing/audit-process-termination.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit Process Termination
diff --git a/windows/device-security/auditing/audit-registry.md b/windows/device-security/auditing/audit-registry.md
index ad25025bc9..89c6e2069e 100644
--- a/windows/device-security/auditing/audit-registry.md
+++ b/windows/device-security/auditing/audit-registry.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit Registry
diff --git a/windows/device-security/auditing/audit-removable-storage.md b/windows/device-security/auditing/audit-removable-storage.md
index de2555c64a..40a3de6168 100644
--- a/windows/device-security/auditing/audit-removable-storage.md
+++ b/windows/device-security/auditing/audit-removable-storage.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit Removable Storage
diff --git a/windows/device-security/auditing/audit-rpc-events.md b/windows/device-security/auditing/audit-rpc-events.md
index 69b62bbff7..68fe08ab59 100644
--- a/windows/device-security/auditing/audit-rpc-events.md
+++ b/windows/device-security/auditing/audit-rpc-events.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit RPC Events
diff --git a/windows/device-security/auditing/audit-sam.md b/windows/device-security/auditing/audit-sam.md
index 49b763f835..68cbdf8de2 100644
--- a/windows/device-security/auditing/audit-sam.md
+++ b/windows/device-security/auditing/audit-sam.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit SAM
diff --git a/windows/device-security/auditing/audit-security-group-management.md b/windows/device-security/auditing/audit-security-group-management.md
index 17c4f1861e..6f5966a3e8 100644
--- a/windows/device-security/auditing/audit-security-group-management.md
+++ b/windows/device-security/auditing/audit-security-group-management.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit Security Group Management
diff --git a/windows/device-security/auditing/audit-security-state-change.md b/windows/device-security/auditing/audit-security-state-change.md
index 54492ea27c..82b7442603 100644
--- a/windows/device-security/auditing/audit-security-state-change.md
+++ b/windows/device-security/auditing/audit-security-state-change.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit Security State Change
diff --git a/windows/device-security/auditing/audit-security-system-extension.md b/windows/device-security/auditing/audit-security-system-extension.md
index b340e3efe0..dd197405eb 100644
--- a/windows/device-security/auditing/audit-security-system-extension.md
+++ b/windows/device-security/auditing/audit-security-system-extension.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit Security System Extension
diff --git a/windows/device-security/auditing/audit-sensitive-privilege-use.md b/windows/device-security/auditing/audit-sensitive-privilege-use.md
index 220187fc5b..fee5387d6e 100644
--- a/windows/device-security/auditing/audit-sensitive-privilege-use.md
+++ b/windows/device-security/auditing/audit-sensitive-privilege-use.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit Sensitive Privilege Use
diff --git a/windows/device-security/auditing/audit-special-logon.md b/windows/device-security/auditing/audit-special-logon.md
index 2838689d0f..4e565482ce 100644
--- a/windows/device-security/auditing/audit-special-logon.md
+++ b/windows/device-security/auditing/audit-special-logon.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit Special Logon
diff --git a/windows/device-security/auditing/audit-system-integrity.md b/windows/device-security/auditing/audit-system-integrity.md
index 90bbb22cde..d1ab5a9287 100644
--- a/windows/device-security/auditing/audit-system-integrity.md
+++ b/windows/device-security/auditing/audit-system-integrity.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit System Integrity
diff --git a/windows/device-security/auditing/audit-user-account-management.md b/windows/device-security/auditing/audit-user-account-management.md
index e641522e84..db25e022e7 100644
--- a/windows/device-security/auditing/audit-user-account-management.md
+++ b/windows/device-security/auditing/audit-user-account-management.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit User Account Management
diff --git a/windows/device-security/auditing/audit-user-device-claims.md b/windows/device-security/auditing/audit-user-device-claims.md
index 69c9dc94c2..d7a6965f65 100644
--- a/windows/device-security/auditing/audit-user-device-claims.md
+++ b/windows/device-security/auditing/audit-user-device-claims.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Audit User/Device Claims
diff --git a/windows/device-security/auditing/basic-audit-account-logon-events.md b/windows/device-security/auditing/basic-audit-account-logon-events.md
index 392a87e381..fb3376bbfa 100644
--- a/windows/device-security/auditing/basic-audit-account-logon-events.md
+++ b/windows/device-security/auditing/basic-audit-account-logon-events.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Audit account logon events
diff --git a/windows/device-security/auditing/basic-audit-account-management.md b/windows/device-security/auditing/basic-audit-account-management.md
index 364a455ec2..927836fa61 100644
--- a/windows/device-security/auditing/basic-audit-account-management.md
+++ b/windows/device-security/auditing/basic-audit-account-management.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Audit account management
diff --git a/windows/device-security/auditing/basic-audit-directory-service-access.md b/windows/device-security/auditing/basic-audit-directory-service-access.md
index b377adcecc..c8c80ce9d6 100644
--- a/windows/device-security/auditing/basic-audit-directory-service-access.md
+++ b/windows/device-security/auditing/basic-audit-directory-service-access.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Audit directory service access
diff --git a/windows/device-security/auditing/basic-audit-logon-events.md b/windows/device-security/auditing/basic-audit-logon-events.md
index dd0764f2b5..64857a7afb 100644
--- a/windows/device-security/auditing/basic-audit-logon-events.md
+++ b/windows/device-security/auditing/basic-audit-logon-events.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Audit logon events
diff --git a/windows/device-security/auditing/basic-audit-object-access.md b/windows/device-security/auditing/basic-audit-object-access.md
index 05d9500660..38bb2e466d 100644
--- a/windows/device-security/auditing/basic-audit-object-access.md
+++ b/windows/device-security/auditing/basic-audit-object-access.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Audit object access
diff --git a/windows/device-security/auditing/basic-audit-policy-change.md b/windows/device-security/auditing/basic-audit-policy-change.md
index 9aee64c9c8..19b0d6e645 100644
--- a/windows/device-security/auditing/basic-audit-policy-change.md
+++ b/windows/device-security/auditing/basic-audit-policy-change.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Audit policy change
diff --git a/windows/device-security/auditing/basic-audit-privilege-use.md b/windows/device-security/auditing/basic-audit-privilege-use.md
index 62d38eec12..8aa5da56c9 100644
--- a/windows/device-security/auditing/basic-audit-privilege-use.md
+++ b/windows/device-security/auditing/basic-audit-privilege-use.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Audit privilege use
diff --git a/windows/device-security/auditing/basic-audit-process-tracking.md b/windows/device-security/auditing/basic-audit-process-tracking.md
index acfe7b0fb1..fea480a728 100644
--- a/windows/device-security/auditing/basic-audit-process-tracking.md
+++ b/windows/device-security/auditing/basic-audit-process-tracking.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Audit process tracking
diff --git a/windows/device-security/auditing/basic-audit-system-events.md b/windows/device-security/auditing/basic-audit-system-events.md
index 70674dbb21..06fa199863 100644
--- a/windows/device-security/auditing/basic-audit-system-events.md
+++ b/windows/device-security/auditing/basic-audit-system-events.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Audit system events
diff --git a/windows/device-security/auditing/basic-security-audit-policies.md b/windows/device-security/auditing/basic-security-audit-policies.md
index 1de3ff5747..9ad2959a47 100644
--- a/windows/device-security/auditing/basic-security-audit-policies.md
+++ b/windows/device-security/auditing/basic-security-audit-policies.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Basic security audit policies
diff --git a/windows/device-security/auditing/basic-security-audit-policy-settings.md b/windows/device-security/auditing/basic-security-audit-policy-settings.md
index 82989b0eee..933f85b9dc 100644
--- a/windows/device-security/auditing/basic-security-audit-policy-settings.md
+++ b/windows/device-security/auditing/basic-security-audit-policy-settings.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Basic security audit policy settings
diff --git a/windows/device-security/auditing/create-a-basic-audit-policy-settings-for-an-event-category.md b/windows/device-security/auditing/create-a-basic-audit-policy-settings-for-an-event-category.md
index 69742a74b0..7fbe7ab069 100644
--- a/windows/device-security/auditing/create-a-basic-audit-policy-settings-for-an-event-category.md
+++ b/windows/device-security/auditing/create-a-basic-audit-policy-settings-for-an-event-category.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Create a basic audit policy for an event category
diff --git a/windows/device-security/auditing/event-1100.md b/windows/device-security/auditing/event-1100.md
index 3a1a897cf0..ac6f19eefe 100644
--- a/windows/device-security/auditing/event-1100.md
+++ b/windows/device-security/auditing/event-1100.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 1100(S): The event logging service has shut down.
diff --git a/windows/device-security/auditing/event-1102.md b/windows/device-security/auditing/event-1102.md
index e0506ea15f..6a067516da 100644
--- a/windows/device-security/auditing/event-1102.md
+++ b/windows/device-security/auditing/event-1102.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 1102(S): The audit log was cleared.
diff --git a/windows/device-security/auditing/event-1104.md b/windows/device-security/auditing/event-1104.md
index 89e9980503..0a8546990f 100644
--- a/windows/device-security/auditing/event-1104.md
+++ b/windows/device-security/auditing/event-1104.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 1104(S): The security log is now full.
diff --git a/windows/device-security/auditing/event-1105.md b/windows/device-security/auditing/event-1105.md
index 75a97f1a66..a8476fff7b 100644
--- a/windows/device-security/auditing/event-1105.md
+++ b/windows/device-security/auditing/event-1105.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 1105(S): Event log automatic backup.
diff --git a/windows/device-security/auditing/event-1108.md b/windows/device-security/auditing/event-1108.md
index a20422a550..017af286c0 100644
--- a/windows/device-security/auditing/event-1108.md
+++ b/windows/device-security/auditing/event-1108.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 1108(S): The event logging service encountered an error while processing an incoming event published from %1.
diff --git a/windows/device-security/auditing/event-4608.md b/windows/device-security/auditing/event-4608.md
index 92e9691726..1e57fd65bd 100644
--- a/windows/device-security/auditing/event-4608.md
+++ b/windows/device-security/auditing/event-4608.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4608(S): Windows is starting up.
diff --git a/windows/device-security/auditing/event-4610.md b/windows/device-security/auditing/event-4610.md
index 66df4467cd..58520e1319 100644
--- a/windows/device-security/auditing/event-4610.md
+++ b/windows/device-security/auditing/event-4610.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4610(S): An authentication package has been loaded by the Local Security Authority.
diff --git a/windows/device-security/auditing/event-4611.md b/windows/device-security/auditing/event-4611.md
index 3212f7f081..38c317122b 100644
--- a/windows/device-security/auditing/event-4611.md
+++ b/windows/device-security/auditing/event-4611.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4611(S): A trusted logon process has been registered with the Local Security Authority.
diff --git a/windows/device-security/auditing/event-4612.md b/windows/device-security/auditing/event-4612.md
index ffdc67f828..10c759d27c 100644
--- a/windows/device-security/auditing/event-4612.md
+++ b/windows/device-security/auditing/event-4612.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4612(S): Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits.
diff --git a/windows/device-security/auditing/event-4614.md b/windows/device-security/auditing/event-4614.md
index 5afea7b670..fca623f333 100644
--- a/windows/device-security/auditing/event-4614.md
+++ b/windows/device-security/auditing/event-4614.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4614(S): A notification package has been loaded by the Security Account Manager.
diff --git a/windows/device-security/auditing/event-4615.md b/windows/device-security/auditing/event-4615.md
index 7089ff1ad7..3b59808bcf 100644
--- a/windows/device-security/auditing/event-4615.md
+++ b/windows/device-security/auditing/event-4615.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4615(S): Invalid use of LPC port.
diff --git a/windows/device-security/auditing/event-4616.md b/windows/device-security/auditing/event-4616.md
index bc5688955b..58f6621355 100644
--- a/windows/device-security/auditing/event-4616.md
+++ b/windows/device-security/auditing/event-4616.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4616(S): The system time was changed.
diff --git a/windows/device-security/auditing/event-4618.md b/windows/device-security/auditing/event-4618.md
index e9b106a0b3..7ad5986151 100644
--- a/windows/device-security/auditing/event-4618.md
+++ b/windows/device-security/auditing/event-4618.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4618(S): A monitored security event pattern has occurred.
diff --git a/windows/device-security/auditing/event-4621.md b/windows/device-security/auditing/event-4621.md
index 82eeb320a4..dfa9094672 100644
--- a/windows/device-security/auditing/event-4621.md
+++ b/windows/device-security/auditing/event-4621.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4621(S): Administrator recovered system from CrashOnAuditFail.
diff --git a/windows/device-security/auditing/event-4622.md b/windows/device-security/auditing/event-4622.md
index 09fae3de05..489d82cb44 100644
--- a/windows/device-security/auditing/event-4622.md
+++ b/windows/device-security/auditing/event-4622.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4622(S): A security package has been loaded by the Local Security Authority.
diff --git a/windows/device-security/auditing/event-4624.md b/windows/device-security/auditing/event-4624.md
index 77cacc6fdd..5fb9a858c9 100644
--- a/windows/device-security/auditing/event-4624.md
+++ b/windows/device-security/auditing/event-4624.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4624(S): An account was successfully logged on.
diff --git a/windows/device-security/auditing/event-4625.md b/windows/device-security/auditing/event-4625.md
index a8d3223cc0..a156058e1d 100644
--- a/windows/device-security/auditing/event-4625.md
+++ b/windows/device-security/auditing/event-4625.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4625(F): An account failed to log on.
diff --git a/windows/device-security/auditing/event-4626.md b/windows/device-security/auditing/event-4626.md
index 0966b98b63..d127aa0e92 100644
--- a/windows/device-security/auditing/event-4626.md
+++ b/windows/device-security/auditing/event-4626.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4626(S): User/Device claims information.
diff --git a/windows/device-security/auditing/event-4627.md b/windows/device-security/auditing/event-4627.md
index 11e687dafb..7b5753c8a2 100644
--- a/windows/device-security/auditing/event-4627.md
+++ b/windows/device-security/auditing/event-4627.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4627(S): Group membership information.
diff --git a/windows/device-security/auditing/event-4634.md b/windows/device-security/auditing/event-4634.md
index a6b32d39a0..4181c69829 100644
--- a/windows/device-security/auditing/event-4634.md
+++ b/windows/device-security/auditing/event-4634.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 11/20/2017
---
# 4634(S): An account was logged off.
diff --git a/windows/device-security/auditing/event-4647.md b/windows/device-security/auditing/event-4647.md
index 853ddb782f..f302b30dcb 100644
--- a/windows/device-security/auditing/event-4647.md
+++ b/windows/device-security/auditing/event-4647.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4647(S): User initiated logoff.
diff --git a/windows/device-security/auditing/event-4648.md b/windows/device-security/auditing/event-4648.md
index c8116d5fcf..c2d202fde2 100644
--- a/windows/device-security/auditing/event-4648.md
+++ b/windows/device-security/auditing/event-4648.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4648(S): A logon was attempted using explicit credentials.
diff --git a/windows/device-security/auditing/event-4649.md b/windows/device-security/auditing/event-4649.md
index 50ea622c1b..f9e9bf8138 100644
--- a/windows/device-security/auditing/event-4649.md
+++ b/windows/device-security/auditing/event-4649.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4649(S): A replay attack was detected.
diff --git a/windows/device-security/auditing/event-4656.md b/windows/device-security/auditing/event-4656.md
index d9ef101c34..7410f05971 100644
--- a/windows/device-security/auditing/event-4656.md
+++ b/windows/device-security/auditing/event-4656.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4656(S, F): A handle to an object was requested.
diff --git a/windows/device-security/auditing/event-4657.md b/windows/device-security/auditing/event-4657.md
index f5b0e7181e..52063e6430 100644
--- a/windows/device-security/auditing/event-4657.md
+++ b/windows/device-security/auditing/event-4657.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4657(S): A registry value was modified.
diff --git a/windows/device-security/auditing/event-4658.md b/windows/device-security/auditing/event-4658.md
index c952188595..49fd39d667 100644
--- a/windows/device-security/auditing/event-4658.md
+++ b/windows/device-security/auditing/event-4658.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4658(S): The handle to an object was closed.
diff --git a/windows/device-security/auditing/event-4660.md b/windows/device-security/auditing/event-4660.md
index bc95644d61..19abcd9404 100644
--- a/windows/device-security/auditing/event-4660.md
+++ b/windows/device-security/auditing/event-4660.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4660(S): An object was deleted.
diff --git a/windows/device-security/auditing/event-4661.md b/windows/device-security/auditing/event-4661.md
index 781e05b999..2a841eb423 100644
--- a/windows/device-security/auditing/event-4661.md
+++ b/windows/device-security/auditing/event-4661.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4661(S, F): A handle to an object was requested.
diff --git a/windows/device-security/auditing/event-4662.md b/windows/device-security/auditing/event-4662.md
index 147cdf6a2a..76d00d60be 100644
--- a/windows/device-security/auditing/event-4662.md
+++ b/windows/device-security/auditing/event-4662.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4662(S, F): An operation was performed on an object.
diff --git a/windows/device-security/auditing/event-4663.md b/windows/device-security/auditing/event-4663.md
index c75c3f3061..bb6612c203 100644
--- a/windows/device-security/auditing/event-4663.md
+++ b/windows/device-security/auditing/event-4663.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4663(S): An attempt was made to access an object.
diff --git a/windows/device-security/auditing/event-4664.md b/windows/device-security/auditing/event-4664.md
index da086d12b3..69474b2b12 100644
--- a/windows/device-security/auditing/event-4664.md
+++ b/windows/device-security/auditing/event-4664.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4664(S): An attempt was made to create a hard link.
diff --git a/windows/device-security/auditing/event-4670.md b/windows/device-security/auditing/event-4670.md
index c118f6db45..4c4b0f7b46 100644
--- a/windows/device-security/auditing/event-4670.md
+++ b/windows/device-security/auditing/event-4670.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4670(S): Permissions on an object were changed.
diff --git a/windows/device-security/auditing/event-4671.md b/windows/device-security/auditing/event-4671.md
index c1962e0f68..bb9b80ab81 100644
--- a/windows/device-security/auditing/event-4671.md
+++ b/windows/device-security/auditing/event-4671.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4671(-): An application attempted to access a blocked ordinal through the TBS.
diff --git a/windows/device-security/auditing/event-4672.md b/windows/device-security/auditing/event-4672.md
index fbca45d29f..5cc1a63520 100644
--- a/windows/device-security/auditing/event-4672.md
+++ b/windows/device-security/auditing/event-4672.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4672(S): Special privileges assigned to new logon.
diff --git a/windows/device-security/auditing/event-4673.md b/windows/device-security/auditing/event-4673.md
index 97c11f2548..f9573a09ae 100644
--- a/windows/device-security/auditing/event-4673.md
+++ b/windows/device-security/auditing/event-4673.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4673(S, F): A privileged service was called.
diff --git a/windows/device-security/auditing/event-4674.md b/windows/device-security/auditing/event-4674.md
index a61af11105..bca2e5f52e 100644
--- a/windows/device-security/auditing/event-4674.md
+++ b/windows/device-security/auditing/event-4674.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4674(S, F): An operation was attempted on a privileged object.
diff --git a/windows/device-security/auditing/event-4675.md b/windows/device-security/auditing/event-4675.md
index 8f4328750d..421b82fe4c 100644
--- a/windows/device-security/auditing/event-4675.md
+++ b/windows/device-security/auditing/event-4675.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4675(S): SIDs were filtered.
diff --git a/windows/device-security/auditing/event-4688.md b/windows/device-security/auditing/event-4688.md
index cb5292c7a4..0b7635c328 100644
--- a/windows/device-security/auditing/event-4688.md
+++ b/windows/device-security/auditing/event-4688.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4688(S): A new process has been created.
diff --git a/windows/device-security/auditing/event-4689.md b/windows/device-security/auditing/event-4689.md
index 7e1eac53c0..d7f928b85c 100644
--- a/windows/device-security/auditing/event-4689.md
+++ b/windows/device-security/auditing/event-4689.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4689(S): A process has exited.
diff --git a/windows/device-security/auditing/event-4690.md b/windows/device-security/auditing/event-4690.md
index c7a0b4163e..708ad3f4b2 100644
--- a/windows/device-security/auditing/event-4690.md
+++ b/windows/device-security/auditing/event-4690.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4690(S): An attempt was made to duplicate a handle to an object.
diff --git a/windows/device-security/auditing/event-4691.md b/windows/device-security/auditing/event-4691.md
index eb51f9ad42..5a62c9c916 100644
--- a/windows/device-security/auditing/event-4691.md
+++ b/windows/device-security/auditing/event-4691.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4691(S): Indirect access to an object was requested.
diff --git a/windows/device-security/auditing/event-4692.md b/windows/device-security/auditing/event-4692.md
index 499cfda1d7..81042229eb 100644
--- a/windows/device-security/auditing/event-4692.md
+++ b/windows/device-security/auditing/event-4692.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4692(S, F): Backup of data protection master key was attempted.
diff --git a/windows/device-security/auditing/event-4693.md b/windows/device-security/auditing/event-4693.md
index 3bc8e3565e..139eeb2b7b 100644
--- a/windows/device-security/auditing/event-4693.md
+++ b/windows/device-security/auditing/event-4693.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4693(S, F): Recovery of data protection master key was attempted.
diff --git a/windows/device-security/auditing/event-4694.md b/windows/device-security/auditing/event-4694.md
index ebd12e3f78..0818b64f14 100644
--- a/windows/device-security/auditing/event-4694.md
+++ b/windows/device-security/auditing/event-4694.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4694(S, F): Protection of auditable protected data was attempted.
diff --git a/windows/device-security/auditing/event-4695.md b/windows/device-security/auditing/event-4695.md
index 48d9dd1dc6..79b6f0de79 100644
--- a/windows/device-security/auditing/event-4695.md
+++ b/windows/device-security/auditing/event-4695.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4695(S, F): Unprotection of auditable protected data was attempted.
diff --git a/windows/device-security/auditing/event-4696.md b/windows/device-security/auditing/event-4696.md
index 8ad8718911..9f33773c45 100644
--- a/windows/device-security/auditing/event-4696.md
+++ b/windows/device-security/auditing/event-4696.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4696(S): A primary token was assigned to process.
diff --git a/windows/device-security/auditing/event-4697.md b/windows/device-security/auditing/event-4697.md
index 33b2f64912..bf57e86499 100644
--- a/windows/device-security/auditing/event-4697.md
+++ b/windows/device-security/auditing/event-4697.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4697(S): A service was installed in the system.
diff --git a/windows/device-security/auditing/event-4698.md b/windows/device-security/auditing/event-4698.md
index c6af21518c..b5a3c2eb05 100644
--- a/windows/device-security/auditing/event-4698.md
+++ b/windows/device-security/auditing/event-4698.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4698(S): A scheduled task was created.
diff --git a/windows/device-security/auditing/event-4699.md b/windows/device-security/auditing/event-4699.md
index 4db03e314f..43d2d4038a 100644
--- a/windows/device-security/auditing/event-4699.md
+++ b/windows/device-security/auditing/event-4699.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4699(S): A scheduled task was deleted.
diff --git a/windows/device-security/auditing/event-4700.md b/windows/device-security/auditing/event-4700.md
index 52c1cc9eb4..a428e5d220 100644
--- a/windows/device-security/auditing/event-4700.md
+++ b/windows/device-security/auditing/event-4700.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4700(S): A scheduled task was enabled.
diff --git a/windows/device-security/auditing/event-4701.md b/windows/device-security/auditing/event-4701.md
index 9089d6e2b2..8e7d004bfd 100644
--- a/windows/device-security/auditing/event-4701.md
+++ b/windows/device-security/auditing/event-4701.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4701(S): A scheduled task was disabled.
diff --git a/windows/device-security/auditing/event-4702.md b/windows/device-security/auditing/event-4702.md
index 14f24e8daa..f4965a440b 100644
--- a/windows/device-security/auditing/event-4702.md
+++ b/windows/device-security/auditing/event-4702.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4702(S): A scheduled task was updated.
diff --git a/windows/device-security/auditing/event-4703.md b/windows/device-security/auditing/event-4703.md
index 9abb2081f5..34dac9b054 100644
--- a/windows/device-security/auditing/event-4703.md
+++ b/windows/device-security/auditing/event-4703.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4703(S): A user right was adjusted.
diff --git a/windows/device-security/auditing/event-4704.md b/windows/device-security/auditing/event-4704.md
index a0bb977685..e9d8f04685 100644
--- a/windows/device-security/auditing/event-4704.md
+++ b/windows/device-security/auditing/event-4704.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4704(S): A user right was assigned.
diff --git a/windows/device-security/auditing/event-4705.md b/windows/device-security/auditing/event-4705.md
index a8c14607d7..83bd4b2090 100644
--- a/windows/device-security/auditing/event-4705.md
+++ b/windows/device-security/auditing/event-4705.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4705(S): A user right was removed.
diff --git a/windows/device-security/auditing/event-4706.md b/windows/device-security/auditing/event-4706.md
index 2e326b5568..00f7c4abc7 100644
--- a/windows/device-security/auditing/event-4706.md
+++ b/windows/device-security/auditing/event-4706.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4706(S): A new trust was created to a domain.
diff --git a/windows/device-security/auditing/event-4707.md b/windows/device-security/auditing/event-4707.md
index 7e655a216c..ef7889ed6a 100644
--- a/windows/device-security/auditing/event-4707.md
+++ b/windows/device-security/auditing/event-4707.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4707(S): A trust to a domain was removed.
diff --git a/windows/device-security/auditing/event-4713.md b/windows/device-security/auditing/event-4713.md
index 48812811d4..b73f98ed27 100644
--- a/windows/device-security/auditing/event-4713.md
+++ b/windows/device-security/auditing/event-4713.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4713(S): Kerberos policy was changed.
diff --git a/windows/device-security/auditing/event-4714.md b/windows/device-security/auditing/event-4714.md
index 0531957676..939496efb7 100644
--- a/windows/device-security/auditing/event-4714.md
+++ b/windows/device-security/auditing/event-4714.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4714(S): Encrypted data recovery policy was changed.
diff --git a/windows/device-security/auditing/event-4715.md b/windows/device-security/auditing/event-4715.md
index 04ed3bb817..3c44c43d38 100644
--- a/windows/device-security/auditing/event-4715.md
+++ b/windows/device-security/auditing/event-4715.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4715(S): The audit policy (SACL) on an object was changed.
diff --git a/windows/device-security/auditing/event-4716.md b/windows/device-security/auditing/event-4716.md
index 885e5db4dd..627e3b0995 100644
--- a/windows/device-security/auditing/event-4716.md
+++ b/windows/device-security/auditing/event-4716.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4716(S): Trusted domain information was modified.
diff --git a/windows/device-security/auditing/event-4717.md b/windows/device-security/auditing/event-4717.md
index e52cd30ee3..586027ec44 100644
--- a/windows/device-security/auditing/event-4717.md
+++ b/windows/device-security/auditing/event-4717.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4717(S): System security access was granted to an account.
diff --git a/windows/device-security/auditing/event-4718.md b/windows/device-security/auditing/event-4718.md
index 47bf8fc744..2717038a73 100644
--- a/windows/device-security/auditing/event-4718.md
+++ b/windows/device-security/auditing/event-4718.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4718(S): System security access was removed from an account.
diff --git a/windows/device-security/auditing/event-4719.md b/windows/device-security/auditing/event-4719.md
index a310a2b602..1da37f1754 100644
--- a/windows/device-security/auditing/event-4719.md
+++ b/windows/device-security/auditing/event-4719.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4719(S): System audit policy was changed.
diff --git a/windows/device-security/auditing/event-4720.md b/windows/device-security/auditing/event-4720.md
index 0633fa88af..8fe04dc1e8 100644
--- a/windows/device-security/auditing/event-4720.md
+++ b/windows/device-security/auditing/event-4720.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4720(S): A user account was created.
diff --git a/windows/device-security/auditing/event-4722.md b/windows/device-security/auditing/event-4722.md
index 525a134276..8cdab0a747 100644
--- a/windows/device-security/auditing/event-4722.md
+++ b/windows/device-security/auditing/event-4722.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4722(S): A user account was enabled.
diff --git a/windows/device-security/auditing/event-4723.md b/windows/device-security/auditing/event-4723.md
index 2f0aa7139d..2d4fc27242 100644
--- a/windows/device-security/auditing/event-4723.md
+++ b/windows/device-security/auditing/event-4723.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4723(S, F): An attempt was made to change an account's password.
diff --git a/windows/device-security/auditing/event-4724.md b/windows/device-security/auditing/event-4724.md
index a686fd58f2..ccecd029bd 100644
--- a/windows/device-security/auditing/event-4724.md
+++ b/windows/device-security/auditing/event-4724.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4724(S, F): An attempt was made to reset an account's password.
diff --git a/windows/device-security/auditing/event-4725.md b/windows/device-security/auditing/event-4725.md
index 3645da0eae..d98ecec63c 100644
--- a/windows/device-security/auditing/event-4725.md
+++ b/windows/device-security/auditing/event-4725.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4725(S): A user account was disabled.
diff --git a/windows/device-security/auditing/event-4726.md b/windows/device-security/auditing/event-4726.md
index 8a7317ddbe..00b157f1a0 100644
--- a/windows/device-security/auditing/event-4726.md
+++ b/windows/device-security/auditing/event-4726.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4726(S): A user account was deleted.
diff --git a/windows/device-security/auditing/event-4731.md b/windows/device-security/auditing/event-4731.md
index 914ea75bf3..acf70d448c 100644
--- a/windows/device-security/auditing/event-4731.md
+++ b/windows/device-security/auditing/event-4731.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4731(S): A security-enabled local group was created.
diff --git a/windows/device-security/auditing/event-4732.md b/windows/device-security/auditing/event-4732.md
index 52ae49b95b..d7000fb020 100644
--- a/windows/device-security/auditing/event-4732.md
+++ b/windows/device-security/auditing/event-4732.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4732(S): A member was added to a security-enabled local group.
diff --git a/windows/device-security/auditing/event-4733.md b/windows/device-security/auditing/event-4733.md
index b63b74806a..a5b171538f 100644
--- a/windows/device-security/auditing/event-4733.md
+++ b/windows/device-security/auditing/event-4733.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4733(S): A member was removed from a security-enabled local group.
diff --git a/windows/device-security/auditing/event-4734.md b/windows/device-security/auditing/event-4734.md
index efb3ce2cb2..cdacfc1a47 100644
--- a/windows/device-security/auditing/event-4734.md
+++ b/windows/device-security/auditing/event-4734.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4734(S): A security-enabled local group was deleted.
diff --git a/windows/device-security/auditing/event-4735.md b/windows/device-security/auditing/event-4735.md
index 1c19b7ba00..104f37e498 100644
--- a/windows/device-security/auditing/event-4735.md
+++ b/windows/device-security/auditing/event-4735.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4735(S): A security-enabled local group was changed.
diff --git a/windows/device-security/auditing/event-4738.md b/windows/device-security/auditing/event-4738.md
index 5c1b73def8..0086eae7fe 100644
--- a/windows/device-security/auditing/event-4738.md
+++ b/windows/device-security/auditing/event-4738.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4738(S): A user account was changed.
diff --git a/windows/device-security/auditing/event-4739.md b/windows/device-security/auditing/event-4739.md
index 88eab87af3..d1a83fc01d 100644
--- a/windows/device-security/auditing/event-4739.md
+++ b/windows/device-security/auditing/event-4739.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4739(S): Domain Policy was changed.
diff --git a/windows/device-security/auditing/event-4740.md b/windows/device-security/auditing/event-4740.md
index e713d3c034..74ca5aa2d4 100644
--- a/windows/device-security/auditing/event-4740.md
+++ b/windows/device-security/auditing/event-4740.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4740(S): A user account was locked out.
diff --git a/windows/device-security/auditing/event-4741.md b/windows/device-security/auditing/event-4741.md
index a886a23351..ae5cc3aad8 100644
--- a/windows/device-security/auditing/event-4741.md
+++ b/windows/device-security/auditing/event-4741.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4741(S): A computer account was created.
diff --git a/windows/device-security/auditing/event-4742.md b/windows/device-security/auditing/event-4742.md
index 517e8a6ca9..3dbff53ca0 100644
--- a/windows/device-security/auditing/event-4742.md
+++ b/windows/device-security/auditing/event-4742.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4742(S): A computer account was changed.
diff --git a/windows/device-security/auditing/event-4743.md b/windows/device-security/auditing/event-4743.md
index 771a19eb20..cf8fe2de93 100644
--- a/windows/device-security/auditing/event-4743.md
+++ b/windows/device-security/auditing/event-4743.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4743(S): A computer account was deleted.
diff --git a/windows/device-security/auditing/event-4749.md b/windows/device-security/auditing/event-4749.md
index afb8fea445..6fa7e4ad47 100644
--- a/windows/device-security/auditing/event-4749.md
+++ b/windows/device-security/auditing/event-4749.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4749(S): A security-disabled global group was created.
diff --git a/windows/device-security/auditing/event-4750.md b/windows/device-security/auditing/event-4750.md
index f75243fc41..1433514327 100644
--- a/windows/device-security/auditing/event-4750.md
+++ b/windows/device-security/auditing/event-4750.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4750(S): A security-disabled global group was changed.
diff --git a/windows/device-security/auditing/event-4751.md b/windows/device-security/auditing/event-4751.md
index 781c19b91c..bccd6fcfd1 100644
--- a/windows/device-security/auditing/event-4751.md
+++ b/windows/device-security/auditing/event-4751.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4751(S): A member was added to a security-disabled global group.
diff --git a/windows/device-security/auditing/event-4752.md b/windows/device-security/auditing/event-4752.md
index 2310ada963..e8aba8e488 100644
--- a/windows/device-security/auditing/event-4752.md
+++ b/windows/device-security/auditing/event-4752.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4752(S): A member was removed from a security-disabled global group.
diff --git a/windows/device-security/auditing/event-4753.md b/windows/device-security/auditing/event-4753.md
index 380323dd2c..8723b71531 100644
--- a/windows/device-security/auditing/event-4753.md
+++ b/windows/device-security/auditing/event-4753.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4753(S): A security-disabled global group was deleted.
diff --git a/windows/device-security/auditing/event-4764.md b/windows/device-security/auditing/event-4764.md
index 516e945b57..2d2eccc064 100644
--- a/windows/device-security/auditing/event-4764.md
+++ b/windows/device-security/auditing/event-4764.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4764(S): A group’s type was changed.
diff --git a/windows/device-security/auditing/event-4765.md b/windows/device-security/auditing/event-4765.md
index f1bc1a4995..5c9dbc3e45 100644
--- a/windows/device-security/auditing/event-4765.md
+++ b/windows/device-security/auditing/event-4765.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4765(S): SID History was added to an account.
diff --git a/windows/device-security/auditing/event-4766.md b/windows/device-security/auditing/event-4766.md
index b3d0a00060..8d5dcd247b 100644
--- a/windows/device-security/auditing/event-4766.md
+++ b/windows/device-security/auditing/event-4766.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4766(F): An attempt to add SID History to an account failed.
diff --git a/windows/device-security/auditing/event-4767.md b/windows/device-security/auditing/event-4767.md
index 40887505ab..bbce5d97f8 100644
--- a/windows/device-security/auditing/event-4767.md
+++ b/windows/device-security/auditing/event-4767.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4767(S): A user account was unlocked.
diff --git a/windows/device-security/auditing/event-4768.md b/windows/device-security/auditing/event-4768.md
index 249d775d53..142326fd82 100644
--- a/windows/device-security/auditing/event-4768.md
+++ b/windows/device-security/auditing/event-4768.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4768(S, F): A Kerberos authentication ticket (TGT) was requested.
diff --git a/windows/device-security/auditing/event-4769.md b/windows/device-security/auditing/event-4769.md
index 9a7a4c84e0..9c8f497da1 100644
--- a/windows/device-security/auditing/event-4769.md
+++ b/windows/device-security/auditing/event-4769.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4769(S, F): A Kerberos service ticket was requested.
diff --git a/windows/device-security/auditing/event-4770.md b/windows/device-security/auditing/event-4770.md
index 7a4d8dfdac..cfc91281f1 100644
--- a/windows/device-security/auditing/event-4770.md
+++ b/windows/device-security/auditing/event-4770.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4770(S): A Kerberos service ticket was renewed.
diff --git a/windows/device-security/auditing/event-4771.md b/windows/device-security/auditing/event-4771.md
index aee6a3327f..ebe86ace57 100644
--- a/windows/device-security/auditing/event-4771.md
+++ b/windows/device-security/auditing/event-4771.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4771(F): Kerberos pre-authentication failed.
diff --git a/windows/device-security/auditing/event-4772.md b/windows/device-security/auditing/event-4772.md
index cc22ebd0d0..612b71e2da 100644
--- a/windows/device-security/auditing/event-4772.md
+++ b/windows/device-security/auditing/event-4772.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4772(F): A Kerberos authentication ticket request failed.
diff --git a/windows/device-security/auditing/event-4773.md b/windows/device-security/auditing/event-4773.md
index d1edccab49..1f809ff2f0 100644
--- a/windows/device-security/auditing/event-4773.md
+++ b/windows/device-security/auditing/event-4773.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4773(F): A Kerberos service ticket request failed.
diff --git a/windows/device-security/auditing/event-4774.md b/windows/device-security/auditing/event-4774.md
index 0616a1e887..e8304521fa 100644
--- a/windows/device-security/auditing/event-4774.md
+++ b/windows/device-security/auditing/event-4774.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4774(S, F): An account was mapped for logon.
diff --git a/windows/device-security/auditing/event-4775.md b/windows/device-security/auditing/event-4775.md
index f02523531c..b8e498ff1a 100644
--- a/windows/device-security/auditing/event-4775.md
+++ b/windows/device-security/auditing/event-4775.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4775(F): An account could not be mapped for logon.
diff --git a/windows/device-security/auditing/event-4776.md b/windows/device-security/auditing/event-4776.md
index c244914722..17c5196837 100644
--- a/windows/device-security/auditing/event-4776.md
+++ b/windows/device-security/auditing/event-4776.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4776(S, F): The computer attempted to validate the credentials for an account.
diff --git a/windows/device-security/auditing/event-4777.md b/windows/device-security/auditing/event-4777.md
index 7a985dae86..17d6d60001 100644
--- a/windows/device-security/auditing/event-4777.md
+++ b/windows/device-security/auditing/event-4777.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4777(F): The domain controller failed to validate the credentials for an account.
diff --git a/windows/device-security/auditing/event-4778.md b/windows/device-security/auditing/event-4778.md
index ff3e197630..6b9b0ebb67 100644
--- a/windows/device-security/auditing/event-4778.md
+++ b/windows/device-security/auditing/event-4778.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4778(S): A session was reconnected to a Window Station.
diff --git a/windows/device-security/auditing/event-4779.md b/windows/device-security/auditing/event-4779.md
index 2dfd8ef4ab..27a1850d12 100644
--- a/windows/device-security/auditing/event-4779.md
+++ b/windows/device-security/auditing/event-4779.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4779(S): A session was disconnected from a Window Station.
diff --git a/windows/device-security/auditing/event-4780.md b/windows/device-security/auditing/event-4780.md
index f90b4a900a..ffaeeb0a6f 100644
--- a/windows/device-security/auditing/event-4780.md
+++ b/windows/device-security/auditing/event-4780.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4780(S): The ACL was set on accounts which are members of administrators groups.
diff --git a/windows/device-security/auditing/event-4781.md b/windows/device-security/auditing/event-4781.md
index bb0ad55a75..653ccce05c 100644
--- a/windows/device-security/auditing/event-4781.md
+++ b/windows/device-security/auditing/event-4781.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4781(S): The name of an account was changed.
diff --git a/windows/device-security/auditing/event-4782.md b/windows/device-security/auditing/event-4782.md
index 8b3da7f2d2..72fb865981 100644
--- a/windows/device-security/auditing/event-4782.md
+++ b/windows/device-security/auditing/event-4782.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4782(S): The password hash an account was accessed.
diff --git a/windows/device-security/auditing/event-4793.md b/windows/device-security/auditing/event-4793.md
index 348f6e79bd..bcd5b48e69 100644
--- a/windows/device-security/auditing/event-4793.md
+++ b/windows/device-security/auditing/event-4793.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4793(S): The Password Policy Checking API was called.
diff --git a/windows/device-security/auditing/event-4794.md b/windows/device-security/auditing/event-4794.md
index 5cecaab447..20004e2404 100644
--- a/windows/device-security/auditing/event-4794.md
+++ b/windows/device-security/auditing/event-4794.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4794(S, F): An attempt was made to set the Directory Services Restore Mode administrator password.
diff --git a/windows/device-security/auditing/event-4798.md b/windows/device-security/auditing/event-4798.md
index cd7e30f620..dfb877c452 100644
--- a/windows/device-security/auditing/event-4798.md
+++ b/windows/device-security/auditing/event-4798.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4798(S): A user's local group membership was enumerated.
diff --git a/windows/device-security/auditing/event-4799.md b/windows/device-security/auditing/event-4799.md
index 205a394570..5a93e06782 100644
--- a/windows/device-security/auditing/event-4799.md
+++ b/windows/device-security/auditing/event-4799.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4799(S): A security-enabled local group membership was enumerated.
diff --git a/windows/device-security/auditing/event-4800.md b/windows/device-security/auditing/event-4800.md
index 1b56de4322..36e68e0d64 100644
--- a/windows/device-security/auditing/event-4800.md
+++ b/windows/device-security/auditing/event-4800.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4800(S): The workstation was locked.
diff --git a/windows/device-security/auditing/event-4801.md b/windows/device-security/auditing/event-4801.md
index 86eeda1939..58137aaf46 100644
--- a/windows/device-security/auditing/event-4801.md
+++ b/windows/device-security/auditing/event-4801.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4801(S): The workstation was unlocked.
diff --git a/windows/device-security/auditing/event-4802.md b/windows/device-security/auditing/event-4802.md
index 5b2c0022ba..7947029272 100644
--- a/windows/device-security/auditing/event-4802.md
+++ b/windows/device-security/auditing/event-4802.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4802(S): The screen saver was invoked.
diff --git a/windows/device-security/auditing/event-4803.md b/windows/device-security/auditing/event-4803.md
index 18885ae72d..f2d01eac46 100644
--- a/windows/device-security/auditing/event-4803.md
+++ b/windows/device-security/auditing/event-4803.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4803(S): The screen saver was dismissed.
diff --git a/windows/device-security/auditing/event-4816.md b/windows/device-security/auditing/event-4816.md
index 846e37ddf7..aff1f0b7b8 100644
--- a/windows/device-security/auditing/event-4816.md
+++ b/windows/device-security/auditing/event-4816.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4816(S): RPC detected an integrity violation while decrypting an incoming message.
diff --git a/windows/device-security/auditing/event-4817.md b/windows/device-security/auditing/event-4817.md
index 567cbc4f85..90db648c38 100644
--- a/windows/device-security/auditing/event-4817.md
+++ b/windows/device-security/auditing/event-4817.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4817(S): Auditing settings on object were changed.
diff --git a/windows/device-security/auditing/event-4818.md b/windows/device-security/auditing/event-4818.md
index f425d6615b..681c20e5ce 100644
--- a/windows/device-security/auditing/event-4818.md
+++ b/windows/device-security/auditing/event-4818.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4818(S): Proposed Central Access Policy does not grant the same access permissions as the current Central Access Policy.
diff --git a/windows/device-security/auditing/event-4819.md b/windows/device-security/auditing/event-4819.md
index 1ad90e9b42..945ae256a1 100644
--- a/windows/device-security/auditing/event-4819.md
+++ b/windows/device-security/auditing/event-4819.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4819(S): Central Access Policies on the machine have been changed.
diff --git a/windows/device-security/auditing/event-4826.md b/windows/device-security/auditing/event-4826.md
index afdbc4d90c..02fc2b2dbe 100644
--- a/windows/device-security/auditing/event-4826.md
+++ b/windows/device-security/auditing/event-4826.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4826(S): Boot Configuration Data loaded.
diff --git a/windows/device-security/auditing/event-4864.md b/windows/device-security/auditing/event-4864.md
index c889c54cdf..43d6cf33bb 100644
--- a/windows/device-security/auditing/event-4864.md
+++ b/windows/device-security/auditing/event-4864.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4864(S): A namespace collision was detected.
diff --git a/windows/device-security/auditing/event-4865.md b/windows/device-security/auditing/event-4865.md
index be9c5d608b..6594212812 100644
--- a/windows/device-security/auditing/event-4865.md
+++ b/windows/device-security/auditing/event-4865.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4865(S): A trusted forest information entry was added.
diff --git a/windows/device-security/auditing/event-4866.md b/windows/device-security/auditing/event-4866.md
index 29f39da73a..5cf74949cb 100644
--- a/windows/device-security/auditing/event-4866.md
+++ b/windows/device-security/auditing/event-4866.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4866(S): A trusted forest information entry was removed.
diff --git a/windows/device-security/auditing/event-4867.md b/windows/device-security/auditing/event-4867.md
index b253d15a6b..10367c56b8 100644
--- a/windows/device-security/auditing/event-4867.md
+++ b/windows/device-security/auditing/event-4867.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4867(S): A trusted forest information entry was modified.
diff --git a/windows/device-security/auditing/event-4902.md b/windows/device-security/auditing/event-4902.md
index f8979e200f..c94bd3c5bb 100644
--- a/windows/device-security/auditing/event-4902.md
+++ b/windows/device-security/auditing/event-4902.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4902(S): The Per-user audit policy table was created.
diff --git a/windows/device-security/auditing/event-4904.md b/windows/device-security/auditing/event-4904.md
index 51c6232e84..4b1b1d10b6 100644
--- a/windows/device-security/auditing/event-4904.md
+++ b/windows/device-security/auditing/event-4904.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4904(S): An attempt was made to register a security event source.
diff --git a/windows/device-security/auditing/event-4905.md b/windows/device-security/auditing/event-4905.md
index 50570c4ebc..91c33a149b 100644
--- a/windows/device-security/auditing/event-4905.md
+++ b/windows/device-security/auditing/event-4905.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4905(S): An attempt was made to unregister a security event source.
diff --git a/windows/device-security/auditing/event-4906.md b/windows/device-security/auditing/event-4906.md
index b7e82beaac..09c93dd96b 100644
--- a/windows/device-security/auditing/event-4906.md
+++ b/windows/device-security/auditing/event-4906.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4906(S): The CrashOnAuditFail value has changed.
diff --git a/windows/device-security/auditing/event-4907.md b/windows/device-security/auditing/event-4907.md
index a0aaea1776..6770563571 100644
--- a/windows/device-security/auditing/event-4907.md
+++ b/windows/device-security/auditing/event-4907.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4907(S): Auditing settings on object were changed.
diff --git a/windows/device-security/auditing/event-4908.md b/windows/device-security/auditing/event-4908.md
index bbbde0846b..1228c676e7 100644
--- a/windows/device-security/auditing/event-4908.md
+++ b/windows/device-security/auditing/event-4908.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4908(S): Special Groups Logon table modified.
diff --git a/windows/device-security/auditing/event-4909.md b/windows/device-security/auditing/event-4909.md
index f3f6b7d90e..256b121950 100644
--- a/windows/device-security/auditing/event-4909.md
+++ b/windows/device-security/auditing/event-4909.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4909(-): The local policy settings for the TBS were changed.
diff --git a/windows/device-security/auditing/event-4910.md b/windows/device-security/auditing/event-4910.md
index bf7110033f..42981b3496 100644
--- a/windows/device-security/auditing/event-4910.md
+++ b/windows/device-security/auditing/event-4910.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4910(-): The group policy settings for the TBS were changed.
diff --git a/windows/device-security/auditing/event-4911.md b/windows/device-security/auditing/event-4911.md
index 8db6c492da..a906f906e4 100644
--- a/windows/device-security/auditing/event-4911.md
+++ b/windows/device-security/auditing/event-4911.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4911(S): Resource attributes of the object were changed.
diff --git a/windows/device-security/auditing/event-4912.md b/windows/device-security/auditing/event-4912.md
index 98bc16ca95..a905f4b664 100644
--- a/windows/device-security/auditing/event-4912.md
+++ b/windows/device-security/auditing/event-4912.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4912(S): Per User Audit Policy was changed.
diff --git a/windows/device-security/auditing/event-4913.md b/windows/device-security/auditing/event-4913.md
index b3a602931b..53a5d024c1 100644
--- a/windows/device-security/auditing/event-4913.md
+++ b/windows/device-security/auditing/event-4913.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4913(S): Central Access Policy on the object was changed.
diff --git a/windows/device-security/auditing/event-4928.md b/windows/device-security/auditing/event-4928.md
index 04ad5cd8c9..4c84b51785 100644
--- a/windows/device-security/auditing/event-4928.md
+++ b/windows/device-security/auditing/event-4928.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4928(S, F): An Active Directory replica source naming context was established.
diff --git a/windows/device-security/auditing/event-4929.md b/windows/device-security/auditing/event-4929.md
index 1ce345a023..540f77ac0f 100644
--- a/windows/device-security/auditing/event-4929.md
+++ b/windows/device-security/auditing/event-4929.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4929(S, F): An Active Directory replica source naming context was removed.
diff --git a/windows/device-security/auditing/event-4930.md b/windows/device-security/auditing/event-4930.md
index 83c58cab73..f04e61bab7 100644
--- a/windows/device-security/auditing/event-4930.md
+++ b/windows/device-security/auditing/event-4930.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4930(S, F): An Active Directory replica source naming context was modified.
diff --git a/windows/device-security/auditing/event-4931.md b/windows/device-security/auditing/event-4931.md
index 90d993cd8f..1ab43a9df6 100644
--- a/windows/device-security/auditing/event-4931.md
+++ b/windows/device-security/auditing/event-4931.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4931(S, F): An Active Directory replica destination naming context was modified.
diff --git a/windows/device-security/auditing/event-4932.md b/windows/device-security/auditing/event-4932.md
index 4a285d53f7..888d65a13f 100644
--- a/windows/device-security/auditing/event-4932.md
+++ b/windows/device-security/auditing/event-4932.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4932(S): Synchronization of a replica of an Active Directory naming context has begun.
diff --git a/windows/device-security/auditing/event-4933.md b/windows/device-security/auditing/event-4933.md
index ecfdab4b9f..a444061003 100644
--- a/windows/device-security/auditing/event-4933.md
+++ b/windows/device-security/auditing/event-4933.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4933(S, F): Synchronization of a replica of an Active Directory naming context has ended.
diff --git a/windows/device-security/auditing/event-4934.md b/windows/device-security/auditing/event-4934.md
index 370261af0f..7576f09c73 100644
--- a/windows/device-security/auditing/event-4934.md
+++ b/windows/device-security/auditing/event-4934.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4934(S): Attributes of an Active Directory object were replicated.
diff --git a/windows/device-security/auditing/event-4935.md b/windows/device-security/auditing/event-4935.md
index 95089ddc63..c04cd3c3f6 100644
--- a/windows/device-security/auditing/event-4935.md
+++ b/windows/device-security/auditing/event-4935.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4935(F): Replication failure begins.
diff --git a/windows/device-security/auditing/event-4936.md b/windows/device-security/auditing/event-4936.md
index 0d3f01212d..1a6fe8601e 100644
--- a/windows/device-security/auditing/event-4936.md
+++ b/windows/device-security/auditing/event-4936.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4936(S): Replication failure ends.
diff --git a/windows/device-security/auditing/event-4937.md b/windows/device-security/auditing/event-4937.md
index e828453e4c..05fcc3a155 100644
--- a/windows/device-security/auditing/event-4937.md
+++ b/windows/device-security/auditing/event-4937.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4937(S): A lingering object was removed from a replica.
diff --git a/windows/device-security/auditing/event-4944.md b/windows/device-security/auditing/event-4944.md
index 13323d44aa..b1e940a227 100644
--- a/windows/device-security/auditing/event-4944.md
+++ b/windows/device-security/auditing/event-4944.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4944(S): The following policy was active when the Windows Firewall started.
diff --git a/windows/device-security/auditing/event-4945.md b/windows/device-security/auditing/event-4945.md
index fb0731ead7..e75fd5b89d 100644
--- a/windows/device-security/auditing/event-4945.md
+++ b/windows/device-security/auditing/event-4945.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4945(S): A rule was listed when the Windows Firewall started.
diff --git a/windows/device-security/auditing/event-4946.md b/windows/device-security/auditing/event-4946.md
index 0fea17268d..2ee2573635 100644
--- a/windows/device-security/auditing/event-4946.md
+++ b/windows/device-security/auditing/event-4946.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4946(S): A change has been made to Windows Firewall exception list. A rule was added.
diff --git a/windows/device-security/auditing/event-4947.md b/windows/device-security/auditing/event-4947.md
index 3103502558..f6e3914c39 100644
--- a/windows/device-security/auditing/event-4947.md
+++ b/windows/device-security/auditing/event-4947.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4947(S): A change has been made to Windows Firewall exception list. A rule was modified.
diff --git a/windows/device-security/auditing/event-4948.md b/windows/device-security/auditing/event-4948.md
index 8193b2ec9f..75dff8ca6c 100644
--- a/windows/device-security/auditing/event-4948.md
+++ b/windows/device-security/auditing/event-4948.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4948(S): A change has been made to Windows Firewall exception list. A rule was deleted.
diff --git a/windows/device-security/auditing/event-4949.md b/windows/device-security/auditing/event-4949.md
index 0b8194ac9e..465f4e4f8e 100644
--- a/windows/device-security/auditing/event-4949.md
+++ b/windows/device-security/auditing/event-4949.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4949(S): Windows Firewall settings were restored to the default values.
diff --git a/windows/device-security/auditing/event-4950.md b/windows/device-security/auditing/event-4950.md
index 0c8dadbb62..34f2003512 100644
--- a/windows/device-security/auditing/event-4950.md
+++ b/windows/device-security/auditing/event-4950.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4950(S): A Windows Firewall setting has changed.
diff --git a/windows/device-security/auditing/event-4951.md b/windows/device-security/auditing/event-4951.md
index 82cf1bbeb8..661062f902 100644
--- a/windows/device-security/auditing/event-4951.md
+++ b/windows/device-security/auditing/event-4951.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4951(F): A rule has been ignored because its major version number was not recognized by Windows Firewall.
diff --git a/windows/device-security/auditing/event-4952.md b/windows/device-security/auditing/event-4952.md
index 06e7cc5bc5..b1c36d493f 100644
--- a/windows/device-security/auditing/event-4952.md
+++ b/windows/device-security/auditing/event-4952.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4952(F): Parts of a rule have been ignored because its minor version number was not recognized by Windows Firewall. The other parts of the rule will be enforced.
diff --git a/windows/device-security/auditing/event-4953.md b/windows/device-security/auditing/event-4953.md
index 5f4046b134..2c36a9d208 100644
--- a/windows/device-security/auditing/event-4953.md
+++ b/windows/device-security/auditing/event-4953.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4953(F): Windows Firewall ignored a rule because it could not be parsed.
diff --git a/windows/device-security/auditing/event-4954.md b/windows/device-security/auditing/event-4954.md
index 313eef1046..73484f44b8 100644
--- a/windows/device-security/auditing/event-4954.md
+++ b/windows/device-security/auditing/event-4954.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4954(S): Windows Firewall Group Policy settings have changed. The new settings have been applied.
diff --git a/windows/device-security/auditing/event-4956.md b/windows/device-security/auditing/event-4956.md
index 598387895b..b244794b33 100644
--- a/windows/device-security/auditing/event-4956.md
+++ b/windows/device-security/auditing/event-4956.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4956(S): Windows Firewall has changed the active profile.
diff --git a/windows/device-security/auditing/event-4957.md b/windows/device-security/auditing/event-4957.md
index 1d651773dd..5b7eb9a592 100644
--- a/windows/device-security/auditing/event-4957.md
+++ b/windows/device-security/auditing/event-4957.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4957(F): Windows Firewall did not apply the following rule.
diff --git a/windows/device-security/auditing/event-4958.md b/windows/device-security/auditing/event-4958.md
index aec78e8144..fa45d31733 100644
--- a/windows/device-security/auditing/event-4958.md
+++ b/windows/device-security/auditing/event-4958.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4958(F): Windows Firewall did not apply the following rule because the rule referred to items not configured on this computer.
diff --git a/windows/device-security/auditing/event-4964.md b/windows/device-security/auditing/event-4964.md
index 9dddee6f7a..8e1b38f252 100644
--- a/windows/device-security/auditing/event-4964.md
+++ b/windows/device-security/auditing/event-4964.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4964(S): Special groups have been assigned to a new logon.
diff --git a/windows/device-security/auditing/event-4985.md b/windows/device-security/auditing/event-4985.md
index 3efe06ee87..da38bc5ac3 100644
--- a/windows/device-security/auditing/event-4985.md
+++ b/windows/device-security/auditing/event-4985.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 4985(S): The state of a transaction has changed.
diff --git a/windows/device-security/auditing/event-5024.md b/windows/device-security/auditing/event-5024.md
index c06e33a285..e669caf386 100644
--- a/windows/device-security/auditing/event-5024.md
+++ b/windows/device-security/auditing/event-5024.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5024(S): The Windows Firewall Service has started successfully.
diff --git a/windows/device-security/auditing/event-5025.md b/windows/device-security/auditing/event-5025.md
index 2e871f2ce0..8771cc7974 100644
--- a/windows/device-security/auditing/event-5025.md
+++ b/windows/device-security/auditing/event-5025.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5025(S): The Windows Firewall Service has been stopped.
diff --git a/windows/device-security/auditing/event-5027.md b/windows/device-security/auditing/event-5027.md
index d8f0c10631..491f846ff8 100644
--- a/windows/device-security/auditing/event-5027.md
+++ b/windows/device-security/auditing/event-5027.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5027(F): The Windows Firewall Service was unable to retrieve the security policy from the local storage. The service will continue enforcing the current policy.
diff --git a/windows/device-security/auditing/event-5028.md b/windows/device-security/auditing/event-5028.md
index c5dd276e84..6042fef617 100644
--- a/windows/device-security/auditing/event-5028.md
+++ b/windows/device-security/auditing/event-5028.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5028(F): The Windows Firewall Service was unable to parse the new security policy. The service will continue with currently enforced policy.
diff --git a/windows/device-security/auditing/event-5029.md b/windows/device-security/auditing/event-5029.md
index 8bd1677e18..daf0e0248e 100644
--- a/windows/device-security/auditing/event-5029.md
+++ b/windows/device-security/auditing/event-5029.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5029(F): The Windows Firewall Service failed to initialize the driver. The service will continue to enforce the current policy.
diff --git a/windows/device-security/auditing/event-5030.md b/windows/device-security/auditing/event-5030.md
index 2ae7dc1fd3..bc11ab187c 100644
--- a/windows/device-security/auditing/event-5030.md
+++ b/windows/device-security/auditing/event-5030.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5030(F): The Windows Firewall Service failed to start.
diff --git a/windows/device-security/auditing/event-5031.md b/windows/device-security/auditing/event-5031.md
index 6a4e5a375b..f19a1c644a 100644
--- a/windows/device-security/auditing/event-5031.md
+++ b/windows/device-security/auditing/event-5031.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5031(F): The Windows Firewall Service blocked an application from accepting incoming connections on the network.
diff --git a/windows/device-security/auditing/event-5032.md b/windows/device-security/auditing/event-5032.md
index ae74c91364..6be54f3206 100644
--- a/windows/device-security/auditing/event-5032.md
+++ b/windows/device-security/auditing/event-5032.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5032(F): Windows Firewall was unable to notify the user that it blocked an application from accepting incoming connections on the network.
diff --git a/windows/device-security/auditing/event-5033.md b/windows/device-security/auditing/event-5033.md
index 850dd18213..6742336fcb 100644
--- a/windows/device-security/auditing/event-5033.md
+++ b/windows/device-security/auditing/event-5033.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5033(S): The Windows Firewall Driver has started successfully.
diff --git a/windows/device-security/auditing/event-5034.md b/windows/device-security/auditing/event-5034.md
index ff3fb85462..896fe4e94c 100644
--- a/windows/device-security/auditing/event-5034.md
+++ b/windows/device-security/auditing/event-5034.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5034(S): The Windows Firewall Driver was stopped.
diff --git a/windows/device-security/auditing/event-5035.md b/windows/device-security/auditing/event-5035.md
index 1bfd2005f7..e65b0680cd 100644
--- a/windows/device-security/auditing/event-5035.md
+++ b/windows/device-security/auditing/event-5035.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5035(F): The Windows Firewall Driver failed to start.
diff --git a/windows/device-security/auditing/event-5037.md b/windows/device-security/auditing/event-5037.md
index 74d89cfcb2..f05fd3be1c 100644
--- a/windows/device-security/auditing/event-5037.md
+++ b/windows/device-security/auditing/event-5037.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5037(F): The Windows Firewall Driver detected critical runtime error. Terminating.
diff --git a/windows/device-security/auditing/event-5038.md b/windows/device-security/auditing/event-5038.md
index 03e3a001cb..ff00407e6e 100644
--- a/windows/device-security/auditing/event-5038.md
+++ b/windows/device-security/auditing/event-5038.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5038(F): Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error.
diff --git a/windows/device-security/auditing/event-5039.md b/windows/device-security/auditing/event-5039.md
index 7efc527d45..f629490f28 100644
--- a/windows/device-security/auditing/event-5039.md
+++ b/windows/device-security/auditing/event-5039.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5039(-): A registry key was virtualized.
diff --git a/windows/device-security/auditing/event-5051.md b/windows/device-security/auditing/event-5051.md
index 925586c371..4880ab3e11 100644
--- a/windows/device-security/auditing/event-5051.md
+++ b/windows/device-security/auditing/event-5051.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5051(-): A file was virtualized.
diff --git a/windows/device-security/auditing/event-5056.md b/windows/device-security/auditing/event-5056.md
index 112eec47ed..108eaf241b 100644
--- a/windows/device-security/auditing/event-5056.md
+++ b/windows/device-security/auditing/event-5056.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5056(S): A cryptographic self-test was performed.
diff --git a/windows/device-security/auditing/event-5057.md b/windows/device-security/auditing/event-5057.md
index 1c1207d464..4b26c92088 100644
--- a/windows/device-security/auditing/event-5057.md
+++ b/windows/device-security/auditing/event-5057.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5057(F): A cryptographic primitive operation failed.
diff --git a/windows/device-security/auditing/event-5058.md b/windows/device-security/auditing/event-5058.md
index 84f96041ec..50fdab44bf 100644
--- a/windows/device-security/auditing/event-5058.md
+++ b/windows/device-security/auditing/event-5058.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5058(S, F): Key file operation.
diff --git a/windows/device-security/auditing/event-5059.md b/windows/device-security/auditing/event-5059.md
index 3192a1230f..c723a6e639 100644
--- a/windows/device-security/auditing/event-5059.md
+++ b/windows/device-security/auditing/event-5059.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5059(S, F): Key migration operation.
diff --git a/windows/device-security/auditing/event-5060.md b/windows/device-security/auditing/event-5060.md
index 19b2b5754d..984126866d 100644
--- a/windows/device-security/auditing/event-5060.md
+++ b/windows/device-security/auditing/event-5060.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5060(F): Verification operation failed.
diff --git a/windows/device-security/auditing/event-5061.md b/windows/device-security/auditing/event-5061.md
index eaaf0b1218..bf37954b97 100644
--- a/windows/device-security/auditing/event-5061.md
+++ b/windows/device-security/auditing/event-5061.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5061(S, F): Cryptographic operation.
diff --git a/windows/device-security/auditing/event-5062.md b/windows/device-security/auditing/event-5062.md
index 4f1aa57c3f..47e1402ebb 100644
--- a/windows/device-security/auditing/event-5062.md
+++ b/windows/device-security/auditing/event-5062.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5062(S): A kernel-mode cryptographic self-test was performed.
diff --git a/windows/device-security/auditing/event-5063.md b/windows/device-security/auditing/event-5063.md
index 9a0a83c802..54bc56bdc4 100644
--- a/windows/device-security/auditing/event-5063.md
+++ b/windows/device-security/auditing/event-5063.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5063(S, F): A cryptographic provider operation was attempted.
diff --git a/windows/device-security/auditing/event-5064.md b/windows/device-security/auditing/event-5064.md
index e77dfa511d..c4d034a000 100644
--- a/windows/device-security/auditing/event-5064.md
+++ b/windows/device-security/auditing/event-5064.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5064(S, F): A cryptographic context operation was attempted.
diff --git a/windows/device-security/auditing/event-5065.md b/windows/device-security/auditing/event-5065.md
index 23b817ac6c..8d81a7604f 100644
--- a/windows/device-security/auditing/event-5065.md
+++ b/windows/device-security/auditing/event-5065.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5065(S, F): A cryptographic context modification was attempted.
diff --git a/windows/device-security/auditing/event-5066.md b/windows/device-security/auditing/event-5066.md
index ae0b53e526..25b595c19f 100644
--- a/windows/device-security/auditing/event-5066.md
+++ b/windows/device-security/auditing/event-5066.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5066(S, F): A cryptographic function operation was attempted.
diff --git a/windows/device-security/auditing/event-5067.md b/windows/device-security/auditing/event-5067.md
index 64c0a626eb..d2fc40cdf7 100644
--- a/windows/device-security/auditing/event-5067.md
+++ b/windows/device-security/auditing/event-5067.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5067(S, F): A cryptographic function modification was attempted.
diff --git a/windows/device-security/auditing/event-5068.md b/windows/device-security/auditing/event-5068.md
index 2200cc9eed..dd27edc08d 100644
--- a/windows/device-security/auditing/event-5068.md
+++ b/windows/device-security/auditing/event-5068.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5068(S, F): A cryptographic function provider operation was attempted.
diff --git a/windows/device-security/auditing/event-5069.md b/windows/device-security/auditing/event-5069.md
index b58724b2d2..eece0a1b44 100644
--- a/windows/device-security/auditing/event-5069.md
+++ b/windows/device-security/auditing/event-5069.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5069(S, F): A cryptographic function property operation was attempted.
diff --git a/windows/device-security/auditing/event-5070.md b/windows/device-security/auditing/event-5070.md
index 668edaba15..14bf2b591e 100644
--- a/windows/device-security/auditing/event-5070.md
+++ b/windows/device-security/auditing/event-5070.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5070(S, F): A cryptographic function property modification was attempted.
diff --git a/windows/device-security/auditing/event-5136.md b/windows/device-security/auditing/event-5136.md
index bf765d2c01..be3cebc546 100644
--- a/windows/device-security/auditing/event-5136.md
+++ b/windows/device-security/auditing/event-5136.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5136(S): A directory service object was modified.
diff --git a/windows/device-security/auditing/event-5137.md b/windows/device-security/auditing/event-5137.md
index bfb88beb1c..2811ea8260 100644
--- a/windows/device-security/auditing/event-5137.md
+++ b/windows/device-security/auditing/event-5137.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5137(S): A directory service object was created.
diff --git a/windows/device-security/auditing/event-5138.md b/windows/device-security/auditing/event-5138.md
index b9287c53cb..0b7bc8bdda 100644
--- a/windows/device-security/auditing/event-5138.md
+++ b/windows/device-security/auditing/event-5138.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5138(S): A directory service object was undeleted.
diff --git a/windows/device-security/auditing/event-5139.md b/windows/device-security/auditing/event-5139.md
index 7ec7f38b5a..ca1dcb8760 100644
--- a/windows/device-security/auditing/event-5139.md
+++ b/windows/device-security/auditing/event-5139.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5139(S): A directory service object was moved.
diff --git a/windows/device-security/auditing/event-5140.md b/windows/device-security/auditing/event-5140.md
index 06900b8e8c..e026048c46 100644
--- a/windows/device-security/auditing/event-5140.md
+++ b/windows/device-security/auditing/event-5140.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5140(S, F): A network share object was accessed.
diff --git a/windows/device-security/auditing/event-5141.md b/windows/device-security/auditing/event-5141.md
index e0d22c03ab..3bba690ce9 100644
--- a/windows/device-security/auditing/event-5141.md
+++ b/windows/device-security/auditing/event-5141.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5141(S): A directory service object was deleted.
diff --git a/windows/device-security/auditing/event-5142.md b/windows/device-security/auditing/event-5142.md
index c5c8aa21e9..dade8d91b1 100644
--- a/windows/device-security/auditing/event-5142.md
+++ b/windows/device-security/auditing/event-5142.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5142(S): A network share object was added.
diff --git a/windows/device-security/auditing/event-5143.md b/windows/device-security/auditing/event-5143.md
index ede4544f3c..766455cb88 100644
--- a/windows/device-security/auditing/event-5143.md
+++ b/windows/device-security/auditing/event-5143.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5143(S): A network share object was modified.
diff --git a/windows/device-security/auditing/event-5144.md b/windows/device-security/auditing/event-5144.md
index b1abb3ff72..1ea7b1be36 100644
--- a/windows/device-security/auditing/event-5144.md
+++ b/windows/device-security/auditing/event-5144.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5144(S): A network share object was deleted.
diff --git a/windows/device-security/auditing/event-5145.md b/windows/device-security/auditing/event-5145.md
index 2154135d25..756dad0627 100644
--- a/windows/device-security/auditing/event-5145.md
+++ b/windows/device-security/auditing/event-5145.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5145(S, F): A network share object was checked to see whether client can be granted desired access.
diff --git a/windows/device-security/auditing/event-5148.md b/windows/device-security/auditing/event-5148.md
index 305afcbee8..77116b9355 100644
--- a/windows/device-security/auditing/event-5148.md
+++ b/windows/device-security/auditing/event-5148.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 05/29/2017
---
# 5148(F): The Windows Filtering Platform has detected a DoS attack and entered a defensive mode; packets associated with this attack will be discarded.
diff --git a/windows/device-security/auditing/event-5149.md b/windows/device-security/auditing/event-5149.md
index 82a1d84b8e..8e64d233fb 100644
--- a/windows/device-security/auditing/event-5149.md
+++ b/windows/device-security/auditing/event-5149.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 05/29/2017
---
# 5149(F): The DoS attack has subsided and normal processing is being resumed.
diff --git a/windows/device-security/auditing/event-5150.md b/windows/device-security/auditing/event-5150.md
index 10ae5b7bcb..918be364cf 100644
--- a/windows/device-security/auditing/event-5150.md
+++ b/windows/device-security/auditing/event-5150.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5150(-): The Windows Filtering Platform blocked a packet.
diff --git a/windows/device-security/auditing/event-5151.md b/windows/device-security/auditing/event-5151.md
index d1221cb8df..d524a4bfcf 100644
--- a/windows/device-security/auditing/event-5151.md
+++ b/windows/device-security/auditing/event-5151.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5151(-): A more restrictive Windows Filtering Platform filter has blocked a packet.
diff --git a/windows/device-security/auditing/event-5152.md b/windows/device-security/auditing/event-5152.md
index af74957188..794e03728c 100644
--- a/windows/device-security/auditing/event-5152.md
+++ b/windows/device-security/auditing/event-5152.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5152(F): The Windows Filtering Platform blocked a packet.
diff --git a/windows/device-security/auditing/event-5153.md b/windows/device-security/auditing/event-5153.md
index e02ea78a1e..6a80984c62 100644
--- a/windows/device-security/auditing/event-5153.md
+++ b/windows/device-security/auditing/event-5153.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5153(S): A more restrictive Windows Filtering Platform filter has blocked a packet.
diff --git a/windows/device-security/auditing/event-5154.md b/windows/device-security/auditing/event-5154.md
index 12255300cf..7bf096f3d4 100644
--- a/windows/device-security/auditing/event-5154.md
+++ b/windows/device-security/auditing/event-5154.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5154(S): The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections.
diff --git a/windows/device-security/auditing/event-5155.md b/windows/device-security/auditing/event-5155.md
index 369db60297..b4bf0b06ec 100644
--- a/windows/device-security/auditing/event-5155.md
+++ b/windows/device-security/auditing/event-5155.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5155(F): The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections.
diff --git a/windows/device-security/auditing/event-5156.md b/windows/device-security/auditing/event-5156.md
index faa073a9c3..a9eade92a4 100644
--- a/windows/device-security/auditing/event-5156.md
+++ b/windows/device-security/auditing/event-5156.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5156(S): The Windows Filtering Platform has permitted a connection.
diff --git a/windows/device-security/auditing/event-5157.md b/windows/device-security/auditing/event-5157.md
index b66541d467..252e41c447 100644
--- a/windows/device-security/auditing/event-5157.md
+++ b/windows/device-security/auditing/event-5157.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5157(F): The Windows Filtering Platform has blocked a connection.
diff --git a/windows/device-security/auditing/event-5158.md b/windows/device-security/auditing/event-5158.md
index 2e9b42e9b0..b1faa28a26 100644
--- a/windows/device-security/auditing/event-5158.md
+++ b/windows/device-security/auditing/event-5158.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5158(S): The Windows Filtering Platform has permitted a bind to a local port.
diff --git a/windows/device-security/auditing/event-5159.md b/windows/device-security/auditing/event-5159.md
index 02939e687e..3d4b26fdc0 100644
--- a/windows/device-security/auditing/event-5159.md
+++ b/windows/device-security/auditing/event-5159.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5159(F): The Windows Filtering Platform has blocked a bind to a local port.
diff --git a/windows/device-security/auditing/event-5168.md b/windows/device-security/auditing/event-5168.md
index 0cfa2eafcb..8905c824d3 100644
--- a/windows/device-security/auditing/event-5168.md
+++ b/windows/device-security/auditing/event-5168.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5168(F): SPN check for SMB/SMB2 failed.
diff --git a/windows/device-security/auditing/event-5376.md b/windows/device-security/auditing/event-5376.md
index 409fd126a2..9759e6d0c2 100644
--- a/windows/device-security/auditing/event-5376.md
+++ b/windows/device-security/auditing/event-5376.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5376(S): Credential Manager credentials were backed up.
diff --git a/windows/device-security/auditing/event-5377.md b/windows/device-security/auditing/event-5377.md
index 2d7b2cc53f..5d2a1709d1 100644
--- a/windows/device-security/auditing/event-5377.md
+++ b/windows/device-security/auditing/event-5377.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5377(S): Credential Manager credentials were restored from a backup.
diff --git a/windows/device-security/auditing/event-5378.md b/windows/device-security/auditing/event-5378.md
index 6d3b688f26..3bd452b0c4 100644
--- a/windows/device-security/auditing/event-5378.md
+++ b/windows/device-security/auditing/event-5378.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5378(F): The requested credentials delegation was disallowed by policy.
diff --git a/windows/device-security/auditing/event-5447.md b/windows/device-security/auditing/event-5447.md
index f262a70474..73a1f15abe 100644
--- a/windows/device-security/auditing/event-5447.md
+++ b/windows/device-security/auditing/event-5447.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5447(S): A Windows Filtering Platform filter has been changed.
diff --git a/windows/device-security/auditing/event-5632.md b/windows/device-security/auditing/event-5632.md
index 0116808357..29bdb8e39c 100644
--- a/windows/device-security/auditing/event-5632.md
+++ b/windows/device-security/auditing/event-5632.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5632(S, F): A request was made to authenticate to a wireless network.
diff --git a/windows/device-security/auditing/event-5633.md b/windows/device-security/auditing/event-5633.md
index bd4d485c9c..21fabc1686 100644
--- a/windows/device-security/auditing/event-5633.md
+++ b/windows/device-security/auditing/event-5633.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5633(S, F): A request was made to authenticate to a wired network.
diff --git a/windows/device-security/auditing/event-5712.md b/windows/device-security/auditing/event-5712.md
index 0b590700ce..65544e2603 100644
--- a/windows/device-security/auditing/event-5712.md
+++ b/windows/device-security/auditing/event-5712.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5712(S): A Remote Procedure Call (RPC) was attempted.
diff --git a/windows/device-security/auditing/event-5888.md b/windows/device-security/auditing/event-5888.md
index 2acda5543a..0a962eb85a 100644
--- a/windows/device-security/auditing/event-5888.md
+++ b/windows/device-security/auditing/event-5888.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5888(S): An object in the COM+ Catalog was modified.
diff --git a/windows/device-security/auditing/event-5889.md b/windows/device-security/auditing/event-5889.md
index 80f29e655f..c17e01b947 100644
--- a/windows/device-security/auditing/event-5889.md
+++ b/windows/device-security/auditing/event-5889.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5889(S): An object was deleted from the COM+ Catalog.
diff --git a/windows/device-security/auditing/event-5890.md b/windows/device-security/auditing/event-5890.md
index 6a3e71cef4..fa696c09b1 100644
--- a/windows/device-security/auditing/event-5890.md
+++ b/windows/device-security/auditing/event-5890.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 5890(S): An object was added to the COM+ Catalog.
diff --git a/windows/device-security/auditing/event-6144.md b/windows/device-security/auditing/event-6144.md
index 1bcff85f12..1b7b6cbe26 100644
--- a/windows/device-security/auditing/event-6144.md
+++ b/windows/device-security/auditing/event-6144.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 6144(S): Security policy in the group policy objects has been applied successfully.
diff --git a/windows/device-security/auditing/event-6145.md b/windows/device-security/auditing/event-6145.md
index 5566da1217..5dd2b3ca8b 100644
--- a/windows/device-security/auditing/event-6145.md
+++ b/windows/device-security/auditing/event-6145.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 6145(F): One or more errors occurred while processing security policy in the group policy objects.
diff --git a/windows/device-security/auditing/event-6281.md b/windows/device-security/auditing/event-6281.md
index 5f76bd8681..aedaab33bb 100644
--- a/windows/device-security/auditing/event-6281.md
+++ b/windows/device-security/auditing/event-6281.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 6281(F): Code Integrity determined that the page hashes of an image file are not valid. The file could be improperly signed without page hashes or corrupt due to unauthorized modification. The invalid hashes could indicate a potential disk device error.
diff --git a/windows/device-security/auditing/event-6400.md b/windows/device-security/auditing/event-6400.md
index 814cd9ffca..cfb77f2b3a 100644
--- a/windows/device-security/auditing/event-6400.md
+++ b/windows/device-security/auditing/event-6400.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 6400(-): BranchCache: Received an incorrectly formatted response while discovering availability of content.
diff --git a/windows/device-security/auditing/event-6401.md b/windows/device-security/auditing/event-6401.md
index f7d1d86945..3d2cdad2e8 100644
--- a/windows/device-security/auditing/event-6401.md
+++ b/windows/device-security/auditing/event-6401.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 6401(-): BranchCache: Received invalid data from a peer. Data discarded.
diff --git a/windows/device-security/auditing/event-6402.md b/windows/device-security/auditing/event-6402.md
index 95d011d2ac..25ab43c57a 100644
--- a/windows/device-security/auditing/event-6402.md
+++ b/windows/device-security/auditing/event-6402.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 6402(-): BranchCache: The message to the hosted cache offering it data is incorrectly formatted.
diff --git a/windows/device-security/auditing/event-6403.md b/windows/device-security/auditing/event-6403.md
index bead5c33d0..dc6488418a 100644
--- a/windows/device-security/auditing/event-6403.md
+++ b/windows/device-security/auditing/event-6403.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 6403(-): BranchCache: The hosted cache sent an incorrectly formatted response to the client.
diff --git a/windows/device-security/auditing/event-6404.md b/windows/device-security/auditing/event-6404.md
index b01dff56dd..8b687e9d61 100644
--- a/windows/device-security/auditing/event-6404.md
+++ b/windows/device-security/auditing/event-6404.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 6404(-): BranchCache: Hosted cache could not be authenticated using the provisioned SSL certificate.
diff --git a/windows/device-security/auditing/event-6405.md b/windows/device-security/auditing/event-6405.md
index e17b4ca9f4..7fc02c9412 100644
--- a/windows/device-security/auditing/event-6405.md
+++ b/windows/device-security/auditing/event-6405.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 6405(-): BranchCache: %2 instance(s) of event id %1 occurred.
diff --git a/windows/device-security/auditing/event-6406.md b/windows/device-security/auditing/event-6406.md
index 0d964b060b..1dcb6e90d7 100644
--- a/windows/device-security/auditing/event-6406.md
+++ b/windows/device-security/auditing/event-6406.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 6406(-): %1 registered to Windows Firewall to control filtering for the following: %2.
diff --git a/windows/device-security/auditing/event-6407.md b/windows/device-security/auditing/event-6407.md
index 98a71f5c1c..1317d12b70 100644
--- a/windows/device-security/auditing/event-6407.md
+++ b/windows/device-security/auditing/event-6407.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 6407(-): 1%.
diff --git a/windows/device-security/auditing/event-6408.md b/windows/device-security/auditing/event-6408.md
index 29b4a1f469..682546cef4 100644
--- a/windows/device-security/auditing/event-6408.md
+++ b/windows/device-security/auditing/event-6408.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 6408(-): Registered product %1 failed and Windows Firewall is now controlling the filtering for %2.
diff --git a/windows/device-security/auditing/event-6409.md b/windows/device-security/auditing/event-6409.md
index 7716be0032..133b879966 100644
--- a/windows/device-security/auditing/event-6409.md
+++ b/windows/device-security/auditing/event-6409.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 6409(-): BranchCache: A service connection point object could not be parsed.
diff --git a/windows/device-security/auditing/event-6410.md b/windows/device-security/auditing/event-6410.md
index b0a4c89708..7cd9614b30 100644
--- a/windows/device-security/auditing/event-6410.md
+++ b/windows/device-security/auditing/event-6410.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 6410(F): Code integrity determined that a file does not meet the security requirements to load into a process.
diff --git a/windows/device-security/auditing/event-6416.md b/windows/device-security/auditing/event-6416.md
index d06cc4c9b8..3fcc8e37dd 100644
--- a/windows/device-security/auditing/event-6416.md
+++ b/windows/device-security/auditing/event-6416.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 6416(S): A new external device was recognized by the System.
diff --git a/windows/device-security/auditing/event-6419.md b/windows/device-security/auditing/event-6419.md
index aa001dac81..d185fb6e2c 100644
--- a/windows/device-security/auditing/event-6419.md
+++ b/windows/device-security/auditing/event-6419.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 6419(S): A request was made to disable a device.
diff --git a/windows/device-security/auditing/event-6420.md b/windows/device-security/auditing/event-6420.md
index bd3873b57f..3c7d9aafa9 100644
--- a/windows/device-security/auditing/event-6420.md
+++ b/windows/device-security/auditing/event-6420.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 6420(S): A device was disabled.
diff --git a/windows/device-security/auditing/event-6421.md b/windows/device-security/auditing/event-6421.md
index f8bf6c76d3..e82d2c1cce 100644
--- a/windows/device-security/auditing/event-6421.md
+++ b/windows/device-security/auditing/event-6421.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 6421(S): A request was made to enable a device.
diff --git a/windows/device-security/auditing/event-6422.md b/windows/device-security/auditing/event-6422.md
index 74d636f59f..bbd690551c 100644
--- a/windows/device-security/auditing/event-6422.md
+++ b/windows/device-security/auditing/event-6422.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 6422(S): A device was enabled.
diff --git a/windows/device-security/auditing/event-6423.md b/windows/device-security/auditing/event-6423.md
index 6ad3a0c590..6e9a3a1f54 100644
--- a/windows/device-security/auditing/event-6423.md
+++ b/windows/device-security/auditing/event-6423.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 6423(S): The installation of this device is forbidden by system policy.
diff --git a/windows/device-security/auditing/event-6424.md b/windows/device-security/auditing/event-6424.md
index a91d282a95..3afa0bee64 100644
--- a/windows/device-security/auditing/event-6424.md
+++ b/windows/device-security/auditing/event-6424.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# 6424(S): The installation of this device was allowed, after having previously been forbidden by policy.
diff --git a/windows/device-security/auditing/file-system-global-object-access-auditing.md b/windows/device-security/auditing/file-system-global-object-access-auditing.md
index 13e7b15ca7..d83ec4b427 100644
--- a/windows/device-security/auditing/file-system-global-object-access-auditing.md
+++ b/windows/device-security/auditing/file-system-global-object-access-auditing.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# File System (Global Object Access Auditing)
diff --git a/windows/device-security/auditing/monitor-central-access-policy-and-rule-definitions.md b/windows/device-security/auditing/monitor-central-access-policy-and-rule-definitions.md
index 6904612d1c..5bcc889fff 100644
--- a/windows/device-security/auditing/monitor-central-access-policy-and-rule-definitions.md
+++ b/windows/device-security/auditing/monitor-central-access-policy-and-rule-definitions.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Monitor central access policy and rule definitions
diff --git a/windows/device-security/auditing/monitor-claim-types.md b/windows/device-security/auditing/monitor-claim-types.md
index fcbaaa93b0..410b771c8d 100644
--- a/windows/device-security/auditing/monitor-claim-types.md
+++ b/windows/device-security/auditing/monitor-claim-types.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Monitor claim types
diff --git a/windows/device-security/auditing/monitor-resource-attribute-definitions.md b/windows/device-security/auditing/monitor-resource-attribute-definitions.md
index 75bff821fe..3b001b7e2a 100644
--- a/windows/device-security/auditing/monitor-resource-attribute-definitions.md
+++ b/windows/device-security/auditing/monitor-resource-attribute-definitions.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Monitor resource attribute definitions
diff --git a/windows/device-security/auditing/monitor-the-central-access-policies-associated-with-files-and-folders.md b/windows/device-security/auditing/monitor-the-central-access-policies-associated-with-files-and-folders.md
index 74e926c90b..a87230b143 100644
--- a/windows/device-security/auditing/monitor-the-central-access-policies-associated-with-files-and-folders.md
+++ b/windows/device-security/auditing/monitor-the-central-access-policies-associated-with-files-and-folders.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Monitor the central access policies associated with files and folders
diff --git a/windows/device-security/auditing/monitor-the-central-access-policies-that-apply-on-a-file-server.md b/windows/device-security/auditing/monitor-the-central-access-policies-that-apply-on-a-file-server.md
index 4e21c32c36..54d4d33846 100644
--- a/windows/device-security/auditing/monitor-the-central-access-policies-that-apply-on-a-file-server.md
+++ b/windows/device-security/auditing/monitor-the-central-access-policies-that-apply-on-a-file-server.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Monitor the central access policies that apply on a file server
diff --git a/windows/device-security/auditing/monitor-the-resource-attributes-on-files-and-folders.md b/windows/device-security/auditing/monitor-the-resource-attributes-on-files-and-folders.md
index 5849cc955c..c272a341c2 100644
--- a/windows/device-security/auditing/monitor-the-resource-attributes-on-files-and-folders.md
+++ b/windows/device-security/auditing/monitor-the-resource-attributes-on-files-and-folders.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Monitor the resource attributes on files and folders
diff --git a/windows/device-security/auditing/monitor-the-use-of-removable-storage-devices.md b/windows/device-security/auditing/monitor-the-use-of-removable-storage-devices.md
index 7665d0dddc..a2ce772425 100644
--- a/windows/device-security/auditing/monitor-the-use-of-removable-storage-devices.md
+++ b/windows/device-security/auditing/monitor-the-use-of-removable-storage-devices.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Monitor the use of removable storage devices
diff --git a/windows/device-security/auditing/monitor-user-and-device-claims-during-sign-in.md b/windows/device-security/auditing/monitor-user-and-device-claims-during-sign-in.md
index f95697b152..0134469570 100644
--- a/windows/device-security/auditing/monitor-user-and-device-claims-during-sign-in.md
+++ b/windows/device-security/auditing/monitor-user-and-device-claims-during-sign-in.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Monitor user and device claims during sign-in
diff --git a/windows/device-security/auditing/other-events.md b/windows/device-security/auditing/other-events.md
index 6a5cf852d1..d67be8eaff 100644
--- a/windows/device-security/auditing/other-events.md
+++ b/windows/device-security/auditing/other-events.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: Mir0sh
+ms.date: 04/19/2017
---
# Other Events
diff --git a/windows/device-security/auditing/planning-and-deploying-advanced-security-audit-policies.md b/windows/device-security/auditing/planning-and-deploying-advanced-security-audit-policies.md
index 77613b4101..31785c4181 100644
--- a/windows/device-security/auditing/planning-and-deploying-advanced-security-audit-policies.md
+++ b/windows/device-security/auditing/planning-and-deploying-advanced-security-audit-policies.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Planning and deploying advanced security audit policies
diff --git a/windows/device-security/auditing/registry-global-object-access-auditing.md b/windows/device-security/auditing/registry-global-object-access-auditing.md
index b734cec46b..175aee073f 100644
--- a/windows/device-security/auditing/registry-global-object-access-auditing.md
+++ b/windows/device-security/auditing/registry-global-object-access-auditing.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Registry (Global Object Access Auditing)
diff --git a/windows/device-security/auditing/security-auditing-overview.md b/windows/device-security/auditing/security-auditing-overview.md
index 5390760328..2ee5032e3b 100644
--- a/windows/device-security/auditing/security-auditing-overview.md
+++ b/windows/device-security/auditing/security-auditing-overview.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Security auditing
diff --git a/windows/device-security/auditing/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md b/windows/device-security/auditing/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md
index a26cffe188..63da4cc404 100644
--- a/windows/device-security/auditing/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md
+++ b/windows/device-security/auditing/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Using advanced security auditing options to monitor dynamic access control objects
diff --git a/windows/device-security/auditing/view-the-security-event-log.md b/windows/device-security/auditing/view-the-security-event-log.md
index 388d32ddc8..d491761c2a 100644
--- a/windows/device-security/auditing/view-the-security-event-log.md
+++ b/windows/device-security/auditing/view-the-security-event-log.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# View the security event log
diff --git a/windows/device-security/auditing/which-editions-of-windows-support-advanced-audit-policy-configuration.md b/windows/device-security/auditing/which-editions-of-windows-support-advanced-audit-policy-configuration.md
index 4428ed173d..f2d774c843 100644
--- a/windows/device-security/auditing/which-editions-of-windows-support-advanced-audit-policy-configuration.md
+++ b/windows/device-security/auditing/which-editions-of-windows-support-advanced-audit-policy-configuration.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Which editions of Windows support advanced audit policy configuration
diff --git a/windows/device-security/bitlocker/bcd-settings-and-bitlocker.md b/windows/device-security/bitlocker/bcd-settings-and-bitlocker.md
index 5bbe801d60..6fecccdc81 100644
--- a/windows/device-security/bitlocker/bcd-settings-and-bitlocker.md
+++ b/windows/device-security/bitlocker/bcd-settings-and-bitlocker.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 08/21/2017
---
# BCD settings and BitLocker
diff --git a/windows/device-security/bitlocker/bitlocker-basic-deployment.md b/windows/device-security/bitlocker/bitlocker-basic-deployment.md
index fbc016705b..8a37191b30 100644
--- a/windows/device-security/bitlocker/bitlocker-basic-deployment.md
+++ b/windows/device-security/bitlocker/bitlocker-basic-deployment.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# BitLocker basic deployment
@@ -522,7 +523,7 @@ Decryption with Windows PowerShell cmdlets is straightforward, similar to manage
Using the Disable-BitLocker command, they can remove all protectors and encryption at the same time without the need for additional commands. An example of this command is:
``` syntax
-DisableBitLocker
+Disable-BitLocker
```
If a user did not want to input each mount point individually, using the `-MountPoint` parameter in an array can sequence the same command into one line without requiring additional user input. An example command is:
diff --git a/windows/device-security/bitlocker/bitlocker-countermeasures.md b/windows/device-security/bitlocker/bitlocker-countermeasures.md
index 9cff481f09..ca2703df29 100644
--- a/windows/device-security/bitlocker/bitlocker-countermeasures.md
+++ b/windows/device-security/bitlocker/bitlocker-countermeasures.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 10/27/2017
---
# BitLocker Countermeasures
diff --git a/windows/device-security/bitlocker/bitlocker-device-encryption-overview-windows-10.md b/windows/device-security/bitlocker/bitlocker-device-encryption-overview-windows-10.md
index c9d9a49c93..c3833b7707 100644
--- a/windows/device-security/bitlocker/bitlocker-device-encryption-overview-windows-10.md
+++ b/windows/device-security/bitlocker/bitlocker-device-encryption-overview-windows-10.md
@@ -6,6 +6,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: Justinha
+ms.date: 10/27/2017
---
# Overview of BitLocker Device Encryption in Windows 10
diff --git a/windows/device-security/bitlocker/bitlocker-frequently-asked-questions.md b/windows/device-security/bitlocker/bitlocker-frequently-asked-questions.md
index 43c3ecbbd8..b56af7542a 100644
--- a/windows/device-security/bitlocker/bitlocker-frequently-asked-questions.md
+++ b/windows/device-security/bitlocker/bitlocker-frequently-asked-questions.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: security
localizationpriority: high
author: brianlic-msft
+ms.date: 10/16/2017
---
# BitLocker frequently asked questions (FAQ)
@@ -29,8 +30,6 @@ BitLocker is a data protection feature that encrypts the hard drives on your com
- [BitLocker Network Unlock](#bkmk-bnusect)
- [Other questions](#bkmk-other)
-Not finding content you need? Windows 10 users, tell us what you want on [Feedback Hub](feedback-hub://?referrer=techDocsUcPage&tabid=2&contextid=897&newFeedback=true&topic=bitlocker-frequently-asked-questions.md).
-
## Overview and requirements
### How does BitLocker work?
diff --git a/windows/device-security/bitlocker/bitlocker-group-policy-settings.md b/windows/device-security/bitlocker/bitlocker-group-policy-settings.md
index be88d6d8bf..41f2b07751 100644
--- a/windows/device-security/bitlocker/bitlocker-group-policy-settings.md
+++ b/windows/device-security/bitlocker/bitlocker-group-policy-settings.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 11/03/2017
---
# BitLocker Group Policy settings
@@ -1855,7 +1856,7 @@ This policy controls how BitLocker-enabled system volumes are handled in conjunc
Conflicts
-
If the Configure TPM platform validation profile for native UEFI firmware configurations Group Policy setting is enabled and PCR 7 is omitted, BitLocker is prevented from using Secure Boot for platform or BCD integrity validation.
+
If you enable **Allow Secure Boot for integrity validation**, make sure the Configure TPM platform validation profile for native UEFI firmware configurations Group Policy setting is not enabled or include PCR 7 to allow BitLocker to use Secure Boot for platform or BCD integrity validation.
For more information about PCR 7, see [Platform Configuration Register (PCR)](#bkmk-pcr) in this topic.
diff --git a/windows/device-security/bitlocker/bitlocker-how-to-deploy-on-windows-server.md b/windows/device-security/bitlocker/bitlocker-how-to-deploy-on-windows-server.md
index 8a9e7b2ab7..b77aa70779 100644
--- a/windows/device-security/bitlocker/bitlocker-how-to-deploy-on-windows-server.md
+++ b/windows/device-security/bitlocker/bitlocker-how-to-deploy-on-windows-server.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# BitLocker: How to deploy on Windows Server 2012 and later
diff --git a/windows/device-security/bitlocker/bitlocker-how-to-enable-network-unlock.md b/windows/device-security/bitlocker/bitlocker-how-to-enable-network-unlock.md
index 337c4d39e8..7ed9c2166c 100644
--- a/windows/device-security/bitlocker/bitlocker-how-to-enable-network-unlock.md
+++ b/windows/device-security/bitlocker/bitlocker-how-to-enable-network-unlock.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# BitLocker: How to enable Network Unlock
@@ -259,7 +260,7 @@ After adding the Network Unlock template to the Certification Authority, this ce
By default, all clients with the correct Network Unlock Certificate and valid Network Unlock protectors that have wired access to a Network Unlock-enabled WDS server via DHCP are unlocked by the server. A subnet policy configuration file on the WDS server can be created to limit which subnet(s) Network Unlock clients can use to unlock.
-The configuration file, called bde-network-unlock.ini, must be located in the same directory as the Network Unlock provider DLL and it applies to both IPv6 and IPv4 DHCP implementations. If the subnet configuration policy becomes corrupted, the provider will fail and stop responding to requests.
+The configuration file, called bde-network-unlock.ini, must be located in the same directory as the Network Unlock provider DLL (%windir%\System32\Nkpprov.dll) and it applies to both IPv6 and IPv4 DHCP implementations. If the subnet configuration policy becomes corrupted, the provider will fail and stop responding to requests.
The subnet policy configuration file must use a “\[SUBNETS\]” section to identify the specific subnets. The named subnets may then be used to specify restrictions in certificate subsections. Subnets are defined as simple name-value pairs, in the common INI format, where each subnet has its own line, with the name on the left of the equals sign, and the subnet identified on the right of the equal sign as a Classless Inter-Domain Routing (CIDR) address or range. The key word “ENABLED” is disallowed for subnet names.
@@ -334,6 +335,7 @@ Files to gather when troubleshooting BitLocker Network Unlock include:
## Configure Network Unlock Group Policy settings on earlier versions
Network Unlock and the accompanying Group Policy settings were introduced in Windows Server 2012 but can be deployed using operating systems running Windows Server 2008 R2 and Windows Server 2008.
+
**Requirements**
- The server hosting WDS must be running any of the server operating systems designated in the **Applies To** list at the beginning of this topic.
diff --git a/windows/device-security/bitlocker/bitlocker-management-for-enterprises.md b/windows/device-security/bitlocker/bitlocker-management-for-enterprises.md
index 190a682c87..d5952e711b 100644
--- a/windows/device-security/bitlocker/bitlocker-management-for-enterprises.md
+++ b/windows/device-security/bitlocker/bitlocker-management-for-enterprises.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: security
localizationpriority: high
author: brianlic-msft
+ms.date: 10/27/2017
---
# BitLocker Management Recommendations for Enterprises
diff --git a/windows/device-security/bitlocker/bitlocker-overview.md b/windows/device-security/bitlocker/bitlocker-overview.md
index aab42b32d4..37b3f8e0ef 100644
--- a/windows/device-security/bitlocker/bitlocker-overview.md
+++ b/windows/device-security/bitlocker/bitlocker-overview.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: high
author: brianlic-msft
+ms.date: 10/16/2017
---
# BitLocker
@@ -82,4 +83,4 @@ When installing the BitLocker optional component on a server you will also need
| [Protecting cluster shared volumes and storage area networks with BitLocker](protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md)| This topic for IT pros describes how to protect CSVs and SANs with BitLocker.|
| [Enabling Secure Boot and BitLocker Device Encryption on Windows 10 IoT Core](https://developer.microsoft.com/windows/iot/docs/securebootandbitlocker) | This topic covers how to use BitLocker with Windows 10 IoT Core |
-Not finding content you need? Windows 10 users, tell us what you want on [Feedback Hub](feedback-hub://?referrer=techDocsUcPage&tabid=2&contextid=897&newFeedback=true&topic=bitlocker-overview.md).
+
diff --git a/windows/device-security/bitlocker/bitlocker-recovery-guide-plan.md b/windows/device-security/bitlocker/bitlocker-recovery-guide-plan.md
index 5ffc817153..3463fb30d9 100644
--- a/windows/device-security/bitlocker/bitlocker-recovery-guide-plan.md
+++ b/windows/device-security/bitlocker/bitlocker-recovery-guide-plan.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 08/17/2017
---
# BitLocker recovery guide
diff --git a/windows/device-security/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md b/windows/device-security/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md
index 16e23be904..08c6e11a72 100644
--- a/windows/device-security/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md
+++ b/windows/device-security/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/25/2017
---
# BitLocker: Use BitLocker Drive Encryption Tools to manage BitLocker
diff --git a/windows/device-security/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer.md b/windows/device-security/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer.md
index 850c7507b0..d835ee97f5 100644
--- a/windows/device-security/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer.md
+++ b/windows/device-security/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# BitLocker: Use BitLocker Recovery Password Viewer
diff --git a/windows/device-security/bitlocker/choose-the-right-bitlocker-countermeasure.md b/windows/device-security/bitlocker/choose-the-right-bitlocker-countermeasure.md
index 7206bde1f7..c1b351b15e 100644
--- a/windows/device-security/bitlocker/choose-the-right-bitlocker-countermeasure.md
+++ b/windows/device-security/bitlocker/choose-the-right-bitlocker-countermeasure.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 10/27/2017
---
# Choose the right BitLocker countermeasure
diff --git a/windows/device-security/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md b/windows/device-security/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md
index 9ced211913..a88e1e8413 100644
--- a/windows/device-security/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md
+++ b/windows/device-security/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Prepare your organization for BitLocker: Planning and policies
diff --git a/windows/device-security/bitlocker/protect-bitlocker-from-pre-boot-attacks.md b/windows/device-security/bitlocker/protect-bitlocker-from-pre-boot-attacks.md
index 197d906dd6..d67cd69a82 100644
--- a/windows/device-security/bitlocker/protect-bitlocker-from-pre-boot-attacks.md
+++ b/windows/device-security/bitlocker/protect-bitlocker-from-pre-boot-attacks.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Protect BitLocker from pre-boot attacks
diff --git a/windows/device-security/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md b/windows/device-security/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md
index 60483dd6e4..b7fb12a822 100644
--- a/windows/device-security/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md
+++ b/windows/device-security/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 06/19/2017
---
# Protecting cluster shared volumes and storage area networks with BitLocker
diff --git a/windows/device-security/bitlocker/types-of-attacks-for-volume-encryption-keys.md b/windows/device-security/bitlocker/types-of-attacks-for-volume-encryption-keys.md
index 8dea84c3be..d7abb90fbd 100644
--- a/windows/device-security/bitlocker/types-of-attacks-for-volume-encryption-keys.md
+++ b/windows/device-security/bitlocker/types-of-attacks-for-volume-encryption-keys.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 10/27/2017
---
# Types of attacks for volume encryption keys
diff --git a/windows/device-security/change-history-for-device-security.md b/windows/device-security/change-history-for-device-security.md
index cdc986a04a..9f19b7a064 100644
--- a/windows/device-security/change-history-for-device-security.md
+++ b/windows/device-security/change-history-for-device-security.md
@@ -6,6 +6,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 11/27/2017
---
# Change history for device security
diff --git a/windows/device-security/device-guard/deploy-catalog-files-to-support-code-integrity-policies.md b/windows/device-security/device-guard/deploy-catalog-files-to-support-windows-defender-application-control.md
similarity index 78%
rename from windows/device-security/device-guard/deploy-catalog-files-to-support-code-integrity-policies.md
rename to windows/device-security/device-guard/deploy-catalog-files-to-support-windows-defender-application-control.md
index 50fee16fa2..1cdb8061a7 100644
--- a/windows/device-security/device-guard/deploy-catalog-files-to-support-code-integrity-policies.md
+++ b/windows/device-security/device-guard/deploy-catalog-files-to-support-windows-defender-application-control.md
@@ -1,37 +1,37 @@
---
title: Deploy catalog files to support code integrity policies (Windows 10)
-description: This article describes how to deploy catalog files to support code integrity policies, one of the main features that are part of Windows Defender Device Guard in Windows 10.
+description: This article describes how to deploy catalog files to support Windows Defender Application Control, one of the main features that are part of Windows Defender Device Guard in Windows 10.
keywords: virtualization, security, malware
ms.prod: w10
ms.mktglfcycl: deploy
ms.localizationpriority: high
author: brianlic-msft
-ms.date: 10/20/2017
+ms.date: 10/27/2017
---
-# Deploy catalog files to support code integrity policies
+# Deploy catalog files to support Windows Defender Application Control
**Applies to**
- Windows 10
- Windows Server 2016
-Catalog files can be important in your deployment of code integrity polices if you have unsigned line-of-business (LOB) applications for which the process of signing is difficult. To prepare to create code integrity policies that allow these trusted applications but block unsigned code (most malware is unsigned), you create a *catalog file* that contains information about the trusted applications. After you sign and distribute the catalog, your trusted applications can be handled by code integrity policies in the same way as any other signed application. With this foundation, you can more easily block all unsigned applications, allowing only signed applications to run.
+Catalog files can be important in your deployment of Windows Defender Application Control (WDAC) if you have unsigned line-of-business (LOB) applications for which the process of signing is difficult. To prepare to create WDAC policies that allow these trusted applications but block unsigned code (most malware is unsigned), you create a *catalog file* that contains information about the trusted applications. After you sign and distribute the catalog, your trusted applications can be handled by WDAC in the same way as any other signed application. With this foundation, you can more easily block all unsigned applications, allowing only signed applications to run.
For more description of catalog files, see [Reviewing your applications: application signing and catalog files](requirements-and-deployment-planning-guidelines-for-device-guard.md#reviewing-your-applications-application-signing-and-catalog-files) in "Requirements and deployment planning guidelines for Windows Defender Device Guard."
## Create catalog files
-The creation of a catalog file is a necessary step for adding an unsigned application to a code integrity policy.
+The creation of a catalog file simplifies the steps to run unsigned applications in the presence of a WDAC policy.
-To create a catalog file, you use a tool called **Package Inspector**. You must also have a code integrity policy deployed in audit mode on the computer on which you run Package Inspector, because Package Inspector does not always detect installation files that have been removed from the computer during the installation process.
+To create a catalog file, you use a tool called **Package Inspector**. You must also have a WDAC policy deployed in audit mode on the computer on which you run Package Inspector, so that Package Inspector can include any temporary installation files that are added and then removed from the computer during the installation process.
> **Note** When you establish a naming convention it makes it easier to detect deployed catalog files in the future. In this guide, *\*-Contoso.cat* is used as the example naming convention. For more information about why this practice is helpful to inventory or detect catalog files, see [Inventory catalog files with System Center Configuration Manager](#inventory-catalog-files-with-system-center-configuration-manager), later in this topic.
-1. Be sure that a code integrity policy is currently deployed in audit mode on the computer on which you will run Package Inspector.
+1. Be sure that a WDAC policy is currently deployed in audit mode on the computer on which you will run Package Inspector.
- Package Inspector does not always detect installation files that have been removed from the computer during the installation process. To ensure that these binaries are also trusted, deploy a code integrity policy in audit mode. You can use the code integrity policy that you created and audited in [Create a code integrity policy from a reference computer](deploy-code-integrity-policies-steps.md#create-a-code-integrity-policy-from-a-reference-computer) and [Audit code integrity policies](deploy-code-integrity-policies-steps.md#audit-code-integrity-policies).
+ Package Inspector does not always detect temporary installation files that are added and then removed from the computer during the installation process. To ensure that these binaries are also included in your catalog file, deploy a WDAC policy in audit mode. You can use the WDAC policy that you created and audited in [Create a Windows Defender Application Control policy from a reference computer](steps-to-deploy-windows-defender-application-control.md#create-a-windows-defender-application-control-policy-from-a-reference-computer) and [Audit Windows Defender Application Control policies](steps-to-deploy-windows-defender-application-control.md#audit-windows-defender-application-control-policies).
- > **Note** This process should **not** be performed on a system with an enforced Windows Defender Device Guard policy, only with a policy in audit mode. If a policy is currently being enforced, you will not be able to install and run the application.
+ > **Note** This process should **not** be performed on a system with an enforced Windows Defender Application Control policy, only with a policy in audit mode. If a policy is currently being enforced, you will not be able to install and run the application unless the policy already allows it.
2. Start Package Inspector, and then start scanning a local drive, for example, drive C:
@@ -41,7 +41,7 @@ To create a catalog file, you use a tool called **Package Inspector**. You must
3. Copy the installation media to the local drive (typically drive C).
- By copying the installation media to the local drive, you ensure that Package Inspector detects and catalogs the actual installer. If you skip this step, the future code integrity policy may trust the application to run but not to be installed.
+ By copying the installation media to the local drive, you ensure that Package Inspector detects and catalogs the actual installer. If you skip this step, the future WDAC policy may allow the application to run but not to be installed.
4. Install the application. Install it to the same drive that the application installer is located on (the drive you are scanning). Also, while Package Inspector is running, do not run any installations or updates that you don't want to capture in the catalog.
@@ -73,11 +73,11 @@ To create a catalog file, you use a tool called **Package Inspector**. You must
When finished, the files will be saved to your desktop. You can double-click the \*.cat file to see its contents, and you can view the \*.cdf file with a text editor.
-To trust this catalog file within a code integrity policy, the catalog must first be signed. Then, the signing certificate can be added to the code integrity policy, and the catalog file can be distributed to the individual client computers.
+To trust the contents of the catalog file within a WDAC policy, the catalog must first be signed. Then, the signing certificate can be added to the WDAC policy, and the catalog file can be distributed to the individual client computers.
For information about signing catalog files by using a certificate and SignTool.exe, a free tool available in the Windows SDK, see the next section, [Catalog signing with SignTool.exe](#catalog-signing-with-signtoolexe).
-For information about adding the signing certificate to a code integrity policy, see [Add a catalog signing certificate to a code integrity policy](#add-a-catalog-signing-certificate-to-a-code-integrity-policy).
+For information about adding the signing certificate to a WDAC policy, see [Add a catalog signing certificate to a Windows Defender Application Control policy](#add-a-catalog-signing-certificate-to-a-windows-defender-application-control-policy).
### Resolving package failures
@@ -95,7 +95,7 @@ Packages can fail for the following reasons:
- Package Inspector is completely incompatible if files in the package (temporary or otherwise) change hash each time the package is installed. You can diagnose this by looking at the hash field in the 3077 block events when the package is failing in enforcement. If each time you attempt to run the package you get a new block event with a different hash, the package will not work with Package Inspector
- Files with an invalid signature blob or otherwise “unhashable” files
- This issue arises when a file that has been signed is modified post signing in a way that invalidates the PE header and renders the file unable to be hashed by the Authenticode Spec.
- - Device Guard uses Authenticode Hashes to validate files when they are running. If the file is unhashable via the authenticode SIP, there is no way to identify the file to allow it, regardless of if you attempt to add the file to the policy directly, or re-sign the file with a Package Inspector catalog (the signature is invalidated due to file being edited, file can’t be allowed by hash due to authenticode hashing algorithm rejecting it)
+ - WDAC uses Authenticode Hashes to validate files when they are running. If the file is unhashable via the authenticode SIP, there is no way to identify the file to allow it, regardless of if you attempt to add the file to the policy directly, or re-sign the file with a Package Inspector catalog (the signature is invalidated due to file being edited, file can’t be allowed by hash due to authenticode hashing algorithm rejecting it)
- Recent versions of InstallShield packages that use custom actions can hit this. If the DLL input to the custom action was signed before being put through InstallShield, InstallShield adds tracking markers to the file (editing it post signature) which leaves the file in this “unhashable” state and renders the file unable to be allowed by Device Guard (regardless of if you try to allow directly by policy or resign with Package Inspector)
## Catalog signing with SignTool.exe
@@ -108,7 +108,7 @@ In this section, you sign a catalog file you generated by using PackageInspector
- An internal certification authority (CA) code signing certificate or purchased code signing certificate
-If you do not have a code signing certificate, see [Optional: Create a code signing certificate for code integrity policies](optional-create-a-code-signing-certificate-for-code-integrity-policies.md) for a walkthrough of how to create one. That topic uses an example certificate name of **ContosoDGSigningCert**, and the procedure that follows uses that example certificate name to sign the catalog file that you created in [Create catalog files](#create-catalog-files), earlier in this topic. If you are using an alternate certificate or catalog file, update the following steps with the appropriate variables and certificate.
+If you do not have a code signing certificate, see [Optional: Create a code signing certificate for Windows Defender Application Control](optional-create-a-code-signing-certificate-for-windows-defender-application-control.md) for a walkthrough of how to create one. That topic uses an example certificate name of **ContosoDGSigningCert**, and the procedure that follows uses that example certificate name to sign the catalog file that you created in [Create catalog files](#create-catalog-files), earlier in this topic. If you are using an alternate certificate or catalog file, update the following steps with the appropriate variables and certificate.
To sign the existing catalog file, copy each of the following commands into an elevated Windows PowerShell session.
@@ -120,7 +120,7 @@ To sign the existing catalog file, copy each of the following commands into an e
> **Note** This example specifies the catalog file you created in the [Create catalog files](#create-catalog-files) section. If you are signing another catalog file, update the *$ExamplePath* and *$CatFileName* variables with the correct information.
-2. Import the code signing certificate that will be used to sign the catalog file. Import it to the signing user’s personal store. This example uses the certificate name from [Optional: Create a code signing certificate for code integrity policies](optional-create-a-code-signing-certificate-for-code-integrity-policies.md).
+2. Import the code signing certificate that will be used to sign the catalog file. Import it to the signing user’s personal store. This example uses the certificate name from [Optional: Create a code signing certificate for Windows Defender Application Control](optional-create-a-code-signing-certificate-for-windows-defender-application-control.md).
3. Sign the catalog file with Signtool.exe:
@@ -140,29 +140,29 @@ To sign the existing catalog file, copy each of the following commands into an e
For testing purposes, you can manually copy signed catalog files to their intended folder. For large-scale implementations, to copy the appropriate catalog files to all desired computers, we recommend that you use Group Policy File Preferences or an enterprise systems management product such as System Center Configuration Manager. Doing this also simplifies the management of catalog versions.
-## Add a catalog signing certificate to a code integrity policy
+## Add a catalog signing certificate to a Windows Defender Application Control policy
-After the catalog file is signed, add the signing certificate to a code integrity policy, as described in the following steps.
+After the catalog file is signed, add the signing certificate to a WDAC policy, as described in the following steps.
1. If you have not already verified the catalog file digital signature, right-click the catalog file, and then click **Properties**. On the **Digital Signatures** tab, verify that your signing certificate exists with the algorithm you expect.
-2. If you already have an XML policy file that you want to add the signing certificate to, skip to the next step. Otherwise, use [New-CIPolicy](https://technet.microsoft.com/library/mt634473.aspx) to create a code integrity policy that you will later merge into another policy (not deploy as-is). This example creates a policy called **CatalogSignatureOnly.xml** in the location **C:\\PolicyFolder**:
+2. If you already have an XML policy file that you want to add the signing certificate to, skip to the next step. Otherwise, use [New-CIPolicy](https://technet.microsoft.com/library/mt634473.aspx) to create a WDAC policy that you will later merge into another policy (not deploy as-is). This example creates a policy called **CatalogSignatureOnly.xml** in the location **C:\\PolicyFolder**:
` New-CIPolicy -Level PcaCertificate -FilePath C:\PolicyFolder\CatalogSignatureOnly.xml –UserPEs`
> **Note** Include the **-UserPEs** parameter to ensure that the policy includes user mode code integrity.
-3. Use [Add-SignerRule](https://technet.microsoft.com/library/mt634479.aspx) to add the signing certificate to the code integrity policy, filling in the correct path and filenames for `` and ``:
+3. Use [Add-SignerRule](https://technet.microsoft.com/library/mt634479.aspx) to add the signing certificate to the WDAC policy, filling in the correct path and filenames for `` and ``:
` Add-SignerRule -FilePath -CertificatePath -User `
-If you used step 2 to create a new code integrity policy, and want information about merging policies together, see [Merge code integrity policies](deploy-code-integrity-policies-steps.md#merge-code-integrity-policies).
+If you used step 2 to create a new WDAC policy, and want information about merging policies together, see [Merge Windows Defender Application Control policies](steps-to-deploy-windows-defender-application-control.md#merge-windows-defender-application-control-policies).
## Deploy catalog files with Group Policy
To simplify the management of catalog files, you can use Group Policy preferences to deploy catalog files to the appropriate computers in your organization. The following process walks you through the deployment of a signed catalog file called **LOBApp-Contoso.cat** to a test OU called DG Enabled PCs with a GPO called **Contoso DG Catalog File GPO Test**.
-> **Note** This walkthrough requires that you have previously created a signed catalog file and have a computer running Windows 10 on which to test a Group Policy deployment. For more information about how to create a catalog file, see [Create catalog files](#create-catalog-files), earlier in this topic. Also, before you begin testing of a catalog file with the code integrity policy it supports, review [Add a catalog signing certificate to a code integrity policy](#add-a-catalog-signing-certificate-to-a-code-integrity-policy).
+> **Note** This walkthrough requires that you have previously created a signed catalog file and have a computer running Windows 10 on which to test a Group Policy deployment. For more information about how to create a catalog file, see [Create catalog files](#create-catalog-files), earlier in this topic. Also, before you begin testing of a catalog file with the WDAC policy it supports, review [Add a catalog signing certificate to a Windows Defender Application Control policy](#add-a-catalog-signing-certificate-to-a-windows-defender-application-control-policy).
**To deploy a catalog file with Group Policy:**
@@ -170,7 +170,7 @@ To simplify the management of catalog files, you can use Group Policy preference
2. Create a new GPO: right-click an OU, for example, the **DG Enabled PCs OU**, and then click **Create a GPO in this domain, and Link it here**, as shown in Figure 2.
- > **Note** You can use any OU name. Also, security group filtering is an option when you consider different ways of combining code integrity policies (or keeping them separate), as discussed in [Planning and getting started on the Windows Defender Device Guard deployment process](planning-and-getting-started-on-the-device-guard-deployment-process.md).
+ > **Note** You can use any OU name. Also, security group filtering is an option when you consider different ways of combining WDAC policies (or keeping them separate), as discussed in [Planning and getting started on the Windows Defender Device Guard deployment process](planning-and-getting-started-on-the-device-guard-deployment-process.md).
@@ -210,7 +210,7 @@ To simplify the management of catalog files, you can use Group Policy preference
12. Close the Group Policy Management Editor, and then update the policy on the test computer running Windows 10, by running GPUpdate.exe. When the policy has been updated, verify that the catalog file exists in C:\\Windows\\System32\\catroot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE} on the computer running Windows 10.
-Before you begin testing the deployed catalog file, make sure that the catalog signing certificate has been added to an appropriate code integrity policy, as described in [Add a catalog signing certificate to a code integrity policy](#add-a-catalog-signing-certificate-to-a-code-integrity-policy).
+Before you begin testing the deployed catalog file, make sure that the catalog signing certificate has been added to an appropriate WDAC policy, as described in [Add a catalog signing certificate to a Windows Defender Application Control policy](#add-a-catalog-signing-certificate-to-a-windows-defender-application-control-policy).
## Deploy catalog files with System Center Configuration Manager
@@ -284,7 +284,7 @@ After you create the deployment package, deploy it to a collection so that the c
11. Close the wizard.
-Before you begin testing the deployed catalog file, make sure that the catalog signing certificate has been added to an appropriate code integrity policy, as described in [Add a catalog signing certificate to a code integrity policy](#add-a-catalog-signing-certificate-to-a-code-integrity-policy).
+Before you begin testing the deployed catalog file, make sure that the catalog signing certificate has been added to an appropriate WDAC policy, as described in [Add a catalog signing certificate to a Windows Defender Application Control policy](#add-a-catalog-signing-certificate-to-a-windows-defender-application-control-policy).
## Inventory catalog files with System Center Configuration Manager
@@ -338,9 +338,9 @@ At the time of the next software inventory cycle, when the targeted clients rece
## Related topics
-- [Introduction to Windows Defender Device Guard: virtualization-based security and code integrity policies](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md)
+- [Introduction to Windows Defender Device Guard: virtualization-based security and Windows Defender Application Control](introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md)
- [Planning and getting started on the Windows Defender Device Guard deployment process](planning-and-getting-started-on-the-device-guard-deployment-process.md)
-- [Deploy Windows Defender Device Guard: deploy code integrity policies](deploy-device-guard-deploy-code-integrity-policies.md)
+- [Deploy Windows Defender Application Control](deploy-windows-defender-application-control.md)
diff --git a/windows/device-security/device-guard/deploy-code-integrity-policies-policy-rules-and-file-rules.md b/windows/device-security/device-guard/deploy-code-integrity-policies-policy-rules-and-file-rules.md
deleted file mode 100644
index c8016cda8c..0000000000
--- a/windows/device-security/device-guard/deploy-code-integrity-policies-policy-rules-and-file-rules.md
+++ /dev/null
@@ -1,118 +0,0 @@
----
-title: Deploy code integrity policies - policy rules and file rules (Windows 10)
-description: This article provides information about two elements in code integrity policies, called policy rules and file rules. Code integrity policies are part of Windows Defender Device Guard in Windows 10.
-keywords: virtualization, security, malware
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.localizationpriority: high
-author: brianlic-msft
-ms.date: 10/20/2017
----
-
-# Deploy code integrity policies: policy rules and file rules
-
-**Applies to**
-- Windows 10
-- Windows Server 2016
-
-Code integrity policies provide control over a computer running Windows 10 by specifying whether a driver or application is trusted and can be run. For an overview of code integrity, see:
-- [How Windows Defender Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md#how-windows-defender-device-guard-features-help-protect-against-threats) in "Introduction to Windows Defender Device Guard: virtualization-based security and code integrity policies."
-- [Code integrity policy formats and signing](requirements-and-deployment-planning-guidelines-for-device-guard.md#code-integrity-policy-formats-and-signing) in "Requirements and deployment planning guidelines for Windows Defender Device Guard."
-
-If you already understand the basics of code integrity policy and want procedures for creating, auditing, and merging code integrity policies, see [Deploy code integrity policies: steps](deploy-code-integrity-policies-steps.md).
-
-This topic includes the following sections:
-
-- [Overview of the process of creating code integrity policies](#overview-of-the-process-of-creating-code-integrity-policies): Helps familiarize you with the process described in this and related topics.
-- [Code integrity policy rules](#code-integrity-policy-rules): Describes one key element you specify in a policy, the *policy rules*, which control options such as audit mode or whether user mode code integrity (UMCI) is enabled in a code integrity policy.
-- [Code integrity file rule levels](#code-integrity-file-rule-levels): Describes the other key element you specify in a policy, the *file rules* (or *file rule levels*), which specify the level at which applications will be identified and trusted.
-- [Example of file rule levels in use](#example-of-file-rule-levels-in-use): Gives an example of how file rule levels can be applied.
-
-## Overview of the process of creating code integrity policies
-
-A common system imaging practice in today’s IT organization is to establish a “golden” image as a reference for what an ideal system should look like, and then use that image to clone additional company assets. Code integrity policies follow a similar methodology, that begins with the establishment of a golden computer. As with imaging, you can have multiple golden computers based on model, department, application set, and so on. Although the thought process around the creation of code integrity policies is similar to imaging, these policies should be maintained independently. Assess the necessity of additional code integrity policies based on what should be allowed to be installed and run and for whom. For more details on doing this assessment, see the planning steps in [Planning and getting started on the Windows Defender Device Guard deployment process](planning-and-getting-started-on-the-device-guard-deployment-process.md).
-
-> **Note** Each computer can have only **one** code integrity policy at a time. Whichever way you deploy this policy, it is renamed to SIPolicy.p7b and copied to **C:\\Windows\\System32\\CodeIntegrity** and, for UEFI computers, **<EFI System Partition>\\Microsoft\\Boot**. Keep this in mind when you create your code integrity policies.
-
-Optionally, code integrity policies can align with your software catalog as well as any IT department–approved applications. One straightforward method to implement code integrity policies is to use existing images to create one master code integrity policy. You do so by creating a code integrity policy from each image, and then by merging the policies. This way, what is installed on all of those images will be allowed to run, if the applications are installed on a computer based on a different image. Alternatively, you may choose to create a base applications policy and add policies based on the computer’s role or department. Organizations have a choice of how their policies are created, merged or serviced, and managed.
-
-If you plan to use an internal CA to sign catalog files or code integrity policies, see the steps in [Optional: Create a code signing certificate for code integrity policies](optional-create-a-code-signing-certificate-for-code-integrity-policies.md).
-
-## Code integrity policy rules
-
-Code integrity policies include *policy rules*, which control options such as audit mode or whether UMCI is enabled in a code integrity policy. You can modify these options in a new or existing code integrity policy. (For information about *file rules*, which specify the level at which applications will be identified and trusted, see the next section, [Code integrity file rule levels](#code-integrity-file-rule-levels).)
-
-To modify the policy rule options of an existing code integrity policy, use the [Set-RuleOption](https://technet.microsoft.com/library/mt634483.aspx) Windows PowerShell cmdlet. Note the following examples of how to use this cmdlet to add and remove a rule option on an existing code integrity policy:
-
-- To ensure that UMCI is enabled for a code integrity policy that was created with the `-UserPEs` (user mode) option, add rule option 0 to an existing policy by running the following command:
-
- ` Set-RuleOption -FilePath -Option 0`
-
- Note that a policy that was created without the `-UserPEs` option is empty of user mode executables, that is, applications. If you enable UMCI (Option 0) for such a policy and then attempt to run an application, Windows Defender Device Guard will see that the application is not on its list (which is empty of applications), and respond. In audit mode, the response is logging an event, and in enforced mode, the response is blocking the application. To create a policy that includes user mode executables (applications), when you run `New-CIPolicy`, include the `-UserPEs` option.
-
-- To disable UMCI on an existing code integrity policy, delete rule option 0 by running the following command:
-
- ` Set-RuleOption -FilePath -Option 0 -Delete`
-
-You can set several rule options within a code integrity policy. To display a list of rule options, you can type **Set-
-RuleOption -Help** in a Windows PowerShell session. Table 2 describes each rule option.
-
-> **Note** **Enabled:Audit Mode** is an important rule option. We recommend that you use this option for a period of time with all new code integrity policies, because it allows you to test them before you enforce them. With audit mode, no application is blocked—the policy just logs an event whenever an application outside the policy is started. To expand the policy so that (when enforced) it will allow these applications, you can use Windows PowerShell commands to capture the needed policy information from the event log, and then merge that information into the existing policy.
-
-> The mode—audit mode or enforced mode—is set by including or deleting **Enabled:Audit Mode** in the code integrity policy. When this option is deleted, the policy runs in enforced mode.
-
-**Table 2. Code integrity policy - policy rule options**
-
-| Rule option | Description |
-|------------ | ----------- |
-| **0 Enabled:UMCI** | Code integrity policies restrict both kernel-mode and user-mode binaries. By default, only kernel-mode binaries are restricted. Enabling this rule option validates user mode executables and scripts. |
-| **1 Enabled:Boot Menu Protection** | This option is not currently supported. |
-| **2 Required:WHQL** | By default, legacy drivers that are not Windows Hardware Quality Labs (WHQL) signed are allowed to execute. Enabling this rule requires that every executed driver is WHQL signed and removes legacy driver support. Going forward, every new Windows 10–compatible driver must be WHQL certified. |
-| **3 Enabled:Audit Mode (Default)** | Enables the execution of binaries outside of the code integrity policy but logs each occurrence in the CodeIntegrity event log, which can be used to update the existing policy before enforcement. To begin enforcing a code integrity policy, delete this option. |
-| **4 Disabled:Flight Signing** | If enabled, code integrity policies will not trust flightroot-signed binaries. This would be used in the scenario in which organizations only want to run released binaries, not flighted builds. |
-| **5 Enabled:Inherent Default Policy** | This option is not currently supported. |
-| **6 Enabled:Unsigned System Integrity Policy (Default)** | Allows the policy to remain unsigned. When this option is removed, the policy must be signed and have UpdatePolicySigners added to the policy to enable future policy modifications. |
-| **7 Allowed:Debug Policy Augmented** | This option is not currently supported. |
-| **8 Required:EV Signers** | In addition to being WHQL signed, this rule requires that drivers must have been submitted by a partner that has an Extended Verification (EV) certificate. All future Windows 10 and later drivers will meet this requirement. |
-| **9 Enabled:Advanced Boot Options Menu** | The F8 preboot menu is disabled by default for all code integrity policies. Setting this rule option allows the F8 menu to appear to physically present users. |
-| **10 Enabled:Boot Audit on Failure** | Used when the code integrity policy is in enforcement mode. When a driver fails during startup, the code integrity policy will be placed in audit mode so that Windows will load. Administrators can validate the reason for the failure in the CodeIntegrity event log. |
-
-## Code integrity file rule levels
-
-File rule levels allow administrators to specify the level at which they want to trust their applications. This level of trust could be as fine-tuned as the hash of each binary or as general as a CA certificate. You specify file rule levels both when you create a new code integrity policy from a scan and when you create a policy from audit events. In addition, to combine rule levels found in multiple policies, you can merge the policies. When merged, code integrity policies combine their file rules, so that any application that would be allowed by either of the original policies will be allowed by the combined policy.
-
-Each file rule level has its benefit and disadvantage. Use Table 3 to select the appropriate protection level for your available administrative resources and Windows Defender Device Guard deployment scenario.
-
-Table 3. Code integrity policy - file rule levels
-
-| Rule level | Description |
-|----------- | ----------- |
-| **Hash** | Specifies individual hash values for each discovered binary. Although this level is specific, it can cause additional administrative overhead to maintain the current product versions’ hash values. Each time a binary is updated, the hash value changes, therefore requiring a policy update. |
-| **FileName** | Specifies individual binary file names. Although the hash values for an application are modified when updated, the file names are typically not. This offers less specific security than the hash level but does not typically require a policy update when any binary is modified. |
-| **SignedVersion** | This combines the publisher rule with a version number. This option allows anything from the specified publisher, with a version at or above the specified version number, to run. |
-| **Publisher** | This is a combination of the PcaCertificate level (typically one certificate below the root) and the common name (CN) of the leaf certificate. This rule level allows organizations to trust a certificate from a major CA (such as Symantec), but only if the leaf certificate is from a specific company (such as Intel, for device drivers). |
-| **FilePublisher** | This is a combination of the “FileName” attribute of the signed file, plus “Publisher” (PCA certificate with CN of leaf), plus a minimum version number. This option trusts specific files from the specified publisher, with a version at or above the specified version number. |
-| **LeafCertificate** | Adds trusted signers at the individual signing certificate level. The benefit of using this level versus the individual hash level is that new versions of the product will have different hash values but typically the same signing certificate. Using this level, no policy update would be needed to run the new version of the application. However, leaf certificates have much shorter validity periods than CA certificates, so additional administrative overhead is associated with updating the code integrity policy when these certificates expire. |
-| **PcaCertificate** | Adds the highest available certificate in the provided certificate chain to signers. This is typically one certificate below the root certificate, because the scan does not validate anything beyond the certificates included in the provided signature (it does not go online or check local root stores). |
-| **RootCertificate** | Currently unsupported. |
-| **WHQL** | Trusts binaries if they have been validated and signed by WHQL. This is primarily for kernel binaries. |
-| **WHQLPublisher** | This is a combination of the WHQL and the CN on the leaf certificate and is primarily for kernel binaries. |
-| **WHQLFilePublisher** | Specifies that the binaries are validated and signed by WHQL, with a specific publisher (WHQLPublisher), and that the binary is the specified version or newer. This is primarily for kernel binaries. |
-
-> **Note** When you create code integrity policies with the [New-CIPolicy](https://technet.microsoft.com/library/mt634473.aspx) cmdlet, you can specify a primary file rule level by including the **-Level** parameter. For discovered binaries that cannot be trusted based on the primary file rule criteria, use the **-Fallback** parameter. For example, if the primary file rule level is PCACertificate but you would like to trust the unsigned applications as well, using the Hash rule level as a fallback adds the hash values of binaries that did not have a signing certificate.
-
-## Example of file rule levels in use
-
-For example, consider some IT professionals in a department that runs many servers. They decide they want their servers to run only software signed by the providers of their software and drivers, that is, the companies that provide their hardware, operating system, antivirus, and other important software. They know that their servers also run an internally written application that is unsigned but is rarely updated. They want to allow this application to run.
-
-To create the code integrity policy, they build a reference server on their standard hardware, and install all of the software that their servers are known to run. Then they run [New-CIPolicy](https://technet.microsoft.com/library/mt634473.aspx) with **-Level Publisher** (to allow software from their software providers, the "Publishers") and **-Fallback Hash** (to allow the internal, unsigned application). They enable the policy in auditing mode and gather information about any necessary software that was not included on the reference server. They merge code integrity policies into the original policy to allow that additional software to run. Then they enable the code integrity policy in enforced mode for their servers.
-
-As part of normal operations, they will eventually install software updates, or perhaps add software from the same software providers. Because the "Publisher" remains the same on those updates and software, they will not need to update their code integrity policy. If they come to a time when the internally-written, unsigned application must be updated, they must also update the code integrity policy so that the hash in the policy matches the hash of the updated internal application.
-
-They could also choose to create a catalog that captures information about the unsigned internal application, then sign and distribute the catalog. Then the internal application could be handled by code integrity policies in the same way as any other signed application. An update to the internal application would only require that the catalog be regenerated, signed, and distributed (no restarts would be required).
-
-
-## Related topics
-
-- [How Windows Defender Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md#how-windows-defender-device-guard-features-help-protect-against-threats)
-- [Deploy code integrity policies: steps](deploy-code-integrity-policies-steps.md)
diff --git a/windows/device-security/device-guard/deploy-device-guard-deploy-code-integrity-policies.md b/windows/device-security/device-guard/deploy-device-guard-deploy-code-integrity-policies.md
deleted file mode 100644
index 319f383f40..0000000000
--- a/windows/device-security/device-guard/deploy-device-guard-deploy-code-integrity-policies.md
+++ /dev/null
@@ -1,33 +0,0 @@
----
-title: Deploy Windows Defender Device Guard - deploy code integrity policies (Windows 10)
-description: This article, and the articles it links to, describe how to create code integrity policies, one of the main features that are part of Windows Defender Device Guard in Windows 10.
-keywords: virtualization, security, malware
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.localizationpriority: high
-author: brianlic-msft
-ms.date: 10/20/2017
----
-
-# Deploy Windows Defender Device Guard: deploy code integrity policies
-
-**Applies to**
-- Windows 10
-- Windows Server 2016
-
-This section includes the following topics:
-
-- [Optional: Create a code signing certificate for code integrity policies](optional-create-a-code-signing-certificate-for-code-integrity-policies.md)
-- [Deploy code integrity policies: policy rules and file rules](deploy-code-integrity-policies-policy-rules-and-file-rules.md)
-- [Deploy code integrity policies: steps](deploy-code-integrity-policies-steps.md)
-- [Deploy catalog files to support code integrity policies](deploy-catalog-files-to-support-code-integrity-policies.md)
-- [Deploy Managed Installer for Windows Defender Device Guard](deploy-managed-installer-for-device-guard.md)
-
-To increase the protection for devices that meet certain hardware requirements, you can use virtualization-based security (VBS) with your code integrity policies.
-- For requirements, see [Hardware, firmware, and software requirements for Windows Defender Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-windows-defender-device-guard) in "Requirements and deployment planning guidelines for Windows Defender Device Guard."
-- For steps, see [Deploy Windows Defender Device Guard: enable virtualization-based security](deploy-device-guard-enable-virtualization-based-security.md).
-
-## Related topics
-
-[Introduction to Windows Defender Device Guard: virtualization-based security and code integrity policies](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md)
-
diff --git a/windows/device-security/device-guard/deploy-device-guard-enable-virtualization-based-security.md b/windows/device-security/device-guard/deploy-device-guard-enable-virtualization-based-security.md
index a4823e4143..ab3baf28eb 100644
--- a/windows/device-security/device-guard/deploy-device-guard-enable-virtualization-based-security.md
+++ b/windows/device-security/device-guard/deploy-device-guard-enable-virtualization-based-security.md
@@ -9,25 +9,30 @@ author: brianlic-msft
ms.date: 10/20/2017
---
-# Deploy Windows Defender Device Guard: enable virtualization-based security
+# Enable virtualization-based protection of code integrity
**Applies to**
- Windows 10
- Windows Server 2016
-Hardware-based security features, also called virtualization-based security or VBS, reinforce Windows Defender Application Control. There are a few steps to configure virtualization-based security:
+Virtualization-based protection of code integrity (herein referred to as Hypervisor-protected Code Integrity, or HVCI) is a powerful system mitigation that leverages hardware virtualization and the Windows Hyper-V hypervisor to protect Windows kernel-mode processes against the injection and execution of malicious or unverified code. Code integrity validation is performed in a secure environment that is resistant to attack from malicious software, and page permissions for kernel mode are set and maintained by the Hyper-V hypervisor. When used with Windows Defender Application Control (WDAC), HVCI helps achieve a locked down configuration state known as Windows Defender Device Guard that can block many types of malware from running on computers running Windows 10 and Windows Server 2016.
-1. **Decide whether to use the procedures in this topic, or to use the Windows Defender Device Guard readiness tool**. To enable VBS, you can use [the Device Guard and Credential Guard hardware readiness tool](https://www.microsoft.com/en-us/download/details.aspx?id=53337) or follow the procedures in this topic.
+> [!NOTE]
+> Some applications, including device drivers, may be incompatible with HVCI. This can cause devices or software to malfunction and in rare cases may result in a Blue Screen. Such issues may occur after HVCI has been turned on or during the enablement process itself. We recommend testing thoroughly before enabling HVCI on production systems.
-2. **Verify that hardware and firmware requirements are met**. Verify that your client computers have the hardware and firmware to run VBS. For a list of requirements, see [Hardware, firmware, and software requirements for Windows Defender Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-windows-defender-device-guard).
+Use the following procedure to enable virtualization-based protection of code integrity:
-3. **Enable the necessary Windows features**. You can use the [hardware readiness tool](https://www.microsoft.com/en-us/download/details.aspx?id=53337) or see [Windows feature requirements for virtualization-based security](#windows-feature-requirements-for-virtualization-based-security-and-device-guard).
+1. **Decide whether to use the procedures in this topic, or to use the Windows Defender Device Guard readiness tool**. To enable HVCI, you can use [the Device Guard and Credential Guard hardware readiness tool](https://www.microsoft.com/en-us/download/details.aspx?id=53337) or follow the procedures in this topic.
-4. **Enable additional features as desired**. You can use the [hardware readiness tool](https://www.microsoft.com/en-us/download/details.aspx?id=53337) or see [Enable virtualization-based security (VBS)](#enable-virtualization-based-security-vbs-and-device-guard).
+2. **Verify that hardware and firmware requirements are met**. Verify that your client computers have the hardware and firmware to run HVCI. For a list of requirements, see [Hardware, firmware, and software requirements for Windows Defender Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-windows-defender-device-guard).
-## Windows feature requirements for virtualization-based security and Windows Defender Device Guard
+3. **Enable the necessary Windows features**. You can use the [hardware readiness tool](https://www.microsoft.com/en-us/download/details.aspx?id=53337) or see [Windows feature requirements for virtualization-based security](#windows-feature-requirements-for-virtualization-based-protection-of-code-integrity).
-Make sure these operating system features are enabled before you can enable VBS:
+4. **Enable additional features as desired**. You can use the [hardware readiness tool](https://www.microsoft.com/en-us/download/details.aspx?id=53337) or see [Enable virtualization-based protection of code integrity](#enable-virtualization-based-protection-of-code-integrity).
+
+## Windows feature requirements for virtualization-based protection of code integrity
+
+Make sure these operating system features are enabled before you can enable HVCI:
- Beginning with Windows 10, version 1607 or Windows Server 2016:
Hyper-V Hypervisor, which is enabled automatically. No further action is needed.
@@ -37,16 +42,16 @@ Hyper-V Hypervisor and Isolated User Mode (shown in Figure 1).
-**Figure 1. Enable operating system features for VBS, Windows 10, version 1511**
+**Figure 1. Enable operating system features for HVCI, Windows 10, version 1511**
> [!NOTE]
> You can configure these features by using Group Policy or Dism.exe, or manually by using Windows PowerShell or the Windows Features dialog box.
-## Enable Virtualization Based Security (VBS) and Windows Defender Device Guard
+## Enable virtualization-based protection of code integrity
-If you don't want to use the [hardware readiness tool](https://www.microsoft.com/en-us/download/details.aspx?id=53337), you can use Group Policy or the Registry to enable VBS.
+If you don't want to use the [hardware readiness tool](https://www.microsoft.com/en-us/download/details.aspx?id=53337), you can use Group Policy or the Registry to enable HVCI.
-### Use Group Policy to enable VBS and Windows Defender Device Guard
+### Use Group Policy to enable virtualization-based protection of code integrity
1. To create a new GPO, right-click the OU where you want to link the GPO, and then click **Create a GPO in this domain, and Link it here**.
@@ -60,12 +65,12 @@ If you don't want to use the [hardware readiness tool](https://www.microsoft.com
- Figure 3. Enable VBS
+ Figure 3. Enable virtualization-based security (VBS)
5. Select the **Enabled** button. For **Select Platform Security Level**:
- **Secure Boot** provides as much protection as a computer’s hardware can support. If the computer does not have input/output memory management units (IOMMUs), enable **Secure Boot**.
- - **Secure Boot with DMA** enables Secure Boot—and VBS itself—only on a computer that supports DMA, that is, a computer with IOMMUs. With this setting, any computer without IOMMUs will not have VBS (hardware-based) protection, although it can have Windows Defender Application Control enabled. For information about how VBS uses the hypervisor to strengthen protections provided by a code integrity policy, see [How Windows Defender Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md#how-windows-defender-device-guard-features-help-protect-against-threats).
+ - **Secure Boot with DMA** enables Secure Boot—and VBS itself—only on a computer that supports DMA, that is, a computer with IOMMUs. With this setting, any computer without IOMMUs will not have VBS or HVCI protection, although it can have WDAC enabled. For information about how VBS uses the hypervisor to strengthen protections provided by WDAC, see [How Windows Defender Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md#how-windows-defender-device-guard-features-help-protect-against-threats).
For **Virtualization Based Protection of Code Integrity**:
@@ -75,20 +80,20 @@ If you don't want to use the [hardware readiness tool](https://www.microsoft.com
- Figure 5. Configure VBS, Lock setting (in Windows 10, version 1607)
+ Figure 5. Configure HVCI, Lock setting (in Windows 10, version 1607)
7. Close the Group Policy Management Editor, and then restart the Windows 10 test computer. The settings will take effect upon restart.
8. Check Device Guard logs in Event Viewer at **Applications and Services Logs\\Microsoft\\Windows\\DeviceGuard-GPEXT\\Operational** for Event ID 7000, which contains the selected settings within a GPO that has been successfully processed. This event is logged only when Group Policy is used.
-### Use registry keys to enable VBS and Windows Defender Device Guard
+### Use registry keys to enable virtualization-based protection of code integrity
-Set the following registry keys to enable VBS and Windows Defender Device Guard. This provides exactly the same set of configuration options provided by Group Policy.
+Set the following registry keys to enable HVCI. This provides exactly the same set of configuration options provided by Group Policy.
> [!IMPORTANT]
-> - Among the commands that follow, you can choose settings for **Secure Boot** and **Secure Boot with DMA**. In most situations, we recommend that you choose **Secure Boot**. This option provides Secure Boot with as much protection as is supported by a given computer’s hardware. A computer with input/output memory management units (IOMMUs) will have Secure Boot with DMA protection. A computer without IOMMUs will simply have Secure Boot enabled. In contrast, with **Secure Boot with DMA**, the setting will enable Secure Boot—and VBS itself—only on a computer that supports DMA, that is, a computer with IOMMUs. With this setting, any computer without IOMMUs will not have VBS (hardware-based) protection, although it can still have code integrity policies enabled. For information about how VBS uses the hypervisor to strengthen protections provided by a code integrity policy, see [How Windows Defender Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md#how-windows-defender-device-guard-features-help-protect-against-threats).
+> - Among the commands that follow, you can choose settings for **Secure Boot** and **Secure Boot with DMA**. In most situations, we recommend that you choose **Secure Boot**. This option provides Secure Boot with as much protection as is supported by a given computer’s hardware. A computer with input/output memory management units (IOMMUs) will have Secure Boot with DMA protection. A computer without IOMMUs will simply have Secure Boot enabled. In contrast, with **Secure Boot with DMA**, the setting will enable Secure Boot—and VBS itself—only on a computer that supports DMA, that is, a computer with IOMMUs. With this setting, any computer without IOMMUs will not have VBS or HVCI protection, although it can still have WDAC enabled. For information about how VBS uses the hypervisor to strengthen protections provided by WDAC, see [How Windows Defender Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md#how-windows-defender-device-guard-features-help-protect-against-threats).
> - All drivers on the system must be compatible with virtualization-based protection of code integrity; otherwise, your system may fail. We recommend that you enable these features on a group of test computers before you enable them on users' computers.
#### For Windows 1607 and above
@@ -284,6 +289,6 @@ Figure 6. Windows Defender Device Guard properties in the System Summary
## Related topics
-- [Introduction to Windows Defender Device Guard: virtualization-based security and code integrity policies](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md)
+- [Introduction to Windows Defender Device Guard: virtualization-based security and Windows Defender Application Control](introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md)
-- [Deploy Windows Defender Device Guard: deploy code integrity policies](deploy-device-guard-deploy-code-integrity-policies.md)
+- [Deploy Windows Defender Application Control](deploy-windows-defender-application-control.md)
diff --git a/windows/device-security/device-guard/deploy-managed-installer-for-device-guard.md b/windows/device-security/device-guard/deploy-managed-installer-for-device-guard.md
index ae71744549..c3cefa3e19 100644
--- a/windows/device-security/device-guard/deploy-managed-installer-for-device-guard.md
+++ b/windows/device-security/device-guard/deploy-managed-installer-for-device-guard.md
@@ -9,9 +9,9 @@ author: mdsakibMSFT
ms.date: 10/20/2017
---
-# Deploy Managed Installer for Windows Defender Device Guard
+# Deploy Managed Installer for Windows Defender Application Control
-Creating and maintaining application execution control policies has always been challenging, and finding ways to address this issue has been a frequently-cited request for customers of AppLocker and Windows Defender Device Guard [configurable code integrity (CI)](device-guard-deployment-guide.md).
+Creating and maintaining application execution control policies has always been challenging, and finding ways to address this issue has been a frequently-cited request for customers of AppLocker and Windows Defender Application Control (WDAC).
This is especially true for enterprises with large, ever changing software catalogs.
Windows 10, version 1703 (also known as the Windows 10 Creators Update) provides a new option, known as a managed installer, that allows IT administrators to automatically authorize applications deployed and installed by a designated software distribution solution, such as System Center Configuration Manager.
@@ -22,23 +22,23 @@ A managed installer helps an IT admin balance security and manageability require
A managed installer uses a new rule collection in AppLocker to specify one or more executables that are trusted by the organization as an authorized source for application deployment.
Specifying an executable as a managed installer will cause Windows to tag files that are written from the executable’s process (or processes it launches) as having originated from a trusted installation authority.
-Once the IT administrator adds the Allow: Managed Installer option to a configurable CI policy for Windows Defender Device Guard, the configurable CI component will subsequently check for the presence of the origin information when evaluating other application execution control rules specified in the policy.
+Once the IT administrator adds the Allow: Managed Installer option to a WDAC policy, the WDAC component will subsequently check for the presence of the origin information when evaluating other application execution control rules specified in the policy.
If there are no deny rules present for the file, it will be authorized based on the managed installer origin information.
> [!NOTE]
-> Admins needs to ensure that there is a CI policy in place to allow the system to boot and run any other authorized applications that may not be deployed through a managed installer.
+> Admins needs to ensure that there is a WDAC policy in place to allow the system to boot and run any other authorized applications that may not be deployed through a managed installer.
>
-> Examples of CI policies available in C:\Windows\schemas\CodeIntegrity\ExamplePolicies help authorize Windows OS components, WHQL signed drivers and all Store apps.
-> Admins can reference and customize them as needed for their Windows Defender Device Guard deployment.
+> Examples of WDAC policies available in C:\Windows\schemas\CodeIntegrity\ExamplePolicies help authorize Windows OS components, WHQL signed drivers and all Store apps.
+> Admins can reference and customize them as needed for their Windows Defender Application Control deployment or create a custom WDAC policy as described in [Deploy Windows Defender Application Control: steps](steps-to-deploy-windows-defender-application-control.md#create-a-windows-defender-application-control-policy-from-a-reference-computer).
-## Configuring a managed installer with AppLocker and configurable code integrity policy
+## Configuring a managed installer with AppLocker and Windows Defender Application Control
-Setting up managed installer tracking and application execution enforcement requires applying both an AppLocker and configurable CI policy with specific rules and options enabled.
+Setting up managed installer tracking and application execution enforcement requires applying both an AppLocker and WDAC policy with specific rules and options enabled.
There are three primary steps to keep in mind:
- Specify managed installers using the Managed Installer rule collection in AppLocker policy
- Enable service enforcement in AppLocker policy
-- Enable the managed installer option in a configurable CI policy
+- Enable the managed installer option in a WDAC policy
### Specify managed installers using the Managed Installer rule collection in AppLocker policy
@@ -105,45 +105,29 @@ For example:
```
-### Enable the managed installer option in CI policy
+### Enable the managed installer option in WDAC policy
-In order to enable trust for the binaries laid down by managed installers, the Allow: Managed Installer option must be specified in your configurable CI policy. .
+In order to enable trust for the binaries laid down by managed installers, the Allow: Managed Installer option must be specified in your WDAC policy.
This can be done by using the [Set-RuleOption cmdlet](https://technet.microsoft.com/itpro/powershell/windows/configci/set-ruleoption).
An example of the managed installer option being set in policy is shown below.
```code
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
```
@@ -152,32 +136,31 @@ An example of the managed installer option being set in policy is shown below.
Since managed installer is a heuristic-based mechanism, it does not provide the same security guarantees that explicit allow or deny rules do.
It is best suited for deployment to systems where each user is configured as a standard user and where all software is deployed and installed by a software distribution solution, such as System Center Configuration Manager.
-Users with administrator privileges on the system may be able to circumvent the intent of Windows Defender Device Guard configurable CI when the managed installer option is allowed.
-If the authorized managed installer process performs installations in the context of a user with standard privileges, then it is possible that standard users may be able to circumvent the intent of Windows Defender Device Guard configurable CI policy.
-In some cases, the heuristic tracking and authorizing applications may be active on the first execution of an application that is laid down from a designated managed installer.
-Typically, this would occur if the managed installer executes the application directly as part of the installation process.
+Users with administrator privileges or malware running as an administrator user on the system may be able to circumvent the intent of Windows Defender Application Control when the managed installer option is allowed.
+If the authorized managed installer process performs installations in the context of a user with standard privileges, then it is possible that standard users or malware running as standard user may be able to circumvent the intent of Windows Defender Application Control.
+Some application installers include an option to automatically run the application at the end of the installation process. If this happens when the installer is run by a managed installer, then the managed installer's heuristic tracking and authorization may continue to apply to all files created during the first run of the application. This could result in over-authorization for executables that were not intended.
To avoid this, ensure that the application deployment solution being used as a managed installer limits running applications as part of installation.
## Known limitations with managed installer
- Application execution control based on managed installer does not support applications that self-update.
-If an application deployed by a managed installer subsequently updates itself, the updated application files will no longer include the managed installer origin EA information and will not be authorized to run.
+If an application deployed by a managed installer subsequently updates itself, the updated application files will no longer include the managed installer origin information and will not be authorized to run.
Enterprises should deploy and install all application updates using the managed installer.
In some cases, it may be possible to also designate an application binary that performs the self-updates as a managed installer.
Proper review for functionality and security should be performed for the application before using this method.
-- Although configurable CI policies can be deployed in both audit and enforced mode, the managed installer option is currently only recommended for use with policies set to enforced except in lab environments.
-Using the managed installer option with configurable CI policies set to audit only may result in unexpected behavior if the policy is subsequently changed to enforced mode.
+- Although WDAC policies can be deployed in both audit and enforced mode, the managed installer option is currently only recommended for use with policies set to enforced except in lab environments.
+Using the managed installer option with WDAC policies set to audit only may result in unexpected behavior if the policy is subsequently changed to enforced mode.
-- Modern apps deployed through a managed installer will not be tracked by the heuristic and will need to be appropriately authorized in policy.
+- Modern apps deployed through a managed installer will not be tracked by the managed installer heuristic and will need to be separately authorized in your WDAC policy.
-- Executables that extract files and then attempt to execute may fail the heuristic.
+- Executables that extract files and then attempt to execute may not be allowed by the managed installer heuristic.
In some cases, it may be possible to also designate an application binary that performs such an operation as a managed installer.
Proper review for functionality and security should be performed for the application before using this method.
- The managed installer heuristic does not authorize drivers.
-The configurable code integrity policy being used must have rules that allow the necessary drivers to run.
+The WDAC policy must have rules that allow the necessary drivers to run.
-- In some cases, the code integrity logs will contain error events for native images generated for .NET assemblies.
+- In some cases, the code integrity logs where WDAC errors and warnings are written will contain error events for native images generated for .NET assemblies.
Typically, the error is functionally benign as a blocked native image will result in the corresponding assembly being re-interpreted.
-Review for functionality and performance for the related applications using the native images maybe necessary in some cases.
\ No newline at end of file
+Review for functionality and performance for the related applications using the native images maybe necessary in some cases.
diff --git a/windows/device-security/device-guard/deploy-windows-defender-application-control-policy-rules-and-file-rules.md b/windows/device-security/device-guard/deploy-windows-defender-application-control-policy-rules-and-file-rules.md
new file mode 100644
index 0000000000..3b2d35881e
--- /dev/null
+++ b/windows/device-security/device-guard/deploy-windows-defender-application-control-policy-rules-and-file-rules.md
@@ -0,0 +1,124 @@
+---
+title: Deploy code integrity policies - policy rules and file rules (Windows 10)
+description: This article provides information about two elements in code integrity policies, called policy rules and file rules. Code integrity policies are part of Windows Defender Device Guard in Windows 10.
+keywords: virtualization, security, malware
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.localizationpriority: high
+author: brianlic-msft
+ms.date: 10/20/2017
+---
+
+# Deploy Windows Defender Application Control: policy rules and file rules
+
+**Applies to**
+- Windows 10
+- Windows Server 2016
+
+Windows Defender Application Control (WDAC) provides control over a computer running Windows 10 by specifying whether a driver or application is trusted and can be run. For an overview of WDAC, see:
+- [How Windows Defender Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md#how-windows-defender-device-guard-features-help-protect-against-threats) in "Introduction to Windows Defender Device Guard: virtualization-based security and Windows Defender Application Control."
+- [Windows Defender Application Control policy formats and signing](requirements-and-deployment-planning-guidelines-for-device-guard.md#windows-defender-application-control-policy-formats-and-signing) in "Requirements and deployment planning guidelines for Windows Defender Device Guard."
+
+If you already understand the basics of WDAC and want procedures for creating, auditing, and merging WDAC policies, see [Deploy Windows Defender Application Control: steps](steps-to-deploy-windows-defender-application-control.md).
+
+This topic includes the following sections:
+
+- [Overview of the process of creating Windows Defender Application Control policies](#overview-of-the-process-of-creating-windows-defender-application-control-policies): Helps familiarize you with the process described in this and related topics.
+- [Windows Defender Application Control policy rules](#windows-defender-application-control-policy-rules): Describes one key element you specify in a policy, the *policy rules*, which control options such as audit mode or whether user mode code integrity (UMCI) is enabled in a WDAC policy.
+- [Windows Defender Application Control file rule levels](#windows-defender-application-control-file-rule-levels): Describes the other key element you specify in a policy, the *file rules* (or *file rule levels*), which specify the level at which applications will be identified and trusted.
+- [Example of file rule levels in use](#example-of-file-rule-levels-in-use): Gives an example of how file rule levels can be applied.
+
+## Overview of the process of creating Windows Defender Application Control policies
+
+A common system imaging practice in today’s IT organization is to establish a “golden” image as a reference for what an ideal system should look like, and then use that image to clone additional company assets. WDAC policies follow a similar methodology, that begins with the establishment of a golden computer. As with imaging, you can have multiple golden computers based on model, department, application set, and so on. Although the thought process around the creation of WDAC policies is similar to imaging, these policies should be maintained independently. Assess the necessity of additional WDAC policies based on what should be allowed to be installed and run and for whom. For more details on doing this assessment, see the planning steps in [Planning and getting started on the Windows Defender Device Guard deployment process](planning-and-getting-started-on-the-device-guard-deployment-process.md).
+
+> **Note** Each computer can have only **one** WDAC policy at a time. Whichever way you deploy this policy, it is renamed to SIPolicy.p7b and copied to **C:\\Windows\\System32\\CodeIntegrity** and, for UEFI computers, **<EFI System Partition>\\Microsoft\\Boot**. Keep this in mind when you create your WDAC policies.
+
+Optionally, WDAC can align with your software catalog as well as any IT department–approved applications. One straightforward method to implement WDAC is to use existing images to create one master WDAC policy. You do so by creating a WDAC policy from each image, and then by merging the policies. This way, what is installed on all of those images will be allowed to run, if the applications are installed on a computer based on a different image. Alternatively, you may choose to create a base applications policy and add policies based on the computer’s role or department. Organizations have a choice of how their policies are created, merged or serviced, and managed.
+
+If you plan to use an internal CA to sign catalog files or WDAC policies, see the steps in [Optional: Create a code signing certificate for Windows Defender Application Control](optional-create-a-code-signing-certificate-for-windows-defender-application-control.md).
+
+## Windows Defender Application Control policy rules
+
+WDAC policies include *policy rules*, which control options such as audit mode or whether UMCI is enabled in a WDAC policy. You can modify these options in a new or existing WDAC policy. (For information about *file rules*, which specify the level at which applications will be identified and trusted, see the next section, [Windows Defender Application Control file rule levels](#windows-defender-application-control-file-rule-levels).)
+
+To modify the policy rule options of an existing WDAC policy, use the [Set-RuleOption](https://technet.microsoft.com/library/mt634483.aspx) Windows PowerShell cmdlet. Note the following examples of how to use this cmdlet to add and remove a rule option on an existing WDAC policy:
+
+- To ensure that UMCI is enabled for a WDAC policy that was created with the `-UserPEs` (user mode) option, add rule option 0 to an existing policy by running the following command:
+
+ ` Set-RuleOption -FilePath -Option 0`
+
+ Note that a policy that was created without the `-UserPEs` option is empty of user mode executables, that is, applications. If you enable UMCI (Option 0) for such a policy and then attempt to run an application, Windows Defender Application Control will see that the application is not on its list (which is empty of applications), and respond. In audit mode, the response is logging an event, and in enforced mode, the response is blocking the application. To create a policy that includes user mode executables (applications), when you run `New-CIPolicy`, include the `-UserPEs` option.
+
+- To disable UMCI on an existing WDAC policy, delete rule option 0 by running the following command:
+
+ ` Set-RuleOption -FilePath -Option 0 -Delete`
+
+You can set several rule options within a WDAC policy. To display a list of rule options, you can type **Set-
+RuleOption -Help** in a Windows PowerShell session. Table 2 describes each rule option.
+
+> **Note** **Enabled:Audit Mode** is an important rule option. We recommend that you use this option for a period of time with all new WDAC policies, because it allows you to test them before you enforce them. With audit mode, no application is blocked—the policy just logs an event whenever an application outside the policy is started. To expand the policy so that (when enforced) it will allow these applications, you can use Windows PowerShell commands to capture the needed policy information from the event log, and then merge that information into the existing policy.
+
+> The mode—audit mode or enforced mode—is set by including or deleting **Enabled:Audit Mode** in the WDAC policy. When this option is deleted, the policy runs in enforced mode.
+
+**Table 2. Windows Defender Application Control policy - policy rule options**
+
+| Rule option | Description |
+|------------ | ----------- |
+| **0 Enabled:UMCI** | WDAC policies restrict both kernel-mode and user-mode binaries. By default, only kernel-mode binaries are restricted. Enabling this rule option validates user mode executables and scripts. |
+| **1 Enabled:Boot Menu Protection** | This option is not currently supported. |
+| **2 Required:WHQL** | By default, legacy drivers that are not Windows Hardware Quality Labs (WHQL) signed are allowed to execute. Enabling this rule requires that every executed driver is WHQL signed and removes legacy driver support. Going forward, every new Windows 10–compatible driver must be WHQL certified. |
+| **3 Enabled:Audit Mode (Default)** | Enables the execution of binaries outside of the WDAC policy but logs each occurrence in the CodeIntegrity event log, which can be used to update the existing policy before enforcement. To begin enforcing a WDAC policy, delete this option. |
+| **4 Disabled:Flight Signing** | If enabled, WDAC policies will not trust flightroot-signed binaries. This would be used in the scenario in which organizations only want to run released binaries, not flighted builds. |
+| **5 Enabled:Inherent Default Policy** | This option is not currently supported. |
+| **6 Enabled:Unsigned System Integrity Policy (Default)** | Allows the policy to remain unsigned. When this option is removed, the policy must be signed and have UpdatePolicySigners added to the policy to enable future policy modifications. |
+| **7 Allowed:Debug Policy Augmented** | This option is not currently supported. |
+| **8 Required:EV Signers** | In addition to being WHQL signed, this rule requires that drivers must have been submitted by a partner that has an Extended Verification (EV) certificate. All future Windows 10 and later drivers will meet this requirement. |
+| **9 Enabled:Advanced Boot Options Menu** | The F8 preboot menu is disabled by default for all WDAC policies. Setting this rule option allows the F8 menu to appear to physically present users. |
+| **10 Enabled:Boot Audit on Failure** | Used when the WDAC policy is in enforcement mode. When a driver fails during startup, the WDAC policy will be placed in audit mode so that Windows will load. Administrators can validate the reason for the failure in the CodeIntegrity event log. |
+| **11 Disabled:Script Enforcement** | WDAC policies also restrict scripts and MSIs, and PowerShell runs in constrained language mode. Enabling this rule option will allow unsigned scripts to run and will leave PowerShell in full language mode. |
+| **12 Required:Enforce Store Applications** | If this rule option is enabled, WDAC policies will also apply to Universal Windows applications. |
+| **13 Enabled:Managed Installer** | Use this option to automatically allow applications installed by a software distribution solution, such as System Center Configuration Manager, that has been defined as a managed installer. |
+| **14 Enabled:Intelligent Security Graph Authorization** | Use this option to automatically allow applications with "known good" reputation as defined by Microsoft’s Intelligent Security Graph (ISG). |
+| **15 Enabled:Invalidate EAs on Reboot** | When the Intelligent Security Graph option (14) is used, WDAC sets an extended file attribute that indicates that the file was authorized to run. This option will cause WDAC to periodically re-validate the reputation for files that were authorized by the ISG.|
+| **16 Enabled:Update Policy No Reboot** | Use this option to allow future WDAC policy updates to apply without requiring a system reboot. |
+
+## Windows Defender Application Control file rule levels
+
+File rule levels allow administrators to specify the level at which they want to trust their applications. This level of trust could be as fine-tuned as the hash of each binary or as general as a CA certificate. You specify file rule levels both when you create a new WDAC policy from a scan and when you create a policy from audit events. In addition, to combine rule levels found in multiple policies, you can merge the policies. When merged, WDAC policies combine their file rules, so that any application that would be allowed by either of the original policies will be allowed by the combined policy.
+
+Each file rule level has its benefit and disadvantage. Use Table 3 to select the appropriate protection level for your available administrative resources and Windows Defender Application Control deployment scenario.
+
+Table 3. Windows Defender Application Control policy - file rule levels
+
+| Rule level | Description |
+|----------- | ----------- |
+| **Hash** | Specifies individual hash values for each discovered binary. Although this level is specific, it can cause additional administrative overhead to maintain the current product versions’ hash values. Each time a binary is updated, the hash value changes, therefore requiring a policy update. |
+| **FileName** | Specifies individual binary file names. Although the hash values for an application are modified when updated, the file names are typically not. This offers less specific security than the hash level but does not typically require a policy update when any binary is modified. |
+| **SignedVersion** | This combines the publisher rule with a version number. This option allows anything from the specified publisher, with a version at or above the specified version number, to run. |
+| **Publisher** | This is a combination of the PcaCertificate level (typically one certificate below the root) and the common name (CN) of the leaf certificate. This rule level allows organizations to trust a certificate from a major CA (such as Symantec), but only if the leaf certificate is from a specific company (such as Intel, for device drivers). |
+| **FilePublisher** | This is a combination of the “FileName” attribute of the signed file, plus “Publisher” (PCA certificate with CN of leaf), plus a minimum version number. This option trusts specific files from the specified publisher, with a version at or above the specified version number. |
+| **LeafCertificate** | Adds trusted signers at the individual signing certificate level. The benefit of using this level versus the individual hash level is that new versions of the product will have different hash values but typically the same signing certificate. Using this level, no policy update would be needed to run the new version of the application. However, leaf certificates have much shorter validity periods than CA certificates, so additional administrative overhead is associated with updating the WDAC policy when these certificates expire. |
+| **PcaCertificate** | Adds the highest available certificate in the provided certificate chain to signers. This is typically one certificate below the root certificate, because the scan does not validate anything beyond the certificates included in the provided signature (it does not go online or check local root stores). |
+| **RootCertificate** | Currently unsupported. |
+| **WHQL** | Trusts binaries if they have been validated and signed by WHQL. This is primarily for kernel binaries. |
+| **WHQLPublisher** | This is a combination of the WHQL and the CN on the leaf certificate and is primarily for kernel binaries. |
+| **WHQLFilePublisher** | Specifies that the binaries are validated and signed by WHQL, with a specific publisher (WHQLPublisher), and that the binary is the specified version or newer. This is primarily for kernel binaries. |
+
+> **Note** When you create WDAC policies with the [New-CIPolicy](https://technet.microsoft.com/library/mt634473.aspx) cmdlet, you can specify a primary file rule level by including the **-Level** parameter. For discovered binaries that cannot be trusted based on the primary file rule criteria, use the **-Fallback** parameter. For example, if the primary file rule level is PCACertificate but you would like to trust the unsigned applications as well, using the Hash rule level as a fallback adds the hash values of binaries that did not have a signing certificate.
+
+## Example of file rule levels in use
+
+For example, consider some IT professionals in a department that runs many servers. They decide they want their servers to run only software signed by the providers of their software and drivers, that is, the companies that provide their hardware, operating system, antivirus, and other important software. They know that their servers also run an internally written application that is unsigned but is rarely updated. They want to allow this application to run.
+
+To create the WDAC policy, they build a reference server on their standard hardware, and install all of the software that their servers are known to run. Then they run [New-CIPolicy](https://technet.microsoft.com/library/mt634473.aspx) with **-Level Publisher** (to allow software from their software providers, the "Publishers") and **-Fallback Hash** (to allow the internal, unsigned application). They enable the policy in auditing mode and gather information about any necessary software that was not included on the reference server. They merge WDAC policies into the original policy to allow that additional software to run. Then they enable the WDAC policy in enforced mode for their servers.
+
+As part of normal operations, they will eventually install software updates, or perhaps add software from the same software providers. Because the "Publisher" remains the same on those updates and software, they will not need to update their WDAC policy. If they come to a time when the internally-written, unsigned application must be updated, they must also update the WDAC policy so that the hash in the policy matches the hash of the updated internal application.
+
+They could also choose to create a catalog that captures information about the unsigned internal application, then sign and distribute the catalog. Then the internal application could be handled by WDAC policies in the same way as any other signed application. An update to the internal application would only require that the catalog be regenerated, signed, and distributed (no restarts would be required).
+
+
+## Related topics
+
+- [How Windows Defender Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md#how-windows-defender-device-guard-features-help-protect-against-threats)
+- [Deploy Windows Defender Application Control: steps](steps-to-deploy-windows-defender-application-control.md)
diff --git a/windows/device-security/device-guard/deploy-windows-defender-application-control.md b/windows/device-security/device-guard/deploy-windows-defender-application-control.md
new file mode 100644
index 0000000000..8becbe0a0e
--- /dev/null
+++ b/windows/device-security/device-guard/deploy-windows-defender-application-control.md
@@ -0,0 +1,33 @@
+---
+title: Deploy Windows Defender Device Guard - deploy code integrity policies (Windows 10)
+description: This article, and the articles it links to, describe how to create code integrity policies, one of the main features that are part of Windows Defender Device Guard in Windows 10.
+keywords: virtualization, security, malware
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.localizationpriority: high
+author: brianlic-msft
+ms.date: 10/20/2017
+---
+
+# Deploy Windows Defender Application Control
+
+**Applies to**
+- Windows 10
+- Windows Server 2016
+
+This section includes the following topics:
+
+- [Optional: Create a code signing certificate for Windows Defender Application Control](optional-create-a-code-signing-certificate-for-windows-defender-application-control.md)
+- [Deploy Windows Defender Application Control: policy rules and file rules](deploy-windows-defender-application-control-policy-rules-and-file-rules.md)
+- [Deploy Windows Defender Application Control: steps](steps-to-deploy-windows-defender-application-control.md)
+- [Deploy catalog files to support Windows Defender Application Control](deploy-catalog-files-to-support-windows-defender-application-control.md)
+- [Deploy Managed Installer for Windows Defender Application Control](deploy-managed-installer-for-device-guard.md)
+
+To increase the protection for devices that meet certain hardware requirements, you can use virtualization-based protection of code integrity with your Windows Defender Application Control (WDAC) policies.
+- For requirements, see [Hardware, firmware, and software requirements for Windows Defender Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-windows-defender-device-guard) in "Requirements and deployment planning guidelines for Windows Defender Device Guard."
+- For steps, see [Enable virtualization-based protection of code integrity](deploy-device-guard-enable-virtualization-based-security.md).
+
+## Related topics
+
+[Introduction to Windows Defender Device Guard: virtualization-based security and Windows Defender Application Control](introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md)
+
diff --git a/windows/device-security/device-guard/device-guard-deployment-guide.md b/windows/device-security/device-guard/device-guard-deployment-guide.md
index 4b9c59e523..0408fa63d3 100644
--- a/windows/device-security/device-guard/device-guard-deployment-guide.md
+++ b/windows/device-security/device-guard/device-guard-deployment-guide.md
@@ -16,32 +16,29 @@ ms.date: 10/20/2017
- Windows 10
- Windows Server 2016
-Windows Defender Device Guard is a combination of enterprise-related hardware and software security features that run on Windows 10 Enterprise edition and Windows Server. When these features are configured together, Windows Defender Device Guard will lock a device down so that it can only run trusted applications that you define in your code integrity policies. If the app isn’t trusted, it can’t run, period.
+With thousands of new malicious files created every day, using traditional methods like antivirus solutions—signature-based detection to fight against malware—provides an inadequate defense against new attacks. Windows Defender Device Guard describes a locked-down device configuration state that uses multiple enterprise-related hardware and software security features that run on Windows 10 Enterprise edition and Windows Server. When these features are configured together, Windows Defender Device Guard changes from a mode where apps are trusted unless blocked by an antivirus or other security solution, to a mode where the operating system trusts only apps authorized by your enterprise. If the app isn’t trusted, it can’t run, period.
-> [!NOTE]
-> Beginning with Windows 10, version 1709, configurable code integrity policies are known as Windows Defender Application Control.
-
-With hardware that meets basic qualifications, Windows Defender Device Guard can also use virtualization-based security to isolate the Code Integrity service and run it alongside the Windows kernel in a hypervisor-protected container. Even if an attacker manages to get control of the Windows kernel itself, the ability to run malicious executable code is much less likely.
+Windows Defender Device Guard also uses virtualization-based security to isolate the Code Integrity service and run it alongside the Windows kernel in a hypervisor-protected container. Even if an attacker manages to get control of the Windows kernel itself, the ability to run malicious executable code is much less likely.
This guide explores the individual features in Windows Defender Device Guard as well as how to plan for, configure, and deploy them. It includes:
-- [Introduction to Windows Defender Device Guard: virtualization-based security and code integrity policies](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md)
+- [Introduction to Windows Defender Device Guard: virtualization-based security and Windows Defender Application Control](introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md)
- [Requirements and deployment planning guidelines for Windows Defender Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md)
- [Planning and getting started on the Windows Defender Device Guard deployment process](planning-and-getting-started-on-the-device-guard-deployment-process.md)
-- [Deploy Windows Defender Device Guard: deploy code integrity policies](deploy-device-guard-deploy-code-integrity-policies.md)
+- [Deploy Windows Defender Application Control](deploy-windows-defender-application-control.md)
- - [Optional: Create a code signing certificate for code integrity policies](optional-create-a-code-signing-certificate-for-code-integrity-policies.md)
+ - [Optional: Create a code signing certificate for Windows Defender Application Control](optional-create-a-code-signing-certificate-for-windows-defender-application-control.md)
- - [Deploy code integrity policies: policy rules and file rules](deploy-code-integrity-policies-policy-rules-and-file-rules.md)
+ - [Deploy Windows Defender Application Control: policy rules and file rules](deploy-windows-defender-application-control-policy-rules-and-file-rules.md)
- - [Deploy code integrity policies: steps](deploy-code-integrity-policies-steps.md)
+ - [Deploy Windows Defender Application Control: steps](steps-to-deploy-windows-defender-application-control.md)
- - [Deploy catalog files to support code integrity policies](deploy-catalog-files-to-support-code-integrity-policies.md)
+ - [Deploy catalog files to support Windows Defender Application Control](deploy-catalog-files-to-support-windows-defender-application-control.md)
-- [Deploy Windows Defender Device Guard: enable virtualization-based security](deploy-device-guard-enable-virtualization-based-security.md)
+- [Enable virtualization-based protection of code integrity](deploy-device-guard-enable-virtualization-based-security.md)
## Related topics
diff --git a/windows/device-security/device-guard/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md b/windows/device-security/device-guard/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md
deleted file mode 100644
index 8e7f7cbde4..0000000000
--- a/windows/device-security/device-guard/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md
+++ /dev/null
@@ -1,87 +0,0 @@
----
-title: Introduction to Windows Defender Device Guard - virtualization-based security and code integrity policies (Windows 10)
-description: Microsoft Windows Defender Device Guard is a feature set that consists of both hardware and software system integrity hardening features that revolutionize the Windows operating system’s security.
-keywords: virtualization, security, malware
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.localizationpriority: high
-author: brianlic-msft
-ms.date: 10/20/2017
----
-
-# Introduction to Windows Defender Device Guard: virtualization-based security and code integrity policies
-
-**Applies to**
-- Windows 10
-- Windows Server 2016
-
-With thousands of new malicious files created every day, using traditional methods like antivirus solutions—signature-based detection to fight against malware—provides an inadequate defense against new attacks. Windows Defender Device Guard changes from a mode where apps are trusted unless blocked by an antivirus or other security solution, to a mode where the operating system trusts only apps authorized by your enterprise. You designate these trusted apps by creating *code integrity policies*.
-
-> [!NOTE]
-> Beginning with Windows 10, version 1709, configurable code integrity policies are known as Windows Defender Application Control.
-
-On hardware that includes CPU virtualization extensions (called "Intel VT-x" or "AMD-V") and second-level address translation (SLAT), Windows Defender Device Guard can also use Virtualization Based Security (VBS) to run the Code Integrity service alongside the kernel in a Windows hypervisor-protected container, which increases the security of code integrity policies. On hardware that includes input/output memory management units (IOMMUs), Windows Defender Device Guard can also help protect against DMA attacks. The following table provides more information about how Windows Defender Device Guard and these hardware features can help protect against various threats.
-
-When Windows Defender Application Control and hardware-based security features are combined, Windows Defender Device Guard provides a locked-down configuration for computers.
-
-## How Windows Defender Device Guard features help protect against threats
-
-The following table lists security threats and describes the corresponding Windows Defender Device Guard features:
-
-| Security threat in the enterprise | How a Windows Defender Device Guard feature helps protect against the threat |
-| --------------------------------- | ----------------------------------------------------------- |
-| **Exposure to new malware**, for which the "signature" is not yet known | **Windows Defender Application Control**: You can maintain a whitelist of software that is allowed to run (a configurable code integrity policy), rather than constantly update a list of "signatures" of software that should be blocked. This approach uses the trust-nothing model well known in mobile device operating systems. Only code that is verified by Windows Defender Application Control (AC), usually through the digital signature that you have identified as being from a trusted signer, is allowed to run. This allows full control over allowed code in both kernel and user mode.
**Specialized hardware required?** No security-related hardware features are required, but Windows Defender AC is strengthened by such features, as described in the next rows. |
-| **Exposure to unsigned code** (most malware is unsigned) | **Windows Defender AC plus catalog files as needed**: Because most malware is unsigned, Windows Defender AC (which in most cases requires signed code) can immediately help protect against a large number of threats. For organizations that use unsigned line-of-business (LOB) applications, you can use a tool called Package Inspector to create a *catalog* of all deployed and executed binary files for your trusted applications. After you sign and distribute the catalog, your trusted applications can be handled by Windows Defender AC in the same way as any other signed application. With this foundation, you can more easily block all unsigned applications, allowing only signed applications to run.
**Specialized hardware required?** No, but Windows Defender AC and catalogs are strengthened by the hardware features, as described in the next rows. |
-| **Malware that gains access to the kernel** and then, from within the kernel, captures sensitive information or damages the system | **Virtualization-based security (VBS)**: This is protection that uses the hypervisor to help protect the kernel and other parts of the operating system. When VBS is enabled, it strengthens either the default kernel-mode code integrity policy (which protects against bad drivers or system files), or the configurable code integrity policy that you deploy. With VBS, even if malware gains access to the kernel, the effects can be severely limited because the hypervisor can prevent the malware from executing code. The hypervisor, the most privileged level of system software, enforces R/W/X permissions across system memory. Code integrity checks are performed in a secure environment which is resistant to attack from kernel mode software, and page permissions for kernel mode are set and maintained by the hypervisor. Even if there are vulnerabilities that allow memory modification, like a buffer overflow, the modified memory cannot be executed.
**Specialized hardware required?** Yes, VBS requires at least CPU virtualization extensions and SLAT, as described in [Hardware, firmware, and software requirements for Windows Defender Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-windows-defender-device-guard). |
-| **DMA-based attacks**, for example, attacks launched from a malicious device that reads secrets from memory, making the enterprise more vulnerable to attack | **Virtualization-based security (VBS) using IOMMUs**: With this type of VBS protection, when the DMA-based attack makes a memory request, IOMMUs will evaluate the request and deny access.
**Specialized hardware required?** Yes, IOMMUs are a hardware feature that supports the hypervisor, and if you choose hardware that includes them, they can help protect against malicious attempts to access memory. |
-| **Exposure to boot kits or to a physically present attacker at boot time** | **Universal Extensible Firmware Interface (UEFI) Secure Boot**: Secure Boot and related methods protect the boot process and firmware from tampering. This tampering can come from a physically present attacker or from forms of malware that run early in the boot process or in the kernel after startup. UEFI is locked down (Boot order, Boot entries, Secure Boot, Virtualization extensions, IOMMU, Microsoft UEFI CA), so the settings in UEFI cannot be changed to compromise Windows Defender Device Guard security.
**Specialized hardware required?** UEFI Secure Boot has firmware requirements. For more information, see [Hardware, firmware, and software requirements for Windows Defender Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-windows-defender-device-guard). |
-
-In this guide, you learn about the individual features found within Windows Defender Device Guard as well as how to plan for, configure, and deploy them. Windows Defender Device Guard with configurable code integrity is intended for deployment alongside additional threat-mitigating Windows features such as [Windows Defender Credential Guard](/windows/access-protection/credential-guard/credential-guard) and [AppLocker](/windows/device-security/applocker/applocker-overview).
-
-## New and changed functionality
-
-Beginning with Windows 10, version 1709, configurable code integrity policies are known as Windows Defender Application Control.
-
-Beginning with Windows 10, version 1703, you can use code integrity policies not only to control applications, but also to control whether specific plug-ins, add-ins, and modules can run from specific apps (such as a line-of-business application or a browser). For more information, see [Use a code integrity policy to control specific plug-ins, add-ins, and modules](deploy-code-integrity-policies-steps.md#plug-ins).
-
-## Tools for managing Windows Defender Device Guard features
-
-You can easily manage Windows Defender Device Guard features by using familiar enterprise and client-management tools that IT pros use every day:
-
-
-
-- **Group Policy**. Windows 10 provides an administrative template to configure and deploy the configurable code integrity policies for your organization. This template also allows you to specify which hardware-based security features you would like to enable and deploy. You can manage these settings along with your existing Group Policy Objects (GPOs), which makes it simpler to implement Windows Defender Device Guard features. In addition to these code integrity and hardware-based security features, you can use Group Policy to help you manage your catalog files.
-
- - For a description of catalog files, see the table row describing **Exposure to unsigned code** in [How Windows Defender Device Guard features help protect against threats](#how-windows-defender-device-guard-features-help-protect-against-threats), earlier in this topic.
- - For information about using Group Policy as a deployment tool, see: [Deploy catalog files with Group Policy](deploy-catalog-files-to-support-code-integrity-policies.md#deploy-catalog-files-with-group-policy) [Deploy and manage code integrity policies with Group Policy](deploy-code-integrity-policies-steps.md#deploy-and-manage-code-integrity-policies-with-group-policy)
-
-- **Microsoft System Center Configuration Manager**. You can use System Center Configuration Manager to simplify deployment and management of catalog files, code integrity policies, and hardware-based security features, as well as provide version control. For more information, see [Deploy catalog files with System Center Configuration Manager](deploy-catalog-files-to-support-code-integrity-policies.md#deploy-catalog-files-with-system-center-configuration-manager).
-
-- **Microsoft Intune**. In a future release of Microsoft Intune, Microsoft is considering including features that will support the deployment and management of code integrity policies and catalog files.
-
-- **Windows PowerShell**. You can use Windows PowerShell to create and service code integrity policies. For more information, see [Deploy code integrity policies: steps](deploy-code-integrity-policies-steps.md) and [Configurable Code Integrity Policy for Windows PowerShell](https://technet.microsoft.com/library/mt634481.aspx).
-
-These options provide the same experience you're used to in order to manage your existing enterprise management solutions.
-
-For more information about the deployment of Windows Defender Device Guard features, see:
-- [Deploy Windows Defender Device Guard: deploy code integrity policies](deploy-device-guard-deploy-code-integrity-policies.md)
-- [Deploy Windows Defender Device Guard: enable virtualization-based security](deploy-device-guard-enable-virtualization-based-security.md)
-
-## Other features that relate to Windows Defender Device Guard
-
-### Windows Defender Device Guard with AppLocker
-
-Although [AppLocker](/windows/device-security/applocker/applocker-overview) is not considered a new Windows Defender Device Guard feature, it complements Windows Defender Device Guard functionality when enforced code integrity cannot be fully implemented or its functionality does not cover every desired scenario. There are many scenarios in which code integrity policies would be used alongside AppLocker rules. As a best practice, you should enforce code integrity policies at the most restrictive level possible for your organization, and then you can use AppLocker to fine-tune the restrictions to an even lower level.
-
-> **Note** One example of how Windows Defender Device Guard functionality can be enhanced by AppLocker is when you want to limit universal applications. Universal applications have already been validated by Microsoft to be trustworthy to run, but an organization may not want to allow specific universal applications to run in their environment. You can accomplish this enforcement by using an AppLocker rule.
-
-AppLocker and Windows Defender Device Guard should run side-by-side in your organization, which offers the best of both security features at the same time and provides the most comprehensive security to as many devices as possible. In addition to these features, we recommend that you continue to maintain an enterprise antivirus solution for a well-rounded enterprise security portfolio.
-
-### Windows Defender Device Guard with Windows Defender Credential Guard
-
-Another Windows 10 feature that employs VBS is [Windows Defender Credential Guard](/windows/access-protection/credential-guard/credential-guard). Windows Defender Credential Guard provides additional protection to Active Directory domain users by storing domain credentials within the same type of VBS virtualization container that hosts code integrity. By isolating these domain credentials from the active user mode and kernel mode, they have a much lower risk of being stolen. For more information about Windows Defender Credential Guard (which is not a feature within Windows Defender Device Guard), see [Protect derived domain credentials with Windows Defender Credential Guard](/windows/access-protection/credential-guard/credential-guard).
-
-Windows Defender Credential Guard is targeted at resisting pass-the-hash and pass-the-ticket techniques. By employing multifactor authentication with Windows Defender Credential Guard, organizations can gain additional protection against such threats.
-
-
-
diff --git a/windows/device-security/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md b/windows/device-security/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md
new file mode 100644
index 0000000000..a1b6bbcab8
--- /dev/null
+++ b/windows/device-security/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md
@@ -0,0 +1,87 @@
+---
+title: Introduction to Windows Defender Device Guard - virtualization-based security and code integrity policies (Windows 10)
+description: Microsoft Windows Defender Device Guard is a feature set that consists of both hardware and software system integrity hardening features that revolutionize the Windows operating system’s security.
+keywords: virtualization, security, malware
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.localizationpriority: high
+author: brianlic-msft
+ms.date: 10/20/2017
+---
+
+# Introduction to Windows Defender Device Guard: virtualization-based security and Windows Defender Application Control
+
+**Applies to**
+- Windows 10
+- Windows Server 2016
+
+With thousands of new malicious files created every day, using traditional methods like antivirus solutions—signature-based detection to fight against malware—provides an inadequate defense against new attacks. Windows Defender Device Guard changes from a mode where apps are trusted unless blocked by an antivirus or other security solution, to a mode where the operating system trusts only apps authorized by your enterprise. You designate these trusted apps by creating *Windows Defender Application Control (WDAC) policies*.
+
+> [!NOTE]
+> Prior to Windows 10, version 1709, Windows Defender Application Control was known as configurable code integrity policies.
+
+On hardware that includes CPU virtualization extensions (called "Intel VT-x" or "AMD-V") and second-level address translation (SLAT), Windows Defender Device Guard can also use Virtualization Based Security (VBS) to run the Code Integrity service alongside the kernel in a Windows hypervisor-protected container, which increases the security of code integrity policies. On hardware that includes input/output memory management units (IOMMUs), Windows Defender Device Guard can also help protect against DMA attacks. The following table provides more information about how Windows Defender Device Guard and these hardware features can help protect against various threats.
+
+When Windows Defender Application Control and hardware-based security features are combined, Windows Defender Device Guard provides a locked-down configuration for computers.
+
+## How Windows Defender Device Guard features help protect against threats
+
+The following table lists security threats and describes the corresponding Windows Defender Device Guard features:
+
+| Security threat in the enterprise | How a Windows Defender Device Guard feature helps protect against the threat |
+| --------------------------------- | ----------------------------------------------------------- |
+| **Exposure to new malware**, for which the "signature" is not yet known | **Windows Defender Application Control (WDAC)**: You can maintain a whitelist of software that is allowed to run (a configurable code integrity policy), rather than constantly update a list of "signatures" of software that should be blocked. This approach uses the trust-nothing model well known in mobile device operating systems. Only code that is verified by WDAC, usually through the digital signature that you have identified as being from a trusted signer, is allowed to run. This allows full control over allowed code in both kernel and user mode.
**Specialized hardware required?** No security-related hardware features are required, but WDAC is strengthened by such features, as described in the next rows.
[!NOTE] Prior to Windows 10, version 1709, Windows Defender Application Control was known as configurable code integrity policies. |
+| **Exposure to unsigned code** (most malware is unsigned) | **WDAC plus catalog files as needed**: Because most malware is unsigned, WDAC can immediately help protect against a large number of threats. For organizations that use unsigned line-of-business (LOB) applications, you can use a tool called Package Inspector to create a *catalog* of all deployed and executed binary files for your trusted applications. After you sign and distribute the catalog, your trusted applications can be handled by WDAC in the same way as any other signed application. With this foundation, you can more easily block all unsigned applications, allowing only signed applications to run.
**Specialized hardware required?** No, but WDAC and catalogs are strengthened by the hardware features, as described in the next rows. |
+| **Malware that gains access to the kernel** and then, from within the kernel, captures sensitive information or damages the system | **Virtualization-based protection of code integrity**: This is protection that uses Windows 10’s new virtualization-based security (VBS) feature to help protect the kernel and other parts of the operating system. When virtualization-based protection of code integrity (also known as hypervisor-protected code integrity, or HVCI) is enabled, it strengthens either the default kernel-mode code integrity policy (which protects against bad drivers or system files), or the configurable code integrity policy that you deploy. With HVCI, even if malware gains access to the kernel, the effects can be severely limited because the hypervisor can prevent the malware from executing code. The hypervisor, the most privileged level of system software, enforces R/W/X permissions across system memory. Code integrity checks are performed in a secure environment which is resistant to attack from kernel mode software, and page permissions for kernel mode are set and maintained by the hypervisor. Even if there are vulnerabilities that allow memory modification, like a buffer overflow, the modified memory cannot be executed.
**Specialized hardware required?** Yes, VBS requires at least CPU virtualization extensions and SLAT, as described in [Hardware, firmware, and software requirements for Windows Defender Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-windows-defender-device-guard). |
+| **DMA-based attacks**, for example, attacks launched from a malicious device that reads secrets from memory, making the enterprise more vulnerable to attack | **Virtualization-based security (VBS) using IOMMUs**: With this type of VBS protection, when the DMA-based attack makes a memory request, IOMMUs will evaluate the request and deny access.
**Specialized hardware required?** Yes, IOMMUs are a hardware feature that supports the hypervisor, and if you choose hardware that includes them, they can help protect against malicious attempts to access memory. |
+| **Exposure to boot kits or to a physically present attacker at boot time** | **Universal Extensible Firmware Interface (UEFI) Secure Boot**: Secure Boot and related methods protect the boot process and firmware from tampering. This tampering can come from a physically present attacker or from forms of malware that run early in the boot process or in the kernel after startup. UEFI is locked down (Boot order, Boot entries, Secure Boot, Virtualization extensions, IOMMU, Microsoft UEFI CA), so the settings in UEFI cannot be changed to compromise Windows Defender Device Guard security.
**Specialized hardware required?** UEFI Secure Boot has firmware requirements. For more information, see [Hardware, firmware, and software requirements for Windows Defender Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-windows-defender-device-guard). |
+
+In this guide, you learn about the individual features found within Windows Defender Device Guard as well as how to plan for, configure, and deploy them. Windows Defender Device Guard with WDAC is intended for deployment alongside additional threat-mitigating Windows features such as [Windows Defender Credential Guard](/windows/access-protection/credential-guard/credential-guard) and [AppLocker](/windows/device-security/applocker/applocker-overview).
+
+## New and changed functionality
+
+Prior to Windows 10, version 1709, Windows Defender Application Control (WDAC) was known as configurable code integrity policies.
+
+Beginning with Windows 10, version 1703, you can use WDAC not only to control applications, but also to control whether specific plug-ins, add-ins, and modules can run from specific apps (such as a line-of-business application or a browser). For more information, see [Use a Windows Defender Application Control policy to control specific plug-ins, add-ins, and modules](steps-to-deploy-windows-defender-application-control.md#use-a-windows-defender-application-control-policy-to-control-specific-plug-ins-add-ins-and-modules).
+
+## Tools for managing Windows Defender Device Guard features
+
+You can easily manage Windows Defender Device Guard features by using familiar enterprise and client-management tools that IT pros use every day:
+
+
+
+- **Group Policy**. Windows 10 provides an administrative template to configure and deploy the configurable WDAC policies for your organization. Another template allows you to specify which hardware-based security features you would like to enable and deploy. You can manage these settings along with your existing Group Policy Objects (GPOs), which makes it simpler to implement Windows Defender Device Guard features. In addition to these WDAC and hardware-based security features, you can use Group Policy to help you manage your catalog files.
+
+ - For a description of catalog files, see the table row describing **Exposure to unsigned code** in [How Windows Defender Device Guard features help protect against threats](#how-windows-defender-device-guard-features-help-protect-against-threats), earlier in this topic.
+ - For information about using Group Policy as a deployment tool, see: [Deploy catalog files with Group Policy](deploy-catalog-files-to-support-windows-defender-application-control.md#deploy-catalog-files-with-group-policy) [Deploy and manage WDAC with Group Policy](steps-to-deploy-windows-defender-application-control.md#deploy-and-manage-windows-defender-application-control-with-group-policy)
+
+- **Microsoft System Center Configuration Manager**. You can use System Center Configuration Manager to simplify deployment and management of catalog files, WDAC policies, and hardware-based security features, as well as provide version control. For more information, see [Deploy catalog files with System Center Configuration Manager](deploy-catalog-files-to-support-windows-defender-application-control.md#deploy-catalog-files-with-system-center-configuration-manager).
+
+- **Microsoft Intune**. You can use Microsoft Intune to simplify deployment and management of WDAC policies, as well as provide version control. In a future release of Microsoft Intune, Microsoft is considering including features that will support the deployment and management of catalog files.
+
+- **Windows PowerShell**. You can use Windows PowerShell to create and service WDAC policies. For more information, see [Deploy Windows Defender Application Control: steps](steps-to-deploy-windows-defender-application-control.md).
+
+These options provide the same experience you're used to in order to manage your existing enterprise management solutions.
+
+For more information about the deployment of Windows Defender Device Guard features, see:
+- [Deploy Windows Defender Application Control](deploy-windows-defender-application-control.md)
+- [Deploy virtualization-based protection of code integrity](deploy-device-guard-enable-virtualization-based-security.md)
+
+## Other features that relate to Windows Defender Device Guard
+
+### Windows Defender Device Guard with AppLocker
+
+Although [AppLocker](/windows/device-security/applocker/applocker-overview) is not considered a new Windows Defender Device Guard feature, it complements Windows Defender Device Guard functionality when WDAC cannot be fully implemented or its functionality does not cover every desired scenario. There are many scenarios in which WDAC would be used alongside AppLocker rules. As a best practice, you should enforce WDAC at the most restrictive level possible for your organization, and then you can use AppLocker to fine-tune the restrictions to an even lower level.
+
+> **Note** One example of how Windows Defender Device Guard functionality can be enhanced by AppLocker is when you want to apply different policies for different users on the same device. For example, you may allow your IT support personnel to run additional apps that you do not allow for your end-users. You can accomplish this user-specific enforcement by using an AppLocker rule.
+
+AppLocker and Windows Defender Device Guard should run side-by-side in your organization, which offers the best of both security features at the same time and provides the most comprehensive security to as many devices as possible. In addition to these features, we recommend that you continue to maintain an enterprise antivirus solution for a well-rounded enterprise security portfolio.
+
+### Windows Defender Device Guard with Windows Defender Credential Guard
+
+Another Windows 10 feature that employs VBS is [Windows Defender Credential Guard](/windows/access-protection/credential-guard/credential-guard). Windows Defender Credential Guard provides additional protection to Active Directory domain users by storing domain credentials within the same type of VBS virtualization container that hosts code integrity when HVCI is enabled. By isolating these domain credentials from the active user mode and kernel mode, they have a much lower risk of being stolen. For more information about Windows Defender Credential Guard (which is not a feature within Windows Defender Device Guard), see [Protect derived domain credentials with Windows Defender Credential Guard](/windows/access-protection/credential-guard/credential-guard).
+
+Windows Defender Credential Guard is targeted at resisting pass-the-hash and pass-the-ticket techniques. By employing multifactor authentication with Windows Defender Credential Guard, organizations can gain additional protection against such threats.
+
+
+
diff --git a/windows/device-security/device-guard/optional-create-a-code-signing-certificate-for-code-integrity-policies.md b/windows/device-security/device-guard/optional-create-a-code-signing-certificate-for-windows-defender-application-control.md
similarity index 83%
rename from windows/device-security/device-guard/optional-create-a-code-signing-certificate-for-code-integrity-policies.md
rename to windows/device-security/device-guard/optional-create-a-code-signing-certificate-for-windows-defender-application-control.md
index b70de832d1..668316004b 100644
--- a/windows/device-security/device-guard/optional-create-a-code-signing-certificate-for-code-integrity-policies.md
+++ b/windows/device-security/device-guard/optional-create-a-code-signing-certificate-for-windows-defender-application-control.md
@@ -9,13 +9,13 @@ author: brianlic-msft
ms.date: 10/20/2017
---
-# Optional: Create a code signing certificate for code integrity policies
+# Optional: Create a code signing certificate for Windows Defender Application Control
**Applies to**
- Windows 10
- Windows Server 2016
-As you deploy code integrity policies (part of Windows Defender Device Guard), you might need to sign catalog files or code integrity policies internally. To do this, you will either need a publicly issued code signing certificate or an internal CA. If you have purchased a code signing certificate, you can skip this topic and instead follow other topics listed in [Deploy Windows Defender Device Guard: deploy code integrity policies](deploy-device-guard-deploy-code-integrity-policies.md).
+As you deploy Windows Defender Application Control (WDAC) (also part of Windows Defender Device Guard), you might need to sign catalog files or WDAC policies internally. To do this, you will either need a publicly issued code signing certificate or an internal CA. If you have purchased a code signing certificate, you can skip this topic and instead follow other topics listed in [Deploy Windows Defender Application Control](deploy-windows-defender-application-control.md).
If you have an internal CA, complete these steps to create a code signing certificate.
Only RSA algorithm is supported for the code signing certificate, and signatures must be PKCS 1.5 padded.
@@ -33,7 +33,7 @@ ECDSA is not supported.
4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2012** from the **Certification Authority** list, and then select **Windows 8 / Windows Server 2012** from the **Certificate recipient** list.
-5. On the **General** tab, specify the **Template display name** and **Template name**. This example uses the name **DG Catalog Signing Certificate**.
+5. On the **General** tab, specify the **Template display name** and **Template name**. This example uses the name **WDAC Catalog Signing Certificate**.
6. On the **Request Handling** tab, select the **Allow private key to be exported** check box.
@@ -63,7 +63,7 @@ When this certificate template has been created, you must publish it to the CA p
A list of available templates to issue appears, including the template you just created.
-2. Select the DG Catalog signing certificate, and then click **OK**.
+2. Select the WDAC Catalog signing certificate, and then click **OK**.
Now that the template is available to be issued, you must request one from the computer running Windows 10 on which you create and sign catalog files. To begin, open the MMC, and then complete the following steps:
@@ -93,13 +93,13 @@ This certificate must be installed in the user’s personal store on the compute
3. Choose the default settings, and then select **Export all extended properties**.
-4. Set a password, select an export path, and then select **DGCatSigningCert.pfx** as the file name.
+4. Set a password, select an export path, and then select **WDACCatSigningCert.pfx** as the file name.
When the certificate has been exported, import it into the personal store for the user who will be signing the catalog files or code integrity policies on the specific computer that will be signing them.
## Related topics
-- [Introduction to Windows Defender Device Guard: virtualization-based security and code integrity policies](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md)
+- [Introduction to Windows Defender Device Guard: virtualization-based security and Windows Defender Application Control](introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md)
-- [Deploy Windows Defender Device Guard: deploy code integrity policies](deploy-device-guard-deploy-code-integrity-policies.md)
+- [Deploy Windows Defender Application Control](deploy-windows-defender-application-control.md)
diff --git a/windows/device-security/device-guard/planning-and-getting-started-on-the-device-guard-deployment-process.md b/windows/device-security/device-guard/planning-and-getting-started-on-the-device-guard-deployment-process.md
index d3bb26de08..b2c2cb7926 100644
--- a/windows/device-security/device-guard/planning-and-getting-started-on-the-device-guard-deployment-process.md
+++ b/windows/device-security/device-guard/planning-and-getting-started-on-the-device-guard-deployment-process.md
@@ -19,61 +19,60 @@ This topic provides a roadmap for planning and getting started on the Windows De
## Planning
-1. **Review requirements, especially hardware requirements for VBS**. Review the virtualization-based security (VBS) features described in [How Windows Defender Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md#how-windows-defender-device-guard-features-help-protect-against-threats). Then you can assess your end-user systems to see how many support the VBS features you are interested in, as described in [Hardware, firmware, and software requirements for Windows Defender Device Guard(requirements-and-deployment-planning-guidelines-for-device-guard.md#windows-defender-hardware-firmware-and-software-requirements-for-
-windows-defender-device-guard).
+1. **Review requirements, especially hardware requirements for VBS**. Review the virtualization-based security (VBS) features described in [How Windows Defender Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md#how-windows-defender-device-guard-features-help-protect-against-threats). Then you can assess your end-user systems to see how many support the VBS features you are interested in, as described in [Hardware, firmware, and software requirements for Windows Defender Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-windows-defender-device-guard).
2. **Group devices by degree of control needed**. Group devices according to the table in [Windows Defender Device Guard deployment in different scenarios: types of devices](requirements-and-deployment-planning-guidelines-for-device-guard.md#windows-defender-device-guard-deployment-in-different-scenarios-types-of-devices). Do most devices fit neatly into a few categories, or are they scattered across all categories? Are users allowed to install any application or must they choose from a list? Are users allowed to use their own peripheral devices? Deployment is simpler if everything is locked down in the same way, but meeting individual departments’ needs, and working with a wide variety of devices, may require a more complicated and flexible deployment.
-3. **Review how much variety in software and hardware is needed by roles or departments**. When several departments all use the same hardware and software, you might need to deploy only one code integrity policy for them. More variety across departments might mean you need to create and manage more code integrity policies. The following questions can help you clarify how many code integrity policies to create:
- - How standardized is the hardware? This can be relevant because of drivers. You could create a code integrity policy on hardware that uses a particular set of drivers, and if other drivers in your environment use the same signature, they would also be allowed to run. However, you might need to create several code integrity policies on different "reference" hardware, then merge the policies together, to ensure that the resulting policy recognizes all the drivers in your environment.
+3. **Review how much variety in software and hardware is needed by roles or departments**. When several departments all use the same hardware and software, you might need to deploy only one Windows Defender Application Control (WDAC) policy for them. More variety across departments might mean you need to create and manage more WDAC policies. The following questions can help you clarify how many WDAC policies to create:
+ - How standardized is the hardware? This can be relevant because of drivers. You could create a WDAC policy on hardware that uses a particular set of drivers, and if other drivers in your environment use the same signature, they would also be allowed to run. However, you might need to create several WDAC policies on different "reference" hardware, then merge the policies together, to ensure that the resulting policy recognizes all the drivers in your environment.
- - What software does each department or role need? Should they be able to install and run other departments’ software? If multiple departments are allowed to run the same list of software, you might be able to merge several code integrity policies to simplify management.
+ - What software does each department or role need? Should they be able to install and run other departments’ software? If multiple departments are allowed to run the same list of software, you might be able to merge several WDAC policies to simplify management.
- - Are there departments or roles where unique, restricted software is used? If one department needs to run an application that no other department is allowed, it might require a separate code integrity policy. Similarly, if only one department must run an old version of an application (while other departments allow only the newer version), it might require a separate code integrity policy.
+ - Are there departments or roles where unique, restricted software is used? If one department needs to run an application that no other department is allowed, it might require a separate WDAC policy. Similarly, if only one department must run an old version of an application (while other departments allow only the newer version), it might require a separate WDAC policy.
- - Is there already a list of accepted applications? A list of accepted applications can be used to help create a baseline code integrity policy. As of Windows 10, version 1703, it might also be useful to have a list of plug-ins, add-ins, or modules that you want to allow only in a specific app (such as a line-of-business app). Similarly, it might be useful to have a list of plug-ins, add-ins, or modules that you want to block in a specific app (such as a browser).
+ - Is there already a list of accepted applications? A list of accepted applications can be used to help create a baseline WDAC policy. As of Windows 10, version 1703, it might also be useful to have a list of plug-ins, add-ins, or modules that you want to allow only in a specific app (such as a line-of-business app). Similarly, it might be useful to have a list of plug-ins, add-ins, or modules that you want to block in a specific app (such as a browser).
- As part of a threat review process, have you reviewed systems for software that can load arbitrary DLLs or run code or scripts?
- In day-to-day operations, your organization’s security policy may allow certain applications, code, or scripts to run on your systems depending on their role and the context. However, if your security policy requires that you run only trusted applications, code, and scripts on your systems, you may decide to lock these systems down securely with Windows Defender Device Guard code integrity policies. You can also fine-tune your control by using Windows Defender Device Guard in combination with AppLocker, as described in [Windows Defender Device Guard with AppLocker](https://technet.microsoft.com/itpro/windows/keep-secure/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies#device-guard-with-applocker).
+ In day-to-day operations, your organization’s security policy may allow certain applications, code, or scripts to run on your systems depending on their role and the context. However, if your security policy requires that you run only trusted applications, code, and scripts on your systems, you may decide to lock these systems down securely with Windows Defender Application Control policies. You can also fine-tune your control by using Windows Defender Application Control in combination with AppLocker, as described in [Windows Defender Device Guard with AppLocker](introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md#windows-defender-device-guard-with-applocker).
- Legitimate applications from trusted vendors provide valid functionality. However, an attacker could also potentially use that same functionality to run malicious executable code that could bypass code integrity policies.
+ Legitimate applications from trusted vendors provide valid functionality. However, an attacker could also potentially use that same functionality to run malicious executable code that could bypass WDAC.
- For operational scenarios that require elevated security, certain applications with known Code Integrity bypasses may represent a security risk if you whitelist them in your code integrity policies. Other applications where older versions of the application had vulnerabilities also represent a risk. Therefore, you may want to deny or block such applications from your code integrity policies. For applications with vulnerabilities, once the vulnerabilities are fixed you can create a rule that only allows the fixed or newer versions of that application. The decision to allow or block applications depends on the context and on how the reference system is being used.
+ For operational scenarios that require elevated security, certain applications with known Code Integrity bypasses may represent a security risk if you whitelist them in your WDAC policies. Other applications where older versions of the application had vulnerabilities also represent a risk. Therefore, you may want to deny or block such applications from your WDAC policies. For applications with vulnerabilities, once the vulnerabilities are fixed you can create a rule that only allows the fixed or newer versions of that application. The decision to allow or block applications depends on the context and on how the reference system is being used.
- Security professionals collaborate with Microsoft continuously to help protect customers. With the help of their valuable reports, Microsoft has identified a list of known applications that an attacker could potentially use to bypass Windows Defender Device Guard code integrity policies. Depending on the context, you may want to block these applications. To view this list of applications and for use case examples, such as disabling msbuild.exe, see [Deploy code integrity policies: steps](https://technet.microsoft.com/itpro/windows/keep-secure/deploy-code-integrity-policies-steps).
+ Security professionals collaborate with Microsoft continuously to help protect customers. With the help of their valuable reports, Microsoft has identified a list of known applications that an attacker could potentially use to bypass Windows Defender Application Control. Depending on the context, you may want to block these applications. To view this list of applications and for use case examples, such as disabling msbuild.exe, see [Deploy Windows Defender Application Control: steps](steps-to-deploy-windows-defender-application-control.md).
-4. **Identify LOB applications that are currently unsigned**. Although requiring signed code (through code integrity policies) protects against many threats, your organization might use unsigned LOB applications, for which the process of signing might be difficult. You might also have applications that are signed, but you want to add a secondary signature to them. If so, identify these applications, because you will need to create a catalog file for them. For a basic description of catalog files, see the table in [Introduction to Windows Defender Device Guard: virtualization-based security and code integrity policies](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md). For more background information about catalog files, see [Reviewing your applications: application signing and catalog files](requirements-and-deployment-planning-guidelines-for-device-guard.md#reviewing-your-applications-application-signing-and-catalog-files).
+4. **Identify LOB applications that are currently unsigned**. Although requiring signed code (through WDAC) protects against many threats, your organization might use unsigned LOB applications, for which the process of signing might be difficult. You might also have applications that are signed, but you want to add a secondary signature to them. If so, identify these applications, because you will need to create a catalog file for them. For a basic description of catalog files, see the table in [Introduction to Windows Defender Device Guard: virtualization-based security and Windows Defender Application Control](introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md). For more background information about catalog files, see [Reviewing your applications: application signing and catalog files](requirements-and-deployment-planning-guidelines-for-device-guard.md#reviewing-your-applications-application-signing-and-catalog-files).
## Getting started on the deployment process
-1. **Optionally, create a signing certificate for code integrity policies**. As you deploy code integrity policies, you might need to sign catalog files or code integrity policies internally. To do this, you will either need a publicly issued code signing certificate (that you purchase) or an internal CA. If you choose to use an internal CA, you will need to create a code signing certificate. For more information, see [Optional: Create a code signing certificate for code integrity policies](optional-create-a-code-signing-certificate-for-code-integrity-policies.md).
+1. **Optionally, create a signing certificate for Windows Defender Application Control**. As you deploy WDAC, you might need to sign catalog files or WDAC policies internally. To do this, you will either need a publicly issued code signing certificate (that you purchase) or an internal CA. If you choose to use an internal CA, you will need to create a code signing certificate. For more information, see [Optional: Create a code signing certificate for Windows Defender Application Control](optional-create-a-code-signing-certificate-for-windows-defender-application-control.md).
-2. **Create code integrity policies from “golden” computers**. When you have identified departments or roles that use distinctive or partly-distinctive sets of hardware and software, you can set up “golden” computers containing that software and hardware. In this respect, creating and managing code integrity policies to align with the needs of roles or departments can be similar to managing corporate images. From each “golden” computer, you can create a code integrity policy, and decide how to manage that policy. You can merge code integrity policies to create a broader policy or a master policy, or you can manage and deploy each policy individually. For more information, see:
- - [Deploy code integrity policies: policy rules and file rules](deploy-code-integrity-policies-policy-rules-and-file-rules.md)
- - [Deploy code integrity policies: steps](deploy-code-integrity-policies-steps.md)
+2. **Create WDAC policies from “golden” computers**. When you have identified departments or roles that use distinctive or partly-distinctive sets of hardware and software, you can set up “golden” computers containing that software and hardware. In this respect, creating and managing WDAC policies to align with the needs of roles or departments can be similar to managing corporate images. From each “golden” computer, you can create a WDAC policy, and decide how to manage that policy. You can merge WDAC policies to create a broader policy or a master policy, or you can manage and deploy each policy individually. For more information, see:
+ - [Deploy Windows Defender Application Control: policy rules and file rules](deploy-windows-defender-application-control-policy-rules-and-file-rules.md)
+ - [Deploy Windows Defender Application Control: steps](steps-to-deploy-windows-defender-application-control.md)
-3. **Audit the code integrity policy and capture information about applications that are outside the policy**. We recommend that you use “audit mode” to carefully test each code integrity policy before you enforce it. With audit mode, no application is blocked—the policy just logs an event whenever an application outside the policy is started. Later, you can expand the policy to allow these applications, as needed. For more information, see [Audit code integrity policies](deploy-code-integrity-policies-steps.md#audit-code-integrity-policies).
+3. **Audit the WDAC policy and capture information about applications that are outside the policy**. We recommend that you use “audit mode” to carefully test each WDAC policy before you enforce it. With audit mode, no application is blocked—the policy just logs an event whenever an application outside the policy is started. Later, you can expand the policy to allow these applications, as needed. For more information, see [Audit Windows Defender Application Control policies](steps-to-deploy-windows-defender-application-control.md#audit-windows-defender-application-control-policies).
-4. **Create a “catalog file” for unsigned LOB applications**. Use the Package Inspector tool to create and sign a catalog file for your unsigned LOB applications. For more information, review step 4 **Identify LOB applications that are currently unsigned**, earlier in this list, and see [Deploy catalog files to support code integrity policies](deploy-catalog-files-to-support-code-integrity-policies.md). In later steps, you can merge the catalog file's signature into your code integrity policy, so that applications in the catalog will be allowed by the policy.
+4. **Create a “catalog file” for unsigned LOB applications**. Use the Package Inspector tool to create and sign a catalog file for your unsigned LOB applications. For more information, review step 4 **Identify LOB applications that are currently unsigned**, earlier in this list, and see [Deploy catalog files to support Windows Defender Application Control](deploy-catalog-files-to-support-windows-defender-application-control.md). In later steps, you can merge the catalog file's signature into your WDAC policy, so that applications in the catalog will be allowed by the policy.
-6. **Capture needed policy information from the event log, and merge information into the existing policy as needed**. After a code integrity policy has been running for a time in audit mode, the event log will contain information about applications that are outside the policy. To expand the policy so that it allows for these applications, use Windows PowerShell commands to capture the needed policy information from the event log, and then merge that information into the existing policy. You can merge code integrity policies from other sources also, for flexibility in how you create your final code integrity policies. For more information, see:
- - [Create a code integrity policy that captures audit information from the event log](deploy-code-integrity-policies-steps.md#create-a-code-integrity-policy-that-captures-audit-information-from-the-event-log)
- - [Merge code integrity policies](deploy-code-integrity-policies-steps.md#merge-code-integrity-policies)
+6. **Capture needed policy information from the event log, and merge information into the existing policy as needed**. After a WDAC policy has been running for a time in audit mode, the event log will contain information about applications that are outside the policy. To expand the policy so that it allows for these applications, use Windows PowerShell commands to capture the needed policy information from the event log, and then merge that information into the existing policy. You can merge WDAC policies from other sources also, for flexibility in how you create your final WDAC policies. For more information, see:
+ - [Create a Windows Defender Application Control policy that captures audit information from the event log](steps-to-deploy-windows-defender-application-control.md#create-a-windows-defender-application-control-policy-that-captures-audit-information-from-the-event-log)
+ - [Merge Windows Defender Application Control policies](steps-to-deploy-windows-defender-application-control.md#merge-windows-defender-application-control-policies)
-7. **Deploy code integrity policies and catalog files**. After you confirm that you have completed all the preceding steps, you can begin deploying catalog files and taking code integrity policies out of auditing mode. We strongly recommend that you begin this process with a test group of users. This provides a final quality-control validation before you deploy the catalog files and code integrity policies more broadly. For more information, see:
- - [Enforce code integrity policies](deploy-code-integrity-policies-steps.md#enforce-code-integrity-policies)
- - [Deploy and manage code integrity policies with Group Policy](deploy-code-integrity-policies-steps.md#deploy-and-manage-code-integrity-policies-with-group-policy)
+7. **Deploy WDAC policies and catalog files**. After you confirm that you have completed all the preceding steps, you can begin deploying catalog files and taking WDAC policies out of auditing mode. We strongly recommend that you begin this process with a test group of users. This provides a final quality-control validation before you deploy the catalog files and WDAC policies more broadly. For more information, see:
+ - [Enforce Windows Defender Application Control policies](steps-to-deploy-windows-defender-application-control.md#enforce-windows-defender-application-control-policies)
+ - [Deploy and manage Windows Defender Application Control with Group Policy](steps-to-deploy-windows-defender-application-control.md#deploy-and-manage-windows-defender-application-control-with-group-policy)
-8. **Enable desired hardware (VBS) security features**. Hardware-based security features—also called virtualization-based security (VBS) features—strengthen the protections offered by code integrity policies, as described in [How Windows Defender Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md#how-windows-defender-device-guard-features-help-protect-against-threats).
+8. **Enable desired virtualization-based security (VBS) features**. Hardware-based security features—also called virtualization-based security (VBS) features—strengthen the protections offered by Windows Defender Application Control, as described in [How Windows Defender Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md#how-windows-defender-device-guard-features-help-protect-against-threats).
> [!WARNING]
> Virtualization-based protection of code integrity may be incompatible with some devices and applications. We strongly recommend testing this configuration in your lab before enabling virtualization-based protection of code integrity on production systems. Failure to do so may result in unexpected failures up to and including data loss or a blue screen error (also called a stop error).
- For information about enabling VBS features, see [Deploy Windows Defender Device Guard: enable virtualization-based security](deploy-device-guard-enable-virtualization-based-security.md).
+ For information about enabling VBS features, see [Enable virtualization-based protection of code integrity](deploy-device-guard-enable-virtualization-based-security.md).
-
\ No newline at end of file
+
diff --git a/windows/device-security/device-guard/requirements-and-deployment-planning-guidelines-for-device-guard.md b/windows/device-security/device-guard/requirements-and-deployment-planning-guidelines-for-device-guard.md
index a655e65478..418d67676f 100644
--- a/windows/device-security/device-guard/requirements-and-deployment-planning-guidelines-for-device-guard.md
+++ b/windows/device-security/device-guard/requirements-and-deployment-planning-guidelines-for-device-guard.md
@@ -21,9 +21,9 @@ The information in this article is intended for IT professionals, and provides a
## Hardware, firmware, and software requirements for Windows Defender Device Guard
-To deploy Windows Defender Device Guard in a way that uses all of its virtualization-based security (VBS) features, the computers you are protecting must meet certain hardware, firmware, and software requirements. However, computers lacking some of the hardware and firmware requirements will still receive some protection when you deploy code integrity policies—the difference is that those computers will not be as hardened against certain threats.
+To deploy Windows Defender Device Guard in a way that uses all of its virtualization-based security (VBS) features, the computers you are protecting must meet certain hardware, firmware, and software requirements. However, computers lacking some of the hardware and firmware requirements will still receive some protection when you deploy Windows Defender Application Control (WDAC) policies—the difference is that those computers will not be as hardened against certain threats.
-For example, hardware that includes CPU virtualization extensions and SLAT will be hardened against malware that attempts to gain access to the kernel, but without protected BIOS options such as “Boot only from internal hard drive,” the computer could be booted (by a malicious person who has physical access) into an operating system on bootable media. For an outline of how VBS-related hardware strengthens the hardening offered by Windows Defender Device Guard, see [Introduction to Windows Defender Device Guard: virtualization-based security and code integrity policies](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md).
+For example, hardware that includes CPU virtualization extensions and SLAT will be hardened against malware that attempts to gain access to the kernel, but without protected BIOS options such as “Boot only from internal hard drive,” the computer could be booted (by a malicious person who has physical access) into an operating system on bootable media. For an outline of how VBS-related hardware strengthens the hardening offered by Windows Defender Device Guard, see [Introduction to Windows Defender Device Guard: virtualization-based security and Windows Defender Application Control](introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md).
You can deploy Windows Defender Device Guard in phases, and plan these phases in relation to the computer purchases you plan for your next hardware refresh.
@@ -33,7 +33,7 @@ You can deploy Windows Defender Device Guard in phases, and plan these phases in
The following tables provide more information about the hardware, firmware, and software required for deployment of various Windows Defender Device Guard features. The tables describe baseline protections, plus protections for improved security that are associated with hardware and firmware options available in 2015, 2016, and 2017.
> **Notes**
-> • To understand the requirements in the following tables, you will need to be familiar with the main features in Windows Defender Device Guard: configurable code integrity policies, virtualization-based security (VBS), and Universal Extensible Firmware Interface (UEFI) Secure Boot. For information about these features, see [How Windows Defender Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md#how-windows-defender-device-guard-features-help-protect-against-threats).
+> • To understand the requirements in the following tables, you will need to be familiar with the main features in Windows Defender Device Guard: Windows Defender Application Control (WDAC), virtualization-based protection of code integrity, and Universal Extensible Firmware Interface (UEFI) Secure Boot. For information about these features, see [How Windows Defender Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md#how-windows-defender-device-guard-features-help-protect-against-threats).
> • Beginning with Windows 10, version 1607, Trusted Platform Module (TPM 2.0) must be enabled by default on new computers.
## Baseline protections
@@ -45,7 +45,7 @@ The following tables provide more information about the hardware, firmware, and
| Firmware: **UEFI firmware version 2.3.1.c or higher with UEFI Secure Boot** | See the following Windows Hardware Compatibility Program requirement: [System.Fundamentals.Firmware.UEFISecureBoot](http://msdn.microsoft.com/library/windows/hardware/dn932805.aspx#system-fundamentals-firmware-uefisecureboot) | UEFI Secure Boot helps ensure that the device boots only authorized code. This can prevent boot kits and root kits from installing and persisting across reboots. |
| Firmware: **Secure firmware update process** | UEFI firmware must support secure firmware update found under the following Windows Hardware Compatibility Program requirement: [System.Fundamentals.Firmware.UEFISecureBoot](http://msdn.microsoft.com/library/windows/hardware/dn932805.aspx#system-fundamentals-firmware-uefisecureboot). | UEFI firmware just like software can have security vulnerabilities that, when found, need to be patched through firmware updates. Patching helps prevent root kits from getting installed. |
| Software: **HVCI compatible drivers** | See the Windows Hardware Compatibility Program requirements under [Filter.Driver.DeviceGuard.DriverCompatibility](https://msdn.microsoft.com/library/windows/hardware/mt589732(v=vs.85).aspx).| [HVCI Compatible](https://blogs.msdn.microsoft.com/windows_hardware_certification/2015/05/22/driver-compatibility-with-device-guard-in-windows-10/) drivers help ensure that VBS can maintain appropriate memory permissions. This increases resistance to bypassing vulnerable kernel drivers and helps ensure that malware cannot run in kernel. Only code verified through code integrity can run in kernel mode. |
-| Software: Qualified **Windows operating system** | Windows 10 Enterprise, Windows 10 Education, Windows Server 2016, or Windows 10 IoT Enterprise
Important: Windows Server 2016 running as a domain controller does not support Windows Defender Credential Guard. Only Windows Defender Device Guard is supported in this configuration.
| Support for VBS and for management features that simplify configuration of Windows Defender Device Guard. |
+| Software: Qualified **Windows operating system** | Windows 10 Enterprise, Windows 10 Education, Windows Server 2016, or Windows 10 IoT Enterprise
Important: Windows Server 2016 running as a domain controller does not support Windows Defender Credential Guard. Only virtualization-based protection of code integrity is supported in this configuration.
| Support for VBS and for management features that simplify configuration of Windows Defender Device Guard. |
> **Important** The following tables list additional qualifications for improved security. You can use Windows Defender Device Guard with hardware, firmware, and software that support baseline protections, even if they do not support protections for improved security. However, we strongly recommend meeting these additional qualifications to significantly strengthen the level of security that Windows Defender Device Guard can provide.
@@ -87,9 +87,9 @@ Typically, deployment of Windows Defender Device Guard happens best in phases, r
| **Type of device** | **How Windows Defender Device Guard relates to this type of device** | **Windows Defender Device Guard components that you can use to protect this kind of device** |
|------------------------------------|------------------------------------------------------|--------------------------------------------------------------------------------|
-| **Fixed-workload devices**: Perform same tasks every day. Lists of approved applications rarely change. Examples: kiosks, point-of-sale systems, call center computers. | Windows Defender Device Guard can be deployed fully, and deployment and ongoing administration are relatively straightforward. After Windows Defender Device Guard deployment, only approved applications can run. This is because of protections offered by the Hypervisor Code Integrity (HVCI) service. | - VBS (hardware-based) protections, enabled.
• Code integrity policies in enforced mode, with UMCI enabled. |
-| **Fully managed devices**: Allowed software is restricted by IT department. Users can request additional software, or install from a list of applications provided by IT department. Examples: locked-down, company-owned desktops and laptops. | An initial baseline code integrity policy can be established and enforced. Whenever the IT department approves additional applications, it will update the code integrity policy and (for unsigned LOB applications) the catalog. Code integrity policies are supported by the HVCI service. | - VBS (hardware-based) protections, enabled.
• Code integrity policies in enforced mode, with UMCI enabled. |
-| **Lightly managed devices**: Company-owned, but users are free to install software. Devices are required to run organization's antivirus solution and client management tools. | Windows Defender Device Guard can be used to help protect the kernel, and to monitor (audit) for problem applications rather than limiting the applications that can be run. | - VBS (hardware-based) protections, enabled. When enabled with a code integrity policy in audit mode only, VBS means the hypervisor helps enforce the default kernel-mode code integrity policy, which protects against unsigned drivers or system files.
• Code integrity policies, with UMCI enabled, but running in audit mode only. This means applications are not blocked—the policy just logs an event whenever an application outside the policy is started. |
+| **Fixed-workload devices**: Perform same tasks every day. Lists of approved applications rarely change. Examples: kiosks, point-of-sale systems, call center computers. | Windows Defender Device Guard can be deployed fully, and deployment and ongoing administration are relatively straightforward. After Windows Defender Device Guard deployment, only approved applications can run. This is because of protections offered by WDAC. | - VBS (hardware-based) protections, enabled.
• WDAC in enforced mode, with UMCI enabled. |
+| **Fully managed devices**: Allowed software is restricted by IT department. Users can request additional software, or install from a list of applications provided by IT department. Examples: locked-down, company-owned desktops and laptops. | An initial baseline WDAC policy can be established and enforced. Whenever the IT department approves additional applications, it will update the WDAC policy and (for unsigned LOB applications) the catalog. WDAC policies are supported by the HVCI service. | - VBS (hardware-based) protections, enabled.
• WDAC in enforced mode, with UMCI enabled. |
+| **Lightly managed devices**: Company-owned, but users are free to install software. Devices are required to run organization's antivirus solution and client management tools. | Windows Defender Device Guard can be used to help protect the kernel, and to monitor (audit) for problem applications rather than limiting the applications that can be run. | - VBS (hardware-based) protections, enabled. When enabled with a WDAC policy in audit mode only, VBS means the hypervisor helps enforce the default kernel-mode code integrity policy, which protects against unsigned drivers or system files.
• WDAC, with UMCI enabled, but running in audit mode only. This means applications are not blocked—the policy just logs an event whenever an application outside the policy is started. |
| **Bring Your Own Device**: Employees are allowed to bring their own devices, and also use those devices away from work. | Windows Defender Device Guard does not apply. Instead, you can explore other hardening and security features with MDM-based conditional access solutions, such as Microsoft Intune. | N/A |
## Windows Defender Device Guard deployment in virtual machines
@@ -111,9 +111,9 @@ Windows Defender Device Guard protects against malware running in the guest virt
## Reviewing your applications: application signing and catalog files
-Typically, code integrity policies are configured to use the application's signing certificate as part or all of what identifies the application as trusted. This means that applications must either use embedded signing—where the signature is part of the binary—or catalog signing, where you generate a “catalog file” from the applications, sign it, and through the signed catalog file, configure the code integrity policy to recognize the applications as signed.
+Typically, WDAC policies are configured to use the application's signing certificate as part or all of what identifies the application as trusted. This means that applications must either use embedded signing—where the signature is part of the binary—or catalog signing, where you generate a “catalog file” from the applications, sign it, and through the signed catalog file, configure the WDAC policy to recognize the applications as signed.
-Catalog files can be very useful for unsigned LOB applications that cannot easily be given an embedded signature. However, catalogs need to be updated each time an application is updated. In contrast, with embedded signing, your code integrity policies typically do not have to be updated when an application is updated. For this reason, if code-signing is or can be included in your in-house application development process, it can simplify the management of your code integrity policies (compared to using catalog signing).
+Catalog files can be very useful for unsigned LOB applications that cannot easily be given an embedded signature. However, catalogs need to be updated each time an application is updated. In contrast, with embedded signing, your WDAC policies typically do not have to be updated when an application is updated. For this reason, if code-signing is or can be included in your in-house application development process, it can simplify the management of WDAC (compared to using catalog signing).
To obtain signed applications or embed signatures in your in-house applications, you can choose from a variety of methods:
@@ -131,27 +131,27 @@ To use catalog signing, you can choose from the following options:
### Catalog files
-Catalog files (which you can create in Windows 10 with a tool called Package Inspector) contain information about all deployed and executed binary files associated with your trusted but unsigned applications. When you create catalog files, you can also include signed applications for which you do not want to trust the signer but rather the specific application. After creating a catalog, you must sign the catalog file itself by using enterprise public key infrastructure (PKI), or a purchased code signing certificate. Then you can distribute the catalog, so that your trusted applications can be handled by code integrity policies in the same way as any other signed application.
+Catalog files (which you can create in Windows 10 with a tool called Package Inspector) contain information about all deployed and executed binary files associated with your trusted but unsigned applications. When you create catalog files, you can also include signed applications for which you do not want to trust the signer but rather the specific application. After creating a catalog, you must sign the catalog file itself by using enterprise public key infrastructure (PKI), or a purchased code signing certificate. Then you can distribute the catalog, so that your trusted applications can be handled by WDAC in the same way as any other signed application.
Catalog files are simply Secure Hash Algorithm 2 (SHA2) hash lists of discovered binaries. These binaries’ hash values are updated each time an application is updated, which requires the catalog file to be updated also.
-After you have created and signed your catalog files, you can configure your code integrity policies to trust the signer or signing certificate of those files.
+After you have created and signed your catalog files, you can configure your WDAC policies to trust the signer or signing certificate of those files.
> **Note** Package Inspector only works on operating systems that support Windows Defender Device Guard, such as Windows 10 Enterprise, Windows 10 Education, Windows 2016 Server, or Windows Enterprise IoT.
-For information about how creating catalog files fits into Windows Defender Device Guard deployment, see [Planning and getting started on the Windows Defender Device Guard deployment process](planning-and-getting-started-on-the-device-guard-deployment-process.md). For procedures for working with catalog files, see [Deploy catalog files to support code integrity policies](deploy-catalog-files-to-support-code-integrity-policies.md).
+For information about how creating catalog files fits into Windows Defender Device Guard deployment, see [Planning and getting started on the Windows Defender Device Guard deployment process](planning-and-getting-started-on-the-device-guard-deployment-process.md). For procedures for working with catalog files, see [Deploy catalog files to support Windows Defender Application Control](deploy-catalog-files-to-support-windows-defender-application-control.md).
-## Code integrity policy formats and signing
+## Windows Defender Application Control policy formats and signing
-When you generate a code integrity policy, you are generating a binary-encoded XML document that includes configuration settings for both the User and Kernel-modes of Windows 10 Enterprise, along with restrictions on Windows 10 script hosts. You can view your original XML document in a text editor, for example if you want to check the rule options that are present in the **<Rules>** section of the file.
+When you generate a WDAC policy, you are generating a binary-encoded XML document that includes configuration settings for both the User and Kernel-modes of Windows 10 Enterprise, along with restrictions on Windows 10 script hosts. You can view your original XML document in a text editor, for example if you want to check the rule options that are present in the **<Rules>** section of the file.
-We recommend that you keep the original XML file for use when you need to merge the code integrity policy with another policy or update its rule options. For deployment purposes, the file is converted to a binary format, which can be done using a simple Windows PowerShell command.
+We recommend that you keep the original XML file for use when you need to merge the WDAC policy with another policy or update its rule options. For deployment purposes, the file is converted to a binary format, which can be done using a simple Windows PowerShell command.
-When the code integrity policy is deployed, it restricts the software that can run on a device. The XML document can be signed, helping to add additional protection against administrative users changing or removing the policy.
+When the WDAC policy is deployed, it restricts the software that can run on a device. The XML document can be signed, helping to add additional protection against administrative users changing or removing the policy.
## Related topics
- [Planning and getting started on the Windows Defender Device Guard deployment process](planning-and-getting-started-on-the-device-guard-deployment-process.md)
-- [Deploy Windows Defender Device Guard: deploy code integrity policies](deploy-device-guard-deploy-code-integrity-policies.md)
+- [Deploy Windows Defender Application Control](deploy-windows-defender-application-control.md)
diff --git a/windows/device-security/device-guard/deploy-code-integrity-policies-steps.md b/windows/device-security/device-guard/steps-to-deploy-windows-defender-application-control.md
similarity index 70%
rename from windows/device-security/device-guard/deploy-code-integrity-policies-steps.md
rename to windows/device-security/device-guard/steps-to-deploy-windows-defender-application-control.md
index f5c907daf3..380dfc0e0c 100644
--- a/windows/device-security/device-guard/deploy-code-integrity-policies-steps.md
+++ b/windows/device-security/device-guard/steps-to-deploy-windows-defender-application-control.md
@@ -6,26 +6,26 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.localizationpriority: high
author: brianlic-msft
-ms.date: 10/20/2017
+ms.date: 11/02/2017
---
-# Deploy code integrity policies: steps
+# Steps to Deploy Windows Defender Application Control
**Applies to**
- Windows 10
- Windows Server 2016
-For an overview of the process described in the following procedures, see [Deploy code integrity policies: policy rules and file rules](deploy-code-integrity-policies-policy-rules-and-file-rules.md). To understand how the deployment of code integrity policies fits with other steps in the Windows Defender Device Guard deployment process, see [Planning and getting started on the Windows Defender Device Guard deployment process](planning-and-getting-started-on-the-device-guard-deployment-process.md).
+For an overview of the process described in the following procedures, see [Deploy Windows Defender Application Control: policy rules and file rules](deploy-windows-defender-application-control-policy-rules-and-file-rules.md). To understand how the deployment of Windows Defender Application Control (WDAC) fits with other steps in the Windows Defender Device Guard deployment process, see [Planning and getting started on the Windows Defender Device Guard deployment process](planning-and-getting-started-on-the-device-guard-deployment-process.md).
-## Create a code integrity policy from a reference computer
+## Create a Windows Defender Application Control policy from a reference computer
-This section outlines the process to create a code integrity policy with Windows PowerShell.
+This section outlines the process to create a WDAC policy with Windows PowerShell.
For this example, you must initiate variables to be used during the creation process or use the full file paths in the command.
-Then create the code integrity policy by scanning the system for installed applications.
+Then create the WDAC policy by scanning the system for installed applications.
The policy file is converted to binary format when it gets created so that Windows can interpret it.
> [!Note]
-> Make sure the reference computer is virus and malware-free, and install any software you want to be scanned before creating the code integrity policy.
+> Make sure the reference computer is virus and malware-free, and install any software you want to be scanned before creating the WDAC policy.
### Scripting and applications
@@ -33,12 +33,15 @@ Each installed software application should be validated as trustworthy before yo
We recommend that you review the reference computer for software that can load arbitrary DLLs and run code or scripts that could render the PC more vulnerable.
Examples include software aimed at development or scripting such as msbuild.exe (part of Visual Studio and the .NET Framework) which can be removed if you do not want it to run scripts.
You can remove or disable such software on the reference computer.
-You can also fine-tune your control by [using Windows Defender Device Guard in combination with AppLocker](https://technet.microsoft.com/itpro/windows/keep-secure/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies#device-guard-with-applocker).
+You can also fine-tune your control by [using Windows Defender Application Control in combination with AppLocker](introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md#windows-defender-device-guard-with-applocker).
-Members of the security community\* continuously collaborate with Microsoft to help protect customers. With the help of their valuable reports, Microsoft has identified a list of valid applications that an attacker could also potentially use to bypass Windows Defender Device Guard code integrity policies.
+Members of the security community\* continuously collaborate with Microsoft to help protect customers. With the help of their valuable reports, Microsoft has identified a list of valid applications that an attacker could also potentially use to bypass Windows Defender Application Control.
-Unless your use scenarios explicitly require them, Microsoft recommends that you block the following applications. These applications or files can be used by an attacker to circumvent Application Whitelisting policies, including Windows Defender Device Guard:
+Unless your use scenarios explicitly require them, Microsoft recommends that you block the following applications. These applications or files can be used by an attacker to circumvent application whitelisting policies, including Windows Defender Application Control:
+- addinprocess.exe
+- addinprocess32.exe
+- addinutil.exe
- bash.exe
- bginfo.exe[1]
- cdb.exe
@@ -81,11 +84,11 @@ Unless your use scenarios explicitly require them, Microsoft recommends that you
>This application list will be updated with the latest vendor information as application vulnerabilities are resolved and new issues are discovered.
Certain software applications may allow additional code to run by design.
-These types of applications should be blocked by your Windows Defender Device Guard policy.
-In addition, when an application version is upgraded to fix a security vulnerability or potential Windows Defender Device Guard bypass, you should add deny rules to your code integrity policies for that application’s previous, less secure versions.
+These types of applications should be blocked by your Windows Defender Application Control policy.
+In addition, when an application version is upgraded to fix a security vulnerability or potential Windows Defender Application Control bypass, you should add deny rules to your WDAC policies for that application’s previous, less secure versions.
Microsoft recommends that you install the latest security updates.
-The June 2017 Windows updates resolve several issues in PowerShell modules that allowed an attacker to bypass Windows Defender Device Guard code integrity policies.
+The June 2017 Windows updates resolve several issues in PowerShell modules that allowed an attacker to bypass Windows Defender Application Control.
These modules cannot be blocked by name or version, and therefore must be blocked by their corresponding hashes.
For October 2017, we are announcing an update to system.management.automation.dll in which we are revoking older versions by hash values, instead of version rules.
@@ -116,26 +119,29 @@ Microsoft recommends that you block the following Microsoft-signed applications
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
@@ -421,6 +427,9 @@ Microsoft recommends that you block the following Microsoft-signed applications
+
+
+
@@ -681,7 +690,7 @@ Microsoft recommends that you block the following Microsoft-signed applications
```
-To create a code integrity policy, copy each of the following commands into an elevated Windows PowerShell session, in order:
+To create a WDAC policy, copy each of the following commands into an elevated Windows PowerShell session, in order:
1. Initialize variables that you will use. The following example commands use **InitialScan.xml** and **DeviceGuardPolicy.bin** for the names of the files that will be created:
@@ -691,89 +700,89 @@ To create a code integrity policy, copy each of the following commands into an e
` $CIPolicyBin=$CIPolicyPath+"DeviceGuardPolicy.bin"`
-2. Use [New-CIPolicy](https://technet.microsoft.com/library/mt634473.aspx) to create a new code integrity policy by scanning the system for installed applications:
+2. Use [New-CIPolicy](https://technet.microsoft.com/library/mt634473.aspx) to create a new WDAC policy by scanning the system for installed applications:
` New-CIPolicy -Level PcaCertificate -FilePath $InitialCIPolicy –UserPEs 3> CIPolicyLog.txt `
> [!Note]
- > - When you specify the **-UserPEs** parameter (to include user mode executables in the scan), rule option **0 Enabled:UMCI** is automatically added to the code integrity policy. In contrast, if you do not specify **-UserPEs**, the policy will be empty of user mode executables and will only have rules for kernel mode binaries like drivers, in other words, the whitelist will not include applications. If you create such a policy and later add rule option **0 Enabled:UMCI**, all attempts to start applications will cause a response from Windows Defender Device Guard. In audit mode, the response is logging an event, and in enforced mode, the response is blocking the application.
+ > - When you specify the **-UserPEs** parameter (to include user mode executables in the scan), rule option **0 Enabled:UMCI** is automatically added to the WDAC policy. In contrast, if you do not specify **-UserPEs**, the policy will be empty of user mode executables and will only have rules for kernel mode binaries like drivers, in other words, the whitelist will not include applications. If you create such a policy and later add rule option **0 Enabled:UMCI**, all attempts to start applications will cause a response from Windows Defender Application Control. In audit mode, the response is logging an event, and in enforced mode, the response is blocking the application.
- > - You can add the **-Fallback** parameter to catch any applications not discovered using the primary file rule level specified by the **-Level** parameter. For more information about file rule level options, see [Code integrity file rule levels](deploy-code-integrity-policies-policy-rules-and-file-rules.md#code-integrity-file-rule-levels) in “Deploy code integrity policies: policy rules and file rules.”
+ > - You can add the **-Fallback** parameter to catch any applications not discovered using the primary file rule level specified by the **-Level** parameter. For more information about file rule level options, see [Windows Defender Application Control file rule levels](deploy-windows-defender-application-control-policy-rules-and-file-rules.md#windows-defender-application-control-file-rule-levels) in “Deploy Windows Defender Application Control: policy rules and file rules.”
- > - To specify that the code integrity policy scan only a specific drive, include the **-ScanPath** parameter followed by a path. Without this parameter, the entire system is scanned.
+ > - To specify that the WDAC policy scan only a specific drive, include the **-ScanPath** parameter followed by a path. Without this parameter, the entire system is scanned.
> - The preceding example includes `3> CIPolicylog.txt`, which redirects warning messages to a text file, **CIPolicylog.txt**.
-3. Use [ConvertFrom-CIPolicy](https://technet.microsoft.com/library/mt733073.aspx) to convert the code integrity policy to a binary format:
+3. Use [ConvertFrom-CIPolicy](https://technet.microsoft.com/library/mt733073.aspx) to convert the WDAC policy to a binary format:
` ConvertFrom-CIPolicy $InitialCIPolicy $CIPolicyBin`
-After you complete these steps, the Windows Defender Device Guard binary file (DeviceGuardPolicy.bin) and original .xml file (IntialScan.xml) will be available on your desktop. You can use the binary version as a code integrity policy or sign it for additional security.
+After you complete these steps, the WDAC binary file (DeviceGuardPolicy.bin) and original .xml file (IntialScan.xml) will be available on your desktop. You can use the binary file as a WDAC policy or sign it for additional security.
> [!Note]
-> We recommend that you keep the original .xml file of the policy for use when you need to merge the code integrity policy with another policy or update its rule options. Alternatively, you would have to create a new policy from a new scan for servicing. For more information about how to merge code integrity policies, see [Merge code integrity policies](#merge-code-integrity-policies).
+> We recommend that you keep the original .xml file of the policy for use when you need to merge the WDAC policy with another policy or update its rule options. Alternatively, you would have to create a new policy from a new scan for servicing. For more information about how to merge WDAC policies, see [Merge Windows Defender Application Control policies](#merge-windows-defender-application-control-policies).
-We recommend that every code integrity policy be run in audit mode before being enforced. Doing so allows administrators to discover any issues with the policy without receiving error message dialog boxes. For information about how to audit a code integrity policy, see the next section, [Audit code integrity policies](#audit-code-integrity-policies).
+We recommend that every WDAC policy be run in audit mode before being enforced. Doing so allows administrators to discover any issues with the policy without receiving error message dialog boxes. For information about how to audit a WDAC policy, see the next section, [Audit Windows Defender Application Control policies](#audit-windows-defender-application-control-policies).
-## Audit code integrity policies
+## Audit Windows Defender Application Control policies
-When code integrity policies are run in audit mode, it allows administrators to discover any applications that were missed during an initial policy scan and to identify any new applications that have been installed and run since the original policy was created. While a code integrity policy is running in audit mode, any binary that runs and would have been denied had the policy been enforced is logged in the **Applications and Services Logs\\Microsoft\\Windows\\CodeIntegrity\\Operational** event log. When these logged binaries have been validated, they can easily be added to a new code integrity policy. When the new exception policy is created, you can merge it with your existing code integrity policies.
+When WDAC policies are run in audit mode, it allows administrators to discover any applications that were missed during an initial policy scan and to identify any new applications that have been installed and run since the original policy was created. While a WDAC policy is running in audit mode, any binary that runs and would have been denied had the policy been enforced is logged in the **Applications and Services Logs\\Microsoft\\Windows\\CodeIntegrity\\Operational** event log. When these logged binaries have been validated, they can easily be added to a new WDAC policy. When the new exception policy is created, you can merge it with your existing WDAC policies.
> [!Note]
-> Before you begin this process, you need to create a code integrity policy binary file. If you have not already done so, see [Create a code integrity policy from a reference computer](#create-a-code-integrity-policy-from-a-reference-computer), earlier in this topic, for a step-by-step walkthrough of the process to create a code integrity policy and convert it to binary format.
+> Before you begin this process, you need to create a WDAC policy binary file. If you have not already done so, see [Create a Windows Defender Application Control policy from a reference computer](#create-a-windows-defender-application-control-policy-from-a-reference-computer), earlier in this topic, for a step-by-step walkthrough of the process to create a WDAC policy and convert it to binary format.
-**To audit a code integrity policy with local policy:**
+**To audit a Windows Defender Application Control policy with local policy:**
-1. Find a *.bin policy file that you have created, for example, the DeviceGuardPolicy.bin file that resulted from the steps in the earlier section, [Create a code integrity policy from a reference computer](#create-a-code-integrity-policy-from-a-reference-computer). Copy the file to C:\\Windows\\System32\\CodeIntegrity.
+1. Find a *.bin policy file that you have created, for example, the DeviceGuardPolicy.bin file that resulted from the steps in the earlier section, [Create a Windows Defender Application Control policy from a reference computer](#create-a-windows-defender-application-control-policy-from-a-reference-computer). Copy the file to C:\\Windows\\System32\\CodeIntegrity.
2. On the computer you want to run in audit mode, open the Local Group Policy Editor by running **GPEdit.msc**.
> [!Note]
- > - The computer that you will run in audit mode must be clean of viruses or malware. Otherwise, in the process that you follow after auditing the system, you might unintentionally merge in a code integrity policy that allows viruses or malware to run.
+ > - The computer that you will run in audit mode must be clean of viruses or malware. Otherwise, in the process that you follow after auditing the system, you might unintentionally merge in a policy that allows viruses or malware to run.
> - An alternative method to test a policy is to rename the test file to SIPolicy.p7b and drop it into C:\\Windows\\System32\\CodeIntegrity, rather than deploy it by using the Local Group Policy Editor.
-3. Navigate to **Computer Configuration\\Administrative Templates\\System\\Windows Defender Device Guard**, and then select **Deploy Code Integrity Policy**. Enable this setting by using the appropriate file path, for example, C:\\Windows\\System32\\CodeIntegrity\\DeviceGuardPolicy.bin, as shown in Figure 1.
+3. Navigate to **Computer Configuration\\Administrative Templates\\System\\Windows Defender Device Guard**, and then select **Deploy Windows Defender Application Control**. Enable this setting by using the appropriate file path, for example, C:\\Windows\\System32\\CodeIntegrity\\DeviceGuardPolicy.bin, as shown in Figure 1.
> [!Note]
- > - The illustration shows the example file name *DeviceGuardPolicy.bin* because this name was used earlier in this topic, in [Create a code integrity policy from a reference computer](#create-a-code-integrity-policy-from-a-reference-computer). Also, this policy file does not need to be copied to every system. You can instead copy the code integrity policies to a file share to which all computer accounts have access.
+ > - The illustration shows the example file name *DeviceGuardPolicy.bin* because this name was used earlier in this topic, in [Create a Windows Defender Application Control policy from a reference computer](#create-a-windows-defender-application-control-policy-from-a-reference-computer). Also, this policy file does not need to be copied to every system. You can instead copy the WDAC policies to a file share to which all computer accounts have access.
> - Any policy you select here is converted to SIPolicy.p7b when it is deployed to the individual computers.
- > - You might have noticed that the GPO setting references a .p7b file and this policy uses a .bin file. Regardless of the type of policy you deploy (.bin, .p7b, or .p7), they are all converted to SIPolicy.p7b when dropped onto the computers running Windows 10. We recommend that you make your code integrity policy names friendly and allow the system to convert the policy names for you. By doing this, it ensures that the policies are easily distinguishable when viewed in a share or any other central repository.
+ > - You might have noticed that the GPO setting references a .p7b file and this policy uses a .bin file. Regardless of the type of policy you deploy (.bin, .p7b, or .p7), they are all converted to SIPolicy.p7b when dropped onto the computers running Windows 10. We recommend that you make your WDAC policy names friendly and allow the system to convert the policy names for you. By doing this, it ensures that the policies are easily distinguishable when viewed in a share or any other central repository.
- 
+ 
- Figure 1. Deploy your code integrity policy
+ Figure 1. Deploy your Windows Defender Application Control policy
-4. Restart the reference system for the code integrity policy to take effect.
+4. Restart the reference system for the WDAC policy to take effect.
-5. Use the system as you normally would, and monitor code integrity events in the event log. While in audit mode, any exception to the deployed code integrity policy will be logged in the **Applications and Services Logs\\Microsoft\\Windows\\CodeIntegrity\\Operational** event log, as shown in Figure 2.
+5. Use the system as you normally would, and monitor code integrity events in the event log. While in audit mode, any exception to the deployed WDAC policy will be logged in the **Applications and Services Logs\\Microsoft\\Windows\\CodeIntegrity\\Operational** event log, as shown in Figure 2.
- 
+ 
- Figure 2. Exceptions to the deployed code integrity policy
+ Figure 2. Exceptions to the deployed WDAC policy
You will be reviewing the exceptions that appear in the event log, and making a list of any applications that should be allowed to run in your environment.
-6. If you want to create a catalog file to simplify the process of including unsigned LOB applications in your code integrity policy, this is a good time to create it. For information, see [Deploy catalog files to support code integrity policies](deploy-catalog-files-to-support-code-integrity-policies.md).
+6. If you want to create a catalog file to simplify the process of including unsigned LOB applications in your WDAC policy, this is a good time to create it. For information, see [Deploy catalog files to support Windows Defender Application Control](deploy-catalog-files-to-support-windows-defender-application-control.md).
-Now that you have a code integrity policy deployed in audit mode, you can capture any audit information that appears in the event log. This is described in the next section.
+Now that you have a WDAC policy deployed in audit mode, you can capture any audit information that appears in the event log. This is described in the next section.
-## Create a code integrity policy that captures audit information from the event log
+## Create a Windows Defender Application Control policy that captures audit information from the event log
-Use the following procedure after you have been running a computer with a code integrity policy in audit mode for a period of time. When you are ready to capture the needed policy information from the event log (so that you can later merge that information into the original code integrity policy), complete the following steps.
+Use the following procedure after you have been running a computer with a WDAC policy in audit mode for a period of time. When you are ready to capture the needed policy information from the event log (so that you can later merge that information into the original WDAC policy), complete the following steps.
-1. Review the audit information in the event log. From the code integrity policy exceptions that you see, make a list of any applications that should be allowed to run in your environment, and decide on the file rule level that should be used to trust these applications.
+1. Review the audit information in the event log. From the WDAC policy exceptions that you see, make a list of any applications that should be allowed to run in your environment, and decide on the file rule level that should be used to trust these applications.
- Although the Hash file rule level will catch all of these exceptions, it may not be the best way to trust all of them. For information about file rule levels, see [Code integrity file rule levels](deploy-code-integrity-policies-policy-rules-and-file-rules.md#code-integrity-file-rule-levels) in "Deploy code integrity policies: policy rules and file rules."
+ Although the Hash file rule level will catch all of these exceptions, it may not be the best way to trust all of them. For information about file rule levels, see [Windows Defender Application Control file rule levels](deploy-windows-defender-application-control-policy-rules-and-file-rules.md#windows-defender-application-control-file-rule-levels) in "Deploy Windows Defender Application Control: policy rules and file rules."
- Your event log might also contain exceptions for applications that you eventually want your code integrity policy to block. If these appear, make a list of these also, for a later step in this procedure.
+ Your event log might also contain exceptions for applications that you eventually want your WDAC policy to block. If these appear, make a list of these also, for a later step in this procedure.
2. In an elevated Windows PowerShell session, initialize the variables that will be used. The example filename shown here is **DeviceGuardAuditPolicy.xml**:
@@ -781,27 +790,27 @@ Use the following procedure after you have been running a computer with a code i
` $CIAuditPolicy=$CIPolicyPath+"DeviceGuardAuditPolicy.xml"`
-3. Use [New-CIPolicy](https://technet.microsoft.com/library/mt634473.aspx) to generate a new code integrity policy from logged audit events. This example uses a file rule level of **Hash** and includes `3> CIPolicylog.txt`, which redirects warning messages to a text file, **CIPolicylog.txt**.
+3. Use [New-CIPolicy](https://technet.microsoft.com/library/mt634473.aspx) to generate a new WDAC policy from logged audit events. This example uses a file rule level of **Hash** and includes `3> CIPolicylog.txt`, which redirects warning messages to a text file, **CIPolicylog.txt**.
` New-CIPolicy -Audit -Level Hash -FilePath $CIAuditPolicy –UserPEs 3> CIPolicylog.txt`
> [!Note]
> When you create policies from audit events, you should carefully consider the file rule level that you select to trust. The preceding example uses the **Hash** rule level, which is the most specific. Any change to the file (such as replacing the file with a newer version of the same file) will change the Hash value, and require an update to the policy.
-4. Find and review the Windows Defender Device Guard audit policy .xml file that you created. If you used the example variables as shown, the filename will be **DeviceGuardAuditPolicy.xml**, and it will be on your desktop. Look for the following:
+4. Find and review the WDAC audit policy .xml file that you created. If you used the example variables as shown, the filename will be **DeviceGuardAuditPolicy.xml**, and it will be on your desktop. Look for the following:
- Any applications that were caught as exceptions, but should be allowed to run in your environment. These are applications that should be in the .xml file. Leave these as-is in the file.
- - Any applications that actually should not be allowed to run in your environment. Edit these out of the .xml file. If they remain in the .xml file, and the information in the file is merged into your existing code integrity policy, the policy will treat the applications as trusted, and allow them to run.
+ - Any applications that actually should not be allowed to run in your environment. Edit these out of the .xml file. If they remain in the .xml file, and the information in the file is merged into your existing WDAC policy, the policy will treat the applications as trusted, and allow them to run.
-You can now use this file to update the existing code integrity policy that you ran in audit mode by merging the two policies. For instructions on how to merge this audit policy with the existing code integrity policy, see the next section, [Merge code integrity policies](#merge-code-integrity-policies).
+You can now use this file to update the existing WDAC policy that you ran in audit mode by merging the two policies. For instructions on how to merge this audit policy with the existing WDAC policy, see the next section, [Merge Windows Defender Application Control policies](#merge-windows-defender-application-control-policies).
> [!Note]
-> You may have noticed that you did not generate a binary version of this policy as you did in [Create a code integrity policy from a reference computer](#create-a-code-integrity-policy-from-a-reference-computer). This is because code integrity policies created from an audit log are not intended to run as stand-alone policies but rather to update existing code integrity policies.
+> You may have noticed that you did not generate a binary version of this policy as you did in [Create a Windows Defender Application Control policy from a reference computer](#create-a-windows-defender-application-control-policy-from-a-reference-computer). This is because WDAC policies created from an audit log are not intended to run as stand-alone policies but rather to update existing WDAC policies.
-## Use a code integrity policy to control specific plug-ins, add-ins, and modules
+## Use a Windows Defender Application Control policy to control specific plug-ins, add-ins, and modules
-As of Windows 10, version 1703, you can use code integrity policies not only to control applications, but also to control whether specific plug-ins, add-ins, and modules can run from specific apps (such as a line-of-business application or a browser):
+As of Windows 10, version 1703, you can use WDAC policies not only to control applications, but also to control whether specific plug-ins, add-ins, and modules can run from specific apps (such as a line-of-business application or a browser):
| Approach (as of Windows 10, version 1703) | Guideline |
|---|---|
@@ -810,7 +819,7 @@ As of Windows 10, version 1703, you can use code integrity policies not only to
To work with these options, the typical method is to create a policy that only affects plug-ins, add-ins, and modules, then merge it into your ‘master’ policy (merging is described in the next section).
-For example, to create a code integrity policy that allows **addin1.dll** and **addin2.dll** to run in **ERP1.exe**, your organization’s enterprise resource planning (ERP) application, but blocks those add-ins in other applications, run the following commands. Note that in the second command, **+=** is used to add a second rule to the **$rule** variable:
+For example, to create a WDAC policy that allows **addin1.dll** and **addin2.dll** to run in **ERP1.exe**, your organization’s enterprise resource planning (ERP) application, but blocks those add-ins in other applications, run the following commands. Note that in the second command, **+=** is used to add a second rule to the **$rule** variable:
```
$rule = New-CIPolicyRule -DriverFilePath '.\temp\addin1.dll' -Level FileName -AppID '.\ERP1.exe'
@@ -818,21 +827,21 @@ $rule += New-CIPolicyRule -DriverFilePath '.\temp\addin2.dll' -Level FileName -A
New-CIPolicy -Rules $rule -FilePath ".\AllowERPAddins.xml" -UserPEs
```
-As another example, to create a code integrity policy that blocks **addin3.dll** from running in Microsoft Word, run the following command. You must include the `-Deny` option to block the specified add-ins in the specifed application:
+As another example, to create a WDAC policy that blocks **addin3.dll** from running in Microsoft Word, run the following command. You must include the `-Deny` option to block the specified add-ins in the specifed application:
```
$rule = New-CIPolicyRule -DriverFilePath '.\temp\addin3.dll' -Level FileName -Deny -AppID '.\winword.exe'
New-CIPolicy -Rules $rule -FilePath ".\BlockAddins.xml" -UserPEs
```
-## Merge code integrity policies
+## Merge Windows Defender Application Control policies
-When you develop code integrity policies, you will occasionally need to merge two policies. A common example is when a code integrity policy is initially created and audited. Another example is when you create a single master policy by using multiple code integrity policies previously created from reference computers. Because each computer running Windows 10 can have only one code integrity policy, it is important to properly maintain these policies. In this example, audit events have been saved into a secondary code integrity policy that you then merge with the initial code integrity policy.
+When you develop WDAC policies, you will occasionally need to merge two policies. A common example is when a WDAC policy is initially created and audited. Another example is when you create a single master policy by using multiple policies previously created from reference computers. Because each computer running Windows 10 can have only one WDAC policy, it is important to properly maintain these policies. In this example, audit events have been saved into a secondary WDAC policy that you then merge with the initial WDAC policy.
> [!Note]
-> The following example uses several of the code integrity policy .xml files that you created in earlier sections in this topic. You can follow this process, however, with any two code integrity policies you would like to combine.
+> The following example uses several of the WDAC policy .xml files that you created in earlier sections in this topic. You can follow this process, however, with any two WDAC policies you would like to combine.
-To merge two code integrity policies, complete the following steps in an elevated Windows PowerShell session:
+To merge two WDAC policies, complete the following steps in an elevated Windows PowerShell session:
1. Initialize the variables that will be used:
@@ -847,24 +856,24 @@ To merge two code integrity policies, complete the following steps in an elevate
` $CIPolicyBin=$CIPolicyPath+"NewDeviceGuardPolicy.bin"`
> [!Note]
- > The variables in this section specifically expect to find an initial policy on your desktop called **InitialScan.xml** and an audit code integrity policy called **DeviceGuardAuditPolicy.xml**. If you want to merge other code integrity policies, update the variables accordingly.
+ > The variables in this section specifically expect to find an initial policy on your desktop called **InitialScan.xml** and an audit WDAC policy called **DeviceGuardAuditPolicy.xml**. If you want to merge other WDAC policies, update the variables accordingly.
-2. Use [Merge-CIPolicy](https://technet.microsoft.com/library/mt634485.aspx) to merge two policies and create a new code integrity policy:
+2. Use [Merge-CIPolicy](https://technet.microsoft.com/library/mt634485.aspx) to merge two policies and create a new WDAC policy:
` Merge-CIPolicy -PolicyPaths $InitialCIPolicy,$AuditCIPolicy -OutputFilePath $MergedCIPolicy`
-3. Use [ConvertFrom-CIPolicy](https://technet.microsoft.com/library/mt733073.aspx) to convert the merged code integrity policy to binary format:
+3. Use [ConvertFrom-CIPolicy](https://technet.microsoft.com/library/mt733073.aspx) to convert the merged WDAC policy to binary format:
` ConvertFrom-CIPolicy $MergedCIPolicy $CIPolicyBin `
-Now that you have created a new code integrity policy (for example, called **NewDeviceGuardPolicy.bin**), you can deploy the policy to systems manually or by using Group Policy or Microsoft client management solutions. For information about how to deploy this new policy with Group Policy, see the [Deploy and manage code integrity policies with Group Policy](#deploy-and-manage-code-integrity-policies-with-group-policy) section.
+Now that you have created a new WDAC policy (for example, called **NewDeviceGuardPolicy.bin**), you can deploy the policy binary to systems manually or by using Group Policy or Microsoft client management solutions. For information about how to deploy this new policy with Group Policy, see the [Deploy and manage Windows Defender Application Control with Group Policy](#deploy-and-manage-windows-defender-application-control-with-group-policy) section.
-## Enforce code integrity policies
+## Enforce Windows Defender Application Control policies
-Every code integrity policy is created with audit mode enabled. After you have successfully deployed and tested a code integrity policy in audit mode and are ready to test the policy in enforced mode, complete the following steps in an elevated Windows PowerShell session:
+Every WDAC policy is created with audit mode enabled. After you have successfully deployed and tested a WDAC policy in audit mode and are ready to test the policy in enforced mode, complete the following steps in an elevated Windows PowerShell session:
> [!Note]
-> Every code integrity policy should be tested in audit mode first. For information about how to audit code integrity policies, see [Audit code integrity policies](#audit-code-integrity-policies), earlier in this topic.
+> Every WDAC policy should be tested in audit mode first. For information about how to audit WDAC policies, see [Audit Windows Defender Application Control policies](#audit-windows-defender-application-control-policies), earlier in this topic.
1. Initialize the variables that will be used:
@@ -877,9 +886,9 @@ Every code integrity policy is created with audit mode enabled. After you have s
` $CIPolicyBin=$CIPolicyPath+"EnforcedDeviceGuardPolicy.bin"`
> [!Note]
- > The initial code integrity policy that this section refers to was created in the [Create a code integrity policy from a reference computer](#create-a-code-integrity-policy-from-a-reference-computer) section. If you are using a different code integrity policy, update the **CIPolicyPath** and **InitialCIPolicy** variables.
+ > The initial WDAC policy that this section refers to was created in the [Create a Windows Defender Application Control policy from a reference computer](#create-a-windows-defender-application-control-policy-from-a-reference-computer) section. If you are using a different WDAC policy, update the **CIPolicyPath** and **InitialCIPolicy** variables.
-2. Ensure that rule options 9 (“Advanced Boot Options Menu”) and 10 (“Boot Audit on Failure”) are set the way that you intend for this policy. We strongly recommend that you enable these rule options before you run any enforced policy for the first time. Enabling these options provides administrators with a pre-boot command prompt, and allows Windows to start even if the code integrity policy blocks a kernel-mode driver from running. When ready for enterprise deployment, you can remove these options.
+2. Ensure that rule options 9 (“Advanced Boot Options Menu”) and 10 (“Boot Audit on Failure”) are set the way that you intend for this policy. We strongly recommend that you enable these rule options before you run any enforced policy for the first time. Enabling these options provides administrators with a pre-boot command prompt, and allows Windows to start even if the WDAC policy blocks a kernel-mode driver from running. When ready for enterprise deployment, you can remove these options.
To ensure that these options are enabled in a policy, use [Set-RuleOption](https://technet.microsoft.com/library/mt634483.aspx) as shown in the following commands. You can run these commands even if you're not sure whether options 9 and 10 are already enabled—if so, the commands have no effect.
@@ -896,36 +905,36 @@ Every code integrity policy is created with audit mode enabled. After you have s
` Set-RuleOption -FilePath $EnforcedCIPolicy -Option 3 -Delete`
> [!Note]
- > To enforce a code integrity policy, you delete option 3, the **Audit Mode Enabled** option. There is no “enforced” option that can be placed in a code integrity policy.
+ > To enforce a WDAC policy, you delete option 3, the **Audit Mode Enabled** option. There is no “enforced” option that can be placed in a WDAC policy.
-5. Use [ConvertFrom-CIPolicy](https://technet.microsoft.com/library/mt733073.aspx) to convert the new code integrity policy to binary format:
+5. Use [ConvertFrom-CIPolicy](https://technet.microsoft.com/library/mt733073.aspx) to convert the new WDAC policy to binary format:
` ConvertFrom-CIPolicy $EnforcedCIPolicy $CIPolicyBin`
-Now that this policy is in enforced mode, you can deploy it to your test computers. Rename the policy to SIPolicy.p7b and copy it to C:\\Windows\\System32\\CodeIntegrity for testing, or deploy the policy through Group Policy by following the instructions in [Deploy and manage code integrity policies with Group Policy](#deploy-and-manage-code-integrity-policies-with-group-policy). You can also use other client management software to deploy and manage the policy.
+Now that this policy is in enforced mode, you can deploy it to your test computers. Rename the policy to SIPolicy.p7b and copy it to C:\\Windows\\System32\\CodeIntegrity for testing, or deploy the policy through Group Policy by following the instructions in [Deploy and manage Windows Defender Application Control with Group Policy](#deploy-and-manage-windows-defender-application-control-with-group-policy). You can also use other client management software to deploy and manage the policy.
-## Signing code integrity policies with SignTool.exe
+## Signing Windows Defender Application Control policies with SignTool.exe
-Signed code integrity policies give organizations the highest level of malware protection available in Windows 10.
+Signed WDAC policies give organizations the highest level of malware protection available in Windows 10.
In addition to their enforced policy rules, signed policies cannot be modified or deleted by a user or administrator on the computer.
These policies are designed to prevent administrative tampering and kernel mode exploit access.
-With this in mind, it is much more difficult to remove signed code integrity policies.
-Before you sign and deploy a signed code integrity policy, we recommend that you [audit the policy](#audit-code-integrity-policies) to discover any blocked applications that should be allowed to run.
+With this in mind, it is much more difficult to remove signed WDAC policies.
+Before you sign and deploy a signed WDAC policy, we recommend that you [audit the policy](#audit-windows-defender-application-control-policies) to discover any blocked applications that should be allowed to run.
-Signing code integrity policies by using an on-premises CA-generated certificate or a purchased code signing certificate is straightforward.
-If you do not currently have a code signing certificate exported in .pfx format (containing private keys, extensions, and root certificates), see [Optional: Create a code signing certificate for code integrity policies](optional-create-a-code-signing-certificate-for-code-integrity-policies.md) to create one with your on-premises CA.
+Signing WDAC policies by using an on-premises CA-generated certificate or a purchased code signing certificate is straightforward.
+If you do not currently have a code signing certificate exported in .pfx format (containing private keys, extensions, and root certificates), see [Optional: Create a code signing certificate for Windows Defender Application Control](optional-create-a-code-signing-certificate-for-windows-defender-application-control.md) to create one with your on-premises CA.
-Before signing code integrity policies for the first time, be sure to enable rule options 9 (“Advanced Boot Options Menu”) and 10 (“Boot Audit on Failure”) to leave troubleshooting options available to administrators. To ensure that a rule option is enabled, you can run a command such as `Set-RuleOption -FilePath -Option 9` even if you're not sure whether the option is already enabled—if so, the command has no effect. When validated and ready for enterprise deployment, you can remove these options. For more information about rule options, see [Code integrity policy rules](deploy-code-integrity-policies-policy-rules-and-file-rules.md#code-integrity-policy-rules) in "Deploy code integrity policies: policy rules and file rules."
+Before signing WDAC policies for the first time, be sure to enable rule options 9 (“Advanced Boot Options Menu”) and 10 (“Boot Audit on Failure”) to leave troubleshooting options available to administrators. To ensure that a rule option is enabled, you can run a command such as `Set-RuleOption -FilePath -Option 9` even if you're not sure whether the option is already enabled—if so, the command has no effect. When validated and ready for enterprise deployment, you can remove these options. For more information about rule options, see [Windows Defender Application Control policy rules](deploy-windows-defender-application-control-policy-rules-and-file-rules.md#windows-defender-application-control-policy-rules) in "Deploy Windows Defender Application Control: policy rules and file rules."
-To sign a code integrity policy with SignTool.exe, you need the following components:
+To sign a WDAC policy with SignTool.exe, you need the following components:
- SignTool.exe, found in the Windows SDK (Windows 7 or later)
-- The binary format of the code integrity policy that you generated in the [Create a code integrity policy from a reference computer](#create-a-code-integrity-policy-from-a-reference-computer) section or another code integrity policy that you have created
+- The binary format of the WDAC policy that you generated in the [Create a Windows Defender Application Control policy from a reference computer](#create-a-windows-defender-application-control-policy-from-a-reference-computer) section or another WDAC policy that you have created
- An internal CA code signing certificate or a purchased code signing certificate
-If you do not have a code signing certificate, see the [Optional: Create a code signing certificate for code integrity policies](optional-create-a-code-signing-certificate-for-code-integrity-policies.md) section for instructions on how to create one. If you use an alternate certificate or code integrity policy, be sure to update the following steps with the appropriate variables and certificate so that the commands will function properly. To sign the existing code integrity policy, copy each of the following commands into an elevated Windows PowerShell session:
+If you do not have a code signing certificate, see the [Optional: Create a code signing certificate for Windows Defender Application Control](optional-create-a-code-signing-certificate-for-windows-defender-application-control.md) section for instructions on how to create one. If you use an alternate certificate or WDAC policy, be sure to update the following steps with the appropriate variables and certificate so that the commands will function properly. To sign the existing WDAC policy, copy each of the following commands into an elevated Windows PowerShell session:
1. Initialize the variables that will be used:
@@ -936,9 +945,9 @@ If you do not have a code signing certificate, see the [Optional: Create a code
` $CIPolicyBin=$CIPolicyPath+"DeviceGuardPolicy.bin"`
> [!Note]
- > This example uses the code integrity policy that you created in the [Create a code integrity policy from a reference computer](#create-a-code-integrity-policy-from-a-reference-computer) section. If you are signing another policy, be sure to update the **$CIPolicyPath** and **$CIPolicyBin** variables with the correct information.
+ > This example uses the WDAC policy that you created in the [Create a Windows Defender Application Control policy from a reference computer](#create-a-windows-defender-application-control-policy-from-a-reference-computer) section. If you are signing another policy, be sure to update the **$CIPolicyPath** and **$CIPolicyBin** variables with the correct information.
-2. Import the .pfx code signing certificate. Import the code signing certificate that you will use to sign the code integrity policy into the signing user’s personal store on the computer that will be doing the signing. In this example, you use the certificate that was created in [Optional: Create a code signing certificate for code integrity policies](optional-create-a-code-signing-certificate-for-code-integrity-policies.md).
+2. Import the .pfx code signing certificate. Import the code signing certificate that you will use to sign the WDAC policy into the signing user’s personal store on the computer that will be doing the signing. In this example, you use the certificate that was created in [Optional: Create a code signing certificate for Windows Defender Application Control](optional-create-a-code-signing-certificate-for-windows-defender-application-control.md).
3. Export the .cer code signing certificate. After the code signing certificate has been imported, export the .cer version to your desktop. This version will be added to the policy so that it can be updated later.
@@ -946,13 +955,13 @@ If you do not have a code signing certificate, see the [Optional: Create a code
` cd $env:USERPROFILE\Desktop `
-5. Use [Add-SignerRule](https://technet.microsoft.com/library/mt634479.aspx) to add an update signer certificate to the code integrity policy:
+5. Use [Add-SignerRule](https://technet.microsoft.com/library/mt634479.aspx) to add an update signer certificate to the WDAC policy:
` Add-SignerRule -FilePath $InitialCIPolicy -CertificatePath -Kernel -User –Update`
> [!Note]
> *<Path to exported .cer certificate>* should be the full path to the certificate that you exported in step 3.
- Also, adding update signers is crucial to being able to modify or disable this policy in the future. For more information about how to disable signed code integrity policies, see the [Disable signed code integrity policies within Windows](#disable-signed-code-integrity-policies-within-windows) section.
+ Also, adding update signers is crucial to being able to modify or disable this policy in the future. For more information about how to disable signed WDAC policies, see the [Disable signed Windows Defender Application Control policies within Windows](#disable-signed-windows-defender-application-control-policies-within-windows) section.
6. Use [Set-RuleOption](https://technet.microsoft.com/library/mt634483.aspx) to remove the unsigned policy rule option:
@@ -962,31 +971,31 @@ If you do not have a code signing certificate, see the [Optional: Create a code
` ConvertFrom-CIPolicy $InitialCIPolicy $CIPolicyBin`
-8. Sign the code integrity policy by using SignTool.exe:
+8. Sign the WDAC policy by using SignTool.exe:
` sign -v /n "ContosoDGSigningCert" -p7 . -p7co 1.3.6.1.4.1.311.79.1 -fd sha256 $CIPolicyBin`
> [!Note]
- > The *<Path to signtool.exe>* variable should be the full path to the SignTool.exe utility. **ContosoDGSigningCert** is the subject name of the certificate that will be used to sign the code integrity policy. You should import this certificate to your personal certificate store on the computer you use to sign the policy.
+ > The *<Path to signtool.exe>* variable should be the full path to the SignTool.exe utility. **ContosoDGSigningCert** is the subject name of the certificate that will be used to sign the WDAC policy. You should import this certificate to your personal certificate store on the computer you use to sign the policy.
-9. Validate the signed file. When complete, the commands should output a signed policy file called DeviceGuardPolicy.bin.p7 to your desktop. You can deploy this file the same way you deploy an enforced or non-enforced policy. For information about how to deploy code integrity policies, see [Deploy and manage code integrity policies with Group Policy](#deploy-and-manage-code-integrity-policies-with-group-policy).
+9. Validate the signed file. When complete, the commands should output a signed policy file called DeviceGuardPolicy.bin.p7 to your desktop. You can deploy this file the same way you deploy an enforced or non-enforced policy. For information about how to deploy WDAC policies, see [Deploy and manage Windows Defender Application Control with Group Policy](#deploy-and-manage-windows-defender-application-control-with-group-policy).
-## Disable unsigned code integrity policies
+## Disable unsigned Windows Defender Application Control policies
-There may come a time when an administrator wants to disable a code integrity policy. For unsigned code integrity policies, this process is simple. Depending on how the code integrity policy was deployed, unsigned policies can be disabled in one of two ways. If a code integrity policy was manually enabled and copied to the code integrity folder location, simply delete the file and restart the computer. The following locations can contain executing code integrity policies:
+There may come a time when an administrator wants to disable a WDAC policy. For unsigned WDAC policies, this process is simple. Depending on how the WDAC policy was deployed, unsigned policies can be disabled in one of two ways. If a WDAC policy was manually enabled and copied to the code integrity folder location, simply delete the file and restart the computer. The following locations can contain executing WDAC policies:
- <EFI System Partition>\\Microsoft\\Boot\\
- <OS Volume>\\Windows\\System32\\CodeIntegrity\\
-If the code integrity policy was deployed by using Group Policy, the GPO that is currently enabling and deploying the policy must be set to disabled. Then, the code integrity policy will be disabled on the next computer restart.
+If the WDAC policy was deployed by using Group Policy, the GPO that is currently enabling and deploying the policy must be set to disabled. Then, the WDAC policy will be disabled on the next computer restart.
-## Disable signed code integrity policies within Windows
+## Disable signed Windows Defender Application Control policies within Windows
-Signed policies protect Windows from administrative manipulation as well as malware that has gained administrative-level access to the system. For this reason, signed code integrity policies are intentionally more difficult to remove than unsigned policies. They inherently protect themselves from modification or removal and therefore are difficult even for administrators to remove successfully. If the signed code integrity policy is manually enabled and copied to the CodeIntegrity folder, to remove the policy, you must complete the following steps.
+Signed policies protect Windows from administrative manipulation as well as malware that has gained administrative-level access to the system. For this reason, signed WDAC policies are intentionally more difficult to remove than unsigned policies. They inherently protect themselves from modification or removal and therefore are difficult even for administrators to remove successfully. If the signed WDAC policy is manually enabled and copied to the CodeIntegrity folder, to remove the policy, you must complete the following steps.
> [!Note]
-> For reference, signed code integrity policies should be replaced and removed from the following locations:
+> For reference, signed WDAC policies should be replaced and removed from the following locations:
- <EFI System Partition>\\Microsoft\\Boot\\
@@ -1007,7 +1016,7 @@ Signed policies protect Windows from administrative manipulation as well as malw
5. Restart the client computer.
-If the signed code integrity policy has been deployed using by using Group Policy, you must complete the following steps:
+If the signed WDAC policy has been deployed using by using Group Policy, you must complete the following steps:
1. Replace the existing policy in the GPO with another signed policy that has the **6 Enabled: Unsigned System Integrity Policy** rule option enabled.
@@ -1025,31 +1034,31 @@ If the signed code integrity policy has been deployed using by using Group Polic
6. Restart the client computer.
-## Disable signed code integrity policies within the BIOS
+## Disable signed Windows Defender Application Control policies within the BIOS
-There may be a time when signed code integrity policies cause a boot failure. Because code integrity policies enforce kernel mode drivers, it is important that they be thoroughly tested on each software and hardware configuration before being enforced and signed. Signed code integrity policies are validated in the pre-boot sequence by using Secure Boot. When you disable the Secure Boot feature in the BIOS, and then delete the file from the following locations on the operating system disk, it allows the system to boot into Windows:
+There may be a time when signed WDAC policies cause a boot failure. Because WDAC policies enforce kernel mode drivers, it is important that they be thoroughly tested on each software and hardware configuration before being enforced and signed. Signed WDAC policies are validated in the pre-boot sequence by using Secure Boot. When you disable the Secure Boot feature in the BIOS, and then delete the file from the following locations on the operating system disk, it allows the system to boot into Windows:
- <EFI System Partition>\\Microsoft\\Boot\\
- <OS Volume>\\Windows\\System32\\CodeIntegrity\\
-## Deploy and manage code integrity policies with Group Policy
+## Deploy and manage Windows Defender Application Control with Group Policy
-Code integrity policies can easily be deployed and managed with Group Policy. A Windows Defender Device Guard administrative template will be available in Windows Server 2016 that allows you to simplify deployment of Windows Defender Device Guard hardware-based security features and code integrity policies. The following procedure walks you through how to deploy a code integrity policy called **DeviceGuardPolicy.bin** to a test OU called *DG Enabled PCs* by using a GPO called **Contoso GPO Test**.
+WDAC policies can easily be deployed and managed with Group Policy. A Windows Defender Device Guard administrative template will be available in Windows Server 2016 that allows you to simplify deployment of Windows Defender Device Guard hardware-based security features and Windows Defender Application Control policies. The following procedure walks you through how to deploy a WDAC policy called **DeviceGuardPolicy.bin** to a test OU called *DG Enabled PCs* by using a GPO called **Contoso GPO Test**.
> [!Note]
-> This walkthrough requires that you have previously created a code integrity policy and have a computer running Windows 10 on which to test a Group Policy deployment. For more information about how to create a code integrity policy, see [Create a code integrity policy from a reference computer](#create-a-code-integrity-policy-from-a-reference-computer), earlier in this topic.
+> This walkthrough requires that you have previously created a WDAC policy and have a computer running Windows 10 on which to test a Group Policy deployment. For more information about how to create a WDAC policy, see [Create a Windows Defender Application Control policy from a reference computer](#create-a-windows-defender-application-control-policy-from-a-reference-computer), earlier in this topic.
> [!Note]
-> Signed code integrity policies can cause boot failures when deployed. We recommend that signed code integrity policies be thoroughly tested on each hardware platform before enterprise deployment.
+> Signed WDAC policies can cause boot failures when deployed. We recommend that signed WDAC policies be thoroughly tested on each hardware platform before enterprise deployment.
-To deploy and manage a code integrity policy with Group Policy:
+To deploy and manage a WDAC policy with Group Policy:
1. On a domain controller on a client computer on which RSAT is installed, open the GPMC by running **GPMC.MSC** or searching for “Group Policy Management” in Windows Search.
2. Create a new GPO: right-click an OU, for example, the **DG Enabled PCs OU**, and then click **Create a GPO in this domain, and Link it here**, as shown in Figure 3.
- > **Note** You can use any OU name. Also, security group filtering is an option when you consider different ways of combining code integrity policies (or keeping them separate), as discussed in [Planning and getting started on the Windows Defender Device Guard deployment process](planning-and-getting-started-on-the-device-guard-deployment-process.md).
+ > **Note** You can use any OU name. Also, security group filtering is an option when you consider different ways of combining WDAC policies (or keeping them separate), as discussed in [Planning and getting started on the Windows Defender Device Guard deployment process](planning-and-getting-started-on-the-device-guard-deployment-process.md).
@@ -1059,31 +1068,31 @@ To deploy and manage a code integrity policy with Group Policy:
4. Open the Group Policy Management Editor: right-click the new GPO, and then click **Edit**.
-5. In the selected GPO, navigate to Computer Configuration\\Administrative Templates\\System\\Windows Defender Device Guard. Right-click **Deploy Code Integrity Policy** and then click **Edit**.
+5. In the selected GPO, navigate to Computer Configuration\\Administrative Templates\\System\\Windows Defender Device Guard. Right-click **Deploy Windows Defender Application Control** and then click **Edit**.
- 
+ 
- Figure 4. Edit the group policy for code integrity
+ Figure 4. Edit the group policy for Windows Defender Application Control
-6. In the **Display Code Integrity Policy** dialog box, select the **Enabled** option, and then specify the code integrity policy deployment path.
+6. In the **Deploy Windows Defender Application Control** dialog box, select the **Enabled** option, and then specify the code integrity policy deployment path.
In this policy setting, you specify either the local path in which the policy will exist on the client computer or a Universal Naming Convention (UNC) path that the client computers will look to retrieve the latest version of the policy. For example, with DeviceGuardPolicy.bin on the test computer, the example file path would be C:\\Windows\\System32\\CodeIntegrity\\DeviceGuardPolicy.bin, as shown in Figure 5.
> [!Note]
- > The illustration shows the example file name *DeviceGuardPolicy.bin* because this name was used earlier in this topic, in [Create a code integrity policy from a reference computer](#create-a-code-integrity-policy-from-a-reference-computer). Also, this policy file does not need to be copied to every computer. You can instead copy the code integrity policies to a file share to which all computer accounts have access. Any policy selected here is converted to SIPolicy.p7b when it is deployed to the individual client computers.
+ > The illustration shows the example file name *DeviceGuardPolicy.bin* because this name was used earlier in this topic, in [Create a Windows Defender Application Control policy from a reference computer](#create-a-windows-defender-application-control-policy-from-a-reference-computer). Also, this policy file does not need to be copied to every computer. You can instead copy the WDAC policies to a file share to which all computer accounts have access. Any policy selected here is converted to SIPolicy.p7b when it is deployed to the individual client computers.
- 
+ 
- Figure 5. Enable the code integrity policy
+ Figure 5. Enable the Windows Defender Application Control policy
> [!Note]
- > You may have noticed that the GPO setting references a .p7b file and this example uses a .bin file for the policy. Regardless of the type of policy you deploy (.bin, .p7b, or .p7), they are all converted to SIPolicy.p7b when dropped on the client computer running Windows 10. Make your code integrity policies friendly and allow the system to convert the policy names for you to ensure that the policies are easily distinguishable when viewed in a share or any other central repository.
+ > You may have noticed that the GPO setting references a .p7b file and this example uses a .bin file for the policy. Regardless of the type of policy you deploy (.bin, .p7b, or .p7), they are all converted to SIPolicy.p7b when dropped on the client computer running Windows 10. Make your WDAC policies friendly and allow the system to convert the policy names for you to ensure that the policies are easily distinguishable when viewed in a share or any other central repository.
-7. Close the Group Policy Management Editor, and then restart the Windows 10 test computer. Restarting the computer updates the code integrity policy. For information about how to audit code integrity policies, see the [Audit code integrity policies](#audit-code-integrity-policies) section.
+7. Close the Group Policy Management Editor, and then restart the Windows 10 test computer. Restarting the computer updates the WDAC policy. For information about how to audit WDAC policies, see the [Audit Windows Defender Application Control policies](#audit-windows-defender-application-control-policies) section.
## Related topics
-[Introduction to Windows Defender Device Guard: virtualization-based security and code integrity policies](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md)
+[Introduction to Windows Defender Device Guard: virtualization-based security and Windows Defender Application Control](introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md)
-[Deploy Windows Defender Device Guard: enable virtualization-based security](deploy-device-guard-enable-virtualization-based-security.md)
+[Enable virtualization-based protection of code integrity](deploy-device-guard-enable-virtualization-based-security.md)
diff --git a/windows/device-security/enable-virtualization-based-protection-of-code-integrity.md b/windows/device-security/enable-virtualization-based-protection-of-code-integrity.md
index 46290126ff..4483edb168 100644
--- a/windows/device-security/enable-virtualization-based-protection-of-code-integrity.md
+++ b/windows/device-security/enable-virtualization-based-protection-of-code-integrity.md
@@ -6,7 +6,7 @@ ms.mktglfcycl: deploy
ms.localizationpriority: high
ms.author: justinha
author: brianlic-msft
-ms.date: 11/07/2017
+ms.date: 11/28/2017
---
# Enable virtualization-based protection of code integrity
@@ -16,14 +16,14 @@ ms.date: 11/07/2017
- Windows 10
- Windows Server 2016
-Virtualization-based protection of code integrity (herein referred to as HVCI) is a powerful system mitigation, which leverages hardware virtualization and the Windows Hyper-V hypervisor to protect Windows kernel-mode processes against the injection and execution of malicious or unverified code.
+Virtualization-based protection of code integrity (herein referred to as Hypervisor-protected Code Integrity, or HVCI) is a powerful system mitigation that leverages hardware virtualization and the Windows Hyper-V hypervisor to protect Windows kernel-mode processes against the injection and execution of malicious or unverified code.
Code integrity validation is performed in a secure environment that is resistant to attack from malicious software, and page permissions for kernel mode are set and maintained by the Hyper-V hypervisor.
Some applications, including device drivers, may be incompatible with HVCI.
This can cause devices or software to malfunction and in rare cases may result in a Blue Screen. Such issues may occur after HVCI has been turned on or during the enablement process itself.
If this happens, see [Troubleshooting](#troubleshooting) for remediation steps.
-## How to Turn on virtualization-based protection of code integrity on the Windows 10 Fall Creators Update (version 1709)
+## How to turn on virtualization-based protection of code integrity on the Windows 10 Fall Creators Update (version 1709)
These steps apply to Windows 10 S, Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education.
@@ -65,7 +65,7 @@ B. If you experience software or device malfunction after using the above proced
C. If you experience a critical error during boot or your system is unstable after using the above procedure to turn on HVCI, you can recover using the Windows Recovery Environment (Windows RE). To boot to Windows RE, see [Windows RE Technical Reference](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-recovery-environment--windows-re--technical-reference). After logging in to Windows RE, you can turn off HVCI by renaming or deleting the SIPolicy.p7b file from the file location in step 3 above and then restart your device.
-## How to Turn off HVCI on the Windows 10 Fall Creators Update
+## How to turn off HVCI on the Windows 10 Fall Creators Update
1. Rename or delete the SIPolicy.p7b file located at C:\Windows\System32\CodeIntegrity.
2. Restart the device.
diff --git a/windows/device-security/encrypted-hard-drive.md b/windows/device-security/encrypted-hard-drive.md
index 3bae653290..323e089979 100644
--- a/windows/device-security/encrypted-hard-drive.md
+++ b/windows/device-security/encrypted-hard-drive.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Encrypted Hard Drive
diff --git a/windows/device-security/get-support-for-security-baselines.md b/windows/device-security/get-support-for-security-baselines.md
index 3ccf8ae1ba..74d83b5a3d 100644
--- a/windows/device-security/get-support-for-security-baselines.md
+++ b/windows/device-security/get-support-for-security-baselines.md
@@ -7,7 +7,7 @@ ms.mktglfcycl: deploy
ms.localizationpriority: high
ms.author: sagaudre
author: brianlic-msft
-ms.date: 10/17/2017
+ms.date: 10/23/2017
---
# Get Support
diff --git a/windows/device-security/index.md b/windows/device-security/index.md
index dc7615e6f9..0aeca25c88 100644
--- a/windows/device-security/index.md
+++ b/windows/device-security/index.md
@@ -6,6 +6,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/24/2017
---
# Device Security
diff --git a/windows/device-security/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md b/windows/device-security/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md
index 006a0c4470..f9f2c541a5 100644
--- a/windows/device-security/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md
+++ b/windows/device-security/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md
@@ -9,6 +9,7 @@ ms.sitesec: library
ms.pagetype: security, devices
author: arnaudjumelet
+ms.date: 10/13/2017
---
# Control the health of Windows 10-based devices
@@ -177,9 +178,9 @@ Windows 10 supports features to help prevent sophisticated low-level malware li
Virtualization-based security isolates sensitive code like Kernel Mode Code Integrity or sensitive corporate domain credentials from the rest of the Windows operating system. For more information, refer to the [Virtualization-based security](#virtual) section.
-- **Hyper-V Code Integrity (HVCI).** Hyper-V Code Integrity is a feature of Device Guard that ensures only drivers, executables, and DLLs that comply with the Device Guard Code Integrity policy are allowed to run.
+- **Hypervisor-protected Code Integrity (HVCI).** Hypervisor-protected Code Integrity is a feature of Device Guard that ensures only drivers, executables, and DLLs that comply with the Device Guard Code Integrity policy are allowed to run.
- When enabled and configured, Windows 10 can start the Hyper-V virtualization-based security services, including Hyper-V Code Integrity (HVCI). HVCI helps protect the system core (kernel), privileged drivers, and system defenses, like antimalware solutions, by preventing malware from running early in the boot process, or after startup.
+ When enabled and configured, Windows 10 can start the Hyper-V virtualization-based security services. HVCI helps protect the system core (kernel), privileged drivers, and system defenses, like antimalware solutions, by preventing malware from running early in the boot process, or after startup.
HVCI uses virtualization-based security to isolate Code Integrity, the only way kernel memory can become executable is through a Code Integrity verification. This means that kernel memory pages can never be Writable and Executable (W+X) and executable code cannot be directly modified.
diff --git a/windows/device-security/security-compliance-toolkit-10.md b/windows/device-security/security-compliance-toolkit-10.md
index 714ccde1d8..06f04138ac 100644
--- a/windows/device-security/security-compliance-toolkit-10.md
+++ b/windows/device-security/security-compliance-toolkit-10.md
@@ -7,7 +7,7 @@ ms.mktglfcycl: deploy
ms.localizationpriority: high
ms.author: sagaudre
author: brianlic-msft
-ms.date: 10/17/2017
+ms.date: 10/16/2017
---
# Microsoft Security Compliance Toolkit 1.0
@@ -53,5 +53,10 @@ More information on the Policy Analyzer tool can be found on the [Security Guida
## What is the Local Group Policy Object (LGPO) tool?
-LGPO is a tool for transferring Group Policy directly between a host’s registry and a GPO backup file, bypassing the Domain Controller. This gives administrators a simple way to verify the effects of their Group Policy settings directly.
+LGPO.exe is a command-line utility that is designed to help automate management of Local Group Policy.
+Using local policy gives administrators a simple way to verify the effects of Group Policy settings, and is also useful for managing non-domain-joined systems.
+LGPO.exe can import and apply settings from Registry Policy (Registry.pol) files, security templates, Advanced Auditing backup files, as well as from formatted “LGPO text” files.
+It can export local policy to a GPO backup.
+It can export the contents of a Registry Policy file to the “LGPO text” format that can then be edited, and can build a Registry Policy file from an LGPO text file.
+
Documentation for the LGPO tool can be found on the [Security Guidance blog](https://blogs.technet.microsoft.com/secguide/2016/01/21/lgpo-exe-local-group-policy-object-utility-v1-0/) or by [downloading the tool](https://www.microsoft.com/download/details.aspx?id=55319).
\ No newline at end of file
diff --git a/windows/device-security/security-policy-settings/access-credential-manager-as-a-trusted-caller.md b/windows/device-security/security-policy-settings/access-credential-manager-as-a-trusted-caller.md
index ff24a84d8c..57d0ce525d 100644
--- a/windows/device-security/security-policy-settings/access-credential-manager-as-a-trusted-caller.md
+++ b/windows/device-security/security-policy-settings/access-credential-manager-as-a-trusted-caller.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Access Credential Manager as a trusted caller
diff --git a/windows/device-security/security-policy-settings/access-this-computer-from-the-network.md b/windows/device-security/security-policy-settings/access-this-computer-from-the-network.md
index 0d93c1d879..adc562d497 100644
--- a/windows/device-security/security-policy-settings/access-this-computer-from-the-network.md
+++ b/windows/device-security/security-policy-settings/access-this-computer-from-the-network.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Access this computer from the network - security policy setting
diff --git a/windows/device-security/security-policy-settings/account-lockout-duration.md b/windows/device-security/security-policy-settings/account-lockout-duration.md
index 1d438057a4..1adc579110 100644
--- a/windows/device-security/security-policy-settings/account-lockout-duration.md
+++ b/windows/device-security/security-policy-settings/account-lockout-duration.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Account lockout duration
diff --git a/windows/device-security/security-policy-settings/account-lockout-policy.md b/windows/device-security/security-policy-settings/account-lockout-policy.md
index 6a13c989d3..c0380358d5 100644
--- a/windows/device-security/security-policy-settings/account-lockout-policy.md
+++ b/windows/device-security/security-policy-settings/account-lockout-policy.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Account Lockout Policy
diff --git a/windows/device-security/security-policy-settings/account-lockout-threshold.md b/windows/device-security/security-policy-settings/account-lockout-threshold.md
index 828a524fe0..73c16a319d 100644
--- a/windows/device-security/security-policy-settings/account-lockout-threshold.md
+++ b/windows/device-security/security-policy-settings/account-lockout-threshold.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Account lockout threshold
diff --git a/windows/device-security/security-policy-settings/account-policies.md b/windows/device-security/security-policy-settings/account-policies.md
index ca8fb5a3b4..28bda81eec 100644
--- a/windows/device-security/security-policy-settings/account-policies.md
+++ b/windows/device-security/security-policy-settings/account-policies.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Account Policies
diff --git a/windows/device-security/security-policy-settings/accounts-administrator-account-status.md b/windows/device-security/security-policy-settings/accounts-administrator-account-status.md
index aa07230763..9328293eb5 100644
--- a/windows/device-security/security-policy-settings/accounts-administrator-account-status.md
+++ b/windows/device-security/security-policy-settings/accounts-administrator-account-status.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 08/01/2017
---
# Accounts: Administrator account status
diff --git a/windows/device-security/security-policy-settings/accounts-block-microsoft-accounts.md b/windows/device-security/security-policy-settings/accounts-block-microsoft-accounts.md
index b2a0c2025c..8a75825556 100644
--- a/windows/device-security/security-policy-settings/accounts-block-microsoft-accounts.md
+++ b/windows/device-security/security-policy-settings/accounts-block-microsoft-accounts.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 08/10/2017
---
# Accounts: Block Microsoft accounts
diff --git a/windows/device-security/security-policy-settings/accounts-guest-account-status.md b/windows/device-security/security-policy-settings/accounts-guest-account-status.md
index 527a1357c4..6025b06bc7 100644
--- a/windows/device-security/security-policy-settings/accounts-guest-account-status.md
+++ b/windows/device-security/security-policy-settings/accounts-guest-account-status.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Accounts: Guest account status - security policy setting
diff --git a/windows/device-security/security-policy-settings/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only.md b/windows/device-security/security-policy-settings/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only.md
index eb700fe6ec..a46b765862 100644
--- a/windows/device-security/security-policy-settings/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only.md
+++ b/windows/device-security/security-policy-settings/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Accounts: Limit local account use of blank passwords to console logon only
diff --git a/windows/device-security/security-policy-settings/accounts-rename-administrator-account.md b/windows/device-security/security-policy-settings/accounts-rename-administrator-account.md
index 5c79c1d38b..a37109ddc4 100644
--- a/windows/device-security/security-policy-settings/accounts-rename-administrator-account.md
+++ b/windows/device-security/security-policy-settings/accounts-rename-administrator-account.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Accounts: Rename administrator account
diff --git a/windows/device-security/security-policy-settings/accounts-rename-guest-account.md b/windows/device-security/security-policy-settings/accounts-rename-guest-account.md
index c77030e875..e4c76cf159 100644
--- a/windows/device-security/security-policy-settings/accounts-rename-guest-account.md
+++ b/windows/device-security/security-policy-settings/accounts-rename-guest-account.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Accounts: Rename guest account - security policy setting
diff --git a/windows/device-security/security-policy-settings/act-as-part-of-the-operating-system.md b/windows/device-security/security-policy-settings/act-as-part-of-the-operating-system.md
index a35393e223..9703104c06 100644
--- a/windows/device-security/security-policy-settings/act-as-part-of-the-operating-system.md
+++ b/windows/device-security/security-policy-settings/act-as-part-of-the-operating-system.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Act as part of the operating system
diff --git a/windows/device-security/security-policy-settings/add-workstations-to-domain.md b/windows/device-security/security-policy-settings/add-workstations-to-domain.md
index fac531b419..a784ec1b27 100644
--- a/windows/device-security/security-policy-settings/add-workstations-to-domain.md
+++ b/windows/device-security/security-policy-settings/add-workstations-to-domain.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Add workstations to domain
diff --git a/windows/device-security/security-policy-settings/adjust-memory-quotas-for-a-process.md b/windows/device-security/security-policy-settings/adjust-memory-quotas-for-a-process.md
index 44fe866134..19363b3e59 100644
--- a/windows/device-security/security-policy-settings/adjust-memory-quotas-for-a-process.md
+++ b/windows/device-security/security-policy-settings/adjust-memory-quotas-for-a-process.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Adjust memory quotas for a process
diff --git a/windows/device-security/security-policy-settings/administer-security-policy-settings.md b/windows/device-security/security-policy-settings/administer-security-policy-settings.md
index 17efc2a182..d8074abc4f 100644
--- a/windows/device-security/security-policy-settings/administer-security-policy-settings.md
+++ b/windows/device-security/security-policy-settings/administer-security-policy-settings.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Administer security policy settings
diff --git a/windows/device-security/security-policy-settings/allow-log-on-locally.md b/windows/device-security/security-policy-settings/allow-log-on-locally.md
index 9e4831a223..7dc894bdc7 100644
--- a/windows/device-security/security-policy-settings/allow-log-on-locally.md
+++ b/windows/device-security/security-policy-settings/allow-log-on-locally.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Allow log on locally - security policy setting
diff --git a/windows/device-security/security-policy-settings/allow-log-on-through-remote-desktop-services.md b/windows/device-security/security-policy-settings/allow-log-on-through-remote-desktop-services.md
index d409837c30..f03676f04f 100644
--- a/windows/device-security/security-policy-settings/allow-log-on-through-remote-desktop-services.md
+++ b/windows/device-security/security-policy-settings/allow-log-on-through-remote-desktop-services.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Allow log on through Remote Desktop Services
diff --git a/windows/device-security/security-policy-settings/audit-audit-the-access-of-global-system-objects.md b/windows/device-security/security-policy-settings/audit-audit-the-access-of-global-system-objects.md
index afb13502d6..edf83067c0 100644
--- a/windows/device-security/security-policy-settings/audit-audit-the-access-of-global-system-objects.md
+++ b/windows/device-security/security-policy-settings/audit-audit-the-access-of-global-system-objects.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Audit: Audit the access of global system objects
diff --git a/windows/device-security/security-policy-settings/audit-audit-the-use-of-backup-and-restore-privilege.md b/windows/device-security/security-policy-settings/audit-audit-the-use-of-backup-and-restore-privilege.md
index 1abeb256d4..88fb383f82 100644
--- a/windows/device-security/security-policy-settings/audit-audit-the-use-of-backup-and-restore-privilege.md
+++ b/windows/device-security/security-policy-settings/audit-audit-the-use-of-backup-and-restore-privilege.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Audit: Audit the use of Backup and Restore privilege
diff --git a/windows/device-security/security-policy-settings/audit-force-audit-policy-subcategory-settings-to-override.md b/windows/device-security/security-policy-settings/audit-force-audit-policy-subcategory-settings-to-override.md
index 2cd37d2f17..1bf9663ec0 100644
--- a/windows/device-security/security-policy-settings/audit-force-audit-policy-subcategory-settings-to-override.md
+++ b/windows/device-security/security-policy-settings/audit-force-audit-policy-subcategory-settings-to-override.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings
diff --git a/windows/device-security/security-policy-settings/audit-policy.md b/windows/device-security/security-policy-settings/audit-policy.md
index 793d65adee..9dedcad594 100644
--- a/windows/device-security/security-policy-settings/audit-policy.md
+++ b/windows/device-security/security-policy-settings/audit-policy.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Audit Policy
diff --git a/windows/device-security/security-policy-settings/audit-shut-down-system-immediately-if-unable-to-log-security-audits.md b/windows/device-security/security-policy-settings/audit-shut-down-system-immediately-if-unable-to-log-security-audits.md
index 0cd45cc597..fd3dfb48ce 100644
--- a/windows/device-security/security-policy-settings/audit-shut-down-system-immediately-if-unable-to-log-security-audits.md
+++ b/windows/device-security/security-policy-settings/audit-shut-down-system-immediately-if-unable-to-log-security-audits.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Audit: Shut down system immediately if unable to log security audits
diff --git a/windows/device-security/security-policy-settings/back-up-files-and-directories.md b/windows/device-security/security-policy-settings/back-up-files-and-directories.md
index f338698789..e35bdba108 100644
--- a/windows/device-security/security-policy-settings/back-up-files-and-directories.md
+++ b/windows/device-security/security-policy-settings/back-up-files-and-directories.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Back up files and directories - security policy setting
diff --git a/windows/device-security/security-policy-settings/bypass-traverse-checking.md b/windows/device-security/security-policy-settings/bypass-traverse-checking.md
index 5c32eaf5e4..27869c656f 100644
--- a/windows/device-security/security-policy-settings/bypass-traverse-checking.md
+++ b/windows/device-security/security-policy-settings/bypass-traverse-checking.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Bypass traverse checking
diff --git a/windows/device-security/security-policy-settings/change-the-system-time.md b/windows/device-security/security-policy-settings/change-the-system-time.md
index 0ca13c1625..6d8bbb9216 100644
--- a/windows/device-security/security-policy-settings/change-the-system-time.md
+++ b/windows/device-security/security-policy-settings/change-the-system-time.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Change the system time - security policy setting
diff --git a/windows/device-security/security-policy-settings/change-the-time-zone.md b/windows/device-security/security-policy-settings/change-the-time-zone.md
index 50067366d5..3ea2370308 100644
--- a/windows/device-security/security-policy-settings/change-the-time-zone.md
+++ b/windows/device-security/security-policy-settings/change-the-time-zone.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Change the time zone - security policy setting
diff --git a/windows/device-security/security-policy-settings/create-a-pagefile.md b/windows/device-security/security-policy-settings/create-a-pagefile.md
index 804d32f022..6970d1da6a 100644
--- a/windows/device-security/security-policy-settings/create-a-pagefile.md
+++ b/windows/device-security/security-policy-settings/create-a-pagefile.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Create a pagefile - security policy setting
diff --git a/windows/device-security/security-policy-settings/create-a-token-object.md b/windows/device-security/security-policy-settings/create-a-token-object.md
index 8decf358bf..d8fb3590da 100644
--- a/windows/device-security/security-policy-settings/create-a-token-object.md
+++ b/windows/device-security/security-policy-settings/create-a-token-object.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Create a token object
diff --git a/windows/device-security/security-policy-settings/create-global-objects.md b/windows/device-security/security-policy-settings/create-global-objects.md
index c131685bec..ba22997a67 100644
--- a/windows/device-security/security-policy-settings/create-global-objects.md
+++ b/windows/device-security/security-policy-settings/create-global-objects.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Create global objects
diff --git a/windows/device-security/security-policy-settings/create-permanent-shared-objects.md b/windows/device-security/security-policy-settings/create-permanent-shared-objects.md
index bcc0896951..e934ed4cd0 100644
--- a/windows/device-security/security-policy-settings/create-permanent-shared-objects.md
+++ b/windows/device-security/security-policy-settings/create-permanent-shared-objects.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Create permanent shared objects
diff --git a/windows/device-security/security-policy-settings/create-symbolic-links.md b/windows/device-security/security-policy-settings/create-symbolic-links.md
index 994d8de789..25890fd436 100644
--- a/windows/device-security/security-policy-settings/create-symbolic-links.md
+++ b/windows/device-security/security-policy-settings/create-symbolic-links.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Create symbolic links
diff --git a/windows/device-security/security-policy-settings/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax.md b/windows/device-security/security-policy-settings/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax.md
index 99fd9c7f66..f59c6c8bcd 100644
--- a/windows/device-security/security-policy-settings/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax.md
+++ b/windows/device-security/security-policy-settings/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax
diff --git a/windows/device-security/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md b/windows/device-security/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md
index 6b5d3ee2c2..1fb8892b80 100644
--- a/windows/device-security/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md
+++ b/windows/device-security/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# DCOM: Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) syntax
diff --git a/windows/device-security/security-policy-settings/debug-programs.md b/windows/device-security/security-policy-settings/debug-programs.md
index 810c6a21b5..2859c4bbe7 100644
--- a/windows/device-security/security-policy-settings/debug-programs.md
+++ b/windows/device-security/security-policy-settings/debug-programs.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Debug programs
diff --git a/windows/device-security/security-policy-settings/deny-access-to-this-computer-from-the-network.md b/windows/device-security/security-policy-settings/deny-access-to-this-computer-from-the-network.md
index fbad5a0ca8..7f442354a9 100644
--- a/windows/device-security/security-policy-settings/deny-access-to-this-computer-from-the-network.md
+++ b/windows/device-security/security-policy-settings/deny-access-to-this-computer-from-the-network.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Deny access to this computer from the network
diff --git a/windows/device-security/security-policy-settings/deny-log-on-as-a-batch-job.md b/windows/device-security/security-policy-settings/deny-log-on-as-a-batch-job.md
index 5edb8ca898..de37314441 100644
--- a/windows/device-security/security-policy-settings/deny-log-on-as-a-batch-job.md
+++ b/windows/device-security/security-policy-settings/deny-log-on-as-a-batch-job.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Deny log on as a batch job
diff --git a/windows/device-security/security-policy-settings/deny-log-on-as-a-service.md b/windows/device-security/security-policy-settings/deny-log-on-as-a-service.md
index 7acdea2a4c..ed2f25dd74 100644
--- a/windows/device-security/security-policy-settings/deny-log-on-as-a-service.md
+++ b/windows/device-security/security-policy-settings/deny-log-on-as-a-service.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Deny log on as a service
diff --git a/windows/device-security/security-policy-settings/deny-log-on-locally.md b/windows/device-security/security-policy-settings/deny-log-on-locally.md
index cd84f05560..66f3796a26 100644
--- a/windows/device-security/security-policy-settings/deny-log-on-locally.md
+++ b/windows/device-security/security-policy-settings/deny-log-on-locally.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Deny log on locally
diff --git a/windows/device-security/security-policy-settings/deny-log-on-through-remote-desktop-services.md b/windows/device-security/security-policy-settings/deny-log-on-through-remote-desktop-services.md
index 8e5065b443..b04d06b392 100644
--- a/windows/device-security/security-policy-settings/deny-log-on-through-remote-desktop-services.md
+++ b/windows/device-security/security-policy-settings/deny-log-on-through-remote-desktop-services.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Deny log on through Remote Desktop Services
diff --git a/windows/device-security/security-policy-settings/devices-allow-undock-without-having-to-log-on.md b/windows/device-security/security-policy-settings/devices-allow-undock-without-having-to-log-on.md
index d8f1d31192..9ec5cd6013 100644
--- a/windows/device-security/security-policy-settings/devices-allow-undock-without-having-to-log-on.md
+++ b/windows/device-security/security-policy-settings/devices-allow-undock-without-having-to-log-on.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Devices: Allow undock without having to log on
diff --git a/windows/device-security/security-policy-settings/devices-allowed-to-format-and-eject-removable-media.md b/windows/device-security/security-policy-settings/devices-allowed-to-format-and-eject-removable-media.md
index bffc76a5e9..0fb15e5558 100644
--- a/windows/device-security/security-policy-settings/devices-allowed-to-format-and-eject-removable-media.md
+++ b/windows/device-security/security-policy-settings/devices-allowed-to-format-and-eject-removable-media.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Devices: Allowed to format and eject removable media
diff --git a/windows/device-security/security-policy-settings/devices-prevent-users-from-installing-printer-drivers.md b/windows/device-security/security-policy-settings/devices-prevent-users-from-installing-printer-drivers.md
index 0bf0ba89a9..2f97023f61 100644
--- a/windows/device-security/security-policy-settings/devices-prevent-users-from-installing-printer-drivers.md
+++ b/windows/device-security/security-policy-settings/devices-prevent-users-from-installing-printer-drivers.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Devices: Prevent users from installing printer drivers
diff --git a/windows/device-security/security-policy-settings/devices-restrict-cd-rom-access-to-locally-logged-on-user-only.md b/windows/device-security/security-policy-settings/devices-restrict-cd-rom-access-to-locally-logged-on-user-only.md
index 5e399e075e..23b2d882a6 100644
--- a/windows/device-security/security-policy-settings/devices-restrict-cd-rom-access-to-locally-logged-on-user-only.md
+++ b/windows/device-security/security-policy-settings/devices-restrict-cd-rom-access-to-locally-logged-on-user-only.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Devices: Restrict CD-ROM access to locally logged-on user only
diff --git a/windows/device-security/security-policy-settings/devices-restrict-floppy-access-to-locally-logged-on-user-only.md b/windows/device-security/security-policy-settings/devices-restrict-floppy-access-to-locally-logged-on-user-only.md
index 1716725907..c3738380c8 100644
--- a/windows/device-security/security-policy-settings/devices-restrict-floppy-access-to-locally-logged-on-user-only.md
+++ b/windows/device-security/security-policy-settings/devices-restrict-floppy-access-to-locally-logged-on-user-only.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Devices: Restrict floppy access to locally logged-on user only
diff --git a/windows/device-security/security-policy-settings/domain-controller-allow-server-operators-to-schedule-tasks.md b/windows/device-security/security-policy-settings/domain-controller-allow-server-operators-to-schedule-tasks.md
index feafcec116..7d02b9d124 100644
--- a/windows/device-security/security-policy-settings/domain-controller-allow-server-operators-to-schedule-tasks.md
+++ b/windows/device-security/security-policy-settings/domain-controller-allow-server-operators-to-schedule-tasks.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Domain controller: Allow server operators to schedule tasks
diff --git a/windows/device-security/security-policy-settings/domain-controller-ldap-server-signing-requirements.md b/windows/device-security/security-policy-settings/domain-controller-ldap-server-signing-requirements.md
index 9ef4617e9f..2528f5af05 100644
--- a/windows/device-security/security-policy-settings/domain-controller-ldap-server-signing-requirements.md
+++ b/windows/device-security/security-policy-settings/domain-controller-ldap-server-signing-requirements.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Domain controller: LDAP server signing requirements
diff --git a/windows/device-security/security-policy-settings/domain-controller-refuse-machine-account-password-changes.md b/windows/device-security/security-policy-settings/domain-controller-refuse-machine-account-password-changes.md
index 563e0956a9..6dd76544ba 100644
--- a/windows/device-security/security-policy-settings/domain-controller-refuse-machine-account-password-changes.md
+++ b/windows/device-security/security-policy-settings/domain-controller-refuse-machine-account-password-changes.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Domain controller: Refuse machine account password changes
diff --git a/windows/device-security/security-policy-settings/domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md b/windows/device-security/security-policy-settings/domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md
index b748e75485..8a661f02cc 100644
--- a/windows/device-security/security-policy-settings/domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md
+++ b/windows/device-security/security-policy-settings/domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Domain member: Digitally encrypt or sign secure channel data (always)
diff --git a/windows/device-security/security-policy-settings/domain-member-digitally-encrypt-secure-channel-data-when-possible.md b/windows/device-security/security-policy-settings/domain-member-digitally-encrypt-secure-channel-data-when-possible.md
index 241c83b30b..c1502c4e4a 100644
--- a/windows/device-security/security-policy-settings/domain-member-digitally-encrypt-secure-channel-data-when-possible.md
+++ b/windows/device-security/security-policy-settings/domain-member-digitally-encrypt-secure-channel-data-when-possible.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Domain member: Digitally encrypt secure channel data (when possible)
diff --git a/windows/device-security/security-policy-settings/domain-member-digitally-sign-secure-channel-data-when-possible.md b/windows/device-security/security-policy-settings/domain-member-digitally-sign-secure-channel-data-when-possible.md
index dfa36d1360..e9fb1c3dc5 100644
--- a/windows/device-security/security-policy-settings/domain-member-digitally-sign-secure-channel-data-when-possible.md
+++ b/windows/device-security/security-policy-settings/domain-member-digitally-sign-secure-channel-data-when-possible.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Domain member: Digitally sign secure channel data (when possible)
diff --git a/windows/device-security/security-policy-settings/domain-member-disable-machine-account-password-changes.md b/windows/device-security/security-policy-settings/domain-member-disable-machine-account-password-changes.md
index e933a14786..c6a7699292 100644
--- a/windows/device-security/security-policy-settings/domain-member-disable-machine-account-password-changes.md
+++ b/windows/device-security/security-policy-settings/domain-member-disable-machine-account-password-changes.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Domain member: Disable machine account password changes
diff --git a/windows/device-security/security-policy-settings/domain-member-maximum-machine-account-password-age.md b/windows/device-security/security-policy-settings/domain-member-maximum-machine-account-password-age.md
index 841729d203..d73cf6dab0 100644
--- a/windows/device-security/security-policy-settings/domain-member-maximum-machine-account-password-age.md
+++ b/windows/device-security/security-policy-settings/domain-member-maximum-machine-account-password-age.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Domain member: Maximum machine account password age
diff --git a/windows/device-security/security-policy-settings/domain-member-require-strong-windows-2000-or-later-session-key.md b/windows/device-security/security-policy-settings/domain-member-require-strong-windows-2000-or-later-session-key.md
index 2d179f76d3..16f9f08ed7 100644
--- a/windows/device-security/security-policy-settings/domain-member-require-strong-windows-2000-or-later-session-key.md
+++ b/windows/device-security/security-policy-settings/domain-member-require-strong-windows-2000-or-later-session-key.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Domain member: Require strong (Windows 2000 or later) session key
diff --git a/windows/device-security/security-policy-settings/enable-computer-and-user-accounts-to-be-trusted-for-delegation.md b/windows/device-security/security-policy-settings/enable-computer-and-user-accounts-to-be-trusted-for-delegation.md
index 6e5addb821..42a984338a 100644
--- a/windows/device-security/security-policy-settings/enable-computer-and-user-accounts-to-be-trusted-for-delegation.md
+++ b/windows/device-security/security-policy-settings/enable-computer-and-user-accounts-to-be-trusted-for-delegation.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Enable computer and user accounts to be trusted for delegation
diff --git a/windows/device-security/security-policy-settings/enforce-password-history.md b/windows/device-security/security-policy-settings/enforce-password-history.md
index a52801d820..de7e1af7ba 100644
--- a/windows/device-security/security-policy-settings/enforce-password-history.md
+++ b/windows/device-security/security-policy-settings/enforce-password-history.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Enforce password history
diff --git a/windows/device-security/security-policy-settings/enforce-user-logon-restrictions.md b/windows/device-security/security-policy-settings/enforce-user-logon-restrictions.md
index 39f83bb850..e01fcbf962 100644
--- a/windows/device-security/security-policy-settings/enforce-user-logon-restrictions.md
+++ b/windows/device-security/security-policy-settings/enforce-user-logon-restrictions.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Enforce user logon restrictions
diff --git a/windows/device-security/security-policy-settings/force-shutdown-from-a-remote-system.md b/windows/device-security/security-policy-settings/force-shutdown-from-a-remote-system.md
index e635eb56d3..29afe2f595 100644
--- a/windows/device-security/security-policy-settings/force-shutdown-from-a-remote-system.md
+++ b/windows/device-security/security-policy-settings/force-shutdown-from-a-remote-system.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Force shutdown from a remote system
diff --git a/windows/device-security/security-policy-settings/generate-security-audits.md b/windows/device-security/security-policy-settings/generate-security-audits.md
index 437bdc47d0..6f88087bae 100644
--- a/windows/device-security/security-policy-settings/generate-security-audits.md
+++ b/windows/device-security/security-policy-settings/generate-security-audits.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Generate security audits
diff --git a/windows/device-security/security-policy-settings/how-to-configure-security-policy-settings.md b/windows/device-security/security-policy-settings/how-to-configure-security-policy-settings.md
index 2731ce37e8..17b8bfcec6 100644
--- a/windows/device-security/security-policy-settings/how-to-configure-security-policy-settings.md
+++ b/windows/device-security/security-policy-settings/how-to-configure-security-policy-settings.md
@@ -8,6 +8,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Configure security policy settings
diff --git a/windows/device-security/security-policy-settings/impersonate-a-client-after-authentication.md b/windows/device-security/security-policy-settings/impersonate-a-client-after-authentication.md
index 9dc1b4f485..31ab10b629 100644
--- a/windows/device-security/security-policy-settings/impersonate-a-client-after-authentication.md
+++ b/windows/device-security/security-policy-settings/impersonate-a-client-after-authentication.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Impersonate a client after authentication
diff --git a/windows/device-security/security-policy-settings/increase-a-process-working-set.md b/windows/device-security/security-policy-settings/increase-a-process-working-set.md
index 237be32d51..34706bd79f 100644
--- a/windows/device-security/security-policy-settings/increase-a-process-working-set.md
+++ b/windows/device-security/security-policy-settings/increase-a-process-working-set.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Increase a process working set
diff --git a/windows/device-security/security-policy-settings/increase-scheduling-priority.md b/windows/device-security/security-policy-settings/increase-scheduling-priority.md
index 727d53c8e1..c50b81aaaf 100644
--- a/windows/device-security/security-policy-settings/increase-scheduling-priority.md
+++ b/windows/device-security/security-policy-settings/increase-scheduling-priority.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Increase scheduling priority
diff --git a/windows/device-security/security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked.md b/windows/device-security/security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked.md
index 5442141ce8..6efa45a50a 100644
--- a/windows/device-security/security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked.md
+++ b/windows/device-security/security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Interactive logon: Display user information when the session is locked
diff --git a/windows/device-security/security-policy-settings/interactive-logon-do-not-display-last-user-name.md b/windows/device-security/security-policy-settings/interactive-logon-do-not-display-last-user-name.md
index 79f14ac23c..30ac4426eb 100644
--- a/windows/device-security/security-policy-settings/interactive-logon-do-not-display-last-user-name.md
+++ b/windows/device-security/security-policy-settings/interactive-logon-do-not-display-last-user-name.md
@@ -6,6 +6,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Interactive logon: Don't display last signed-in
diff --git a/windows/device-security/security-policy-settings/interactive-logon-do-not-require-ctrl-alt-del.md b/windows/device-security/security-policy-settings/interactive-logon-do-not-require-ctrl-alt-del.md
index d1d0b00b2e..a0e2d4207d 100644
--- a/windows/device-security/security-policy-settings/interactive-logon-do-not-require-ctrl-alt-del.md
+++ b/windows/device-security/security-policy-settings/interactive-logon-do-not-require-ctrl-alt-del.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Interactive logon: Do not require CTRL+ALT+DEL
diff --git a/windows/device-security/security-policy-settings/interactive-logon-dont-display-username-at-sign-in.md b/windows/device-security/security-policy-settings/interactive-logon-dont-display-username-at-sign-in.md
index db24fb9fca..cf495671ea 100644
--- a/windows/device-security/security-policy-settings/interactive-logon-dont-display-username-at-sign-in.md
+++ b/windows/device-security/security-policy-settings/interactive-logon-dont-display-username-at-sign-in.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Interactive logon: Don't display username at sign-in
diff --git a/windows/device-security/security-policy-settings/interactive-logon-machine-account-lockout-threshold.md b/windows/device-security/security-policy-settings/interactive-logon-machine-account-lockout-threshold.md
index ee2f89dfe2..b2dfa5f7dc 100644
--- a/windows/device-security/security-policy-settings/interactive-logon-machine-account-lockout-threshold.md
+++ b/windows/device-security/security-policy-settings/interactive-logon-machine-account-lockout-threshold.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Interactive logon: Machine account lockout threshold
diff --git a/windows/device-security/security-policy-settings/interactive-logon-machine-inactivity-limit.md b/windows/device-security/security-policy-settings/interactive-logon-machine-inactivity-limit.md
index 5ecfd51a7e..f3cadccfc5 100644
--- a/windows/device-security/security-policy-settings/interactive-logon-machine-inactivity-limit.md
+++ b/windows/device-security/security-policy-settings/interactive-logon-machine-inactivity-limit.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Interactive logon: Machine inactivity limit
diff --git a/windows/device-security/security-policy-settings/interactive-logon-message-text-for-users-attempting-to-log-on.md b/windows/device-security/security-policy-settings/interactive-logon-message-text-for-users-attempting-to-log-on.md
index 6ee93f3d7a..3134a03c07 100644
--- a/windows/device-security/security-policy-settings/interactive-logon-message-text-for-users-attempting-to-log-on.md
+++ b/windows/device-security/security-policy-settings/interactive-logon-message-text-for-users-attempting-to-log-on.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Interactive logon: Message text for users attempting to log on
diff --git a/windows/device-security/security-policy-settings/interactive-logon-message-title-for-users-attempting-to-log-on.md b/windows/device-security/security-policy-settings/interactive-logon-message-title-for-users-attempting-to-log-on.md
index 5fd221ea00..1e37715589 100644
--- a/windows/device-security/security-policy-settings/interactive-logon-message-title-for-users-attempting-to-log-on.md
+++ b/windows/device-security/security-policy-settings/interactive-logon-message-title-for-users-attempting-to-log-on.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Interactive logon: Message title for users attempting to log on
diff --git a/windows/device-security/security-policy-settings/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md b/windows/device-security/security-policy-settings/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md
index c57b5db6e3..6b8b3f2fad 100644
--- a/windows/device-security/security-policy-settings/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md
+++ b/windows/device-security/security-policy-settings/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Interactive logon: Number of previous logons to cache (in case domain controller is not available)
diff --git a/windows/device-security/security-policy-settings/interactive-logon-prompt-user-to-change-password-before-expiration.md b/windows/device-security/security-policy-settings/interactive-logon-prompt-user-to-change-password-before-expiration.md
index e188c2bed0..86e3a1b15f 100644
--- a/windows/device-security/security-policy-settings/interactive-logon-prompt-user-to-change-password-before-expiration.md
+++ b/windows/device-security/security-policy-settings/interactive-logon-prompt-user-to-change-password-before-expiration.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Interactive logon: Prompt user to change password before expiration
diff --git a/windows/device-security/security-policy-settings/interactive-logon-require-domain-controller-authentication-to-unlock-workstation.md b/windows/device-security/security-policy-settings/interactive-logon-require-domain-controller-authentication-to-unlock-workstation.md
index 0faeff4378..19bfe5c981 100644
--- a/windows/device-security/security-policy-settings/interactive-logon-require-domain-controller-authentication-to-unlock-workstation.md
+++ b/windows/device-security/security-policy-settings/interactive-logon-require-domain-controller-authentication-to-unlock-workstation.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Interactive logon: Require Domain Controller authentication to unlock workstation
diff --git a/windows/device-security/security-policy-settings/interactive-logon-require-smart-card.md b/windows/device-security/security-policy-settings/interactive-logon-require-smart-card.md
index 503713f8e7..eafc069b2f 100644
--- a/windows/device-security/security-policy-settings/interactive-logon-require-smart-card.md
+++ b/windows/device-security/security-policy-settings/interactive-logon-require-smart-card.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Interactive logon: Require smart card - security policy setting
diff --git a/windows/device-security/security-policy-settings/interactive-logon-smart-card-removal-behavior.md b/windows/device-security/security-policy-settings/interactive-logon-smart-card-removal-behavior.md
index a2ba648b93..3540a9f09f 100644
--- a/windows/device-security/security-policy-settings/interactive-logon-smart-card-removal-behavior.md
+++ b/windows/device-security/security-policy-settings/interactive-logon-smart-card-removal-behavior.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Interactive logon: Smart card removal behavior
diff --git a/windows/device-security/security-policy-settings/kerberos-policy.md b/windows/device-security/security-policy-settings/kerberos-policy.md
index 0cb40c4482..3d1366b626 100644
--- a/windows/device-security/security-policy-settings/kerberos-policy.md
+++ b/windows/device-security/security-policy-settings/kerberos-policy.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Kerberos Policy
diff --git a/windows/device-security/security-policy-settings/load-and-unload-device-drivers.md b/windows/device-security/security-policy-settings/load-and-unload-device-drivers.md
index a0500dbf3c..fdc92d8744 100644
--- a/windows/device-security/security-policy-settings/load-and-unload-device-drivers.md
+++ b/windows/device-security/security-policy-settings/load-and-unload-device-drivers.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Load and unload device drivers
diff --git a/windows/device-security/security-policy-settings/lock-pages-in-memory.md b/windows/device-security/security-policy-settings/lock-pages-in-memory.md
index c1da29a511..b95d2d4210 100644
--- a/windows/device-security/security-policy-settings/lock-pages-in-memory.md
+++ b/windows/device-security/security-policy-settings/lock-pages-in-memory.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Lock pages in memory
diff --git a/windows/device-security/security-policy-settings/log-on-as-a-batch-job.md b/windows/device-security/security-policy-settings/log-on-as-a-batch-job.md
index e2be507be1..6669963069 100644
--- a/windows/device-security/security-policy-settings/log-on-as-a-batch-job.md
+++ b/windows/device-security/security-policy-settings/log-on-as-a-batch-job.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Log on as a batch job
diff --git a/windows/device-security/security-policy-settings/log-on-as-a-service.md b/windows/device-security/security-policy-settings/log-on-as-a-service.md
index eff13752ec..602b204581 100644
--- a/windows/device-security/security-policy-settings/log-on-as-a-service.md
+++ b/windows/device-security/security-policy-settings/log-on-as-a-service.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Log on as a service
diff --git a/windows/device-security/security-policy-settings/manage-auditing-and-security-log.md b/windows/device-security/security-policy-settings/manage-auditing-and-security-log.md
index 282e775032..8a2d799d66 100644
--- a/windows/device-security/security-policy-settings/manage-auditing-and-security-log.md
+++ b/windows/device-security/security-policy-settings/manage-auditing-and-security-log.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Manage auditing and security log
diff --git a/windows/device-security/security-policy-settings/maximum-lifetime-for-service-ticket.md b/windows/device-security/security-policy-settings/maximum-lifetime-for-service-ticket.md
index fd43969eb0..087dc4ed6c 100644
--- a/windows/device-security/security-policy-settings/maximum-lifetime-for-service-ticket.md
+++ b/windows/device-security/security-policy-settings/maximum-lifetime-for-service-ticket.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Maximum lifetime for service ticket
diff --git a/windows/device-security/security-policy-settings/maximum-lifetime-for-user-ticket-renewal.md b/windows/device-security/security-policy-settings/maximum-lifetime-for-user-ticket-renewal.md
index f807fae4e2..1b64be5e1d 100644
--- a/windows/device-security/security-policy-settings/maximum-lifetime-for-user-ticket-renewal.md
+++ b/windows/device-security/security-policy-settings/maximum-lifetime-for-user-ticket-renewal.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Maximum lifetime for user ticket renewal
diff --git a/windows/device-security/security-policy-settings/maximum-lifetime-for-user-ticket.md b/windows/device-security/security-policy-settings/maximum-lifetime-for-user-ticket.md
index e37ae53435..218c85c6c7 100644
--- a/windows/device-security/security-policy-settings/maximum-lifetime-for-user-ticket.md
+++ b/windows/device-security/security-policy-settings/maximum-lifetime-for-user-ticket.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Maximum lifetime for user ticket
diff --git a/windows/device-security/security-policy-settings/maximum-password-age.md b/windows/device-security/security-policy-settings/maximum-password-age.md
index 488f04f383..5577c3b083 100644
--- a/windows/device-security/security-policy-settings/maximum-password-age.md
+++ b/windows/device-security/security-policy-settings/maximum-password-age.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Maximum password age
diff --git a/windows/device-security/security-policy-settings/maximum-tolerance-for-computer-clock-synchronization.md b/windows/device-security/security-policy-settings/maximum-tolerance-for-computer-clock-synchronization.md
index 63ebd1f934..b8541be161 100644
--- a/windows/device-security/security-policy-settings/maximum-tolerance-for-computer-clock-synchronization.md
+++ b/windows/device-security/security-policy-settings/maximum-tolerance-for-computer-clock-synchronization.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Maximum tolerance for computer clock synchronization
diff --git a/windows/device-security/security-policy-settings/microsoft-network-client-digitally-sign-communications-always.md b/windows/device-security/security-policy-settings/microsoft-network-client-digitally-sign-communications-always.md
index 1cb4c83e11..0dccc80a87 100644
--- a/windows/device-security/security-policy-settings/microsoft-network-client-digitally-sign-communications-always.md
+++ b/windows/device-security/security-policy-settings/microsoft-network-client-digitally-sign-communications-always.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Microsoft network client: Digitally sign communications (always)
diff --git a/windows/device-security/security-policy-settings/microsoft-network-client-digitally-sign-communications-if-server-agrees.md b/windows/device-security/security-policy-settings/microsoft-network-client-digitally-sign-communications-if-server-agrees.md
index 4594534751..e796441281 100644
--- a/windows/device-security/security-policy-settings/microsoft-network-client-digitally-sign-communications-if-server-agrees.md
+++ b/windows/device-security/security-policy-settings/microsoft-network-client-digitally-sign-communications-if-server-agrees.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Microsoft network client: Digitally sign communications (if server agrees)
diff --git a/windows/device-security/security-policy-settings/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers.md b/windows/device-security/security-policy-settings/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers.md
index 901baabc0f..55e4e0410e 100644
--- a/windows/device-security/security-policy-settings/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers.md
+++ b/windows/device-security/security-policy-settings/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
diff --git a/windows/device-security/security-policy-settings/microsoft-network-server-amount-of-idle-time-required-before-suspending-session.md b/windows/device-security/security-policy-settings/microsoft-network-server-amount-of-idle-time-required-before-suspending-session.md
index f124f2216c..bed0312e47 100644
--- a/windows/device-security/security-policy-settings/microsoft-network-server-amount-of-idle-time-required-before-suspending-session.md
+++ b/windows/device-security/security-policy-settings/microsoft-network-server-amount-of-idle-time-required-before-suspending-session.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Microsoft network server: Amount of idle time required before suspending session
diff --git a/windows/device-security/security-policy-settings/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information.md b/windows/device-security/security-policy-settings/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information.md
index d979a1d65a..082fce0199 100644
--- a/windows/device-security/security-policy-settings/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information.md
+++ b/windows/device-security/security-policy-settings/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Microsoft network server: Attempt S4U2Self to obtain claim information
diff --git a/windows/device-security/security-policy-settings/microsoft-network-server-digitally-sign-communications-always.md b/windows/device-security/security-policy-settings/microsoft-network-server-digitally-sign-communications-always.md
index e71590b3cf..0cb1a1d201 100644
--- a/windows/device-security/security-policy-settings/microsoft-network-server-digitally-sign-communications-always.md
+++ b/windows/device-security/security-policy-settings/microsoft-network-server-digitally-sign-communications-always.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Microsoft network server: Digitally sign communications (always)
diff --git a/windows/device-security/security-policy-settings/microsoft-network-server-digitally-sign-communications-if-client-agrees.md b/windows/device-security/security-policy-settings/microsoft-network-server-digitally-sign-communications-if-client-agrees.md
index 6ad33d8c8d..2eafb89626 100644
--- a/windows/device-security/security-policy-settings/microsoft-network-server-digitally-sign-communications-if-client-agrees.md
+++ b/windows/device-security/security-policy-settings/microsoft-network-server-digitally-sign-communications-if-client-agrees.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Microsoft network server: Digitally sign communications (if client agrees)
diff --git a/windows/device-security/security-policy-settings/microsoft-network-server-disconnect-clients-when-logon-hours-expire.md b/windows/device-security/security-policy-settings/microsoft-network-server-disconnect-clients-when-logon-hours-expire.md
index 529004e2f0..2efe7661e7 100644
--- a/windows/device-security/security-policy-settings/microsoft-network-server-disconnect-clients-when-logon-hours-expire.md
+++ b/windows/device-security/security-policy-settings/microsoft-network-server-disconnect-clients-when-logon-hours-expire.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Microsoft network server: Disconnect clients when logon hours expire
diff --git a/windows/device-security/security-policy-settings/microsoft-network-server-server-spn-target-name-validation-level.md b/windows/device-security/security-policy-settings/microsoft-network-server-server-spn-target-name-validation-level.md
index 6096400f68..febb391d27 100644
--- a/windows/device-security/security-policy-settings/microsoft-network-server-server-spn-target-name-validation-level.md
+++ b/windows/device-security/security-policy-settings/microsoft-network-server-server-spn-target-name-validation-level.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Microsoft network server: Server SPN target name validation level
diff --git a/windows/device-security/security-policy-settings/minimum-password-age.md b/windows/device-security/security-policy-settings/minimum-password-age.md
index d56c232478..a21530fb60 100644
--- a/windows/device-security/security-policy-settings/minimum-password-age.md
+++ b/windows/device-security/security-policy-settings/minimum-password-age.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Minimum password age
diff --git a/windows/device-security/security-policy-settings/minimum-password-length.md b/windows/device-security/security-policy-settings/minimum-password-length.md
index 39c8f9fa60..91b22ce8ae 100644
--- a/windows/device-security/security-policy-settings/minimum-password-length.md
+++ b/windows/device-security/security-policy-settings/minimum-password-length.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Minimum password length
diff --git a/windows/device-security/security-policy-settings/modify-an-object-label.md b/windows/device-security/security-policy-settings/modify-an-object-label.md
index fecfb339d8..9bc859d8ef 100644
--- a/windows/device-security/security-policy-settings/modify-an-object-label.md
+++ b/windows/device-security/security-policy-settings/modify-an-object-label.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Modify an object label
diff --git a/windows/device-security/security-policy-settings/modify-firmware-environment-values.md b/windows/device-security/security-policy-settings/modify-firmware-environment-values.md
index e4f6b85eb1..1ea9cb284b 100644
--- a/windows/device-security/security-policy-settings/modify-firmware-environment-values.md
+++ b/windows/device-security/security-policy-settings/modify-firmware-environment-values.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Modify firmware environment values
diff --git a/windows/device-security/security-policy-settings/network-access-allow-anonymous-sidname-translation.md b/windows/device-security/security-policy-settings/network-access-allow-anonymous-sidname-translation.md
index 206c76f7fc..f5d8338e71 100644
--- a/windows/device-security/security-policy-settings/network-access-allow-anonymous-sidname-translation.md
+++ b/windows/device-security/security-policy-settings/network-access-allow-anonymous-sidname-translation.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Network access: Allow anonymous SID/Name translation
diff --git a/windows/device-security/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares.md b/windows/device-security/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares.md
index 7de439ad10..b56cb79eab 100644
--- a/windows/device-security/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares.md
+++ b/windows/device-security/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Network access: Do not allow anonymous enumeration of SAM accounts and shares
diff --git a/windows/device-security/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts.md b/windows/device-security/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts.md
index 1a8d592782..8a24119ceb 100644
--- a/windows/device-security/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts.md
+++ b/windows/device-security/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Network access: Do not allow anonymous enumeration of SAM accounts
diff --git a/windows/device-security/security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md b/windows/device-security/security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md
index a60b14af97..7c017c5b0c 100644
--- a/windows/device-security/security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md
+++ b/windows/device-security/security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Network access: Do not allow storage of passwords and credentials for network authentication
diff --git a/windows/device-security/security-policy-settings/network-access-let-everyone-permissions-apply-to-anonymous-users.md b/windows/device-security/security-policy-settings/network-access-let-everyone-permissions-apply-to-anonymous-users.md
index 02f1530efb..0b5d5d3df4 100644
--- a/windows/device-security/security-policy-settings/network-access-let-everyone-permissions-apply-to-anonymous-users.md
+++ b/windows/device-security/security-policy-settings/network-access-let-everyone-permissions-apply-to-anonymous-users.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Network access: Let Everyone permissions apply to anonymous users
diff --git a/windows/device-security/security-policy-settings/network-access-named-pipes-that-can-be-accessed-anonymously.md b/windows/device-security/security-policy-settings/network-access-named-pipes-that-can-be-accessed-anonymously.md
index 68f545297d..4db7cdc5d5 100644
--- a/windows/device-security/security-policy-settings/network-access-named-pipes-that-can-be-accessed-anonymously.md
+++ b/windows/device-security/security-policy-settings/network-access-named-pipes-that-can-be-accessed-anonymously.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Network access: Named Pipes that can be accessed anonymously
diff --git a/windows/device-security/security-policy-settings/network-access-remotely-accessible-registry-paths-and-subpaths.md b/windows/device-security/security-policy-settings/network-access-remotely-accessible-registry-paths-and-subpaths.md
index 3dc22f67e2..cfec2fafb7 100644
--- a/windows/device-security/security-policy-settings/network-access-remotely-accessible-registry-paths-and-subpaths.md
+++ b/windows/device-security/security-policy-settings/network-access-remotely-accessible-registry-paths-and-subpaths.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Network access: Remotely accessible registry paths and subpaths
diff --git a/windows/device-security/security-policy-settings/network-access-remotely-accessible-registry-paths.md b/windows/device-security/security-policy-settings/network-access-remotely-accessible-registry-paths.md
index 88c2340130..0297e485f5 100644
--- a/windows/device-security/security-policy-settings/network-access-remotely-accessible-registry-paths.md
+++ b/windows/device-security/security-policy-settings/network-access-remotely-accessible-registry-paths.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Network access: Remotely accessible registry paths
diff --git a/windows/device-security/security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares.md b/windows/device-security/security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares.md
index 75a2e71242..9a858f2da5 100644
--- a/windows/device-security/security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares.md
+++ b/windows/device-security/security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Network access: Restrict anonymous access to Named Pipes and Shares
diff --git a/windows/device-security/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md b/windows/device-security/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md
index 0264785b4b..968a0346b1 100644
--- a/windows/device-security/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md
+++ b/windows/device-security/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md
@@ -7,6 +7,7 @@ ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: high
author: justinha
+ms.date: 07/27/2017
---
# Network access: Restrict clients allowed to make remote calls to SAM
diff --git a/windows/device-security/security-policy-settings/network-access-shares-that-can-be-accessed-anonymously.md b/windows/device-security/security-policy-settings/network-access-shares-that-can-be-accessed-anonymously.md
index 4f53f77bdc..b5e5008271 100644
--- a/windows/device-security/security-policy-settings/network-access-shares-that-can-be-accessed-anonymously.md
+++ b/windows/device-security/security-policy-settings/network-access-shares-that-can-be-accessed-anonymously.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Network access: Shares that can be accessed anonymously
diff --git a/windows/device-security/security-policy-settings/network-access-sharing-and-security-model-for-local-accounts.md b/windows/device-security/security-policy-settings/network-access-sharing-and-security-model-for-local-accounts.md
index aab32aedb6..3674843d0e 100644
--- a/windows/device-security/security-policy-settings/network-access-sharing-and-security-model-for-local-accounts.md
+++ b/windows/device-security/security-policy-settings/network-access-sharing-and-security-model-for-local-accounts.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Network access: Sharing and security model for local accounts
diff --git a/windows/device-security/security-policy-settings/network-list-manager-policies.md b/windows/device-security/security-policy-settings/network-list-manager-policies.md
index 1488ba7052..e2e72db46d 100644
--- a/windows/device-security/security-policy-settings/network-list-manager-policies.md
+++ b/windows/device-security/security-policy-settings/network-list-manager-policies.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Network List Manager policies
diff --git a/windows/device-security/security-policy-settings/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md b/windows/device-security/security-policy-settings/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md
index 0c3458656e..a962ec3cc3 100644
--- a/windows/device-security/security-policy-settings/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md
+++ b/windows/device-security/security-policy-settings/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Network security: Allow Local System to use computer identity for NTLM
diff --git a/windows/device-security/security-policy-settings/network-security-allow-localsystem-null-session-fallback.md b/windows/device-security/security-policy-settings/network-security-allow-localsystem-null-session-fallback.md
index 405f149efa..da0ccc7bb9 100644
--- a/windows/device-security/security-policy-settings/network-security-allow-localsystem-null-session-fallback.md
+++ b/windows/device-security/security-policy-settings/network-security-allow-localsystem-null-session-fallback.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Network security: Allow LocalSystem NULL session fallback
diff --git a/windows/device-security/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md b/windows/device-security/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md
index fe460ccefd..77d4038a3d 100644
--- a/windows/device-security/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md
+++ b/windows/device-security/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Network security: Allow PKU2U authentication requests to this computer to use online identities
diff --git a/windows/device-security/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos.md b/windows/device-security/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos.md
index bcbe56a0ef..c4dd4a08f4 100644
--- a/windows/device-security/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos.md
+++ b/windows/device-security/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Network security: Configure encryption types allowed for Kerberos Win7 only
diff --git a/windows/device-security/security-policy-settings/network-security-do-not-store-lan-manager-hash-value-on-next-password-change.md b/windows/device-security/security-policy-settings/network-security-do-not-store-lan-manager-hash-value-on-next-password-change.md
index 11984a8b59..a33fcc6cfe 100644
--- a/windows/device-security/security-policy-settings/network-security-do-not-store-lan-manager-hash-value-on-next-password-change.md
+++ b/windows/device-security/security-policy-settings/network-security-do-not-store-lan-manager-hash-value-on-next-password-change.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Network security: Do not store LAN Manager hash value on next password change
diff --git a/windows/device-security/security-policy-settings/network-security-force-logoff-when-logon-hours-expire.md b/windows/device-security/security-policy-settings/network-security-force-logoff-when-logon-hours-expire.md
index a302a70695..572d2ac031 100644
--- a/windows/device-security/security-policy-settings/network-security-force-logoff-when-logon-hours-expire.md
+++ b/windows/device-security/security-policy-settings/network-security-force-logoff-when-logon-hours-expire.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Network security: Force logoff when logon hours expire
diff --git a/windows/device-security/security-policy-settings/network-security-lan-manager-authentication-level.md b/windows/device-security/security-policy-settings/network-security-lan-manager-authentication-level.md
index 3ae2b1240e..f4ae3d7ec6 100644
--- a/windows/device-security/security-policy-settings/network-security-lan-manager-authentication-level.md
+++ b/windows/device-security/security-policy-settings/network-security-lan-manager-authentication-level.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Network security: LAN Manager authentication level
diff --git a/windows/device-security/security-policy-settings/network-security-ldap-client-signing-requirements.md b/windows/device-security/security-policy-settings/network-security-ldap-client-signing-requirements.md
index 158b64ed3c..f22f62b0b2 100644
--- a/windows/device-security/security-policy-settings/network-security-ldap-client-signing-requirements.md
+++ b/windows/device-security/security-policy-settings/network-security-ldap-client-signing-requirements.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Network security: LDAP client signing requirements
diff --git a/windows/device-security/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients.md b/windows/device-security/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients.md
index 3f98b0d5f2..fd7b375759 100644
--- a/windows/device-security/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients.md
+++ b/windows/device-security/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 07/27/2017
---
# Network security: Minimum session security for NTLM SSP based (including secure RPC) clients
diff --git a/windows/device-security/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers.md b/windows/device-security/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers.md
index 752b9c97c1..a1a72b97d9 100644
--- a/windows/device-security/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers.md
+++ b/windows/device-security/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Network security: Minimum session security for NTLM SSP based (including secure RPC) servers
diff --git a/windows/device-security/security-policy-settings/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication.md b/windows/device-security/security-policy-settings/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication.md
index 74c9b41100..943d99b774 100644
--- a/windows/device-security/security-policy-settings/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication.md
+++ b/windows/device-security/security-policy-settings/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication
diff --git a/windows/device-security/security-policy-settings/network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md b/windows/device-security/security-policy-settings/network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md
index e16e7c0ff3..2a7f3ce456 100644
--- a/windows/device-security/security-policy-settings/network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md
+++ b/windows/device-security/security-policy-settings/network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Network security: Restrict NTLM: Add server exceptions in this domain
diff --git a/windows/device-security/security-policy-settings/network-security-restrict-ntlm-audit-incoming-ntlm-traffic.md b/windows/device-security/security-policy-settings/network-security-restrict-ntlm-audit-incoming-ntlm-traffic.md
index f5b4bd4032..de492a6900 100644
--- a/windows/device-security/security-policy-settings/network-security-restrict-ntlm-audit-incoming-ntlm-traffic.md
+++ b/windows/device-security/security-policy-settings/network-security-restrict-ntlm-audit-incoming-ntlm-traffic.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Network security: Restrict NTLM: Audit incoming NTLM traffic
diff --git a/windows/device-security/security-policy-settings/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md b/windows/device-security/security-policy-settings/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md
index c4254e5036..08335febc9 100644
--- a/windows/device-security/security-policy-settings/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md
+++ b/windows/device-security/security-policy-settings/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Network security: Restrict NTLM: Audit NTLM authentication in this domain
diff --git a/windows/device-security/security-policy-settings/network-security-restrict-ntlm-incoming-ntlm-traffic.md b/windows/device-security/security-policy-settings/network-security-restrict-ntlm-incoming-ntlm-traffic.md
index fba51b1a73..841ed44541 100644
--- a/windows/device-security/security-policy-settings/network-security-restrict-ntlm-incoming-ntlm-traffic.md
+++ b/windows/device-security/security-policy-settings/network-security-restrict-ntlm-incoming-ntlm-traffic.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Network security: Restrict NTLM: Incoming NTLM traffic
diff --git a/windows/device-security/security-policy-settings/network-security-restrict-ntlm-ntlm-authentication-in-this-domain.md b/windows/device-security/security-policy-settings/network-security-restrict-ntlm-ntlm-authentication-in-this-domain.md
index 407c4b9976..cbef99d80f 100644
--- a/windows/device-security/security-policy-settings/network-security-restrict-ntlm-ntlm-authentication-in-this-domain.md
+++ b/windows/device-security/security-policy-settings/network-security-restrict-ntlm-ntlm-authentication-in-this-domain.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Network security: Restrict NTLM: NTLM authentication in this domain
diff --git a/windows/device-security/security-policy-settings/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md b/windows/device-security/security-policy-settings/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md
index 896cdbadc1..59346ccb54 100644
--- a/windows/device-security/security-policy-settings/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md
+++ b/windows/device-security/security-policy-settings/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers
diff --git a/windows/device-security/security-policy-settings/password-must-meet-complexity-requirements.md b/windows/device-security/security-policy-settings/password-must-meet-complexity-requirements.md
index 29f724e680..bb0ef8c128 100644
--- a/windows/device-security/security-policy-settings/password-must-meet-complexity-requirements.md
+++ b/windows/device-security/security-policy-settings/password-must-meet-complexity-requirements.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/08/2017
---
# Password must meet complexity requirements
diff --git a/windows/device-security/security-policy-settings/password-policy.md b/windows/device-security/security-policy-settings/password-policy.md
index 4198fac995..c4974cf71c 100644
--- a/windows/device-security/security-policy-settings/password-policy.md
+++ b/windows/device-security/security-policy-settings/password-policy.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Password Policy
diff --git a/windows/device-security/security-policy-settings/perform-volume-maintenance-tasks.md b/windows/device-security/security-policy-settings/perform-volume-maintenance-tasks.md
index dae56942a1..c382fb66e7 100644
--- a/windows/device-security/security-policy-settings/perform-volume-maintenance-tasks.md
+++ b/windows/device-security/security-policy-settings/perform-volume-maintenance-tasks.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Perform volume maintenance tasks
diff --git a/windows/device-security/security-policy-settings/profile-single-process.md b/windows/device-security/security-policy-settings/profile-single-process.md
index 0dce3bdffe..5fbb3b3076 100644
--- a/windows/device-security/security-policy-settings/profile-single-process.md
+++ b/windows/device-security/security-policy-settings/profile-single-process.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Profile single process
diff --git a/windows/device-security/security-policy-settings/profile-system-performance.md b/windows/device-security/security-policy-settings/profile-system-performance.md
index d7b5f3b8fc..fa2a4609bc 100644
--- a/windows/device-security/security-policy-settings/profile-system-performance.md
+++ b/windows/device-security/security-policy-settings/profile-system-performance.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Profile system performance
diff --git a/windows/device-security/security-policy-settings/recovery-console-allow-automatic-administrative-logon.md b/windows/device-security/security-policy-settings/recovery-console-allow-automatic-administrative-logon.md
index 4ef6ba5277..1f8dabdc28 100644
--- a/windows/device-security/security-policy-settings/recovery-console-allow-automatic-administrative-logon.md
+++ b/windows/device-security/security-policy-settings/recovery-console-allow-automatic-administrative-logon.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Recovery console: Allow automatic administrative logon
diff --git a/windows/device-security/security-policy-settings/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders.md b/windows/device-security/security-policy-settings/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders.md
index d8945335fa..55fea42ddb 100644
--- a/windows/device-security/security-policy-settings/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders.md
+++ b/windows/device-security/security-policy-settings/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Recovery console: Allow floppy copy and access to all drives and folders
diff --git a/windows/device-security/security-policy-settings/remove-computer-from-docking-station.md b/windows/device-security/security-policy-settings/remove-computer-from-docking-station.md
index 1823951ae4..c25cf8e2ba 100644
--- a/windows/device-security/security-policy-settings/remove-computer-from-docking-station.md
+++ b/windows/device-security/security-policy-settings/remove-computer-from-docking-station.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Remove computer from docking station - security policy setting
diff --git a/windows/device-security/security-policy-settings/replace-a-process-level-token.md b/windows/device-security/security-policy-settings/replace-a-process-level-token.md
index 5361f2a589..f002ef3118 100644
--- a/windows/device-security/security-policy-settings/replace-a-process-level-token.md
+++ b/windows/device-security/security-policy-settings/replace-a-process-level-token.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Replace a process level token
diff --git a/windows/device-security/security-policy-settings/reset-account-lockout-counter-after.md b/windows/device-security/security-policy-settings/reset-account-lockout-counter-after.md
index d3e6f545ed..13163b2d93 100644
--- a/windows/device-security/security-policy-settings/reset-account-lockout-counter-after.md
+++ b/windows/device-security/security-policy-settings/reset-account-lockout-counter-after.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Reset account lockout counter after
diff --git a/windows/device-security/security-policy-settings/restore-files-and-directories.md b/windows/device-security/security-policy-settings/restore-files-and-directories.md
index bf78f4ff41..856437c766 100644
--- a/windows/device-security/security-policy-settings/restore-files-and-directories.md
+++ b/windows/device-security/security-policy-settings/restore-files-and-directories.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Restore files and directories - security policy setting
diff --git a/windows/device-security/security-policy-settings/secpol-advanced-security-audit-policy-settings.md b/windows/device-security/security-policy-settings/secpol-advanced-security-audit-policy-settings.md
index dca87d3e20..09c52294bb 100644
--- a/windows/device-security/security-policy-settings/secpol-advanced-security-audit-policy-settings.md
+++ b/windows/device-security/security-policy-settings/secpol-advanced-security-audit-policy-settings.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Advanced security audit policy settings
diff --git a/windows/device-security/security-policy-settings/security-options.md b/windows/device-security/security-policy-settings/security-options.md
index e8cba42ee3..502b856b25 100644
--- a/windows/device-security/security-policy-settings/security-options.md
+++ b/windows/device-security/security-policy-settings/security-options.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 08/01/2017
---
# Security Options
diff --git a/windows/device-security/security-policy-settings/security-policy-settings-reference.md b/windows/device-security/security-policy-settings/security-policy-settings-reference.md
index 4023dfc66f..36c19f08f0 100644
--- a/windows/device-security/security-policy-settings/security-policy-settings-reference.md
+++ b/windows/device-security/security-policy-settings/security-policy-settings-reference.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Security policy settings reference
diff --git a/windows/device-security/security-policy-settings/security-policy-settings.md b/windows/device-security/security-policy-settings/security-policy-settings.md
index f9ea234685..4f24fe003a 100644
--- a/windows/device-security/security-policy-settings/security-policy-settings.md
+++ b/windows/device-security/security-policy-settings/security-policy-settings.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Security policy settings
diff --git a/windows/device-security/security-policy-settings/shut-down-the-system.md b/windows/device-security/security-policy-settings/shut-down-the-system.md
index 4cde410c2d..3c7cbedb11 100644
--- a/windows/device-security/security-policy-settings/shut-down-the-system.md
+++ b/windows/device-security/security-policy-settings/shut-down-the-system.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Shut down the system - security policy setting
diff --git a/windows/device-security/security-policy-settings/shutdown-allow-system-to-be-shut-down-without-having-to-log-on.md b/windows/device-security/security-policy-settings/shutdown-allow-system-to-be-shut-down-without-having-to-log-on.md
index bdd15d4040..ef32c15b9a 100644
--- a/windows/device-security/security-policy-settings/shutdown-allow-system-to-be-shut-down-without-having-to-log-on.md
+++ b/windows/device-security/security-policy-settings/shutdown-allow-system-to-be-shut-down-without-having-to-log-on.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Shutdown: Allow system to be shut down without having to log on
diff --git a/windows/device-security/security-policy-settings/shutdown-clear-virtual-memory-pagefile.md b/windows/device-security/security-policy-settings/shutdown-clear-virtual-memory-pagefile.md
index 16ed671235..8458d32a52 100644
--- a/windows/device-security/security-policy-settings/shutdown-clear-virtual-memory-pagefile.md
+++ b/windows/device-security/security-policy-settings/shutdown-clear-virtual-memory-pagefile.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 08/01/2017
---
# Shutdown: Clear virtual memory pagefile
diff --git a/windows/device-security/security-policy-settings/store-passwords-using-reversible-encryption.md b/windows/device-security/security-policy-settings/store-passwords-using-reversible-encryption.md
index 667eaec2fc..6b0bae4976 100644
--- a/windows/device-security/security-policy-settings/store-passwords-using-reversible-encryption.md
+++ b/windows/device-security/security-policy-settings/store-passwords-using-reversible-encryption.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Store passwords using reversible encryption
diff --git a/windows/device-security/security-policy-settings/synchronize-directory-service-data.md b/windows/device-security/security-policy-settings/synchronize-directory-service-data.md
index b562f8a178..740d9d0593 100644
--- a/windows/device-security/security-policy-settings/synchronize-directory-service-data.md
+++ b/windows/device-security/security-policy-settings/synchronize-directory-service-data.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Synchronize directory service data
diff --git a/windows/device-security/security-policy-settings/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer.md b/windows/device-security/security-policy-settings/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer.md
index 0862dc11d1..7e9d1f3acd 100644
--- a/windows/device-security/security-policy-settings/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer.md
+++ b/windows/device-security/security-policy-settings/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# System cryptography: Force strong key protection for user keys stored on the computer
diff --git a/windows/device-security/security-policy-settings/system-objects-require-case-insensitivity-for-non-windows-subsystems.md b/windows/device-security/security-policy-settings/system-objects-require-case-insensitivity-for-non-windows-subsystems.md
index 1f3af1c21c..6f5095b542 100644
--- a/windows/device-security/security-policy-settings/system-objects-require-case-insensitivity-for-non-windows-subsystems.md
+++ b/windows/device-security/security-policy-settings/system-objects-require-case-insensitivity-for-non-windows-subsystems.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# System objects: Require case insensitivity for non-Windows subsystems
diff --git a/windows/device-security/security-policy-settings/system-objects-strengthen-default-permissions-of-internal-system-objects.md b/windows/device-security/security-policy-settings/system-objects-strengthen-default-permissions-of-internal-system-objects.md
index 5be5a462b1..e1466cb95c 100644
--- a/windows/device-security/security-policy-settings/system-objects-strengthen-default-permissions-of-internal-system-objects.md
+++ b/windows/device-security/security-policy-settings/system-objects-strengthen-default-permissions-of-internal-system-objects.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)
diff --git a/windows/device-security/security-policy-settings/system-settings-optional-subsystems.md b/windows/device-security/security-policy-settings/system-settings-optional-subsystems.md
index 15ec7c1221..c82b0dffa3 100644
--- a/windows/device-security/security-policy-settings/system-settings-optional-subsystems.md
+++ b/windows/device-security/security-policy-settings/system-settings-optional-subsystems.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# System settings: Optional subsystems
diff --git a/windows/device-security/security-policy-settings/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies.md b/windows/device-security/security-policy-settings/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies.md
index ae25abd015..7bc764769a 100644
--- a/windows/device-security/security-policy-settings/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies.md
+++ b/windows/device-security/security-policy-settings/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# System settings: Use certificate rules on Windows executables for Software Restriction Policies
diff --git a/windows/device-security/security-policy-settings/take-ownership-of-files-or-other-objects.md b/windows/device-security/security-policy-settings/take-ownership-of-files-or-other-objects.md
index 24ab3257e2..50ee559766 100644
--- a/windows/device-security/security-policy-settings/take-ownership-of-files-or-other-objects.md
+++ b/windows/device-security/security-policy-settings/take-ownership-of-files-or-other-objects.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Take ownership of files or other objects
diff --git a/windows/device-security/security-policy-settings/user-account-control-admin-approval-mode-for-the-built-in-administrator-account.md b/windows/device-security/security-policy-settings/user-account-control-admin-approval-mode-for-the-built-in-administrator-account.md
index b452b3c093..827068144d 100644
--- a/windows/device-security/security-policy-settings/user-account-control-admin-approval-mode-for-the-built-in-administrator-account.md
+++ b/windows/device-security/security-policy-settings/user-account-control-admin-approval-mode-for-the-built-in-administrator-account.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/08/2017
---
# User Account Control: Admin Approval Mode for the Built-in Administrator account
diff --git a/windows/device-security/security-policy-settings/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop.md b/windows/device-security/security-policy-settings/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop.md
index ec501f6f2d..ce00295661 100644
--- a/windows/device-security/security-policy-settings/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop.md
+++ b/windows/device-security/security-policy-settings/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop
diff --git a/windows/device-security/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md b/windows/device-security/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md
index bd001552c4..41a9379d1f 100644
--- a/windows/device-security/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md
+++ b/windows/device-security/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 09/08/2017
---
# User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode
diff --git a/windows/device-security/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md b/windows/device-security/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md
index e2d5edf535..866d8ae86d 100644
--- a/windows/device-security/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md
+++ b/windows/device-security/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# User Account Control: Behavior of the elevation prompt for standard users
diff --git a/windows/device-security/security-policy-settings/user-account-control-detect-application-installations-and-prompt-for-elevation.md b/windows/device-security/security-policy-settings/user-account-control-detect-application-installations-and-prompt-for-elevation.md
index 32708030df..ab6b837747 100644
--- a/windows/device-security/security-policy-settings/user-account-control-detect-application-installations-and-prompt-for-elevation.md
+++ b/windows/device-security/security-policy-settings/user-account-control-detect-application-installations-and-prompt-for-elevation.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# User Account Control: Detect application installations and prompt for elevation
diff --git a/windows/device-security/security-policy-settings/user-account-control-only-elevate-executables-that-are-signed-and-validated.md b/windows/device-security/security-policy-settings/user-account-control-only-elevate-executables-that-are-signed-and-validated.md
index a40147e7fc..6d75c0225d 100644
--- a/windows/device-security/security-policy-settings/user-account-control-only-elevate-executables-that-are-signed-and-validated.md
+++ b/windows/device-security/security-policy-settings/user-account-control-only-elevate-executables-that-are-signed-and-validated.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# User Account Control: Only elevate executables that are signed and validated
diff --git a/windows/device-security/security-policy-settings/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations.md b/windows/device-security/security-policy-settings/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations.md
index bfa1ed931c..a56e37647a 100644
--- a/windows/device-security/security-policy-settings/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations.md
+++ b/windows/device-security/security-policy-settings/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# User Account Control: Only elevate UIAccess applications that are installed in secure locations
diff --git a/windows/device-security/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode.md b/windows/device-security/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode.md
index 566bd4d85a..1a79e80070 100644
--- a/windows/device-security/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode.md
+++ b/windows/device-security/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# User Account Control: Run all administrators in Admin Approval Mode
diff --git a/windows/device-security/security-policy-settings/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md b/windows/device-security/security-policy-settings/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md
index 4946bf5cee..2b87555ed9 100644
--- a/windows/device-security/security-policy-settings/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md
+++ b/windows/device-security/security-policy-settings/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# User Account Control: Switch to the secure desktop when prompting for elevation
diff --git a/windows/device-security/security-policy-settings/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations.md b/windows/device-security/security-policy-settings/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations.md
index 8308a25a5d..7fba0a0991 100644
--- a/windows/device-security/security-policy-settings/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations.md
+++ b/windows/device-security/security-policy-settings/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# User Account Control: Virtualize file and registry write failures to per-user locations
diff --git a/windows/device-security/security-policy-settings/user-rights-assignment.md b/windows/device-security/security-policy-settings/user-rights-assignment.md
index 59979d3158..249e7ff426 100644
--- a/windows/device-security/security-policy-settings/user-rights-assignment.md
+++ b/windows/device-security/security-policy-settings/user-rights-assignment.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# User Rights Assignment
diff --git a/windows/device-security/tpm/backup-tpm-recovery-information-to-ad-ds.md b/windows/device-security/tpm/backup-tpm-recovery-information-to-ad-ds.md
index 10963dd930..0f5768fe1c 100644
--- a/windows/device-security/tpm/backup-tpm-recovery-information-to-ad-ds.md
+++ b/windows/device-security/tpm/backup-tpm-recovery-information-to-ad-ds.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Back up the TPM recovery information to AD DS
diff --git a/windows/device-security/tpm/change-the-tpm-owner-password.md b/windows/device-security/tpm/change-the-tpm-owner-password.md
index 16b63a490e..85fc58c11a 100644
--- a/windows/device-security/tpm/change-the-tpm-owner-password.md
+++ b/windows/device-security/tpm/change-the-tpm-owner-password.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Change the TPM owner password
diff --git a/windows/device-security/tpm/how-windows-uses-the-tpm.md b/windows/device-security/tpm/how-windows-uses-the-tpm.md
index 680fea9138..4502a82d12 100644
--- a/windows/device-security/tpm/how-windows-uses-the-tpm.md
+++ b/windows/device-security/tpm/how-windows-uses-the-tpm.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: security
localizationpriority: high
author: brianlic-msft
+ms.date: 10/27/2017
---
# How Windows 10 uses the Trusted Platform Module
diff --git a/windows/device-security/tpm/initialize-and-configure-ownership-of-the-tpm.md b/windows/device-security/tpm/initialize-and-configure-ownership-of-the-tpm.md
index 152eec4793..525ead7434 100644
--- a/windows/device-security/tpm/initialize-and-configure-ownership-of-the-tpm.md
+++ b/windows/device-security/tpm/initialize-and-configure-ownership-of-the-tpm.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# View status, clear, or troubleshoot the TPM
diff --git a/windows/device-security/tpm/manage-tpm-commands.md b/windows/device-security/tpm/manage-tpm-commands.md
index 6fc1327a37..0f681444d4 100644
--- a/windows/device-security/tpm/manage-tpm-commands.md
+++ b/windows/device-security/tpm/manage-tpm-commands.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 11/30/2017
---
# Manage TPM commands
diff --git a/windows/device-security/tpm/manage-tpm-lockout.md b/windows/device-security/tpm/manage-tpm-lockout.md
index 57880902c5..b12ca2ea4c 100644
--- a/windows/device-security/tpm/manage-tpm-lockout.md
+++ b/windows/device-security/tpm/manage-tpm-lockout.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 05/02/2017
---
# Manage TPM lockout
diff --git a/windows/device-security/tpm/switch-pcr-banks-on-tpm-2-0-devices.md b/windows/device-security/tpm/switch-pcr-banks-on-tpm-2-0-devices.md
index 993c5d1aea..fabb1ccc07 100644
--- a/windows/device-security/tpm/switch-pcr-banks-on-tpm-2-0-devices.md
+++ b/windows/device-security/tpm/switch-pcr-banks-on-tpm-2-0-devices.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 04/19/2017
---
# Understanding PCR banks on TPM 2.0 devices
diff --git a/windows/device-security/tpm/tpm-fundamentals.md b/windows/device-security/tpm/tpm-fundamentals.md
index ee007150c7..5b7969364b 100644
--- a/windows/device-security/tpm/tpm-fundamentals.md
+++ b/windows/device-security/tpm/tpm-fundamentals.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 08/16/2017
---
# TPM fundamentals
diff --git a/windows/device-security/tpm/tpm-recommendations.md b/windows/device-security/tpm/tpm-recommendations.md
index e04cffc57b..a9f0a616d2 100644
--- a/windows/device-security/tpm/tpm-recommendations.md
+++ b/windows/device-security/tpm/tpm-recommendations.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: high
author: brianlic-msft
+ms.date: 10/27/2017
---
# TPM recommendations
diff --git a/windows/device-security/tpm/trusted-platform-module-overview.md b/windows/device-security/tpm/trusted-platform-module-overview.md
index 119ebafb02..c1521d4195 100644
--- a/windows/device-security/tpm/trusted-platform-module-overview.md
+++ b/windows/device-security/tpm/trusted-platform-module-overview.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: high
author: brianlic-msft
+ms.date: 07/27/2017
---
# Trusted Platform Module Technology Overview
diff --git a/windows/device-security/tpm/trusted-platform-module-services-group-policy-settings.md b/windows/device-security/tpm/trusted-platform-module-services-group-policy-settings.md
index a666d3e71e..ea9f6e17a8 100644
--- a/windows/device-security/tpm/trusted-platform-module-services-group-policy-settings.md
+++ b/windows/device-security/tpm/trusted-platform-module-services-group-policy-settings.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 08/16/2017
---
# TPM Group Policy settings
diff --git a/windows/device-security/tpm/trusted-platform-module-top-node.md b/windows/device-security/tpm/trusted-platform-module-top-node.md
index f7ef7a4b61..668749894f 100644
--- a/windows/device-security/tpm/trusted-platform-module-top-node.md
+++ b/windows/device-security/tpm/trusted-platform-module-top-node.md
@@ -7,6 +7,7 @@ ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: high
author: brianlic-msft
+ms.date: 07/27/2017
---
# Trusted Platform Module
diff --git a/windows/device-security/windows-10-mobile-security-guide.md b/windows/device-security/windows-10-mobile-security-guide.md
index 48ce7f6de9..e5f757a0fc 100644
--- a/windows/device-security/windows-10-mobile-security-guide.md
+++ b/windows/device-security/windows-10-mobile-security-guide.md
@@ -9,6 +9,7 @@ ms.sitesec: library
ms.pagetype: security, mobile
ms.localizationpriority: high
author: AMeeus
+ms.date: 10/13/2017
---
# Windows 10 Mobile security guide
diff --git a/windows/device-security/windows-security-baselines.md b/windows/device-security/windows-security-baselines.md
index f79a9cec63..5f0da685dd 100644
--- a/windows/device-security/windows-security-baselines.md
+++ b/windows/device-security/windows-security-baselines.md
@@ -7,7 +7,7 @@ ms.mktglfcycl: deploy
ms.localizationpriority: high
ms.author: sagaudre
author: brianlic-msft
-ms.date: 10/17/2017
+ms.date: 10/31/2017
---
# Windows Security Baselines
diff --git a/windows/hub/TOC.md b/windows/hub/TOC.md
index e24c5d48f2..61ac5b3dfc 100644
--- a/windows/hub/TOC.md
+++ b/windows/hub/TOC.md
@@ -8,4 +8,5 @@
## [Access protection](/windows/access-protection)
## [Device security](/windows/device-security)
## [Threat protection](/windows/threat-protection)
-## [Troubleshooting](/windows/client-management/windows-10-support-solutions)
\ No newline at end of file
+## [Troubleshooting](/windows/client-management/windows-10-support-solutions)
+## [Other Windows client versions](https://docs.microsoft.com/previous-versions/windows)
\ No newline at end of file
diff --git a/windows/hub/images/accessprotection.png b/windows/hub/images/accessprotection.png
new file mode 100644
index 0000000000..0cbd9bcda9
Binary files /dev/null and b/windows/hub/images/accessprotection.png differ
diff --git a/windows/hub/images/accessprotection.svg b/windows/hub/images/accessprotection.svg
new file mode 100644
index 0000000000..47a0c1848e
--- /dev/null
+++ b/windows/hub/images/accessprotection.svg
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/windows/hub/images/applicationmanagement.png b/windows/hub/images/applicationmanagement.png
new file mode 100644
index 0000000000..e29d74d946
Binary files /dev/null and b/windows/hub/images/applicationmanagement.png differ
diff --git a/windows/hub/images/applicationmanagement.svg b/windows/hub/images/applicationmanagement.svg
new file mode 100644
index 0000000000..588bc44538
--- /dev/null
+++ b/windows/hub/images/applicationmanagement.svg
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/windows/hub/images/clientmanagement.png b/windows/hub/images/clientmanagement.png
new file mode 100644
index 0000000000..f392cc3081
Binary files /dev/null and b/windows/hub/images/clientmanagement.png differ
diff --git a/windows/hub/images/clientmanagement.svg b/windows/hub/images/clientmanagement.svg
new file mode 100644
index 0000000000..eccf7ed372
--- /dev/null
+++ b/windows/hub/images/clientmanagement.svg
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/windows/hub/images/configuration.png b/windows/hub/images/configuration.png
index de9f183599..b6c4b6817d 100644
Binary files a/windows/hub/images/configuration.png and b/windows/hub/images/configuration.png differ
diff --git a/windows/hub/images/configuration.svg b/windows/hub/images/configuration.svg
new file mode 100644
index 0000000000..b3b9a9af6d
--- /dev/null
+++ b/windows/hub/images/configuration.svg
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/windows/hub/images/deployment.png b/windows/hub/images/deployment.png
index b87cebc6fc..b0aec0de35 100644
Binary files a/windows/hub/images/deployment.png and b/windows/hub/images/deployment.png differ
diff --git a/windows/hub/images/deployment.svg b/windows/hub/images/deployment.svg
new file mode 100644
index 0000000000..7cdab632cc
--- /dev/null
+++ b/windows/hub/images/deployment.svg
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/windows/hub/images/deviceSecurity.svg b/windows/hub/images/deviceSecurity.svg
new file mode 100644
index 0000000000..5a5b28322d
--- /dev/null
+++ b/windows/hub/images/deviceSecurity.svg
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/windows/hub/images/devicesecurity.png b/windows/hub/images/devicesecurity.png
new file mode 100644
index 0000000000..0ded4068e5
Binary files /dev/null and b/windows/hub/images/devicesecurity.png differ
diff --git a/windows/hub/images/access-protection.png b/windows/hub/images/old/access-protection-old.png
similarity index 100%
rename from windows/hub/images/access-protection.png
rename to windows/hub/images/old/access-protection-old.png
diff --git a/windows/hub/images/old/access-protection5.png b/windows/hub/images/old/access-protection5.png
new file mode 100644
index 0000000000..8f405ece8c
Binary files /dev/null and b/windows/hub/images/old/access-protection5.png differ
diff --git a/windows/hub/images/application-management.png b/windows/hub/images/old/application-management-old.png
similarity index 100%
rename from windows/hub/images/application-management.png
rename to windows/hub/images/old/application-management-old.png
diff --git a/windows/hub/images/old/application-management5.png b/windows/hub/images/old/application-management5.png
new file mode 100644
index 0000000000..09de36a442
Binary files /dev/null and b/windows/hub/images/old/application-management5.png differ
diff --git a/windows/hub/images/client-management.png b/windows/hub/images/old/client-management-old.png
similarity index 100%
rename from windows/hub/images/client-management.png
rename to windows/hub/images/old/client-management-old.png
diff --git a/windows/hub/images/old/client-management5.png b/windows/hub/images/old/client-management5.png
new file mode 100644
index 0000000000..6c396874ea
Binary files /dev/null and b/windows/hub/images/old/client-management5.png differ
diff --git a/windows/hub/images/old/configuration-old.png b/windows/hub/images/old/configuration-old.png
new file mode 100644
index 0000000000..de9f183599
Binary files /dev/null and b/windows/hub/images/old/configuration-old.png differ
diff --git a/windows/hub/images/old/configuration5.png b/windows/hub/images/old/configuration5.png
new file mode 100644
index 0000000000..3cf3488c0f
Binary files /dev/null and b/windows/hub/images/old/configuration5.png differ
diff --git a/windows/hub/images/old/deployment-old.png b/windows/hub/images/old/deployment-old.png
new file mode 100644
index 0000000000..b87cebc6fc
Binary files /dev/null and b/windows/hub/images/old/deployment-old.png differ
diff --git a/windows/hub/images/old/deployment5.png b/windows/hub/images/old/deployment5.png
new file mode 100644
index 0000000000..ae2e2928bb
Binary files /dev/null and b/windows/hub/images/old/deployment5.png differ
diff --git a/windows/hub/images/device-security.png b/windows/hub/images/old/device-security-old.png
similarity index 100%
rename from windows/hub/images/device-security.png
rename to windows/hub/images/old/device-security-old.png
diff --git a/windows/hub/images/old/device-security5.png b/windows/hub/images/old/device-security5.png
new file mode 100644
index 0000000000..6f6637315e
Binary files /dev/null and b/windows/hub/images/old/device-security5.png differ
diff --git a/windows/hub/images/front-page-video.PNG b/windows/hub/images/old/front-page-video.PNG
similarity index 100%
rename from windows/hub/images/front-page-video.PNG
rename to windows/hub/images/old/front-page-video.PNG
diff --git a/windows/hub/images/remote.png b/windows/hub/images/old/remote-old.png
similarity index 100%
rename from windows/hub/images/remote.png
rename to windows/hub/images/old/remote-old.png
diff --git a/windows/hub/images/threat-protection.png b/windows/hub/images/old/threat-protection-old.png
similarity index 100%
rename from windows/hub/images/threat-protection.png
rename to windows/hub/images/old/threat-protection-old.png
diff --git a/windows/hub/images/old/threat-protection5.png b/windows/hub/images/old/threat-protection5.png
new file mode 100644
index 0000000000..497c1aa111
Binary files /dev/null and b/windows/hub/images/old/threat-protection5.png differ
diff --git a/windows/hub/images/virtualization.png b/windows/hub/images/old/virtualization-old.png
similarity index 100%
rename from windows/hub/images/virtualization.png
rename to windows/hub/images/old/virtualization-old.png
diff --git a/windows/hub/images/whats-new-highlight.png b/windows/hub/images/old/whats-new-highlight.png
similarity index 100%
rename from windows/hub/images/whats-new-highlight.png
rename to windows/hub/images/old/whats-new-highlight.png
diff --git a/windows/hub/images/old/whats-new-highlight5.png b/windows/hub/images/old/whats-new-highlight5.png
new file mode 100644
index 0000000000..8222ded5f3
Binary files /dev/null and b/windows/hub/images/old/whats-new-highlight5.png differ
diff --git a/windows/hub/images/whats-new.png b/windows/hub/images/old/whats-new-old.png
similarity index 100%
rename from windows/hub/images/whats-new.png
rename to windows/hub/images/old/whats-new-old.png
diff --git a/windows/hub/images/threatprotection.png b/windows/hub/images/threatprotection.png
new file mode 100644
index 0000000000..5c20d60cfd
Binary files /dev/null and b/windows/hub/images/threatprotection.png differ
diff --git a/windows/hub/images/threatprotection.svg b/windows/hub/images/threatprotection.svg
new file mode 100644
index 0000000000..cf19910bee
--- /dev/null
+++ b/windows/hub/images/threatprotection.svg
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/windows/hub/images/whatsnew.png b/windows/hub/images/whatsnew.png
new file mode 100644
index 0000000000..dab83b28d6
Binary files /dev/null and b/windows/hub/images/whatsnew.png differ
diff --git a/windows/hub/images/whatsnew.svg b/windows/hub/images/whatsnew.svg
new file mode 100644
index 0000000000..a88f581016
--- /dev/null
+++ b/windows/hub/images/whatsnew.svg
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/windows/hub/index.md b/windows/hub/index.md
index 27f20be8e9..c2f87b5f74 100644
--- a/windows/hub/index.md
+++ b/windows/hub/index.md
@@ -4,70 +4,69 @@ description: Find the latest how to and support content that IT pros need to eva
ms.assetid: 345A4B4E-BC1B-4F5C-9E90-58E647D11C60
ms.prod: w10
ms.localizationpriority: high
-author: brianlic-msft
+author: greg-lindsay
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
-ms.date: 10/17/2017
+ms.date: 12/18/2017
---
# Windows 10 and Windows 10 Mobile
Find the latest how to and support content that IT pros need to evaluate, plan, deploy, secure and manage devices running Windows 10 or Windows 10 Mobile.
-
diff --git a/microsoft-365/TOC.md b/windows/security/TOC.md
similarity index 100%
rename from microsoft-365/TOC.md
rename to windows/security/TOC.md
diff --git a/bcs/docfx.json b/windows/security/docfx.json
similarity index 66%
rename from bcs/docfx.json
rename to windows/security/docfx.json
index aa19bbfd9b..3df713a185 100644
--- a/bcs/docfx.json
+++ b/windows/security/docfx.json
@@ -4,7 +4,7 @@
{
"files": [
"**/*.md",
- "**/**.yml"
+ "**/*.yml"
],
"exclude": [
"**/obj/**",
@@ -20,9 +20,7 @@
{
"files": [
"**/*.png",
- "**/*.svg",
- "**/*.jpg",
- "**/*.json"
+ "**/*.jpg"
],
"exclude": [
"**/obj/**",
@@ -33,15 +31,15 @@
"overwrite": [],
"externalReference": [],
"globalMetadata": {
- "breadcrumb_path": "/microsoft-365-business/breadcrumb/toc.json",
- "_op_documentIdPathDepotMapping": {
- "./": {
- "depot_name": "TechNet.bcs"
- }
- }
- },
+ "uhfHeaderId": "MSDocsHeader-WindowsIT",
+ "breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json",
+ "ms.technology": "windows",
+ "ms.topic": "article",
+ "ms.author": "justinha",
+ "extendBreadcrumb": true
+ },
"fileMetadata": {},
"template": [],
- "dest": "bcs"
+ "dest": "security"
}
}
\ No newline at end of file
diff --git a/windows/security/index.md b/windows/security/index.md
new file mode 100644
index 0000000000..898f74389c
--- /dev/null
+++ b/windows/security/index.md
@@ -0,0 +1 @@
+# Welcome to security!
\ No newline at end of file
diff --git a/windows/threat-protection/TOC.md b/windows/threat-protection/TOC.md
index 8604996ad8..42ede7cb70 100644
--- a/windows/threat-protection/TOC.md
+++ b/windows/threat-protection/TOC.md
@@ -65,7 +65,7 @@
###### [Restrict app execution](windows-defender-atp\respond-machine-alerts-windows-defender-advanced-threat-protection.md#restrict-app-execution)
###### [Remove app restriction](windows-defender-atp\respond-machine-alerts-windows-defender-advanced-threat-protection.md#remove-app-restriction)
###### [Isolate machines from the network](windows-defender-atp\respond-machine-alerts-windows-defender-advanced-threat-protection.md#isolate-machines-from-the-network)
-###### [Release machine from the isolation](windows-defender-atp\respond-machine-alerts-windows-defender-advanced-threat-protection.md#release-machine-from-isolation)
+###### [Release machine from isolation](windows-defender-atp\respond-machine-alerts-windows-defender-advanced-threat-protection.md#release-machine-from-isolation)
###### [Check activity details in Action center](windows-defender-atp\respond-machine-alerts-windows-defender-advanced-threat-protection.md#check-activity-details-in-action-center)
##### [Take response actions on a file](windows-defender-atp\respond-file-alerts-windows-defender-advanced-threat-protection.md)
###### [Stop and quarantine files in your network](windows-defender-atp\respond-file-alerts-windows-defender-advanced-threat-protection.md#stop-and-quarantine-files-in-your-network)
@@ -110,27 +110,51 @@
###### [Get domain related machines](windows-defender-atp\get-domain-related-machines-windows-defender-advanced-threat-protection.md)
###### [Get domain statistics](windows-defender-atp\get-domain-statistics-windows-defender-advanced-threat-protection.md)
###### [Is domain seen in organization](windows-defender-atp\is-domain-seen-in-org-windows-defender-advanced-threat-protection.md)
+
##### File
+###### [Block file API](windows-defender-atp\block-file-windows-defender-advanced-threat-protection.md)
###### [Get file information](windows-defender-atp\get-file-information-windows-defender-advanced-threat-protection.md)
###### [Get file related alerts](windows-defender-atp\get-file-related-alerts-windows-defender-advanced-threat-protection.md)
###### [Get file related machines](windows-defender-atp\get-file-related-machines-windows-defender-advanced-threat-protection.md)
###### [Get file statistics](windows-defender-atp\get-file-statistics-windows-defender-advanced-threat-protection.md)
+###### [Get FileActions collection API](windows-defender-atp\get-fileactions-collection-windows-defender-advanced-threat-protection.md)
+###### [Unblock file API](windows-defender-atp\unblock-file-windows-defender-advanced-threat-protection.md)
+
##### IP
###### [Get IP related alerts](windows-defender-atp\get-ip-related-alerts-windows-defender-advanced-threat-protection.md)
###### [Get IP related machines](windows-defender-atp\get-ip-related-machines-windows-defender-advanced-threat-protection.md)
###### [Get IP statistics](windows-defender-atp\get-ip-statistics-windows-defender-advanced-threat-protection.md)
###### [Is IP seen in organization](windows-defender-atp\is-ip-seen-org-windows-defender-advanced-threat-protection.md)
##### Machines
+###### [Collect investigation package API](windows-defender-atp\collect-investigation-package-windows-defender-advanced-threat-protection.md)
###### [Find machine information by IP](windows-defender-atp\find-machine-info-by-ip-windows-defender-advanced-threat-protection.md)
###### [Get machines](windows-defender-atp\get-machines-windows-defender-advanced-threat-protection.md)
+###### [Get FileMachineAction object API](windows-defender-atp\get-filemachineaction-object-windows-defender-advanced-threat-protection.md)
+###### [Get FileMachineActions collection API](windows-defender-atp\get-filemachineactions-collection-windows-defender-advanced-threat-protection.md)
###### [Get machine by ID](windows-defender-atp\get-machine-by-id-windows-defender-advanced-threat-protection.md)
###### [Get machine log on users](windows-defender-atp\get-machine-log-on-users-windows-defender-advanced-threat-protection.md)
###### [Get machine related alerts](windows-defender-atp\get-machine-related-alerts-windows-defender-advanced-threat-protection.md)
+###### [Get MachineAction object API](windows-defender-atp\get-machineaction-object-windows-defender-advanced-threat-protection.md)
+###### [Get MachineActions collection API](windows-defender-atp\get-machineactions-collection-windows-defender-advanced-threat-protection.md)
+###### [Get machines](windows-defender-atp\get-machines-windows-defender-advanced-threat-protection.md)
+###### [Get package SAS URI API](windows-defender-atp\get-package-sas-uri-windows-defender-advanced-threat-protection.md)
+###### [Isolate machine API](windows-defender-atp\isolate-machine-windows-defender-advanced-threat-protection.md)
+###### [Release machine from isolation API](windows-defender-atp\unisolate-machine-windows-defender-advanced-threat-protection.md)
+###### [Remove app restriction API](windows-defender-atp\unrestrict-code-execution-windows-defender-advanced-threat-protection.md)
+###### [Request sample API](windows-defender-atp\request-sample-windows-defender-advanced-threat-protection.md)
+###### [Restrict app execution API](windows-defender-atp\restrict-code-execution-windows-defender-advanced-threat-protection.md)
+###### [Run antivirus scan API](windows-defender-atp\run-av-scan-windows-defender-advanced-threat-protection.md)
+###### [Stop and quarantine file API](windows-defender-atp\stop-quarantine-file-windows-defender-advanced-threat-protection.md)
+
+
+
##### User
###### [Get alert related user information](windows-defender-atp\get-alert-related-user-info-windows-defender-advanced-threat-protection.md)
###### [Get user information](windows-defender-atp\get-user-information-windows-defender-advanced-threat-protection.md)
###### [Get user related alerts](windows-defender-atp\get-user-related-alerts-windows-defender-advanced-threat-protection.md)
###### [Get user related machines](windows-defender-atp\get-user-related-machines-windows-defender-advanced-threat-protection.md)
+
+
### [Create and build Power BI reports using Windows Defender ATP data](windows-defender-atp\powerbi-reports-windows-defender-advanced-threat-protection.md)
### [Check sensor state](windows-defender-atp\check-sensor-status-windows-defender-advanced-threat-protection.md)
#### [Fix unhealthy sensors](windows-defender-atp\fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md)
@@ -234,17 +258,18 @@
#### [Evaluate Attack surface reduction](windows-defender-exploit-guard\evaluate-attack-surface-reduction.md)
#### [Enable Attack surface reduction](windows-defender-exploit-guard\enable-attack-surface-reduction.md)
#### [Customize Attack surface reduction](windows-defender-exploit-guard\customize-attack-surface-reduction.md)
+#### [Troubleshoot Attack surface reduction rules](windows-defender-exploit-guard\troubleshoot-asr.md)
### [Network Protection](windows-defender-exploit-guard\network-protection-exploit-guard.md)
#### [Evaluate Network Protection](windows-defender-exploit-guard\evaluate-network-protection.md)
#### [Enable Network Protection](windows-defender-exploit-guard\enable-network-protection.md)
+#### [Troubleshoot Network protection](windows-defender-exploit-guard\troubleshoot-np.md)
### [Controlled folder access](windows-defender-exploit-guard\controlled-folders-exploit-guard.md)
#### [Evaluate Controlled folder access](windows-defender-exploit-guard\evaluate-controlled-folder-access.md)
#### [Enable Controlled folder access](windows-defender-exploit-guard\enable-controlled-folders-exploit-guard.md)
#### [Customize Controlled folder access](windows-defender-exploit-guard\customize-controlled-folders-exploit-guard.md)
-
-
+## [Windows Defender Application Control](windows-defender-application-control.md)
## [Windows Defender SmartScreen](windows-defender-smartscreen\windows-defender-smartscreen-overview.md)
@@ -289,7 +314,7 @@
## [Secure the Windows 10 boot process](secure-the-windows-10-boot-process.md)
-## [Use Windows Event Forwarding to help with intrusion detection](use-windows-event-forwarding-to-assist-in-instrusion-detection.md)
+## [Use Windows Event Forwarding to help with intrusion detection](use-windows-event-forwarding-to-assist-in-intrusion-detection.md)
## [Block untrusted fonts in an enterprise](block-untrusted-fonts-in-enterprise.md)
diff --git a/windows/threat-protection/change-history-for-threat-protection.md b/windows/threat-protection/change-history-for-threat-protection.md
index a68faca235..2509a33e83 100644
--- a/windows/threat-protection/change-history-for-threat-protection.md
+++ b/windows/threat-protection/change-history-for-threat-protection.md
@@ -6,11 +6,18 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 10/31/2017
---
# Change history for threat protection
This topic lists new and updated topics in the [Threat protection](index.md) documentation.
+## January 2018
+|New or changed topic |Description |
+|---------------------|------------|
+|[Windows Defender Application Control](windows-defender-application-control.md)|New topic. WDAC replaces cofigurable code integrity policies. |
+
+
## October 2017
|New or changed topic |Description |
|---------------------|------------|
diff --git a/windows/threat-protection/index.md b/windows/threat-protection/index.md
index a98bb34278..e33a61e7c8 100644
--- a/windows/threat-protection/index.md
+++ b/windows/threat-protection/index.md
@@ -6,6 +6,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
+ms.date: 08/11/2017
---
# Threat Protection
diff --git a/windows/threat-protection/override-mitigation-options-for-app-related-security-policies.md b/windows/threat-protection/override-mitigation-options-for-app-related-security-policies.md
index e207ba506e..e786911e28 100644
--- a/windows/threat-protection/override-mitigation-options-for-app-related-security-policies.md
+++ b/windows/threat-protection/override-mitigation-options-for-app-related-security-policies.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.pagetype: security
ms.sitesec: library
+ms.date: 04/19/2017
---
diff --git a/windows/threat-protection/overview-of-threat-mitigations-in-windows-10.md b/windows/threat-protection/overview-of-threat-mitigations-in-windows-10.md
index a8f1dd39c7..4a4eb38e44 100644
--- a/windows/threat-protection/overview-of-threat-mitigations-in-windows-10.md
+++ b/windows/threat-protection/overview-of-threat-mitigations-in-windows-10.md
@@ -7,6 +7,7 @@ ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: high
author: justinha
+ms.date: 10/13/2017
---
# Mitigate threats by using Windows 10 security features
diff --git a/windows/threat-protection/secure-the-windows-10-boot-process.md b/windows/threat-protection/secure-the-windows-10-boot-process.md
index e602778817..b939898180 100644
--- a/windows/threat-protection/secure-the-windows-10-boot-process.md
+++ b/windows/threat-protection/secure-the-windows-10-boot-process.md
@@ -8,7 +8,7 @@ ms.pagetype: security
ms.sitesec: library
ms.localizationpriority: medium
author: brianlic-msft
-ms.date: 06/23/2017
+ms.date: 10/13/2017
---
# Secure the Windows 10 boot process
diff --git a/windows/threat-protection/use-windows-event-forwarding-to-assist-in-instrusion-detection.md b/windows/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md
similarity index 99%
rename from windows/threat-protection/use-windows-event-forwarding-to-assist-in-instrusion-detection.md
rename to windows/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md
index 658e3fcaf7..6ab49143bd 100644
--- a/windows/threat-protection/use-windows-event-forwarding-to-assist-in-instrusion-detection.md
+++ b/windows/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: tedhardyMSFT
+ms.date: 10/27/2017
---
# Use Windows Event Forwarding to help with intrusion detection
@@ -650,4 +651,4 @@ You can get more info with the following links:
- [Event Query Schema](http://msdn.microsoft.com/library/aa385760.aspx)
- [Windows Event Collector](http://msdn.microsoft.com/library/windows/desktop/bb427443.aspx)
-Not finding content you need? Windows 10 users, tell us what you want on [Feedback Hub](feedback-hub://?referrer=techDocsUcPage&tabid=2&contextid=897&newFeedback=true&topic=use-windows-event-forwarding-to-assist-in-instrusion-detection.md).
+
diff --git a/windows/threat-protection/wannacrypt-ransomware-worm-targets-out-of-date-systems-wdsi.md b/windows/threat-protection/wannacrypt-ransomware-worm-targets-out-of-date-systems-wdsi.md
index 4f4815d991..6e8c26d829 100644
--- a/windows/threat-protection/wannacrypt-ransomware-worm-targets-out-of-date-systems-wdsi.md
+++ b/windows/threat-protection/wannacrypt-ransomware-worm-targets-out-of-date-systems-wdsi.md
@@ -9,6 +9,7 @@ ms.mktglfcycl: manage
ms.sitesec: library
ms.localizationpriority: medium
author: iaanw
+ms.date: 07/27/2017
---
# WannaCrypt ransomware worm targets out-of-date systems
@@ -16,7 +17,7 @@ author: iaanw
On May 12, 2017 we detected a new ransomware that spreads like a worm by leveraging vulnerabilities that have been previously fixed. While security updates are automatically applied in most computers, some users and enterprises may delay deployment of patches. Unfortunately, the ransomware, known as [WannaCrypt](https://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Ransom:Win32/WannaCrypt), appears to have affected computers that have not applied the patch for these vulnerabilities. While the attack is unfolding, we remind users to install [MS17-010](https://technet.microsoft.com/en-us/library/security/ms17-010.aspx) if they have not already done so.
-Microsoft antimalware telemetry immediately picked up signs of this campaign. Our expert systems gave us visibility and context into this new attack as it happened, allowing [Windows Defender Antivirus](https://technet.microsoft.com/en-us/itpro/windows/keep-secure/windows-defender-in-windows-10) to deliver real-time defense. Through automated analysis, machine learning, and predictive modeling, we were able to rapidly protect against this malware.
+Microsoft antimalware diagnostic data immediately picked up signs of this campaign. Our expert systems gave us visibility and context into this new attack as it happened, allowing [Windows Defender Antivirus](https://technet.microsoft.com/en-us/itpro/windows/keep-secure/windows-defender-in-windows-10) to deliver real-time defense. Through automated analysis, machine learning, and predictive modeling, we were able to rapidly protect against this malware.
In this blog, we provide an early analysis of the end-to-end ransomware attack. Please note this threat is still under investigation. The attack is still active, and there is a possibility that the attacker will attempt to react to our detection response.
diff --git a/windows/threat-protection/windows-defender-antivirus/collect-diagnostic-data-update-compliance.md b/windows/threat-protection/windows-defender-antivirus/collect-diagnostic-data-update-compliance.md
index bc96824baa..bf20b8965c 100644
--- a/windows/threat-protection/windows-defender-antivirus/collect-diagnostic-data-update-compliance.md
+++ b/windows/threat-protection/windows-defender-antivirus/collect-diagnostic-data-update-compliance.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 09/06/2017
+ms.date: 09/12/2017
---
# Collect Update Compliance diagnostic data for Windows Defender AV Assessment
diff --git a/windows/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md
index 7e6a5244b8..8669970d58 100644
--- a/windows/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md
+++ b/windows/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 08/26/2017
---
diff --git a/windows/threat-protection/windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md
index 7c7eed2793..ad3743b16b 100644
--- a/windows/threat-protection/windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md
+++ b/windows/threat-protection/windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 08/26/2017
---
# Reference topics for management and configuration tools
diff --git a/windows/threat-protection/windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus.md
index bc92d0c50e..771d56a805 100644
--- a/windows/threat-protection/windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus.md
+++ b/windows/threat-protection/windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 08/26/2017
---
@@ -60,7 +60,7 @@ Scan files on the network | Scan > Scan network files | Disabled | `-DisableScan
Scan packed executables | Scan > Scan packed executables | Enabled | Not available
Scan removable drives during full scans only | Scan > Scan removable drives | Disabled | `-DisableRemovableDriveScanning`
Specify the level of subfolders within an archive folder to scan | Scan > Specify the maximum depth to scan archive files | 0 | Not available
- Specify the maximum CPU load (as a percentage) during a scan. This is a maximum - scans will not always use the maximum load defined here, but they will never exceed it | Scan > Specify the maximum percentage of CPU utilization during a scan | 50 | `-ScanAvgCPULoadFactor`
+ Specify the maximum CPU load (as a percentage) during a scan. Note: This is not a hard limit but rather a guidance for the scanning engine to not exceed this maximum on average. | Scan > Specify the maximum percentage of CPU utilization during a scan | 50 | `-ScanAvgCPULoadFactor`
Specify the maximum size (in kilobytes) of archive files that should be scanned. The default, **0**, applies no limit | Scan > Specify the maximum size of archive files to be scanned | No limit | Not available
**Use Configuration Manager to configure scanning options:**
@@ -103,4 +103,4 @@ If Windows Defender Antivirus detects a threat inside an email, it will show you
- [Customize, initiate, and review the results of Windows Defender AV scans and remediation](customize-run-review-remediate-scans-windows-defender-antivirus.md)
- [Configure and run on-demand Windows Defender AV scans](run-scan-windows-defender-antivirus.md)
- [Configure scheduled scans for Windows Defender AV](scheduled-catch-up-scans-windows-defender-antivirus.md)
-- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md)
\ No newline at end of file
+- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md)
diff --git a/windows/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md
index 2c61ab81ad..84a88683e7 100644
--- a/windows/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md
+++ b/windows/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 11/20/2017
---
diff --git a/windows/threat-protection/windows-defender-antivirus/configure-cloud-block-timeout-period-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/configure-cloud-block-timeout-period-windows-defender-antivirus.md
index ffae20dfe9..b3a7c51466 100644
--- a/windows/threat-protection/windows-defender-antivirus/configure-cloud-block-timeout-period-windows-defender-antivirus.md
+++ b/windows/threat-protection/windows-defender-antivirus/configure-cloud-block-timeout-period-windows-defender-antivirus.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 08/26/2017
---
# Configure the cloud block timeout period
diff --git a/windows/threat-protection/windows-defender-antivirus/configure-end-user-interaction-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/configure-end-user-interaction-windows-defender-antivirus.md
index 6843c1e01d..4b2e00bfec 100644
--- a/windows/threat-protection/windows-defender-antivirus/configure-end-user-interaction-windows-defender-antivirus.md
+++ b/windows/threat-protection/windows-defender-antivirus/configure-end-user-interaction-windows-defender-antivirus.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 08/26/2017
---
# Configure end-user interaction with Windows Defender Antivirus
diff --git a/windows/threat-protection/windows-defender-antivirus/configure-exclusions-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/configure-exclusions-windows-defender-antivirus.md
index 38c2c15f82..761ad06d6b 100644
--- a/windows/threat-protection/windows-defender-antivirus/configure-exclusions-windows-defender-antivirus.md
+++ b/windows/threat-protection/windows-defender-antivirus/configure-exclusions-windows-defender-antivirus.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 06/13/2017
+ms.date: 07/27/2017
---
# Configure and validate exclusions for Windows Defender AV scans (client)
diff --git a/windows/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md
index 4648182715..65858fabe3 100644
--- a/windows/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md
+++ b/windows/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 10/30/2017
+ms.date: 11/07/2017
---
# Configure and validate exclusions based on file extension and folder location
diff --git a/windows/threat-protection/windows-defender-antivirus/configure-local-policy-overrides-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/configure-local-policy-overrides-windows-defender-antivirus.md
index 885b929ee5..4545c0e5dc 100644
--- a/windows/threat-protection/windows-defender-antivirus/configure-local-policy-overrides-windows-defender-antivirus.md
+++ b/windows/threat-protection/windows-defender-antivirus/configure-local-policy-overrides-windows-defender-antivirus.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 08/26/2017
---
# Prevent or allow users to locally modify Windows Defender AV policy settings
diff --git a/windows/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md
index cfcb0f8782..f44c485e39 100644
--- a/windows/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md
+++ b/windows/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 11/20/2017
---
# Configure and validate network connections for Windows Defender Antivirus
@@ -35,7 +35,7 @@ See the Enterprise Mobility and Security blog post [Important changes to Microso
>[!TIP]
>You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the following features are working:
>- Cloud-delivered protection
->- Fast learning (including Black at first sight)
+>- Fast learning (including Block at first sight)
>- Potentially unwanted application blocking
## Allow connections to the Windows Defender Antivirus cloud
@@ -133,10 +133,10 @@ https://msdl.microsoft.com/download/symbols
Universal Telemetry Client
-Used by Windows to send client telemetry, Windows Defender Antivirus uses this for product quality monitoring purposes
+Used by Windows to send client diagnostic data, Windows Defender Antivirus uses this for product quality monitoring purposes
-This update uses SSL (TCP Port 443) to download manifests and upload telemetry to Microsoft that uses the following DNS endpoints:
vortex-win.data.microsoft.com
settings-win.data.microsoft.com
+This update uses SSL (TCP Port 443) to download manifests and upload diagnostic data to Microsoft that uses the following DNS endpoints:
vortex-win.data.microsoft.com
settings-win.data.microsoft.com
diff --git a/windows/threat-protection/windows-defender-antivirus/configure-notifications-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/configure-notifications-windows-defender-antivirus.md
index 9035fb9082..8bfa75ff42 100644
--- a/windows/threat-protection/windows-defender-antivirus/configure-notifications-windows-defender-antivirus.md
+++ b/windows/threat-protection/windows-defender-antivirus/configure-notifications-windows-defender-antivirus.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 10/31/2017
---
# Configure the notifications that appear on endpoints
diff --git a/windows/threat-protection/windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus.md
index bd0aa9f9ff..7ec2957bda 100644
--- a/windows/threat-protection/windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus.md
+++ b/windows/threat-protection/windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 06/13/2017
+ms.date: 07/27/2017
---
# Configure exclusions for files opened by processes
diff --git a/windows/threat-protection/windows-defender-antivirus/configure-protection-features-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/configure-protection-features-windows-defender-antivirus.md
index 882fec2cbe..12b87815c2 100644
--- a/windows/threat-protection/windows-defender-antivirus/configure-protection-features-windows-defender-antivirus.md
+++ b/windows/threat-protection/windows-defender-antivirus/configure-protection-features-windows-defender-antivirus.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 08/26/2017
---
# Configure behavioral, heuristic, and real-time protection
diff --git a/windows/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md
index 2f73f17890..96199b29be 100644
--- a/windows/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md
+++ b/windows/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 08/26/2017
---
diff --git a/windows/threat-protection/windows-defender-antivirus/configure-remediation-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/configure-remediation-windows-defender-antivirus.md
index 3c3d477567..27f2b3e2e4 100644
--- a/windows/threat-protection/windows-defender-antivirus/configure-remediation-windows-defender-antivirus.md
+++ b/windows/threat-protection/windows-defender-antivirus/configure-remediation-windows-defender-antivirus.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 08/26/2017
---
diff --git a/windows/threat-protection/windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md
index 033e1ba5fd..ed4fbd000f 100644
--- a/windows/threat-protection/windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md
+++ b/windows/threat-protection/windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 06/13/2017
+ms.date: 07/27/2017
---
# Configure exclusions in Windows Defender AV on Windows Server
diff --git a/windows/threat-protection/windows-defender-antivirus/configure-windows-defender-antivirus-features.md b/windows/threat-protection/windows-defender-antivirus/configure-windows-defender-antivirus-features.md
index 315e1bc411..878ec50fed 100644
--- a/windows/threat-protection/windows-defender-antivirus/configure-windows-defender-antivirus-features.md
+++ b/windows/threat-protection/windows-defender-antivirus/configure-windows-defender-antivirus-features.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 08/26/2017
---
# Configure Windows Defender Antivirus features
diff --git a/windows/threat-protection/windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus.md
index 98b3c9615d..ca162858e4 100644
--- a/windows/threat-protection/windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus.md
+++ b/windows/threat-protection/windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 08/26/2017
---
# Customize, initiate, and review the results of Windows Defender AV scans and remediation
diff --git a/windows/threat-protection/windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md
index 02fb05242b..b93c8c5f55 100644
--- a/windows/threat-protection/windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md
+++ b/windows/threat-protection/windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 08/26/2017
---
# Deploy, manage, and report on Windows Defender Antivirus
diff --git a/windows/threat-protection/windows-defender-antivirus/deploy-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/deploy-windows-defender-antivirus.md
index adf719ad5b..9984525b5e 100644
--- a/windows/threat-protection/windows-defender-antivirus/deploy-windows-defender-antivirus.md
+++ b/windows/threat-protection/windows-defender-antivirus/deploy-windows-defender-antivirus.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 12/12/2017
---
# Deploy and enable Windows Defender Antivirus
@@ -33,7 +33,7 @@ See the table in the [Deploy, manage, and report on Windows Defender AV](deploy-
Some scenarios require additional guidance on how to successfully deploy or configure Windows Defender AV protection, such as Virtual Desktop Infrastructure (VDI) environments.
-The remaining topic in this section provides end-to-end advice and best practices for [setting up Windows Defender AV ion virtual machines (VMs) in a VDI or Remote Desktop Services (RDS) environment](deployment-vdi-windows-defender-antivirus.md).
+The remaining topic in this section provides end-to-end advice and best practices for [setting up Windows Defender AV on virtual machines (VMs) in a VDI or Remote Desktop Services (RDS) environment](deployment-vdi-windows-defender-antivirus.md).
## Related topics
diff --git a/windows/threat-protection/windows-defender-antivirus/deployment-vdi-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/deployment-vdi-windows-defender-antivirus.md
index e33ddf160c..a45301b39d 100644
--- a/windows/threat-protection/windows-defender-antivirus/deployment-vdi-windows-defender-antivirus.md
+++ b/windows/threat-protection/windows-defender-antivirus/deployment-vdi-windows-defender-antivirus.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 08/26/2017
---
# Deployment guide for Windows Defender Antivirus in a virtual desktop infrastructure (VDI) environment
@@ -86,7 +86,15 @@ First, you should create your base image according to your business needs, apply
After creating the image, you should ensure it is fully updated. See [Configure Windows Defender in Windows 10]( https://technet.microsoft.com/en-us/itpro/windows/keep-secure/configure-windows-defender-in-windows-10) for instructions on how to update Windows Defender AV protection via WSUS, Microsoft Update, the MMPC site, or UNC file shares. You should ensure that your initial base image is also fully patched with Microsoft and Windows updates and patches.
### Seal the base image
-When the base image is fully updated, you should run a quick scan on the image. This “sealing” or “locking” of the image helps Windows Defender AV build a cache of known-good files and avoid scanning them again on your VMs. In turn, this can help ensure performance on the VM is not impacted.
+When the base image is fully updated, you should run a quick scan on the image.
+
+After running a scan and buliding the cache, remove the machine GUID that uniquely identifies the device in telemetry for both Windows Defender Antivirus and the Microsoft Security Removal Tool. This key is located here:
+
+'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemovalTools\MRT'
+
+Remove the string found in the 'GUID' value
+
+This “sealing” or “locking” of the image helps Windows Defender AV build a cache of known-good files and avoid scanning them again on your VMs. In turn, this can help ensure performance on the VM is not impacted.
You can run a quick scan [from the command line](command-line-arguments-windows-defender-antivirus.md) or via [System Center Configuration Manager](run-scan-windows-defender-antivirus.md).
diff --git a/windows/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md
index baaa8a9d3c..b30883b882 100644
--- a/windows/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md
+++ b/windows/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 11/01/2017
+ms.date: 11/20/2017
---
# Detect and block Potentially Unwanted Applications
diff --git a/windows/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md
index 37acd87aed..24b6f61d0a 100644
--- a/windows/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md
+++ b/windows/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 11/20/2017
---
# Enable cloud-delivered protection in Windows Defender AV
diff --git a/windows/threat-protection/windows-defender-antivirus/evaluate-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/evaluate-windows-defender-antivirus.md
index 2ba340b214..2636c7abd9 100644
--- a/windows/threat-protection/windows-defender-antivirus/evaluate-windows-defender-antivirus.md
+++ b/windows/threat-protection/windows-defender-antivirus/evaluate-windows-defender-antivirus.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 11/20/2017
---
# Evaluate Windows Defender Antivirus protection
@@ -31,7 +31,7 @@ If you're an enterprise security administrator, and you want to determine how we
>[!TIP]
>You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the following features are working and see how they work:
>- Cloud-delivered protection
->- Fast learning (including Black at first sight)
+>- Fast learning (including Block at first sight)
>- Potentially unwanted application blocking
@@ -43,7 +43,7 @@ The guide is available in PDF format for offline viewing:
- [Download the guide in PDF format](https://www.microsoft.com/download/details.aspx?id=54795)
You can also download a PowerShell that will enable all the settings described in the guide automatically. You can obtain the script alongside the PDF download above, or individually from PowerShell Gallery:
-- [Download the PowerShell script to automatically configure the settings](https://www.powershellgallery.com/packages/WindowsDefender_InternalEvaluationSettings/1.0/DisplayScript)
+- [Download the PowerShell script to automatically configure the settings](https://www.powershellgallery.com/packages/WindowsDefender_InternalEvaluationSettings/1.2/DisplayScript)
> [!IMPORTANT]
> The guide is currently intended for single-machine evaluation of Windows Defender Antivirus protection. Enabling all of the settings in this guide may not be suitable for real-world deployment.
diff --git a/windows/threat-protection/windows-defender-antivirus/limited-periodic-scanning-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/limited-periodic-scanning-windows-defender-antivirus.md
index bbd2d551d3..78f6f1e33e 100644
--- a/windows/threat-protection/windows-defender-antivirus/limited-periodic-scanning-windows-defender-antivirus.md
+++ b/windows/threat-protection/windows-defender-antivirus/limited-periodic-scanning-windows-defender-antivirus.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 10/02/2017
+ms.date: 10/16/2017
---
diff --git a/windows/threat-protection/windows-defender-antivirus/manage-event-based-updates-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/manage-event-based-updates-windows-defender-antivirus.md
index 201de035c2..e5cf0f54e3 100644
--- a/windows/threat-protection/windows-defender-antivirus/manage-event-based-updates-windows-defender-antivirus.md
+++ b/windows/threat-protection/windows-defender-antivirus/manage-event-based-updates-windows-defender-antivirus.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 08/26/2017
---
# Manage event-based forced updates
diff --git a/windows/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus.md
index bf8666ecc1..8095eff3ae 100644
--- a/windows/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus.md
+++ b/windows/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 08/26/2017
---
# Manage updates and scans for endpoints that are out of date
diff --git a/windows/threat-protection/windows-defender-antivirus/manage-protection-update-schedule-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/manage-protection-update-schedule-windows-defender-antivirus.md
index 06ac450ee6..968e10782b 100644
--- a/windows/threat-protection/windows-defender-antivirus/manage-protection-update-schedule-windows-defender-antivirus.md
+++ b/windows/threat-protection/windows-defender-antivirus/manage-protection-update-schedule-windows-defender-antivirus.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 08/26/2017
---
# Manage the schedule for when protection updates should be downloaded and applied
diff --git a/windows/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md
index 554e426b6d..2d2614358f 100644
--- a/windows/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md
+++ b/windows/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 08/26/2017
---
# Manage the sources for Windows Defender Antivirus protection updates
diff --git a/windows/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md
index 77c6833644..d282a66fb9 100644
--- a/windows/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md
+++ b/windows/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 12/12/2017
---
# Manage Windows Defender Antivirus updates and apply baselines
@@ -40,7 +40,7 @@ The cloud-delivered protection is always on and requires an active connection to
## Product updates
-Windows Defender AV requires monthly updates (known as "engine updates"), and will receive major feature updates alongside Windows 10 releases.
+Windows Defender AV requires [monthly updates](https://support.microsoft.com/en-us/help/4052623/update-for-windows-defender-antimalware-platform) (known as "engine updates" and "platform updates"), and will receive major feature updates alongside Windows 10 releases.
You can manage the distribution of updates through Windows Server Update Service (WSUS), with [System Center Configuration Manager](https://docs.microsoft.com/en-us/sccm/sum/understand/software-updates-introduction), or in the normal manner that you deploy Microsoft and Windows updates to endpoints in your network.
diff --git a/windows/threat-protection/windows-defender-antivirus/manage-updates-mobile-devices-vms-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/manage-updates-mobile-devices-vms-windows-defender-antivirus.md
index 638419e42b..ae9fbfef91 100644
--- a/windows/threat-protection/windows-defender-antivirus/manage-updates-mobile-devices-vms-windows-defender-antivirus.md
+++ b/windows/threat-protection/windows-defender-antivirus/manage-updates-mobile-devices-vms-windows-defender-antivirus.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 08/26/2017
---
# Manage updates for mobile devices and virtual machines (VMs)
diff --git a/windows/threat-protection/windows-defender-antivirus/prevent-end-user-interaction-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/prevent-end-user-interaction-windows-defender-antivirus.md
index 0c2af7f269..6142a3aa14 100644
--- a/windows/threat-protection/windows-defender-antivirus/prevent-end-user-interaction-windows-defender-antivirus.md
+++ b/windows/threat-protection/windows-defender-antivirus/prevent-end-user-interaction-windows-defender-antivirus.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 08/26/2017
---
# Prevent users from seeing or interacting with the Windows Defender AV user interface
diff --git a/windows/threat-protection/windows-defender-antivirus/report-monitor-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/report-monitor-windows-defender-antivirus.md
index ba5043b800..2d59eb2f93 100644
--- a/windows/threat-protection/windows-defender-antivirus/report-monitor-windows-defender-antivirus.md
+++ b/windows/threat-protection/windows-defender-antivirus/report-monitor-windows-defender-antivirus.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 08/26/2017
---
# Report on Windows Defender Antivirus protection
diff --git a/windows/threat-protection/windows-defender-antivirus/review-scan-results-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/review-scan-results-windows-defender-antivirus.md
index 90bc57e8a3..fcf92cbd9d 100644
--- a/windows/threat-protection/windows-defender-antivirus/review-scan-results-windows-defender-antivirus.md
+++ b/windows/threat-protection/windows-defender-antivirus/review-scan-results-windows-defender-antivirus.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 08/26/2017
---
# Review Windows Defender AV scan results
diff --git a/windows/threat-protection/windows-defender-antivirus/run-scan-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/run-scan-windows-defender-antivirus.md
index e4f58850f2..3ba6851fdc 100644
--- a/windows/threat-protection/windows-defender-antivirus/run-scan-windows-defender-antivirus.md
+++ b/windows/threat-protection/windows-defender-antivirus/run-scan-windows-defender-antivirus.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 08/26/2017
---
diff --git a/windows/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md
index 506abf3a2c..1675810808 100644
--- a/windows/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md
+++ b/windows/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 10/30/2017
---
diff --git a/windows/threat-protection/windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus.md
index 8a1f3a3a08..c938860d27 100644
--- a/windows/threat-protection/windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus.md
+++ b/windows/threat-protection/windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 08/26/2017
---
# Specify the cloud-delivered protection level
diff --git a/windows/threat-protection/windows-defender-antivirus/troubleshoot-reporting.md b/windows/threat-protection/windows-defender-antivirus/troubleshoot-reporting.md
index a723a79704..0dd2646921 100644
--- a/windows/threat-protection/windows-defender-antivirus/troubleshoot-reporting.md
+++ b/windows/threat-protection/windows-defender-antivirus/troubleshoot-reporting.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 09/06/2017
+ms.date: 09/12/2017
---
# Troubleshoot Windows Defender Antivirus reporting in Update Compliance
@@ -51,7 +51,7 @@ In order for devices to properly show up in Update Compliance, you have to meet
>- Endpoints are using Windows Defender Antivirus as the sole antivirus protection app. [Using any other antivirus app will cause Windows Defender AV to disable itself](windows-defender-antivirus-compatibility.md) and the endpoint will not be reported in Update Compliance.
> - [Cloud-delivered protection is enabled](enable-cloud-protection-windows-defender-antivirus.md).
> - Endpoints can [connect to the Windows Defender AV cloud](configure-network-connections-windows-defender-antivirus.md#validate-connections-between-your-network-and-the-cloud)
-> - If the endpoint is running Windows 10 version 1607 or earlier, [Windows 10 telemetry must be set to the Enhanced level](https://docs.microsoft.com/en-us/windows/configuration/configure-windows-telemetry-in-your-organization#enhanced-level).
+> - If the endpoint is running Windows 10 version 1607 or earlier, [Windows 10 diagnostic data must be set to the Enhanced level](https://docs.microsoft.com/en-us/windows/configuration/configure-windows-diagnostic-data-in-your-organization#enhanced-level).
> - It has been 3 days since all requirements have been met
If the above pre-requisites have all been met, you may need to proceed to the next step to collect diagnostic information and send it to us.
diff --git a/windows/threat-protection/windows-defender-antivirus/troubleshoot-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/troubleshoot-windows-defender-antivirus.md
index f10174b897..3b17d0a161 100644
--- a/windows/threat-protection/windows-defender-antivirus/troubleshoot-windows-defender-antivirus.md
+++ b/windows/threat-protection/windows-defender-antivirus/troubleshoot-windows-defender-antivirus.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 06/13/2017
+ms.date: 11/20/2017
---
# Review event logs and error codes to troubleshoot issues with Windows Defender AV
@@ -37,7 +37,7 @@ The tables list:
>[!TIP]
>You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the following features are working:
>- Cloud-delivered protection
->- Fast learning (including Black at first sight)
+>- Fast learning (including Block at first sight)
>- Potentially unwanted application blocking
diff --git a/windows/threat-protection/windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md
index 55a97e770f..cfcd2ef54f 100644
--- a/windows/threat-protection/windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md
+++ b/windows/threat-protection/windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 08/26/2017
---
# Use Group Policy settings to configure and manage Windows Defender AV
diff --git a/windows/threat-protection/windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus.md
index 914d50f8b3..80e0cb124d 100644
--- a/windows/threat-protection/windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus.md
+++ b/windows/threat-protection/windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 08/26/2017
---
# Use System Center Configuration Manager and Microsoft Intune to configure and manage Windows Defender AV
diff --git a/windows/threat-protection/windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus.md
index 6a3cb8e8bd..7f32a7cfe9 100644
--- a/windows/threat-protection/windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus.md
+++ b/windows/threat-protection/windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 12/12/2017
---
# Use PowerShell cmdlets to configure and manage Windows Defender AV
@@ -31,7 +31,7 @@ PowerShell cmdlets are most useful in Windows Server environments that don't rel
Changes made with PowerShell will affect local settings on the endpoint where the changes are deployed or made. This means that deployments of policy with Group Policy, System Center Configuration Manager, or Microsoft Intune can overwrite changes made with PowerShell.
-You can [configure which settings can be overridden locally with local policy overrides](configure-local-policy-overrides-windows-defender-antivirus.md).
+You can [configure which settings can be overridden locally with local policy overrides](configure-local-policy-overrides-windows-defender-antivirus.md).
PowerShell is typically installed under the folder _%SystemRoot%\system32\WindowsPowerShell_.
diff --git a/windows/threat-protection/windows-defender-antivirus/use-wmi-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/use-wmi-windows-defender-antivirus.md
index e009932162..98a25ed21b 100644
--- a/windows/threat-protection/windows-defender-antivirus/use-wmi-windows-defender-antivirus.md
+++ b/windows/threat-protection/windows-defender-antivirus/use-wmi-windows-defender-antivirus.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 08/26/2017
---
# Use Windows Management Instrumentation (WMI) to configure and manage Windows Defender AV
diff --git a/windows/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus.md
index 6eb293cfaa..fec3ab9056 100644
--- a/windows/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus.md
+++ b/windows/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 11/20/2017
---
# Utilize Microsoft cloud-delivered protection in Windows Defender Antivirus
diff --git a/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md b/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md
index ac10f8950b..4fe762ad49 100644
--- a/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md
+++ b/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 09/07/2017
+ms.date: 11/09/2017
---
diff --git a/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md b/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md
index 989d6a0711..c2a9edb814 100644
--- a/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md
+++ b/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 11/20/2017
---
# Windows Defender Antivirus in Windows 10 and Windows Server 2016
@@ -46,7 +46,7 @@ Some of the highlights of Windows Defender AV include:
>[!TIP]
>You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the following features are working and see how they work:
>- Cloud-delivered protection
->- Fast learning (including Black at first sight)
+>- Fast learning (including Block at first sight)
>- Potentially unwanted application blocking
## What's new in Windows 10, version 1703
diff --git a/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016.md b/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016.md
index a28b49ec2c..3ccb022cec 100644
--- a/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016.md
+++ b/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 09/07/2017
+ms.date: 10/12/2017
---
diff --git a/windows/threat-protection/windows-defender-antivirus/windows-defender-offline.md b/windows/threat-protection/windows-defender-antivirus/windows-defender-offline.md
index 3168581911..c6efd499b0 100644
--- a/windows/threat-protection/windows-defender-antivirus/windows-defender-offline.md
+++ b/windows/threat-protection/windows-defender-antivirus/windows-defender-offline.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 08/26/2017
---
# Run and review the results of a Windows Defender Offline scan
diff --git a/windows/threat-protection/windows-defender-antivirus/windows-defender-security-center-antivirus.md b/windows/threat-protection/windows-defender-antivirus/windows-defender-security-center-antivirus.md
index 7f2ef6dac4..af01e728aa 100644
--- a/windows/threat-protection/windows-defender-antivirus/windows-defender-security-center-antivirus.md
+++ b/windows/threat-protection/windows-defender-antivirus/windows-defender-security-center-antivirus.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 10/02/2017
---
diff --git a/windows/threat-protection/windows-defender-application-control.md b/windows/threat-protection/windows-defender-application-control.md
new file mode 100644
index 0000000000..74adeafb06
--- /dev/null
+++ b/windows/threat-protection/windows-defender-application-control.md
@@ -0,0 +1,49 @@
+---
+title: Windows Defender Application Control (WDAC) (Windows 10)
+description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core.
+ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+author: jsuther1974
+ms.date: 01/24/2018
+---
+
+# Windows Defender Application Control
+
+**Applies to:**
+
+- Windows 10
+- Windows Server 2016
+
+With thousands of new malicious files created every day, using traditional methods like antivirus solutions—signature-based detection to fight against malware—provides an inadequate defense against new attacks.
+In most organizations, information is the most valuable asset, and ensuring that only approved users have access to that information is imperative.
+
+However, when a user runs a process, that process has the same level of access to data that the user has.
+As a result, sensitive information could easily be deleted or transmitted out of the organization if a user knowingly or unknowingly runs malicious software.
+
+Application control is a crucial line of defense for protecting enterprises given today’s threat landscape, and it has an inherent advantage over traditional antivirus solutions.
+Specifically, application control moves away from the traditional application trust model where all applications are assumed trustworthy by default to one where applications must earn trust in order to run.
+Many organizations, like the Australian Signals Directorate, understand this and frequently cite application control as one of the most effective means for addressing the threat of executable file-based malware (.exe, .dll, etc.).
+
+Windows Defender Application Control (WDAC) can help mitigate these types of security threats by restricting the applications that users are allowed to run and the code that runs in the System Core (kernel).
+WDAC policies also block unsigned scripts and MSIs, and Windows PowerShell runs in [Constrained Language Mode](https://docs.microsoft.com/powershell/module/microsoft.powershell.core/about/about_language_modes?view=powershell-5.1).
+
+> [!NOTE]
+> Prior to Windows 10, version 1709, Windows Defender Application Control was known as configurable code integrity policies.
+
+## WDAC System Requirements
+
+WDAC policies can only be created on computers running Windows 10 Enterprise or Windows Server 2016.
+They can be applied to computers running any edition of Windows 10 and managed via Mobile Device Management (MDM), such as Microsoft Intune.
+Group Policy can also be used to distribute Group Policy Objects that contain WDAC policies on computers running Windows 10 Enterprise or Windows Server 2016.
+
+## New and changed functionality
+
+Prior to Windows 10, version 1709, Windows Defender Application Control was known as Windows Defender Device Guard configurable code integrity policies.
+
+Beginning with Windows 10, version 1703, you can use WDAC not only to control applications, but also to control whether specific plug-ins, add-ins, and modules can run from specific apps (such as a line-of-business application or a browser).
+For more information, see [Use a Windows Defender Application Control policy to control specific plug-ins, add-ins, and modules](https://docs.microsoft.com/windows/device-security/device-guard/steps-to-deploy-windows-defender-application-control#use-a-windows-defender-application-control-policy-to-control-specific-plug-ins-add-ins-and-modules).
+
+
diff --git a/windows/threat-protection/windows-defender-application-guard/configure-wd-app-guard.md b/windows/threat-protection/windows-defender-application-guard/configure-wd-app-guard.md
index 17fb07bae5..07eb24860e 100644
--- a/windows/threat-protection/windows-defender-application-guard/configure-wd-app-guard.md
+++ b/windows/threat-protection/windows-defender-application-guard/configure-wd-app-guard.md
@@ -7,7 +7,7 @@ ms.sitesec: library
ms.pagetype: security
author: eross-msft
ms.author: lizross
-ms.date: 08/11/2017
+ms.date: 10/19/2017
---
# Configure Windows Defender Application Guard policy settings
diff --git a/windows/threat-protection/windows-defender-application-guard/faq-wd-app-guard.md b/windows/threat-protection/windows-defender-application-guard/faq-wd-app-guard.md
index 74e513ecbd..71c3fac2d7 100644
--- a/windows/threat-protection/windows-defender-application-guard/faq-wd-app-guard.md
+++ b/windows/threat-protection/windows-defender-application-guard/faq-wd-app-guard.md
@@ -7,7 +7,7 @@ ms.sitesec: library
ms.pagetype: security
author: eross-msft
ms.author: lizross
-ms.date: 08/11/2017
+ms.date: 11/07/2017
---
# Frequently asked questions - Windows Defender Application Guard
diff --git a/windows/threat-protection/windows-defender-application-guard/install-wd-app-guard.md b/windows/threat-protection/windows-defender-application-guard/install-wd-app-guard.md
index fa29a5687b..c6bf82932c 100644
--- a/windows/threat-protection/windows-defender-application-guard/install-wd-app-guard.md
+++ b/windows/threat-protection/windows-defender-application-guard/install-wd-app-guard.md
@@ -7,7 +7,7 @@ ms.sitesec: library
ms.pagetype: security
author: eross-msft
ms.author: lizross
-ms.date: 08/11/2017
+ms.date: 10/19/2017
---
# Prepare and install Windows Defender Application Guard
diff --git a/windows/threat-protection/windows-defender-application-guard/reqs-wd-app-guard.md b/windows/threat-protection/windows-defender-application-guard/reqs-wd-app-guard.md
index b7f830ebd5..7b79f26762 100644
--- a/windows/threat-protection/windows-defender-application-guard/reqs-wd-app-guard.md
+++ b/windows/threat-protection/windows-defender-application-guard/reqs-wd-app-guard.md
@@ -7,7 +7,7 @@ ms.sitesec: library
ms.pagetype: security
author: eross-msft
ms.author: lizross
-ms.date: 08/11/2017
+ms.date: 11/09/2017
---
# System requirements for Windows Defender Application Guard
@@ -32,7 +32,7 @@ Your environment needs the following hardware to run Windows Defender Applicatio
|Input/Output Memory Management Unit (IOMMU) support|Not required, but strongly recommended|
## Software requirements
-Your environment needs the following hardware to run Windows Defender Application Guard.
+Your environment needs the following software to run Windows Defender Application Guard.
|Software|Description|
|--------|-----------|
diff --git a/windows/threat-protection/windows-defender-application-guard/test-scenarios-wd-app-guard.md b/windows/threat-protection/windows-defender-application-guard/test-scenarios-wd-app-guard.md
index 1a42dc3b8b..4e9d84ab90 100644
--- a/windows/threat-protection/windows-defender-application-guard/test-scenarios-wd-app-guard.md
+++ b/windows/threat-protection/windows-defender-application-guard/test-scenarios-wd-app-guard.md
@@ -7,7 +7,7 @@ ms.sitesec: library
ms.pagetype: security
author: eross-msft
ms.author: lizross
-ms.date: 08/11/2017
+ms.date: 10/19/2017
---
# Testing scenarios using Windows Defender Application Guard in your business or organization
diff --git a/windows/threat-protection/windows-defender-application-guard/wd-app-guard-overview.md b/windows/threat-protection/windows-defender-application-guard/wd-app-guard-overview.md
index 42ace9f60f..a9148f2252 100644
--- a/windows/threat-protection/windows-defender-application-guard/wd-app-guard-overview.md
+++ b/windows/threat-protection/windows-defender-application-guard/wd-app-guard-overview.md
@@ -7,7 +7,7 @@ ms.sitesec: library
ms.pagetype: security
author: eross-msft
ms.author: lizross
-ms.date: 08/11/2017
+ms.date: 10/23/2017
---
# Windows Defender Application Guard overview
diff --git a/windows/threat-protection/windows-defender-atp/advanced-features-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/advanced-features-windows-defender-advanced-threat-protection.md
index 18204f4978..fee57495f2 100644
--- a/windows/threat-protection/windows-defender-atp/advanced-features-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/advanced-features-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 10/16/2017
---
# Turn on advanced features in Windows Defender ATP
diff --git a/windows/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md
index f262dc08a7..fea04741f7 100644
--- a/windows/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 11/09/2017
---
# View and organize the Windows Defender Advanced Threat Protection Alerts queue
diff --git a/windows/threat-protection/windows-defender-atp/api-portal-mapping-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/api-portal-mapping-windows-defender-advanced-threat-protection.md
index 909ae6a8eb..9c21431658 100644
--- a/windows/threat-protection/windows-defender-atp/api-portal-mapping-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/api-portal-mapping-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 10/16/2017
---
# Windows Defender ATP alert API fields
diff --git a/windows/threat-protection/windows-defender-atp/assign-portal-access-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/assign-portal-access-windows-defender-advanced-threat-protection.md
index 3f28c41ef8..ac64b927c8 100644
--- a/windows/threat-protection/windows-defender-atp/assign-portal-access-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/assign-portal-access-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 10/16/2017
---
# Assign user access to the Windows Defender ATP portal
diff --git a/windows/threat-protection/windows-defender-atp/block-file-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/block-file-windows-defender-advanced-threat-protection.md
new file mode 100644
index 0000000000..2f0c164f77
--- /dev/null
+++ b/windows/threat-protection/windows-defender-atp/block-file-windows-defender-advanced-threat-protection.md
@@ -0,0 +1,91 @@
+---
+title: Block file API
+description: Use this API to blocking files from being running in the organization.
+keywords: apis, graph api, supported apis, block file
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: high
+ms.date: 12/08/2017
+---
+
+# Block file API
+
+**Applies to:**
+
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
+Prevent a file from being executed in the organization using Windows Defender Antivirus.
+
+## Permissions
+Users need to have Security administrator or Global admin directory roles.
+
+## HTTP request
+```
+POST /testwdatppreview/files/{sha1}/block
+```
+
+## Request headers
+
+Header | Value
+:---|:---
+Authorization | Bearer {token}. **Required**.
+Content-Type | application/json
+
+## Request body
+In the request body, supply a JSON object with the following parameters:
+
+Parameter | Type | Description
+:---|:---|:---
+Comment | String | Comment to associate with the action. **Required**.
+
+
+## Response
+If successful, this method returns 200, Ok response code with empty body, which indicates that block message was sent to Windows Defender deployed in the organization.
+
+
+## Example
+
+Request
+
+Here is an example of the request.
+
+```
+POST https://graph.microsoft.com/testwdatppreview/files/7327b54fd718525cbca07dacde913b5ac3c85673/block
+Content-type: application/json
+{
+ "Comment": "Block file due to alert 32123"
+}
+
+
+```
+
+Response
+
+Here is an example of the response.
+
+
+```
+HTTP/1.1 201 Created
+Content-type: application/json
+{
+ "fileIdentifier": "7327b54fd718525cbca07dacde913b5ac3c85673",
+ "fileIdentifierType": "Sha1",
+ "actionType": "Block",
+ "fileStatus": "Blocked",
+ "creationDateTimeUtc": "2017-12-04T13:06:23.4502191Z",
+ "requestor": "Analyst@contoso.com ",
+ "requestorComment": "test",
+ "cancellationDateTimeUtc": null,
+ "cancellationRequestor": null,
+ "cancellationComment": null,
+ "lastUpdateDateTimeUtc": "2017-12-04T13:06:23.4502191Z"
+}
+
+```
diff --git a/windows/threat-protection/windows-defender-atp/check-sensor-status-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/check-sensor-status-windows-defender-advanced-threat-protection.md
index 1ba183765a..a18a381387 100644
--- a/windows/threat-protection/windows-defender-atp/check-sensor-status-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/check-sensor-status-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 10/16/2017
---
# Check sensor health state in Windows Defender ATP
diff --git a/windows/threat-protection/windows-defender-atp/collect-investigation-package-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/collect-investigation-package-windows-defender-advanced-threat-protection.md
new file mode 100644
index 0000000000..9e23f63821
--- /dev/null
+++ b/windows/threat-protection/windows-defender-atp/collect-investigation-package-windows-defender-advanced-threat-protection.md
@@ -0,0 +1,90 @@
+---
+title: Collect investigation package API
+description: Use this API to create calls related to the collecting an investigation package from a machine.
+keywords: apis, graph api, supported apis, collect investigation package
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: high
+ms.date: 12/08/2017
+---
+
+# Collect investigation package API
+
+**Applies to:**
+
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
+Collect investigation package from a machine.
+
+## Permissions
+Users need to have Security administrator or Global admin directory roles.
+
+## HTTP request
+```
+POST /testwdatppreview/machines/{id}/collectInvestigationPackage
+```
+
+## Request headers
+
+Header | Value
+:---|:---
+Authorization | Bearer {token}. Required.
+Content-Type | application/json
+
+## Request body
+In the request body, supply a JSON object with the following parameters:
+
+Parameter | Type | Description
+:---|:---|:---
+Comment | Text | Comment to associate with the action. **Required**.
+
+## Response
+If successful, this method returns 201, Created response code and _MachineAction_ object in the response body.
+
+
+## Example
+
+Request
+
+Here is an example of the request.
+
+```
+POST https://graph.microsoft.com/testwdatppreview/machines/fb9ab6be3965095a09c057be7c90f0a2/collectInvestigationPackage
+Content-type: application/json
+{
+ "Comment": "Collect forensics due to alert 1234"
+}
+```
+
+Response
+
+Here is an example of the response.
+
+>[!NOTE]
+>The response object shown here may be truncated for brevity. All of the properties will be returned from an actual call.
+
+```
+HTTP/1.1 201 Created
+Content-type: application/json
+{
+ "@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#MachineActions/$entity",
+ "id": "c9042f9b-8483-4526-87b5-35e4c2532223",
+ "type": "CollectInvestigationPackage",
+ "requestor": "Analyst@contoso.com ",
+ "requestorComment": " Collect forensics due to alert 1234",
+ "status": "InProgress",
+ "error": "None",
+ "machineId": "f46b9bb259ed4a7fb9981b73510e3cc7aa81ec1f",
+ "creationDateTimeUtc": "2017-12-04T12:09:24.1785079Z",
+ "lastUpdateTimeUtc": "2017-12-04T12:09:24.1785079Z"
+}
+
+
+```
diff --git a/windows/threat-protection/windows-defender-atp/configure-arcsight-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/configure-arcsight-windows-defender-advanced-threat-protection.md
index 7fab21b8af..c9a8873e08 100644
--- a/windows/threat-protection/windows-defender-atp/configure-arcsight-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/configure-arcsight-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 10/16/2017
---
# Configure HP ArcSight to pull Windows Defender ATP alerts
diff --git a/windows/threat-protection/windows-defender-atp/configure-email-notifications-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/configure-email-notifications-windows-defender-advanced-threat-protection.md
index adc3f256ef..9f0f626310 100644
--- a/windows/threat-protection/windows-defender-atp/configure-email-notifications-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/configure-email-notifications-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 10/16/2017
---
# Configure email notifications in Windows Defender ATP
diff --git a/windows/threat-protection/windows-defender-atp/configure-endpoints-gp-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/configure-endpoints-gp-windows-defender-advanced-threat-protection.md
index daaf785304..05863a21ee 100644
--- a/windows/threat-protection/windows-defender-atp/configure-endpoints-gp-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/configure-endpoints-gp-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 11/06/2017
---
# Configure endpoints using Group Policy
diff --git a/windows/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md
index 3aff67dc2f..1da2319b09 100644
--- a/windows/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 11/06/2017
---
# Configure endpoints using Mobile Device Management tools
@@ -106,11 +106,11 @@ Health Status for onboarded machines: Sense Is Running | ./Device/Vendor/MSFT/Wi
Health Status for onboarded machines: Onboarding State | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/OnBoardingState | Integer | 1 | Onboarded to Windows Defender ATP
Health Status for onboarded machines: Organization ID | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/OrgId | String | Use OrgID from onboarding file | Onboarded to Organization ID
Configuration for onboarded machines | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Configuration/SampleSharing | Integer | 0 or 1 Default value: 1 | Windows Defender ATP Sample sharing is enabled
-Configuration for onboarded machines: telemetry reporting frequency | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Configuration/TelemetryReportingFrequency | Integer | 1 or 2 1: Normal (default)
2: Expedite | Windows Defender ATP telemetry reporting
+Configuration for onboarded machines: diagnostic data reporting frequency | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Configuration/TelemetryReportingFrequency | Integer | 1 or 2 1: Normal (default)
2: Expedite | Windows Defender ATP diagnostic data reporting
> [!NOTE]
> - The **Health Status for onboarded machines** policy uses read-only properties and can't be remediated.
-> - Configuration of telemetry reporting frequency is only available for machines on Windows 10, version 1703.
+> - Configuration of diagnostic data reporting frequency is only available for machines on Windows 10, version 1703.
> - Using the Expedite mode might have an impact on the machine's battery usage and actual bandwidth used for sensor data. You should consider this when these measures are critical.
@@ -118,66 +118,6 @@ Configuration for onboarded machines: telemetry reporting frequency | ./Device/V
> After onboarding the endpoint, you can choose to run a detection test to verify that an endpoint is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Windows Defender ATP endpoint](run-detection-test-windows-defender-advanced-threat-protection.md).
-### Using the Azure Intune Portal to deploy Windows Defender Advanced Threat Protection policies on Windows 10 1607 and higher
-
-1. Open the Microsoft Intune configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/):
-
- a. Select **Endpoint management** > **Clients** on the **Navigation pane**.
-
- b. Select **Mobile Device Management/Microsoft Intune** > **Download package** and save the .zip file.
-
- 
-
-2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. You should have a file named *WindowsDefenderATP.onboarding*.
-
-3. Login to the [Microsoft Azure portal](https://portal.azure.com).
-
-4. From the Intune blade, choose **Device configuration**.
-
- 
-
-5. Under **Manage**, choose **Profiles** and click **Create Profile**.
-
- 
-
-6. Type a name, description and choose **Windows 10 and later** as the Platform and **Custom** as the Profile type.
-
- 
-
-7. Click **Settings** > **Configure**.
-
- 
-
-8. Under Custom OMA-URI Settings, click **Add**.
-
- 
-
-9. Enter the following values, then click **OK**.
-
- 
-
- - **Name**: Type a name for the setting.
- - **Description**: Type a description for the setting.
- - **OMA-URI**: _./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Onboarding_
- - **Value**: Copy and paste the contents of the WindowsDefenderATP.onboarding file you downloaded.
-
-10. Save the settings by clicking **OK**.
-
-11. Click **Create**.
-
- 
-
-12. To deploy the Profile, click **Assignments**.
-
- 
-
-13. Search for and select the Group you want to apply the Configuration Profile to, then click **Select**.
-
- 
-
-14. Click **Save** to finish deploying the Configuration Profile.
-
- 
### Offboard and monitor endpoints
diff --git a/windows/threat-protection/windows-defender-atp/configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md
index 706db3ef71..f98fcf98cf 100644
--- a/windows/threat-protection/windows-defender-atp/configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md
@@ -9,14 +9,14 @@ ms.sitesec: library
ms.pagetype: security
author: mjcaparas
localizationpriority: high
-ms.date: 11/08/2017
+ms.date: 12/12/2017
---
# Configure non-Windows endpoints
**Applies to:**
-- Mac OS X
+- macOS X
- Linux
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
@@ -26,7 +26,7 @@ ms.date: 11/08/2017
Windows Defender ATP provides a centralized security operations experience for Windows as well as non-Windows platforms. You'll be able to see alerts from various supported operating systems (OS) in the Windows Defender ATP portal and better protect your organization's network. This experience leverages on a third-party security products’ sensor data.
-You'll need to know the exact Linux distros and Mac OS X versions that are compatible with Windows Defender ATP for the integration to work.
+You'll need to know the exact Linux distros and macOS X versions that are compatible with Windows Defender ATP for the integration to work.
## Onboard non-Windows endpoints
You'll need to take the following steps to oboard non-Windows endpoints:
@@ -41,7 +41,7 @@ You'll need to take the following steps to oboard non-Windows endpoints:
3. Click **Generate access token** button and then **Copy**.
-4. Depending on the third-party implementation you're using, the implementation might vary. Refer to the third-party solution documentation for guidance on how to use the token.
+4. You’ll need to copy and paste the token to the third-party solution you’re using. The implementation may vary depending on the solution.
>[!WARNING]
@@ -60,7 +60,7 @@ To effectively offboard the endpoints from the service, you'll need to disable t
2. In Windows Defender Security Center portal, select **Endpoint management**> **Non-Windows**.
-3. Toggle the third-party provider switch button to turn stop telemetry from endpoints.
+3. Toggle the third-party provider switch button to turn stop diagnostic data from endpoints.
>[!WARNING]
>If you decide to turn on the third-party integration again after disabling the integration, you'll need to regenerate the token and reapply it on endpoints.
diff --git a/windows/threat-protection/windows-defender-atp/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md
index 8747d4b975..de4aa4ddca 100644
--- a/windows/threat-protection/windows-defender-atp/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 11/06/2017
---
# Configure endpoints using System Center Configuration Manager
diff --git a/windows/threat-protection/windows-defender-atp/configure-endpoints-script-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/configure-endpoints-script-windows-defender-advanced-threat-protection.md
index b81b7d062e..f1219c9897 100644
--- a/windows/threat-protection/windows-defender-atp/configure-endpoints-script-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/configure-endpoints-script-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 11/06/2017
---
# Configure endpoints using a local script
diff --git a/windows/threat-protection/windows-defender-atp/configure-endpoints-vdi-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/configure-endpoints-vdi-windows-defender-advanced-threat-protection.md
index aa48ff798a..06efff80c7 100644
--- a/windows/threat-protection/windows-defender-atp/configure-endpoints-vdi-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/configure-endpoints-vdi-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 10/16/2017
---
# Configure non-persistent virtual desktop infrastructure (VDI) machines
diff --git a/windows/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection.md
index 2e727a1895..4afc560682 100644
--- a/windows/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 10/16/2017
---
# Configure Windows Defender ATP client endpoints
diff --git a/windows/threat-protection/windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection.md
index d80ae65c71..cd4942e214 100644
--- a/windows/threat-protection/windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 10/16/2017
---
@@ -47,7 +47,7 @@ The WinHTTP configuration setting is independent of the Windows Internet (WinINe
- WinHTTP configured using netsh command – Suitable only for desktops in a stable topology (for example: a desktop in a corporate network behind the same proxy)
## Configure the proxy server manually using a registry-based static proxy
-Configure a registry-based static proxy to allow only Windows Defender ATP sensor to report telemetry and communicate with Windows Defender ATP services if a computer is not be permitted to connect to the Internet.
+Configure a registry-based static proxy to allow only Windows Defender ATP sensor to report diagnostic data and communicate with Windows Defender ATP services if a computer is not be permitted to connect to the Internet.
The static proxy is configurable through Group Policy (GP). The group policy can be found under: **Administrative Templates > Windows Components > Data Collection and Preview Builds > Configure connected user experiences and telemetry**.
diff --git a/windows/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md
index ba65c41f73..576adf3128 100644
--- a/windows/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md
@@ -9,7 +9,7 @@ ms.sitesec: library
ms.pagetype: security
author: mjcaparas
localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 11/30/2017
---
# Configure Windows Defender ATP server endpoints
@@ -40,6 +40,7 @@ To onboard your servers to Windows Defender ATP, you’ll need to:
>[!TIP]
> After onboarding the endpoint, you can choose to run a detection test to verify that an endpoint is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Windows Defender ATP endpoint](run-detection-test-windows-defender-advanced-threat-protection.md).
+
### Turn on Server monitoring from the Windows Defender Security Center portal
1. In the navigation pane, select **Endpoint management** > **Servers**.
@@ -48,7 +49,7 @@ To onboard your servers to Windows Defender ATP, you’ll need to:
-
+
### Install and configure Microsoft Monitoring Agent (MMA) to report sensor data to Windows Defender ATP
1. Download the agent setup file: [Windows 64-bit agent](https://go.microsoft.com/fwlink/?LinkId=828603).
@@ -62,6 +63,7 @@ To onboard your servers to Windows Defender ATP, you’ll need to:
Once completed, you should see onboarded servers in the portal within an hour.
+
### Configure server endpoint proxy and Internet connectivity settings
- Each Windows server must be able to connect to the Internet using HTTPS. This connection can be direct, using a proxy, or through the [OMS Gateway](https://docs.microsoft.com/en-us/azure/log-analytics/log-analytics-oms-gateway).
- If a proxy or firewall is blocking all traffic by default and allowing only specific domains through or HTTPS scanning (SSL inspection) is enabled, make sure that the following URLs are white-listed to permit communication with Windows Defender ATP service:
diff --git a/windows/threat-protection/windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection.md
index 657af8b344..6cdf425a42 100644
--- a/windows/threat-protection/windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 10/16/2017
---
# Pull alerts to your SIEM tools
diff --git a/windows/threat-protection/windows-defender-atp/configure-splunk-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/configure-splunk-windows-defender-advanced-threat-protection.md
index d0700c0fa5..ed2b034f45 100644
--- a/windows/threat-protection/windows-defender-atp/configure-splunk-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/configure-splunk-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 10/16/2017
---
# Configure Splunk to pull Windows Defender ATP alerts
diff --git a/windows/threat-protection/windows-defender-atp/custom-ti-api-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/custom-ti-api-windows-defender-advanced-threat-protection.md
index 63ea798361..c44eb648d5 100644
--- a/windows/threat-protection/windows-defender-atp/custom-ti-api-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/custom-ti-api-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 10/16/2017
---
# Create custom alerts using the threat intelligence (TI) application program interface (API)
diff --git a/windows/threat-protection/windows-defender-atp/dashboard-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/dashboard-windows-defender-advanced-threat-protection.md
index e5c44b8d67..1846ca83c2 100644
--- a/windows/threat-protection/windows-defender-atp/dashboard-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/dashboard-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 11/01/2017
---
# View the Windows Defender Advanced Threat Protection Security operations dashboard
diff --git a/windows/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md
index 761f4e11dc..a15378b6ad 100644
--- a/windows/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 11/14/2017
---
# Windows Defender ATP data storage and privacy
diff --git a/windows/threat-protection/windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection.md
index 8dc6263371..4e082b67d2 100644
--- a/windows/threat-protection/windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 11/28/2017
---
# Windows Defender Antivirus compatibility with Windows Defender ATP
diff --git a/windows/threat-protection/windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection.md
index 1893d4aeea..def73c0599 100644
--- a/windows/threat-protection/windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 10/16/2017
---
# Enable the custom threat intelligence API in Windows Defender ATP
diff --git a/windows/threat-protection/windows-defender-atp/enable-security-analytics-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/enable-security-analytics-windows-defender-advanced-threat-protection.md
index 9a6a327429..2ff55bdc25 100644
--- a/windows/threat-protection/windows-defender-atp/enable-security-analytics-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/enable-security-analytics-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 10/16/2017
---
# Enable Security Analytics security controls
diff --git a/windows/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection.md
index 978f65a2d7..c444afe13d 100644
--- a/windows/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 11/21/2017
---
# Enable SIEM integration in Windows Defender ATP
diff --git a/windows/threat-protection/windows-defender-atp/event-error-codes-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/event-error-codes-windows-defender-advanced-threat-protection.md
index 1f4a5344b8..79a751c4a0 100644
--- a/windows/threat-protection/windows-defender-atp/event-error-codes-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/event-error-codes-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 10/16/2017
---
@@ -155,7 +155,7 @@ The service could not contact the external processing servers at that URL.
17
Windows Defender Advanced Threat Protection service failed to change the Connected User Experiences and Telemetry service location. Failure code: ```variable```.
An error occurred with the Windows telemetry service.
-
[Ensure the telemetry service is enabled](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-the-telemetry-and-diagnostics-service-is-enabled).
+
[Ensure the diagnostic data service is enabled](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-the-diagnostics-service-is-enabled).
Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md).
Windows Defender Advanced Threat Protection Connected User Experiences and Telemetry service registration failed. Failure code: ```variable```.
An error occurred with the Windows telemetry service.
-
[Ensure the telemetry service is enabled](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-the-telemetry-and-diagnostics-service-is-enabled).
+
[Ensure the diagnostic data service is enabled](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-the-diagnostic-data-service-is-enabled).
Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md).
Windows Defender Advanced Threat Protection Connected User Experiences and Telemetry service unregistration failed. Failure code: ```variable```.
An error occurred with the Windows telemetry service during onboarding. The offboarding process continues.
-
[Check for errors with the Windows telemetry service](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-the-telemetry-and-diagnostics-service-is-enabled).
+
[Check for errors with the Windows telemetry service](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-the-diagnostic-data-service-is-enabled).
32
@@ -241,7 +241,7 @@ If the identifier does not persist, the same machine might appear twice in the p
34
Windows Defender Advanced Threat Protection service failed to add itself as a dependency on the Connected User Experiences and Telemetry service, causing onboarding process to fail. Failure code: ```variable```.
An error occurred with the Windows telemetry service.
-
[Ensure the telemetry service is enabled](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-the-telemetry-and-diagnostics-service-is-enabled).
+
[Ensure the diagnostic data service is enabled](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-the-diagnostic-data-service-is-enabled).
Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md).
@@ -250,7 +250,7 @@ See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defen
Windows Defender Advanced Threat Protection service failed to remove itself as a dependency on the Connected User Experiences and Telemetry service. Failure code: ```variable```.
An error occurred with the Windows telemetry service during offboarding. The offboarding process continues.
-
Check for errors with the Windows telemetry service.
+
Check for errors with the Windows diagnostic data service.
36
diff --git a/windows/threat-protection/windows-defender-atp/experiment-custom-ti-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/experiment-custom-ti-windows-defender-advanced-threat-protection.md
index 8003743e5d..5652ee66e3 100644
--- a/windows/threat-protection/windows-defender-atp/experiment-custom-ti-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/experiment-custom-ti-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 11/09/2017
---
# Experiment with custom threat intelligence (TI) alerts
diff --git a/windows/threat-protection/windows-defender-atp/exposed-apis-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/exposed-apis-windows-defender-advanced-threat-protection.md
index 50e19938e1..2eb3a595ec 100644
--- a/windows/threat-protection/windows-defender-atp/exposed-apis-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/exposed-apis-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 10/23/2017
---
# Use the Windows Defender ATP exposed APIs
diff --git a/windows/threat-protection/windows-defender-atp/find-machine-info-by-ip-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/find-machine-info-by-ip-windows-defender-advanced-threat-protection.md
index 770e413442..c654298268 100644
--- a/windows/threat-protection/windows-defender-atp/find-machine-info-by-ip-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/find-machine-info-by-ip-windows-defender-advanced-threat-protection.md
@@ -10,10 +10,17 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 12/08/2017
---
-# Find machine information by interal IP
+# Find machine information by interal IP API
+
+**Applies to:**
+
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
Find a machine entity around a specific timestamp by FQDN or internal IP.
## Permissions
diff --git a/windows/threat-protection/windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md
index 6a26c03dca..b31dad703f 100644
--- a/windows/threat-protection/windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 10/23/2017
---
# Fix unhealthy sensors in Windows Defender ATP
@@ -72,8 +72,8 @@ Follow theses actions to correct known issues related to a misconfigured machine
- [Verify client connectivity to Windows Defender ATP service URLs](configure-proxy-internet-windows-defender-advanced-threat-protection.md#verify-client-connectivity-to-windows-defender-atp-service-urls)
Verify the proxy configuration completed successfully, that WinHTTP can discover and communicate through the proxy server in your environment, and that the proxy server allows traffic to the Windows Defender ATP service URLs.
-- [Ensure the telemetry and diagnostics service is enabled](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-the-telemetry-and-diagnostics-service-is-enabled)
-If the endpoints aren't reporting correctly, you might need to check that the Windows 10 telemetry and diagnostics service is set to automatically start and is running on the endpoint.
+- [Ensure the diagnostic data service is enabled](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-the-diagnostics-service-is-enabled)
+If the endpoints aren't reporting correctly, you might need to check that the Windows 10 diagnostic data service is set to automatically start and is running on the endpoint.
- [Ensure that Windows Defender Antivirus is not disabled by policy](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-that-windows-defender-antivirus-is-not-disabled-by-a-policy)
If your endpoints are running a third-party antimalware client, the Windows Defender ATP agent needs the Windows Defender Antivirus Early Launch Antimalware (ELAM) driver to be enabled.
diff --git a/windows/threat-protection/windows-defender-atp/general-settings-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/general-settings-windows-defender-advanced-threat-protection.md
index e096e90a23..7c8b6ad443 100644
--- a/windows/threat-protection/windows-defender-atp/general-settings-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/general-settings-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 10/16/2017
---
# Update general Windows Defender ATP settings
diff --git a/windows/threat-protection/windows-defender-atp/get-actor-information-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/get-actor-information-windows-defender-advanced-threat-protection.md
index 9920dd76bc..52ece2cd59 100644
--- a/windows/threat-protection/windows-defender-atp/get-actor-information-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/get-actor-information-windows-defender-advanced-threat-protection.md
@@ -10,10 +10,18 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 12/08/2017
---
-# Get actor information
+
+# Get actor information API
+
+**Applies to:**
+
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
Retrieves an actor information report.
## Permissions
diff --git a/windows/threat-protection/windows-defender-atp/get-actor-related-alerts-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/get-actor-related-alerts-windows-defender-advanced-threat-protection.md
index 5789d02bfa..bf950ccad7 100644
--- a/windows/threat-protection/windows-defender-atp/get-actor-related-alerts-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/get-actor-related-alerts-windows-defender-advanced-threat-protection.md
@@ -10,10 +10,17 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 12/08/2017
---
-# Get actor related alerts
+# Get actor related alerts API
+
+**Applies to:**
+
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
Retrieves all alerts related to a given actor.
## Permissions
diff --git a/windows/threat-protection/windows-defender-atp/get-alert-info-by-id-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/get-alert-info-by-id-windows-defender-advanced-threat-protection.md
index b134792b71..ea7ebc034a 100644
--- a/windows/threat-protection/windows-defender-atp/get-alert-info-by-id-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/get-alert-info-by-id-windows-defender-advanced-threat-protection.md
@@ -10,10 +10,17 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 12/08/2017
---
-# Get alert information by ID
+# Get alert information by ID API
+
+**Applies to:**
+
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
Retrieves an alert by its ID.
## Permissions
diff --git a/windows/threat-protection/windows-defender-atp/get-alert-related-actor-info-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/get-alert-related-actor-info-windows-defender-advanced-threat-protection.md
index 298732bdd3..4936276d33 100644
--- a/windows/threat-protection/windows-defender-atp/get-alert-related-actor-info-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/get-alert-related-actor-info-windows-defender-advanced-threat-protection.md
@@ -10,10 +10,17 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 12/08/2017
---
-# Get alert related actor information
+# Get alert related actor information API
+
+**Applies to:**
+
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
Retrieves the actor information related to the specific alert.
## Permissions
diff --git a/windows/threat-protection/windows-defender-atp/get-alert-related-domain-info-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/get-alert-related-domain-info-windows-defender-advanced-threat-protection.md
index 4aff86fc8e..8585e21488 100644
--- a/windows/threat-protection/windows-defender-atp/get-alert-related-domain-info-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/get-alert-related-domain-info-windows-defender-advanced-threat-protection.md
@@ -10,10 +10,17 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 12/08/2017
---
-# Get alert related domain information
+# Get alert related domain information API
+
+**Applies to:**
+
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
Retrieves all domains related to a specific alert.
## Permissions
diff --git a/windows/threat-protection/windows-defender-atp/get-alert-related-files-info-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/get-alert-related-files-info-windows-defender-advanced-threat-protection.md
index 0caa3eb0fa..5c00116cbb 100644
--- a/windows/threat-protection/windows-defender-atp/get-alert-related-files-info-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/get-alert-related-files-info-windows-defender-advanced-threat-protection.md
@@ -10,10 +10,17 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 12/08/2017
---
-# Get alert related files information
+# Get alert related files information API
+
+**Applies to:**
+
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
Retrieves all files related to a specific alert.
## Permissions
diff --git a/windows/threat-protection/windows-defender-atp/get-alert-related-ip-info-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/get-alert-related-ip-info-windows-defender-advanced-threat-protection.md
index f381d54582..1422fd9d29 100644
--- a/windows/threat-protection/windows-defender-atp/get-alert-related-ip-info-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/get-alert-related-ip-info-windows-defender-advanced-threat-protection.md
@@ -10,10 +10,17 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 12/08/2017
---
-# Get alert related IP information
+# Get alert related IP information API
+
+**Applies to:**
+
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
Retrieves all IPs related to a specific alert.
## Permissions
diff --git a/windows/threat-protection/windows-defender-atp/get-alert-related-machine-info-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/get-alert-related-machine-info-windows-defender-advanced-threat-protection.md
index 5b7faaa789..1a6856dd1b 100644
--- a/windows/threat-protection/windows-defender-atp/get-alert-related-machine-info-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/get-alert-related-machine-info-windows-defender-advanced-threat-protection.md
@@ -10,10 +10,17 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 12/08/2017
---
-# Get alert related machine information
+# Get alert related machine information API
+
+**Applies to:**
+
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
Retrieves all machines related to a specific alert.
## Permissions
diff --git a/windows/threat-protection/windows-defender-atp/get-alert-related-user-info-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/get-alert-related-user-info-windows-defender-advanced-threat-protection.md
index 6676824c44..322e415d1e 100644
--- a/windows/threat-protection/windows-defender-atp/get-alert-related-user-info-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/get-alert-related-user-info-windows-defender-advanced-threat-protection.md
@@ -10,10 +10,17 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 12/08/2017
---
-# Get alert related user information
+# Get alert related user information API
+
+**Applies to:**
+
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
Retrieves the user associated to a specific alert.
## Permissions
diff --git a/windows/threat-protection/windows-defender-atp/get-alerts-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/get-alerts-windows-defender-advanced-threat-protection.md
index 8f77b172b9..f0da636e39 100644
--- a/windows/threat-protection/windows-defender-atp/get-alerts-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/get-alerts-windows-defender-advanced-threat-protection.md
@@ -10,12 +10,20 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 12/08/2017
---
-# Get alerts
+# Get alerts API
+
+**Applies to:**
+
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
Retrieves top recent alerts.
+
## Permissions
User needs read permissions.
diff --git a/windows/threat-protection/windows-defender-atp/get-domain-related-alerts-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/get-domain-related-alerts-windows-defender-advanced-threat-protection.md
index 1d9c9340f2..c96b12cd50 100644
--- a/windows/threat-protection/windows-defender-atp/get-domain-related-alerts-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/get-domain-related-alerts-windows-defender-advanced-threat-protection.md
@@ -10,10 +10,17 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 12/08/2017
---
-# Get domain related alerts
+# Get domain related alerts API
+
+**Applies to:**
+
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
Retrieves a collection of alerts related to a given domain address.
## Permissions
diff --git a/windows/threat-protection/windows-defender-atp/get-domain-related-machines-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/get-domain-related-machines-windows-defender-advanced-threat-protection.md
index 395a145017..69f702f7c9 100644
--- a/windows/threat-protection/windows-defender-atp/get-domain-related-machines-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/get-domain-related-machines-windows-defender-advanced-threat-protection.md
@@ -10,10 +10,17 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 12/08/2017
---
-# Get domain related machines
+# Get domain related machines API
+
+**Applies to:**
+
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
Retrieves a collection of machines related to a given domain address.
## Permissions
diff --git a/windows/threat-protection/windows-defender-atp/get-domain-statistics-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/get-domain-statistics-windows-defender-advanced-threat-protection.md
index d32758960c..32271f2620 100644
--- a/windows/threat-protection/windows-defender-atp/get-domain-statistics-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/get-domain-statistics-windows-defender-advanced-threat-protection.md
@@ -10,10 +10,17 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 12/08/2017
---
-# Get domain statistics
+# Get domain statistics API
+
+**Applies to:**
+
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
Retrieves the prevalence for the given domain.
## Permissions
diff --git a/windows/threat-protection/windows-defender-atp/get-file-information-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/get-file-information-windows-defender-advanced-threat-protection.md
index e8124fcdaa..b3a3eefa7b 100644
--- a/windows/threat-protection/windows-defender-atp/get-file-information-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/get-file-information-windows-defender-advanced-threat-protection.md
@@ -10,10 +10,18 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 12/08/2017
---
-# Get file information
+# Get file information API
+
+**Applies to:**
+
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
+
Retrieves a file by identifier Sha1, Sha256, or MD5.
## Permissions
diff --git a/windows/threat-protection/windows-defender-atp/get-file-related-alerts-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/get-file-related-alerts-windows-defender-advanced-threat-protection.md
index 0055fa9420..fae00da926 100644
--- a/windows/threat-protection/windows-defender-atp/get-file-related-alerts-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/get-file-related-alerts-windows-defender-advanced-threat-protection.md
@@ -10,10 +10,17 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 12/08/2017
---
-# Get file related alerts
+# Get file related alerts API
+
+**Applies to:**
+
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
Retrieves a collection of alerts related to a given file hash.
## Permissions
diff --git a/windows/threat-protection/windows-defender-atp/get-file-related-machines-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/get-file-related-machines-windows-defender-advanced-threat-protection.md
index 7eff513d50..1332ba931e 100644
--- a/windows/threat-protection/windows-defender-atp/get-file-related-machines-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/get-file-related-machines-windows-defender-advanced-threat-protection.md
@@ -10,10 +10,17 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 12/08/2017
---
-# Get file related machines
+# Get file related machines API
+
+**Applies to:**
+
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
Retrieves a collection of machines related to a given file hash.
## Permissions
diff --git a/windows/threat-protection/windows-defender-atp/get-file-statistics-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/get-file-statistics-windows-defender-advanced-threat-protection.md
index 7ea388e1a0..a642184c9d 100644
--- a/windows/threat-protection/windows-defender-atp/get-file-statistics-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/get-file-statistics-windows-defender-advanced-threat-protection.md
@@ -10,10 +10,17 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 12/08/2017
---
-# Get file statistics
+# Get file statistics API
+
+**Applies to:**
+
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
Retrieves the prevalence for the given file.
## Permissions
diff --git a/windows/threat-protection/windows-defender-atp/get-fileactions-collection-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/get-fileactions-collection-windows-defender-advanced-threat-protection.md
new file mode 100644
index 0000000000..21560e7198
--- /dev/null
+++ b/windows/threat-protection/windows-defender-atp/get-fileactions-collection-windows-defender-advanced-threat-protection.md
@@ -0,0 +1,115 @@
+---
+title: Get FileActions collection API
+description: Use this API to create calls related to get fileactions collection
+keywords: apis, graph api, supported apis, get, file, information, fileactions collection
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: high
+ms.date: 12/08/2017
+---
+
+# Get FileActions collection API
+
+**Applies to:**
+
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
+Gets collection of actions done on files. Get FileActions collection API supports OData V4 queries.
+
+## Permissions
+Users need to have Security administrator or Global admin directory roles.
+
+## HTTP request
+```
+GET /testwdatppreview/fileactions
+```
+
+## Request headers
+
+Header | Value
+:---|:---
+Authorization | Bearer {token}. **Required**.
+
+
+## Request body
+Empty
+
+## Response
+If successful, this method returns 200, Ok response code with a collection of FileAction objects.
+
+>[!NOTE]
+>Although Block and Unblock actions are under FileAction category, this API only returns the Block actions on files that are currently blocked. For example, a file that is blocked and then unblocked will not be seen on this API.
+
+
+
+## Example
+
+Request
+
+Here is an example of the request on an organization that has three FileActions.
+
+```
+GET https://graph.microsoft.com/testwdatppreview/fileactions
+```
+
+Response
+
+Here is an example of the response.
+
+
+```
+HTTP/1.1 200 Ok
+Content-type: application/json
+{
+ "@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#FileActions",
+ "value": [
+ {
+ "fileIdentifier": "87662bc3d60e4200ceaf7aae249d1c343f4b83c9",
+ "fileIdentifierType": "Sha1",
+ "actionType": "Block",
+ "fileStatus": "Blocked",
+ "creationDateTimeUtc": "2017-12-04T13:06:23.4502191Z",
+ "requestor": "Analyst@contoso.com ",
+ "requestorComment": "test",
+ "cancellationDateTimeUtc": null,
+ "cancellationRequestor": null,
+ "cancellationComment": null,
+ "lastUpdateDateTimeUtc": "2017-12-04T13:06:23.4502191Z"
+ },
+ {
+ "fileIdentifier": "df708f0107c7cc75ba2e5aaadc88b8bcfa01071d",
+ "fileIdentifierType": "Sha1",
+ "actionType": "Block",
+ "fileStatus": "Blocked",
+ "creationDateTimeUtc": "2017-11-05T11:16:19.9209438Z",
+ "requestor": "Analyst@ contoso.com ",
+ "requestorComment": "1316",
+ "cancellationDateTimeUtc": null,
+ "cancellationRequestor": null,
+ "cancellationComment": null,
+ "lastUpdateDateTimeUtc": "2017-11-05T11:16:19.9209438Z"
+ },
+ {
+ "fileIdentifier": "f5bc0981641c8a1fb3ef03e4bf574d8adf7134cf",
+ "fileIdentifierType": "Sha1",
+ "actionType": "Block",
+ "fileStatus": "Blocked",
+ "creationDateTimeUtc": "2017-11-05T10:57:02.2430564Z",
+ "requestor": "Analyst@ contoso.com ",
+ "requestorComment": "test 1256 2017.11.05",
+ "cancellationDateTimeUtc": null,
+ "cancellationRequestor": null,
+ "cancellationComment": null,
+ "lastUpdateDateTimeUtc": "2017-11-05T10:57:02.2430564Z"
+ }
+ ]
+}
+
+```
diff --git a/windows/threat-protection/windows-defender-atp/get-filemachineaction-object-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/get-filemachineaction-object-windows-defender-advanced-threat-protection.md
new file mode 100644
index 0000000000..6d6d936711
--- /dev/null
+++ b/windows/threat-protection/windows-defender-atp/get-filemachineaction-object-windows-defender-advanced-threat-protection.md
@@ -0,0 +1,87 @@
+---
+title: Get FileMachineAction object API
+description: Use this API to create calls related to get machineaction object
+keywords: apis, graph api, supported apis, filemachineaction object
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: high
+ms.date: 12/08/2017
+---
+
+# Get FileMachineAction object API
+
+**Applies to:**
+
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
+Gets file and machine actions.
+
+## Permissions
+Users need to have Security administrator or Global admin directory roles.
+
+## HTTP request
+```
+GET /testwdatppreview/filemachineactions/{id}
+```
+
+## Request headers
+
+Header | Value
+:---|:---
+Authorization | Bearer {token}. **Required**.
+
+
+## Request body
+Empty
+
+## Response
+If successful, this method returns 200, Ok response code with the *FileMachineAction* object.
+
+
+## Example
+
+Request
+
+Here is an example of the request.
+
+```
+GET https://graph.microsoft.com/testwdatppreview/filemachineactions/3dc88ce3-dd0c-40f7-93fc-8bd14317aab6
+```
+
+Response
+
+Here is an example of the response.
+
+
+```
+HTTP/1.1 200 Ok
+Content-type: application/json
+{
+ "@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#FileMachineActions/$entity",
+ "id": "3dc88ce3-dd0c-40f7-93fc-8bd14317aab6",
+ "sha1": "8908b4441a2cd7285fe9c82917f69041cd467cf7",
+ "type": "StopAndQuarantineFile",
+ "requestor": "Analyst@contoso.com ",
+ "requestorComment": "1104",
+ "status": "Succeeded",
+ "fileId": "8908b4441a2cd7285fe9c82917f69041cd467cf7",
+ "machineId": "61a2d326d2190d048950406b54af23416118094a",
+ "creationDateTimeUtc": "2017-09-06T08:04:06.1994034Z",
+ "lastUpdateDateTimeUtc": "2017-09-06T08:05:46.9200942Z",
+ "fileInstances": [
+ {
+ "filePath": "C:\\tools\\PE\\7f06a650-040b-4774-bb39-5264ea9e93fa.exe",
+ "status": "Succeeded"
+ }
+ ]
+}
+
+
+```
diff --git a/windows/threat-protection/windows-defender-atp/get-filemachineactions-collection-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/get-filemachineactions-collection-windows-defender-advanced-threat-protection.md
new file mode 100644
index 0000000000..013b12118a
--- /dev/null
+++ b/windows/threat-protection/windows-defender-atp/get-filemachineactions-collection-windows-defender-advanced-threat-protection.md
@@ -0,0 +1,174 @@
+---
+title: Get FileMachineActions collection API
+description: Use this API to create calls related to get filemachineactions collection
+keywords: apis, graph api, supported apis, filemachineactions collection
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: high
+ms.date: 12/08/2017
+---
+
+# Get FileMachineActions collection API
+
+**Applies to:**
+
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
+Get collection of file and machine actions. Get FileMachineActions collection API supports OData V4 queries.
+
+## Permissions
+Users need to have Security administrator or Global admin directory roles.
+
+## HTTP request
+```
+GET /testwdatppreview/filemachineactions
+```
+
+## Request headers
+
+Header | Value
+:---|:---
+Authorization | Bearer {token}. **Required**.
+
+
+## Request body
+Empty
+
+## Response
+If successful, this method returns 200, Ok response code with a collection of FileMachineAction objects since the Retention policy time of the organization.
+
+
+## Example 1
+
+Request
+
+Here is an example of the request on an organization that has three FileMachineActions.
+
+```
+GET https://graph.microsoft.com/testwdatppreview/filemachineactions
+```
+
+Response
+
+Here is an example of the response.
+
+
+```
+HTTP/1.1 200 Ok
+Content-type: application/json
+{
+ "@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#FileActions",
+ "value": [
+ {
+ "fileIdentifier": "87662bc3d60e4200ceaf7aae249d1c343f4b83c9",
+ "fileIdentifierType": "Sha1",
+ "actionType": "Block",
+ "fileStatus": "Blocked",
+ "creationDateTimeUtc": "2017-12-04T13:06:23.4502191Z",
+ "requestor": "Analyst@ contoso.com ",
+ "requestorComment": "test",
+ "cancellationDateTimeUtc": null,
+ "cancellationRequestor": null,
+ "cancellationComment": null,
+ "lastUpdateDateTimeUtc": "2017-12-04T13:06:23.4502191Z"
+ },
+ {
+ "fileIdentifier": "df708f0107c7cc75ba2e5aaadc88b8bcfa01071d",
+ "fileIdentifierType": "Sha1",
+ "actionType": "Block",
+ "fileStatus": "Blocked",
+ "creationDateTimeUtc": "2017-11-05T11:16:19.9209438Z",
+ "requestor": "Analyst@contoso.com ",
+ "requestorComment": "1316",
+ "cancellationDateTimeUtc": null,
+ "cancellationRequestor": null,
+ "cancellationComment": null,
+ "lastUpdateDateTimeUtc": "2017-11-05T11:16:19.9209438Z"
+ },
+ {
+ "fileIdentifier": "f5bc0981641c8a1fb3ef03e4bf574d8adf7134cf",
+ "fileIdentifierType": "Sha1",
+ "actionType": "Block",
+ "fileStatus": "Blocked",
+ "creationDateTimeUtc": "2017-11-05T10:57:02.2430564Z",
+ "requestor": "Analyst@ contoso.com ",
+ "requestorComment": "test 1256 2017.11.05",
+ "cancellationDateTimeUtc": null,
+ "cancellationRequestor": null,
+ "cancellationComment": null,
+ "lastUpdateDateTimeUtc": "2017-11-05T10:57:02.2430564Z"
+ }
+ ]
+}
+
+
+```
+
+##Example 2
+
+Request
+
+Here is an example of a request that filters the FileMachineActions by machine ID and shows the latest two FileMachineActions.
+
+```
+GET https://graph.microsoft.com/testwdatppreview/filemachineactions?$filter=machineId eq 'f46b9bb259ed4a7fb9981b73510e3cc7aa81ec1f'&$top=2
+```
+
+Response
+
+```
+HTTP/1.1 200 Ok
+Content-type: application/json
+{
+ "@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#FileMachineActions",
+ "value": [
+ {
+ "id": "6f1d364c-680c-499a-b30c-dd9265ad4c9d",
+ "sha1": "87662bc3d60e4200ceaf7aae249d1c343f4b83c9",
+ "type": "StopAndQuarantineFile",
+ "requestor": "Analyst@ contoso.com ",
+ "requestorComment": "test",
+ "status": "Succeeded",
+ "fileId": "87662bc3d60e4200ceaf7aae249d1c343f4b83c9",
+ "machineId": "f46b9bb259ed4a7fb9981b73510e3cc7aa81ec1f",
+ "creationDateTimeUtc": "2017-12-04T13:13:26.2106524Z",
+ "lastUpdateDateTimeUtc": "2017-12-04T13:15:07.1639963Z",
+ "fileInstances": [
+ {
+ "filePath": "C:\\Users\\ testUser \\Downloads\\elma.exe",
+ "status": "Succeeded"
+ },
+ {
+ "filePath": "C:\\Users\\ testUser \\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\TempState\\Downloads\\elma (2).exe.xc9q785.partial",
+ "status": "Succeeded"
+ },
+ ]
+ },
+ {
+ "id": "c083f601-012f-4955-b4cc-fab50fb69d79",
+ "sha1": "8d25682b3a82af25b42dc90291c35ff3293daa68",
+ "type": "RequestSample",
+ "requestor": "Analyst@ contoso.com ",
+ "requestorComment": "test",
+ "status": "Succeeded",
+ "fileId": "8d25682b3a82af25b42dc90291c35ff3293daa68",
+ "machineId": "f46b9bb259ed4a7fb9981b73510e3cc7aa81ec1f",
+ "creationDateTimeUtc": "2017-12-04T13:39:24.9399004Z",
+ "lastUpdateDateTimeUtc": "2017-12-04T13:40:01.1094743Z",
+ "fileInstances": [
+ {
+ "filePath": "C:\\Windows\\System32\\conhost.exe",
+ "status": "Succeeded"
+ }
+ ]
+ }
+ ]
+}
+```
\ No newline at end of file
diff --git a/windows/threat-protection/windows-defender-atp/get-ip-related-alerts-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/get-ip-related-alerts-windows-defender-advanced-threat-protection.md
index e98f575d57..e390e5f56a 100644
--- a/windows/threat-protection/windows-defender-atp/get-ip-related-alerts-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/get-ip-related-alerts-windows-defender-advanced-threat-protection.md
@@ -10,10 +10,17 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 12/08/2017
---
-# Get IP related alerts
+# Get IP related alerts API
+
+**Applies to:**
+
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
Retrieves a collection of alerts related to a given IP address.
## Permissions
diff --git a/windows/threat-protection/windows-defender-atp/get-ip-related-machines-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/get-ip-related-machines-windows-defender-advanced-threat-protection.md
index 69e883df58..284901aa0d 100644
--- a/windows/threat-protection/windows-defender-atp/get-ip-related-machines-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/get-ip-related-machines-windows-defender-advanced-threat-protection.md
@@ -10,10 +10,10 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 12/08/2017
---
-# Get IP related machines
+# Get IP related machines API
Retrieves a collection of alerts related to a given IP address.
## Permissions
diff --git a/windows/threat-protection/windows-defender-atp/get-ip-statistics-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/get-ip-statistics-windows-defender-advanced-threat-protection.md
index a5f398316d..77c52c4e99 100644
--- a/windows/threat-protection/windows-defender-atp/get-ip-statistics-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/get-ip-statistics-windows-defender-advanced-threat-protection.md
@@ -10,10 +10,17 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 12/08/2017
---
-# Get IP statistics
+# Get IP statistics API
+
+**Applies to:**
+
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
Retrieves the prevalence for the given IP.
## Permissions
diff --git a/windows/threat-protection/windows-defender-atp/get-machine-by-id-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/get-machine-by-id-windows-defender-advanced-threat-protection.md
index 68308e5936..f9cd74d2b6 100644
--- a/windows/threat-protection/windows-defender-atp/get-machine-by-id-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/get-machine-by-id-windows-defender-advanced-threat-protection.md
@@ -10,10 +10,17 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 12/08/2017
---
-# Get machine by ID
+# Get machine by ID API
+
+**Applies to:**
+
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
Retrieves a machine entity by ID.
## Permissions
diff --git a/windows/threat-protection/windows-defender-atp/get-machine-log-on-users-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/get-machine-log-on-users-windows-defender-advanced-threat-protection.md
index c973e3b688..ebcdf50543 100644
--- a/windows/threat-protection/windows-defender-atp/get-machine-log-on-users-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/get-machine-log-on-users-windows-defender-advanced-threat-protection.md
@@ -10,10 +10,18 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 12/08/2017
---
-# Get machine log on users
+# Get machine log on users API
+
+**Applies to:**
+
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
+
Retrieves a collection of logged on users.
## Permissions
diff --git a/windows/threat-protection/windows-defender-atp/get-machine-related-alerts-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/get-machine-related-alerts-windows-defender-advanced-threat-protection.md
index 92fc5fc946..b5b335d796 100644
--- a/windows/threat-protection/windows-defender-atp/get-machine-related-alerts-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/get-machine-related-alerts-windows-defender-advanced-threat-protection.md
@@ -10,10 +10,17 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 12/08/2017
---
-# Get machine related alerts
+# Get machine related alerts API
+
+**Applies to:**
+
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
Retrieves a collection of alerts related to a given machine ID.
## Permissions
diff --git a/windows/threat-protection/windows-defender-atp/get-machineaction-object-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/get-machineaction-object-windows-defender-advanced-threat-protection.md
new file mode 100644
index 0000000000..f680ca3c8e
--- /dev/null
+++ b/windows/threat-protection/windows-defender-atp/get-machineaction-object-windows-defender-advanced-threat-protection.md
@@ -0,0 +1,80 @@
+---
+title: Get MachineAction object API
+description: Use this API to create calls related to get machineaction object
+keywords: apis, graph api, supported apis, machineaction object
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: high
+ms.date: 12/08/2017
+---
+
+# Get MachineAction object API
+
+**Applies to:**
+
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
+Get actions done on a machine.
+
+## Permissions
+Users need to have Security administrator or Global admin directory roles.
+
+## HTTP request
+```
+GET /testwdatppreview/machineactions/{id}
+```
+
+## Request headers
+
+Header | Value
+:---|:---
+Authorization | Bearer {token}. **Required**.
+
+
+## Request body
+Empty
+
+## Response
+If successful, this method returns 200, Ok response code with the *MachineAction* object.
+
+
+## Example
+
+Request
+
+Here is an example of the request.
+
+```
+GET https://graph.microsoft.com/testwdatppreview/machineactions/2e9da30d-27f6-4208-81f2-9cd3d67893ba
+```
+
+Response
+
+Here is an example of the response.
+
+
+```
+HTTP/1.1 200 Ok
+Content-type: application/json
+{
+ "@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#MachineActions/$entity",
+ "id": "2e9da30d-27f6-4208-81f2-9cd3d67893ba",
+ "type": "RunAntiVirusScan",
+ "requestor": "Analyst@contoso.com ",
+ "requestorComment": "Check machine for viruses due to alert 3212",
+ "status": "Succeeded",
+ "error": "None",
+ "machineId": "f46b9bb259ed4a7fb9981b73510e3cc7aa81ec1f",
+ "creationDateTimeUtc": "2017-12-04T12:18:27.1293487Z",
+ "lastUpdateTimeUtc": "2017-12-04T12:18:57.5511934Z"
+}
+
+
+```
diff --git a/windows/threat-protection/windows-defender-atp/get-machineactions-collection-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/get-machineactions-collection-windows-defender-advanced-threat-protection.md
new file mode 100644
index 0000000000..fd36945114
--- /dev/null
+++ b/windows/threat-protection/windows-defender-atp/get-machineactions-collection-windows-defender-advanced-threat-protection.md
@@ -0,0 +1,154 @@
+---
+title: Get MachineActions collection API
+description: Use this API to create calls related to get machineactions collection
+keywords: apis, graph api, supported apis, machineaction collection
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: high
+ms.date: 12/08/2017
+---
+
+# Get MachineActions collection API
+
+**Applies to:**
+
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
+ Gets collection of actions done on machines. Get MachineAction collection API supports OData V4 queries.
+
+## Permissions
+Users need to have Security administrator or Global admin directory roles.
+
+## HTTP request
+```
+GET /testwdatppreview/machineactions
+```
+
+## Request headers
+
+Header | Value
+:---|:---
+Authorization | Bearer {token}. **Required**.
+
+
+## Request body
+Empty
+
+## Response
+If successful, this method returns 200, Ok response code with a collection of MachineAction objects since the Retention policy time of the organization.
+
+
+## Example 1
+
+Request
+
+Here is an example of the request on an organization that has three MachineActions.
+
+```
+GET https://graph.microsoft.com/testwdatppreview/machineactions
+```
+
+Response
+
+Here is an example of the response.
+
+
+```
+HTTP/1.1 200 Ok
+Content-type: application/json
+{
+ "@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#MachineActions",
+ "value": [
+ {
+ "id": "69dc3630-1ccc-4342-acf3-35286eec741d",
+ "type": "CollectInvestigationPackage",
+ "requestor": "Analyst@ contoso.com ",
+ "requestorComment": "test",
+ "status": "Succeeded",
+ "error": "None",
+ "machineId": "f46b9bb259ed4a7fb9981b73510e3cc7aa81ec1f",
+ "creationDateTimeUtc": "2017-12-04T12:43:57.2011911Z",
+ "lastUpdateTimeUtc": "2017-12-04T12:45:25.4049122Z"
+ },
+ {
+ "id": "2e9da30d-27f6-4208-81f2-9cd3d67893ba",
+ "type": "RunAntiVirusScan",
+ "requestor": "Analyst@ contoso.com ",
+ "requestorComment": "Check machine for viruses due to alert 3212",
+ "status": "Succeeded",
+ "error": "None",
+ "machineId": "f46b9bb259ed4a7fb9981b73510e3cc7aa81ec1f",
+ "creationDateTimeUtc": "2017-12-04T12:18:27.1293487Z",
+ "lastUpdateTimeUtc": "2017-12-04T12:18:57.5511934Z"
+ },
+ {
+ "id": "44cffc15-0e3d-4cbf-96aa-bf76f9b27f5e",
+ "type": "UnrestrictCodeExecution",
+ "requestor": "Analyst@ contoso.com ",
+ "requestorComment": "test",
+ "status": "Succeeded",
+ "error": "None",
+ "machineId": "f46b9bb259ed4a7fb9981b73510e3cc7aa81ec1f",
+ "creationDateTimeUtc": "2017-12-04T12:15:40.6052029Z",
+ "lastUpdateTimeUtc": "2017-12-04T12:16:14.2899973Z"
+ }
+ ]
+}
+
+
+```
+
+## Example 2
+
+Request
+
+Here is an example of a request that filters the MachineActions by machine ID and shows the latest two MachineActions.
+
+```
+GET https://graph.microsoft.com/testwdatppreview/machineactions?$filter=machineId eq 'f46b9bb259ed4a7fb9981b73510e3cc7aa81ec1f'&$top=2
+```
+
+
+
+Response
+
+Here is an example of the response.
+
+```
+HTTP/1.1 200 Ok
+Content-type: application/json
+{
+ "@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#MachineActions",
+ "value": [
+ {
+ "id": "69dc3630-1ccc-4342-acf3-35286eec741d",
+ "type": "CollectInvestigationPackage",
+ "requestor": "Analyst@contoso.com ",
+ "requestorComment": "test",
+ "status": "Succeeded",
+ "error": "None",
+ "machineId": "f46b9bb259ed4a7fb9981b73510e3cc7aa81ec1f",
+ "creationDateTimeUtc": "2017-12-04T12:43:57.2011911Z",
+ "lastUpdateTimeUtc": "2017-12-04T12:45:25.4049122Z"
+ },
+ {
+ "id": "2e9da30d-27f6-4208-81f2-9cd3d67893ba",
+ "type": "RunAntiVirusScan",
+ "requestor": "Analyst@ contoso.com ",
+ "requestorComment": "Check machine for viruses due to alert 3212",
+ "status": "Succeeded",
+ "error": "None",
+ "machineId": "f46b9bb259ed4a7fb9981b73510e3cc7aa81ec1f",
+ "creationDateTimeUtc": "2017-12-04T12:18:27.1293487Z",
+ "lastUpdateTimeUtc": "2017-12-04T12:18:57.5511934Z"
+ }
+ ]
+}
+```
diff --git a/windows/threat-protection/windows-defender-atp/get-machines-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/get-machines-windows-defender-advanced-threat-protection.md
index c3006c0f0b..c446711e57 100644
--- a/windows/threat-protection/windows-defender-atp/get-machines-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/get-machines-windows-defender-advanced-threat-protection.md
@@ -10,10 +10,17 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 12/08/2017
---
-# Get machines
+# Get machines API
+
+**Applies to:**
+
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
Retrieves a collection of recently seen machines.
## Permissions
diff --git a/windows/threat-protection/windows-defender-atp/get-package-sas-uri-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/get-package-sas-uri-windows-defender-advanced-threat-protection.md
new file mode 100644
index 0000000000..def484c73a
--- /dev/null
+++ b/windows/threat-protection/windows-defender-atp/get-package-sas-uri-windows-defender-advanced-threat-protection.md
@@ -0,0 +1,75 @@
+---
+title: Get package SAS URI API
+description: Use this API to get a URI that allows downloading an investigation package.
+keywords: apis, graph api, supported apis, get package, sas, uri
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: high
+ms.date: 12/08/2017
+---
+
+# Get package SAS URI API
+
+**Applies to:**
+
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
+Get a URI that allows downloading of an investigation package.
+
+## Permissions
+Users need to have Security administrator or Global admin directory roles.
+
+## HTTP request
+```
+POST /testwdatppreview/machineactions/{id}/getPackageUri
+```
+
+## Request headers
+
+Header | Value
+:---|:---
+Authorization | Bearer {token}. **Required**.
+Content-Type | application/json
+
+
+## Request body
+Empty
+
+## Response
+If successful, this method returns 200, Ok response code with object that holds the link to the package in the “value” parameter. This link is valid for a very short time and should be used immediately for downloading the package to a local storage.
+
+
+## Example
+
+Request
+
+Here is an example of the request.
+
+```
+GET https://graph.microsoft.com/testwdatppreview/machineactions/7327b54fd718525cbca07dacde913b5ac3c85673/GetPackageUri
+
+```
+
+Response
+
+Here is an example of the response.
+
+
+```
+HTTP/1.1 200 Ok
+Content-type: application/json
+
+{
+ "@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#Edm.String",
+ "value": "\"https://userrequests-us.securitycenter.windows.com:443/safedownload/WDATP_Investigation_Package.zip?token=gbDyj7y%2fbWGAZjn2sFiZXlliBTXOCVG7yiJ6mXNaQ9pLByC2Wxeno9mENsPFP3xMk5l%2bZiJXjLvqAyNEzUNROxoM2I1er9dxzfVeBsxSmclJjPsAx%2btiNyxSz1Ax%2b5jaT5cL5bZg%2b8wgbwY9urXbTpGjAKh6FB1e%2b0ypcWkPm8UkfOwsmtC%2biZJ2%2bPqnkkeQk7SKMNoAvmh9%2fcqDIPKXGIBjMa0D9auzypOqd8bQXp7p2BnLSH136BxST8n9IHR4PILvRjAYW9kvtHkBpBitfydAsUW4g2oDZSPN3kCLBOoo1C4w4Lkc9Bc3GNU2IW6dfB7SHcp7G9p4BDkeJl3VuDs6esCaeBorpn9FKJ%2fXo7o9pdcI0hUPZ6Ds9hiPpwPUtz5J29CBE3QAopCK%2fsWlf6OW2WyXsrNRSnF1tVE5H3wXpREzuhD7S4AIA3OIEZKzC4jIPLeMu%2bazZU9xGwuc3gICOaokbwMJiZTqcUuK%2fV9YdBdjdg8wJ16NDU96Pl6%2fgew2KYuk6Wo7ZuHotgHI1abcsvdlpe4AvixDbqcRJthsg2PpLRaFLm5av44UGkeK6TJpFvxUn%2f9fg6Zk5yM1KUTHb8XGmutoCM8U9er6AzXZlY0gGc3D3bQOg41EJZkEZLyUEbk1hXJB36ku2%2bW01cG71t7MxMBYz7%2bdXobxpdo%3d%3bRWS%2bCeoDfTyDcfH5pkCg6hYDmCOPr%2fHYQuaUWUBNVnXURYkdyOzVHqp%2fe%2f1BNyPdVoVkpQHpz1pPS3b5g9h7IMmNKCk5gFq5m2nPx6kk9EYtzx8Ndoa2m9Yj%2bSaf8zIFke86YnfQL4AYewsnQNJJh4wc%2bXxGlBq7axDcoiOdX91rKzVicH3GSBkFoLFAKoegWWsF%2fEDZcVpF%2fXUA1K8HvB6dwyfy4y0sAqnNPxYTQ97mG7yHhxPt4Pe9YF2UPPAJVuEf8LNlQ%2bWHC9%2f7msF6UUI4%2fca%2ftpjFs%2fSNeRE8%2fyQj21TI8YTF1SowvaJuDc1ivEoeopNNGG%2bGI%2fX0SckaVxU9Hdkh0zbydSlT5SZwbSwescs0IpzECitBbaLUz4aT8KTs8T0lvx8D7Te3wVsKAJ1r3iFMQZrlk%2bS1WW8rvac7oHRx2HKURn1v7fDIQWgJr9aNsNlFz4fLJ50T2qSHuuepkLVbe93Va072aMGhvr09WVKoTpAf1j2bcFZZU6Za5PxI32mr0k90FgiYFJ1F%2f1vRDrGwvWVWUkR3Z33m4g0gHa52W1FMxQY0TJIwbovD6FaSNDx7xhKZSd5IJ7r6P91Gez49PaZRcAZPjd%2bfbul3JNm1VqQPTLohT7wa0ymRiXpSST74xtFzuEBzNSNATdbngj3%2fwV4JesTjZjIj5Dc%3d%3blumqauVlFuuO8MQffZgs0tLJ4Fq6fpeozPTdDf8Ll6XLegi079%2b4mSPFjTK0y6eohstxdoOdom2wAHiZwk0u4KLKmRkfYOdT1wHY79qKoBQ3ZDHFTys9V%2fcwKGl%2bl8IenWDutHygn5IcA1y7GTZj4g%3d%3d\""
+}
+
+
+```
diff --git a/windows/threat-protection/windows-defender-atp/get-user-information-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/get-user-information-windows-defender-advanced-threat-protection.md
index 77b3f3d49b..825ff7a13f 100644
--- a/windows/threat-protection/windows-defender-atp/get-user-information-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/get-user-information-windows-defender-advanced-threat-protection.md
@@ -10,10 +10,17 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 12/08/2017
---
-# Get user information
+# Get user information API
+
+**Applies to:**
+
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
Retrieve a User entity by key (user name or domain\user).
## Permissions
diff --git a/windows/threat-protection/windows-defender-atp/get-user-related-alerts-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/get-user-related-alerts-windows-defender-advanced-threat-protection.md
index 84eb273e6d..7d3c12a300 100644
--- a/windows/threat-protection/windows-defender-atp/get-user-related-alerts-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/get-user-related-alerts-windows-defender-advanced-threat-protection.md
@@ -10,10 +10,17 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 12/08/2017
---
-# Get user related alerts
+# Get user related alerts API
+
+**Applies to:**
+
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
Retrieves a collection of alerts related to a given user ID.
## Permissions
diff --git a/windows/threat-protection/windows-defender-atp/get-user-related-machines-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/get-user-related-machines-windows-defender-advanced-threat-protection.md
index 3ac3929e17..779624c483 100644
--- a/windows/threat-protection/windows-defender-atp/get-user-related-machines-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/get-user-related-machines-windows-defender-advanced-threat-protection.md
@@ -10,10 +10,17 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 12/08/2017
---
-# Get user related machines
+# Get user related machines API
+
+**Applies to:**
+
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
Retrieves a collection of machines related to a given user ID.
## Permissions
diff --git a/windows/threat-protection/windows-defender-atp/images/alerts-q-bulk.png b/windows/threat-protection/windows-defender-atp/images/alerts-q-bulk.png
index 6849bcd582..4a2c0fa98e 100644
Binary files a/windows/threat-protection/windows-defender-atp/images/alerts-q-bulk.png and b/windows/threat-protection/windows-defender-atp/images/alerts-q-bulk.png differ
diff --git a/windows/threat-protection/windows-defender-atp/images/atp-alert-details.png b/windows/threat-protection/windows-defender-atp/images/atp-alert-details.png
index d3f3d68920..89fd66df5f 100644
Binary files a/windows/threat-protection/windows-defender-atp/images/atp-alert-details.png and b/windows/threat-protection/windows-defender-atp/images/atp-alert-details.png differ
diff --git a/windows/threat-protection/windows-defender-atp/images/atp-alert-page.png b/windows/threat-protection/windows-defender-atp/images/atp-alert-page.png
index a077b3eaef..379423a53a 100644
Binary files a/windows/threat-protection/windows-defender-atp/images/atp-alert-page.png and b/windows/threat-protection/windows-defender-atp/images/atp-alert-page.png differ
diff --git a/windows/threat-protection/windows-defender-atp/images/atp-alerts-queue-user.png b/windows/threat-protection/windows-defender-atp/images/atp-alerts-queue-user.png
index d1c0c571f4..745712f857 100644
Binary files a/windows/threat-protection/windows-defender-atp/images/atp-alerts-queue-user.png and b/windows/threat-protection/windows-defender-atp/images/atp-alerts-queue-user.png differ
diff --git a/windows/threat-protection/windows-defender-atp/images/atp-alerts-selected.png b/windows/threat-protection/windows-defender-atp/images/atp-alerts-selected.png
index e644d84f5c..eaacfa5256 100644
Binary files a/windows/threat-protection/windows-defender-atp/images/atp-alerts-selected.png and b/windows/threat-protection/windows-defender-atp/images/atp-alerts-selected.png differ
diff --git a/windows/threat-protection/windows-defender-atp/images/atp-alertsq2.png b/windows/threat-protection/windows-defender-atp/images/atp-alertsq2.png
index 811e554851..a2960ce201 100644
Binary files a/windows/threat-protection/windows-defender-atp/images/atp-alertsq2.png and b/windows/threat-protection/windows-defender-atp/images/atp-alertsq2.png differ
diff --git a/windows/threat-protection/windows-defender-atp/images/atp-create-dashboard.png b/windows/threat-protection/windows-defender-atp/images/atp-create-dashboard.png
index 0797d7527e..1918a2064d 100644
Binary files a/windows/threat-protection/windows-defender-atp/images/atp-create-dashboard.png and b/windows/threat-protection/windows-defender-atp/images/atp-create-dashboard.png differ
diff --git a/windows/threat-protection/windows-defender-atp/images/atp-dashboard-security-analytics-full.png b/windows/threat-protection/windows-defender-atp/images/atp-dashboard-security-analytics-full.png
index 4005404aff..2c44e15d09 100644
Binary files a/windows/threat-protection/windows-defender-atp/images/atp-dashboard-security-analytics-full.png and b/windows/threat-protection/windows-defender-atp/images/atp-dashboard-security-analytics-full.png differ
diff --git a/windows/threat-protection/windows-defender-atp/images/atp-download-connector.png b/windows/threat-protection/windows-defender-atp/images/atp-download-connector.png
index 5c6fbe3a1f..9405ae0d6e 100644
Binary files a/windows/threat-protection/windows-defender-atp/images/atp-download-connector.png and b/windows/threat-protection/windows-defender-atp/images/atp-download-connector.png differ
diff --git a/windows/threat-protection/windows-defender-atp/images/atp-enable-security-analytics.png b/windows/threat-protection/windows-defender-atp/images/atp-enable-security-analytics.png
index a51dd8d30a..1fa1650882 100644
Binary files a/windows/threat-protection/windows-defender-atp/images/atp-enable-security-analytics.png and b/windows/threat-protection/windows-defender-atp/images/atp-enable-security-analytics.png differ
diff --git a/windows/threat-protection/windows-defender-atp/images/atp-file-action.png b/windows/threat-protection/windows-defender-atp/images/atp-file-action.png
index 106329f89e..5982447692 100644
Binary files a/windows/threat-protection/windows-defender-atp/images/atp-file-action.png and b/windows/threat-protection/windows-defender-atp/images/atp-file-action.png differ
diff --git a/windows/threat-protection/windows-defender-atp/images/atp-machine-details-view.png b/windows/threat-protection/windows-defender-atp/images/atp-machine-details-view.png
index 674f388e5d..6a005352c5 100644
Binary files a/windows/threat-protection/windows-defender-atp/images/atp-machine-details-view.png and b/windows/threat-protection/windows-defender-atp/images/atp-machine-details-view.png differ
diff --git a/windows/threat-protection/windows-defender-atp/images/atp-machine-timeline-details-panel.png b/windows/threat-protection/windows-defender-atp/images/atp-machine-timeline-details-panel.png
index 1d0a60dc13..b5dee50cd9 100644
Binary files a/windows/threat-protection/windows-defender-atp/images/atp-machine-timeline-details-panel.png and b/windows/threat-protection/windows-defender-atp/images/atp-machine-timeline-details-panel.png differ
diff --git a/windows/threat-protection/windows-defender-atp/images/atp-machine-timeline-export.png b/windows/threat-protection/windows-defender-atp/images/atp-machine-timeline-export.png
index 80fc5d0f56..0be9abed27 100644
Binary files a/windows/threat-protection/windows-defender-atp/images/atp-machine-timeline-export.png and b/windows/threat-protection/windows-defender-atp/images/atp-machine-timeline-export.png differ
diff --git a/windows/threat-protection/windows-defender-atp/images/atp-machine-timeline-filter.png b/windows/threat-protection/windows-defender-atp/images/atp-machine-timeline-filter.png
index 752b6c0426..8047e53b44 100644
Binary files a/windows/threat-protection/windows-defender-atp/images/atp-machine-timeline-filter.png and b/windows/threat-protection/windows-defender-atp/images/atp-machine-timeline-filter.png differ
diff --git a/windows/threat-protection/windows-defender-atp/images/atp-machines-list-view.png b/windows/threat-protection/windows-defender-atp/images/atp-machines-list-view.png
index 3c1c653dd1..6145c08a4c 100644
Binary files a/windows/threat-protection/windows-defender-atp/images/atp-machines-list-view.png and b/windows/threat-protection/windows-defender-atp/images/atp-machines-list-view.png differ
diff --git a/windows/threat-protection/windows-defender-atp/images/atp-mapping5.png b/windows/threat-protection/windows-defender-atp/images/atp-mapping5.png
index 9279e1eb89..c405166f01 100644
Binary files a/windows/threat-protection/windows-defender-atp/images/atp-mapping5.png and b/windows/threat-protection/windows-defender-atp/images/atp-mapping5.png differ
diff --git a/windows/threat-protection/windows-defender-atp/images/atp-mdm-onboarding-package.png b/windows/threat-protection/windows-defender-atp/images/atp-mdm-onboarding-package.png
index 468deeecad..d8d2aea802 100644
Binary files a/windows/threat-protection/windows-defender-atp/images/atp-mdm-onboarding-package.png and b/windows/threat-protection/windows-defender-atp/images/atp-mdm-onboarding-package.png differ
diff --git a/windows/threat-protection/windows-defender-atp/images/atp-mma-properties.png b/windows/threat-protection/windows-defender-atp/images/atp-mma-properties.png
new file mode 100644
index 0000000000..bf34e1b075
Binary files /dev/null and b/windows/threat-protection/windows-defender-atp/images/atp-mma-properties.png differ
diff --git a/windows/threat-protection/windows-defender-atp/images/atp-onboard-endpoints-WDATP-portal.png b/windows/threat-protection/windows-defender-atp/images/atp-onboard-endpoints-WDATP-portal.png
index 83e81a51cd..a0c18757a8 100644
Binary files a/windows/threat-protection/windows-defender-atp/images/atp-onboard-endpoints-WDATP-portal.png and b/windows/threat-protection/windows-defender-atp/images/atp-onboard-endpoints-WDATP-portal.png differ
diff --git a/windows/threat-protection/windows-defender-atp/images/atp-portal.png b/windows/threat-protection/windows-defender-atp/images/atp-portal.png
index 742b8deb22..0dc5215ce4 100644
Binary files a/windows/threat-protection/windows-defender-atp/images/atp-portal.png and b/windows/threat-protection/windows-defender-atp/images/atp-portal.png differ
diff --git a/windows/threat-protection/windows-defender-atp/images/atp-preferences-setup.png b/windows/threat-protection/windows-defender-atp/images/atp-preferences-setup.png
index 44c06d3b66..74b6e5fae6 100644
Binary files a/windows/threat-protection/windows-defender-atp/images/atp-preferences-setup.png and b/windows/threat-protection/windows-defender-atp/images/atp-preferences-setup.png differ
diff --git a/windows/threat-protection/windows-defender-atp/images/atp-preview-features.png b/windows/threat-protection/windows-defender-atp/images/atp-preview-features.png
index aeae7b6a42..0908f75e43 100644
Binary files a/windows/threat-protection/windows-defender-atp/images/atp-preview-features.png and b/windows/threat-protection/windows-defender-atp/images/atp-preview-features.png differ
diff --git a/windows/threat-protection/windows-defender-atp/images/atp-security-analytics-view-machines2.png b/windows/threat-protection/windows-defender-atp/images/atp-security-analytics-view-machines2.png
index 627d376ba2..20e5f4f5fa 100644
Binary files a/windows/threat-protection/windows-defender-atp/images/atp-security-analytics-view-machines2.png and b/windows/threat-protection/windows-defender-atp/images/atp-security-analytics-view-machines2.png differ
diff --git a/windows/threat-protection/windows-defender-atp/images/atp-services.png b/windows/threat-protection/windows-defender-atp/images/atp-services.png
new file mode 100644
index 0000000000..8d9b11ab1b
Binary files /dev/null and b/windows/threat-protection/windows-defender-atp/images/atp-services.png differ
diff --git a/windows/threat-protection/windows-defender-atp/images/atp-siem-integration.png b/windows/threat-protection/windows-defender-atp/images/atp-siem-integration.png
index 493b64b828..2ce7dbc637 100644
Binary files a/windows/threat-protection/windows-defender-atp/images/atp-siem-integration.png and b/windows/threat-protection/windows-defender-atp/images/atp-siem-integration.png differ
diff --git a/windows/threat-protection/windows-defender-atp/images/atp-task-manager.png b/windows/threat-protection/windows-defender-atp/images/atp-task-manager.png
new file mode 100644
index 0000000000..4c4e057756
Binary files /dev/null and b/windows/threat-protection/windows-defender-atp/images/atp-task-manager.png differ
diff --git a/windows/threat-protection/windows-defender-atp/images/atp-threat-intel-api.png b/windows/threat-protection/windows-defender-atp/images/atp-threat-intel-api.png
index 3eece11ebd..70a7ce9fee 100644
Binary files a/windows/threat-protection/windows-defender-atp/images/atp-threat-intel-api.png and b/windows/threat-protection/windows-defender-atp/images/atp-threat-intel-api.png differ
diff --git a/windows/threat-protection/windows-defender-atp/images/atp-user-details-view-tdp.png b/windows/threat-protection/windows-defender-atp/images/atp-user-details-view-tdp.png
index b0732653d6..8822bdf62d 100644
Binary files a/windows/threat-protection/windows-defender-atp/images/atp-user-details-view-tdp.png and b/windows/threat-protection/windows-defender-atp/images/atp-user-details-view-tdp.png differ
diff --git a/windows/threat-protection/windows-defender-atp/images/atp-user-details.png b/windows/threat-protection/windows-defender-atp/images/atp-user-details.png
index 4a7a82d003..eb1366d9cb 100644
Binary files a/windows/threat-protection/windows-defender-atp/images/atp-user-details.png and b/windows/threat-protection/windows-defender-atp/images/atp-user-details.png differ
diff --git a/windows/threat-protection/windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md
index 804852f8a8..b4fae526ee 100644
--- a/windows/threat-protection/windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 10/16/2017
---
# Investigate Windows Defender Advanced Threat Protection alerts
diff --git a/windows/threat-protection/windows-defender-atp/investigate-domain-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/investigate-domain-windows-defender-advanced-threat-protection.md
index e92155911a..f4f611b986 100644
--- a/windows/threat-protection/windows-defender-atp/investigate-domain-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/investigate-domain-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 10/16/2017
---
# Investigate a domain associated with a Windows Defender ATP alert
diff --git a/windows/threat-protection/windows-defender-atp/investigate-files-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/investigate-files-windows-defender-advanced-threat-protection.md
index 809e147a03..df24b9a27b 100644
--- a/windows/threat-protection/windows-defender-atp/investigate-files-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/investigate-files-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 10/16/2017
---
# Investigate a file associated with a Windows Defender ATP alert
@@ -55,7 +55,7 @@ The **File in organization** section provides details on the prevalence of the f
-## Most recent observed machinew with the file
+## Most recent observed machines with the file
The **Most recent observed machines with the file** section allows you to specify a date range to see which machines have been observed with the file.
diff --git a/windows/threat-protection/windows-defender-atp/investigate-ip-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/investigate-ip-windows-defender-advanced-threat-protection.md
index b2f993d4d2..01828ef7ff 100644
--- a/windows/threat-protection/windows-defender-atp/investigate-ip-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/investigate-ip-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 10/16/2017
---
# Investigate an IP address associated with a Windows Defender ATP alert
diff --git a/windows/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md
index 43552b2d21..e9940d0a2b 100644
--- a/windows/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 10/16/2017
---
# Investigate machines in the Windows Defender ATP Machines list
diff --git a/windows/threat-protection/windows-defender-atp/investigate-user-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/investigate-user-windows-defender-advanced-threat-protection.md
index a23a1b8c1c..7d166a4ede 100644
--- a/windows/threat-protection/windows-defender-atp/investigate-user-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/investigate-user-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 10/16/2017
---
# Investigate a user account in Windows Defender ATP
diff --git a/windows/threat-protection/windows-defender-atp/is-domain-seen-in-org-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/is-domain-seen-in-org-windows-defender-advanced-threat-protection.md
index f5d740c1f2..c2e2c9f696 100644
--- a/windows/threat-protection/windows-defender-atp/is-domain-seen-in-org-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/is-domain-seen-in-org-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 10/16/2017
---
# Is domain seen in org
diff --git a/windows/threat-protection/windows-defender-atp/is-ip-seen-org-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/is-ip-seen-org-windows-defender-advanced-threat-protection.md
index 04d0ad5900..a203295bcd 100644
--- a/windows/threat-protection/windows-defender-atp/is-ip-seen-org-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/is-ip-seen-org-windows-defender-advanced-threat-protection.md
@@ -10,10 +10,17 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 12/08/2017
---
# Is IP seen in org
+
+**Applies to:**
+
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
Answers whether an IP was seen in the organization.
## Permissions
diff --git a/windows/threat-protection/windows-defender-atp/isolate-machine-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/isolate-machine-windows-defender-advanced-threat-protection.md
new file mode 100644
index 0000000000..506bb47499
--- /dev/null
+++ b/windows/threat-protection/windows-defender-atp/isolate-machine-windows-defender-advanced-threat-protection.md
@@ -0,0 +1,96 @@
+---
+title: Isolate machine API
+description: Use this API to create calls related isolating a machine.
+keywords: apis, graph api, supported apis, isolate machine
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: high
+ms.date: 12/08/2017
+---
+
+# Isolate machine API
+
+**Applies to:**
+
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
+Isolates a machine from accessing external network.
+
+## Permissions
+Users need to have Security administrator or Global admin directory roles.
+
+## HTTP request
+```
+POST /testwdatppreview/machines/{id}/isolate
+```
+
+## Request headers
+
+Header | Value
+:---|:---
+Authorization | Bearer {token}. **Required**.
+Content-Type | application/json
+
+## Request body
+In the request body, supply a JSON object with the following parameters:
+
+Parameter | Type | Description
+:---|:---|:---
+Comment | String | Comment to associate with the action. **Required**.
+IsolationType | IsolationType | Full or selective isolation
+
+**IsolationType** controls the type of isolation to perform and can be one of the following:
+- Full – Full isolation
+- Selective – Restrict only limited set of applications from accessing the network
+
+
+## Response
+If successful, this method returns 201, Created response code and _MachineAction_ object in the response body.
+
+
+## Example
+
+Request
+
+Here is an example of the request.
+
+```
+POST https://graph.microsoft.com/testwdatppreview/machines/fb9ab6be3965095a09c057be7c90f0a2/isolate
+Content-type: application/json
+{
+ "Comment": "Isolate machine due to alert 1234",
+ “IsolationType”: “Full”
+}
+
+```
+Response
+
+Here is an example of the response.
+
+>[!NOTE]
+>The response object shown here may be truncated for brevity. All of the properties will be returned from an actual call.
+
+```
+HTTP/1.1 201 Created
+Content-type: application/json
+{
+ "@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#MachineActions/$entity",
+ "id": "b89eb834-4578-496c-8be0-03f004061435",
+ "type": "Isolate",
+ "requestor": "Analyst@contoso.com ",
+ "requestorComment": "Isolate machine due to alert 1234",
+ "status": "InProgress",
+ "error": "None",
+ "machineId": "f46b9bb259ed4a7fb9981b73510e3cc7aa81ec1f",
+ "creationDateTimeUtc": "2017-12-04T12:12:18.9725659Z",
+ "lastUpdateTimeUtc": "2017-12-04T12:12:18.9725659Z"
+}
+
+```
diff --git a/windows/threat-protection/windows-defender-atp/licensing-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/licensing-windows-defender-advanced-threat-protection.md
index 02ed4731ee..4e8281d86e 100644
--- a/windows/threat-protection/windows-defender-atp/licensing-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/licensing-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: v-tanewt
author: tbit0001
ms.localizationpriority: high
-ms.date: 09/10/2017
+ms.date: 10/16/2017
---
# Validate licensing provisioning and complete set up for Windows Defender ATP
diff --git a/windows/threat-protection/windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection.md
index 677abeba7e..4c24bf012f 100644
--- a/windows/threat-protection/windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 10/23/2017
---
# View and organize the Windows Defender ATP Machines list
diff --git a/windows/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md
index 713b6e43f7..496720c009 100644
--- a/windows/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 10/16/2017
---
# Manage Windows Defender Advanced Threat Protection alerts
diff --git a/windows/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md
index e8200e9584..3027bbe7f9 100644
--- a/windows/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 11/17/2017
---
# Minimum requirements for Windows Defender ATP
@@ -72,13 +72,14 @@ The Windows Defender ATP sensor can utilize up to 5MB daily of bandwidth to com
For more information on additional proxy configuration settings see, [Configure Windows Defender ATP endpoint proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) .
-Before you configure endpoints, the telemetry and diagnostics service must be enabled. The service is enabled by default in Windows 10.
+Before you configure endpoints, the diagnostic data service must be enabled. The service is enabled by default in Windows 10.
-### Telemetry and diagnostics settings
-You must ensure that the telemetry and diagnostics service is enabled on all the endpoints in your organization.
+
+### Diagnostic data settings
+You must ensure that the diagnostic data service is enabled on all the endpoints in your organization.
By default, this service is enabled, but it's good practice to check to ensure that you'll get sensor data from them.
-**Use the command line to check the Windows 10 telemetry and diagnostics service startup type**:
+**Use the command line to check the Windows 10 diagnostic data service startup type**:
1. Open an elevated command-line prompt on the endpoint:
@@ -100,7 +101,7 @@ If the **START_TYPE** is not set to **AUTO_START**, then you'll need to set the
-**Use the command line to set the Windows 10 telemetry and diagnostics service to automatically start:**
+**Use the command line to set the Windows 10 diagnostic data service to automatically start:**
1. Open an elevated command-line prompt on the endpoint:
diff --git a/windows/threat-protection/windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection.md
index 0daa0c343a..17df4fab03 100644
--- a/windows/threat-protection/windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 11/21/2017
---
# Onboard and set up Windows Defender Advanced Threat Protection
diff --git a/windows/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md
index 138ed7ae40..adef15a6bb 100644
--- a/windows/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md
@@ -57,6 +57,7 @@ Area | Description
**Service health** | Provides information on the current status of the Window Defender ATP service. You'll be able to verify that the service health is healthy or if there are current issues.
**Preferences setup** | Shows the settings you selected during onboarding and lets you update your industry preferences and retention policy period. You can also set other configuration settings such as email notifications, activate the preview experience, enable or turn off advanced features, SIEM integration, threat intel API, build Power BI reports, and set baselines for the Security analytics dashboard.
**Endpoint management** | Provides access to endpoints such as clients and servers. Allows you to download the onboarding configuration package for endpoints. It also provides access to endpoint offboarding.
+**Community center** | Access the Community center to learn, collaborate, and share experiences about the product.
(2) Main portal| Main area where you will see the different views such as the Dashboards, Alerts queue, and Machines list.
(3) Search bar, Feedback, Settings, Help and support | **Search** - Provides access to the search bar where you can search for file, IP, machine, URL, and user. Displays the Search box: the drop-down list allows you to select the entity type and then enter the search query text. **Feedback** - Access the feedback button to provide comments about the portal. **Settings** - Gives you access to the configuration settings where you can set time zones and view license information. **Help and support** - Gives you access to the Windows Defender ATP guide, Microsoft support, and Premier support.
diff --git a/windows/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md
index 6a11d162cc..9f71bafa2b 100644
--- a/windows/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md
@@ -9,7 +9,7 @@ ms.sitesec: library
ms.pagetype: security
author: mjcaparas
localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 10/23/2017
---
# Create and build Power BI reports using Windows Defender ATP data
diff --git a/windows/threat-protection/windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection.md
index 6f6ffb301b..38a4ba668d 100644
--- a/windows/threat-protection/windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 10/16/2017
---
# PowerShell code examples for the custom threat intelligence API
diff --git a/windows/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection.md
index 8da98842db..a21cd910cd 100644
--- a/windows/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 10/16/2017
---
# Configure Windows Defender ATP preferences settings
diff --git a/windows/threat-protection/windows-defender-atp/prerelease.md b/windows/threat-protection/windows-defender-atp/prerelease.md
index 315e4f96d8..c910af7f12 100644
--- a/windows/threat-protection/windows-defender-atp/prerelease.md
+++ b/windows/threat-protection/windows-defender-atp/prerelease.md
@@ -1,3 +1,6 @@
+---
+ms.date: 08/28/2017
+---
>[!IMPORTANT]
>Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
\ No newline at end of file
diff --git a/windows/threat-protection/windows-defender-atp/preview-settings-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/preview-settings-windows-defender-advanced-threat-protection.md
index 6cb826c966..b6de75210b 100644
--- a/windows/threat-protection/windows-defender-atp/preview-settings-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/preview-settings-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 10/16/2017
---
# Turn on the preview experience in Windows Defender ATP
diff --git a/windows/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md
index d6331e520b..a05e77c9a2 100644
--- a/windows/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 11/30/2017
---
# Windows Defender ATP preview features
diff --git a/windows/threat-protection/windows-defender-atp/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md
index 3b35025ce9..82d802c5f9 100644
--- a/windows/threat-protection/windows-defender-atp/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 10/16/2017
---
# Pull Windows Defender ATP alerts using REST API
diff --git a/windows/threat-protection/windows-defender-atp/python-example-code-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/python-example-code-windows-defender-advanced-threat-protection.md
index 0ca06b1365..b3bcae08b4 100644
--- a/windows/threat-protection/windows-defender-atp/python-example-code-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/python-example-code-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 10/16/2017
---
# Python code examples for the custom threat intelligence API
diff --git a/windows/threat-protection/windows-defender-atp/request-sample-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/request-sample-windows-defender-advanced-threat-protection.md
new file mode 100644
index 0000000000..2a6bf80ab0
--- /dev/null
+++ b/windows/threat-protection/windows-defender-atp/request-sample-windows-defender-advanced-threat-protection.md
@@ -0,0 +1,99 @@
+---
+title: Request sample API
+description: Use this API to create calls related to requesting a sample from a machine.
+keywords: apis, graph api, supported apis, request sample
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: high
+ms.date: 12/08/2017
+---
+
+# Request sample API
+
+**Applies to:**
+
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
+Request sample of a file from a specific machine. File will be collected from the machine and uploaded to a secure storage.
+
+## Permissions
+Users need to have Security administrator or Global admin directory roles.
+
+## HTTP request
+```
+POST /testwdatppreview/machines/{id}/requestSample
+```
+
+## Request headers
+
+Header | Value
+:---|:---
+Authorization | Bearer {token}. **Required**.
+Content-Type | application/json
+
+## Request body
+In the request body, supply a JSON object with the following parameters:
+
+Parameter | Type | Description
+:---|:---|:---
+Comment | String | Comment to associate with the action. **Required**.
+Sha1 | String | Sha1 of the file to upload to the secure storage. **Required**.
+
+## Response
+If successful, this method returns 201, Created response code and *FileMachineAction* object in the response body.
+
+
+## Example
+
+Request
+
+Here is an example of the request.
+
+```
+POST https://graph.microsoft.com/testwdatppreview/machines/fb9ab6be3965095a09c057be7c90f0a2/requestSample
+Content-type: application/json
+{
+ "Comment": "Request Sample on machine due to alert 32123",
+ "Sha1": "8d25682b3a82af25b42dc90291c35ff3293daa68"
+}
+
+```
+
+Response
+
+Here is an example of the response.
+
+>[!NOTE]
+>The response object shown here may be truncated for brevity. All of the properties will be returned from an actual call.
+
+```
+HTTP/1.1 201 Created
+Content-type: application/json
+{
+ "@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#FileMachineActions/$entity",
+ "id": "c083f601-012f-4955-b4cc-fab50fb69d79",
+ "sha1": "8d25682b3a82af25b42dc90291c35ff3293daa68",
+ "type": "RequestSample",
+ "requestor": "Analyst@contoso.com ",
+ "requestorComment": "test",
+ "status": "InProgress",
+ "fileId": "8d25682b3a82af25b42dc90291c35ff3293daa68",
+ "machineId": "f46b9bb259ed4a7fb9981b73510e3cc7aa81ec1f",
+ "creationDateTimeUtc": "2017-12-04T13:39:24.9399004Z",
+ "lastUpdateDateTimeUtc": "2017-12-04T13:39:24.9399004Z",
+ "fileInstances": [
+ {
+ "filePath": "C:\\Windows\\System32\\conhost.exe",
+ "status": "InProgress"
+ }
+ ]
+}
+
+```
diff --git a/windows/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md
index f5bdb18d2e..6708631bb3 100644
--- a/windows/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 11/10/2017
+ms.date: 11/09/2017
---
# Take response actions on a file
diff --git a/windows/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md
index 87f97bcd64..adcfd622e0 100644
--- a/windows/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 11/10/2017
+ms.date: 12/12/2017
---
# Take response actions on a machine
@@ -29,7 +29,8 @@ ms.date: 11/10/2017
Quickly respond to detected attacks by isolating machines or collecting an investigation package. After taking action on machines, you can check activity details on the Action center.
>[!IMPORTANT]
-> These response actions are only available for machines on Windows 10, version 1703 or later.
+> - These response actions are only available for machines on Windows 10, version 1703 or later.
+> - For non-Windows platforms, response capabilities (such as Machine isolation) are dependent on the third-party capabilities.
## Collect investigation package from machines
As part of the investigation or response process, you can collect an investigation package from a machine. By collecting the investigation package, you can identify the current state of the machine and further understand the tools and techniques used by the attacker.
diff --git a/windows/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection.md
index b43fb54643..6092b45364 100644
--- a/windows/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 11/12/2017
---
# Take response actions in Windows Defender ATP
diff --git a/windows/threat-protection/windows-defender-atp/restrict-code-execution-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/restrict-code-execution-windows-defender-advanced-threat-protection.md
new file mode 100644
index 0000000000..d6e18c2022
--- /dev/null
+++ b/windows/threat-protection/windows-defender-atp/restrict-code-execution-windows-defender-advanced-threat-protection.md
@@ -0,0 +1,89 @@
+---
+title: Restrict app execution API
+description: Use this API to create calls related to restricting an application from executing.
+keywords: apis, graph api, supported apis, collect investigation package
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: high
+ms.date: 12/08/2017
+---
+
+# Restrict app execution API
+
+**Applies to:**
+
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
+Restrict execution of set of predefined applications.
+
+## Permissions
+Users need to have Security administrator or Global admin directory roles.
+
+## HTTP request
+```
+POST /testwdatppreview/machines/{id}/restrictCodeExecution
+```
+
+## Request headers
+
+Header | Value
+:---|:---
+Authorization | Bearer {token}. **Required**.
+Content-Type | application/json
+
+## Request body
+In the request body, supply a JSON object with the following parameters:
+
+Parameter | Type | Description
+:---|:---|:---
+Comment | String | Comment to associate with the action. **Required**.
+
+## Response
+If successful, this method returns 201, Created response code and _MachineAction_ object in the response body.
+
+
+## Example
+
+Request
+
+Here is an example of the request.
+
+```
+POST https://graph.microsoft.com/testwdatppreview/machines/fb9ab6be3965095a09c057be7c90f0a2/restrictCodeExecution
+Content-type: application/json
+{
+ "Comment": "Restrict code execution due to alert 1234"
+}
+
+```
+Response
+
+Here is an example of the response.
+
+>[!NOTE]
+>The response object shown here may be truncated for brevity. All of the properties will be returned from an actual call.
+
+```
+HTTP/1.1 201 Created
+Content-type: application/json
+{
+ "@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#MachineActions/$entity",
+ "id": "78d408d1-384c-4c19-8b57-ba39e378011a",
+ "type": "RestrictCodeExecution",
+ "requestor": "Analyst@ contoso.com ",
+ "requestorComment": "Restrict code execution due to alert 1234",
+ "status": "InProgress",
+ "error": "None",
+ "machineId": "f46b9bb259ed4a7fb9981b73510e3cc7aa81ec1f",
+ "creationDateTimeUtc": "2017-12-04T12:15:04.3825985Z",
+ "lastUpdateTimeUtc": "2017-12-04T12:15:04.3825985Z"
+}
+
+```
diff --git a/windows/threat-protection/windows-defender-atp/run-av-scan-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/run-av-scan-windows-defender-advanced-threat-protection.md
new file mode 100644
index 0000000000..28e6945c58
--- /dev/null
+++ b/windows/threat-protection/windows-defender-atp/run-av-scan-windows-defender-advanced-threat-protection.md
@@ -0,0 +1,98 @@
+---
+title: Run antivirus scan API
+description: Use this API to create calls related to running an antivirus scan on a machine.
+keywords: apis, graph api, supported apis, remove machine from isolation
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: high
+ms.date: 12/08/2017
+---
+
+# Run antivirus scan API
+
+**Applies to:**
+
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
+Initiate Windows Defender Antivirus scan on the machine.
+
+## Permissions
+Users need to have Security administrator or Global admin directory roles.
+
+## HTTP request
+```
+POST /testwdatppreview/machines/{id}/runAntiVirusScan
+```
+
+## Request headers
+
+Header | Value
+:---|:---
+Authorization | Bearer {token}. **Required**.
+Content-Type | application/json
+
+## Request body
+In the request body, supply a JSON object with the following parameters:
+
+Parameter | Type | Description
+:---|:---|:---
+Comment | String | Comment to associate with the action. **Required**.
+ScanType| ScanType | Defines the type of the Scan. **Required**.
+
+**ScanType** controls the type of scan to perform and can be one of the following:
+
+- **Quick** – Perform quick scan on the machine
+- **Full** – Perform full scan on the machine
+
+
+
+## Response
+If successful, this method returns 201, Created response code and _MachineAction_ object in the response body.
+
+
+## Example
+
+Request
+
+Here is an example of the request.
+
+```
+POST https://graph.microsoft.com/testwdatppreview/machines/fb9ab6be3965095a09c057be7c90f0a2/runAntiVirusScan
+Content-type: application/json
+{
+ "Comment": "Check machine for viruses due to alert 3212",
+ “ScanType”: “Full”
+}
+```
+
+Response
+
+Here is an example of the response.
+
+>[!NOTE]
+>The response object shown here may be truncated for brevity. All of the properties will be returned from an actual call.
+
+```
+HTTP/1.1 201 Created
+Content-type: application/json
+{
+ "@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#MachineActions/$entity",
+ "id": "2e9da30d-27f6-4208-81f2-9cd3d67893ba",
+ "type": "RunAntiVirusScan",
+ "requestor": "Analyst@ contoso.com ",
+ "requestorComment": "Check machine for viruses due to alert 3212",
+ "status": "InProgress",
+ "error": "None",
+ "machineId": "f46b9bb259ed4a7fb9981b73510e3cc7aa81ec1f",
+ "creationDateTimeUtc": "2017-12-04T12:18:27.1293487Z",
+ "lastUpdateTimeUtc": "2017-12-04T12:18:27.1293487Z"
+}
+
+```
diff --git a/windows/threat-protection/windows-defender-atp/security-analytics-dashboard-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/security-analytics-dashboard-windows-defender-advanced-threat-protection.md
index f8b9b55c33..c3705bb1d8 100644
--- a/windows/threat-protection/windows-defender-atp/security-analytics-dashboard-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/security-analytics-dashboard-windows-defender-advanced-threat-protection.md
@@ -9,7 +9,7 @@ ms.sitesec: library
ms.pagetype: security
author: mjcaparas
localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 11/17/2017
---
# View the Windows Defender Advanced Threat Protection Security analytics dashboard
diff --git a/windows/threat-protection/windows-defender-atp/service-status-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/service-status-windows-defender-advanced-threat-protection.md
index d378143d10..fb58b3850a 100644
--- a/windows/threat-protection/windows-defender-atp/service-status-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/service-status-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 10/16/2017
---
# Check the Windows Defender Advanced Threat Protection service health
diff --git a/windows/threat-protection/windows-defender-atp/settings-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/settings-windows-defender-advanced-threat-protection.md
index 5d97ac1e70..d928035ce4 100644
--- a/windows/threat-protection/windows-defender-atp/settings-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/settings-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: DulceMV
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 10/30/2017
---
# Windows Defender Advanced Threat Protection settings
diff --git a/windows/threat-protection/windows-defender-atp/stop-quarantine-file-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/stop-quarantine-file-windows-defender-advanced-threat-protection.md
new file mode 100644
index 0000000000..44ac36d4ef
--- /dev/null
+++ b/windows/threat-protection/windows-defender-atp/stop-quarantine-file-windows-defender-advanced-threat-protection.md
@@ -0,0 +1,103 @@
+---
+title: Stop and quarantine file API
+description: Use this API to create calls related to stopping and quarantining a file.
+keywords: apis, graph api, supported apis, stop, quarantine, file
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: high
+ms.date: 12/08/2017
+---
+
+# Stop and quarantine file API
+
+**Applies to:**
+
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
+Stop execution of a file on a machine and ensure it’s not executed again on that machine.
+
+## Permissions
+Users need to have Security administrator or Global admin directory roles.
+
+## HTTP request
+```
+POST /testwdatppreview/machines/{id}/stopAndQuarantineFile
+```
+
+## Request headers
+
+Header | Value
+:---|:---
+Authorization | Bearer {token}. **Required**.
+Content-Type | application/json
+
+## Request body
+In the request body, supply a JSON object with the following parameters:
+
+Parameter | Type | Description
+:---|:---|:---
+Comment | String | Comment to associate with the action. **Required**.
+Sha1 | String | Sha1 of the file to stop and quarantine on the machine. **Required**.
+
+## Response
+If successful, this method returns 201, Created response code and _FileMachineAction_ object in the response body.
+
+
+## Example
+
+Request
+
+Here is an example of the request.
+
+```
+POST https://graph.microsoft.com/testwdatppreview/machines/fb9ab6be3965095a09c057be7c90f0a2/stopAndQuarantineFile
+Content-type: application/json
+{
+ "Comment": "Stop and quarantine file on machine due to alert 32123",
+ "Sha1": "87662bc3d60e4200ceaf7aae249d1c343f4b83c9"
+}
+
+```
+Response
+
+Here is an example of the response.
+
+>[!NOTE]
+>The response object shown here may be truncated for brevity. All of the properties will be returned from an actual call.
+
+```
+HTTP/1.1 201 Created
+Content-type: application/json
+{
+ "@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#FileMachineActions/$entity",
+ "id": "6f1d364c-680c-499a-b30c-dd9265ad4c9d",
+ "sha1": "87662bc3d60e4200ceaf7aae249d1c343f4b83c9",
+ "type": "StopAndQuarantineFile",
+ "requestor": "Analyst@contoso.com ",
+ "requestorComment": " Stop and quarantine file on machine due to alert 32123",
+ "status": "InProgress",
+ "fileId": "87662bc3d60e4200ceaf7aae249d1c343f4b83c9",
+ "machineId": "f46b9bb259ed4a7fb9981b73510e3cc7aa81ec1f",
+ "creationDateTimeUtc": "2017-12-04T13:13:26.2106524Z",
+ "lastUpdateDateTimeUtc": "2017-12-04T13:13:58.8098277Z",
+ "fileInstances": [
+ {
+ "filePath": "C:\\Users\\ testUser \\Downloads\\elma.exe",
+ "status": "InProgress"
+ },
+ {
+ "filePath": "C:\\Users\\testUser\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\TempState\\Downloads\\elma (2).exe.xc9q785.partial",
+ "status": "InProgress"
+ },
+ ]
+ }
+
+
+```
diff --git a/windows/threat-protection/windows-defender-atp/supported-apis-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/supported-apis-windows-defender-advanced-threat-protection.md
index 21a0c08e76..6277924353 100644
--- a/windows/threat-protection/windows-defender-atp/supported-apis-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/supported-apis-windows-defender-advanced-threat-protection.md
@@ -1,5 +1,5 @@
---
-title: Supported Windows Defender Advanced Threat Protection APIs
+title: Supported Windows Defender Advanced Threat Protection query APIs
description: Learn about the specific supported Windows Defender Advanced Threat Protection entities where you can create API calls to.
keywords: apis, graph api, supported apis, actor, alerts, machine, user, domain, ip, file
search.product: eADQiWindows 10XVcnh
@@ -10,10 +10,10 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 10/16/2017
---
-# Supported Windows Defender ATP APIs
+# Supported Windows Defender ATP query APIs
**Applies to:**
diff --git a/windows/threat-protection/windows-defender-atp/supported-response-apis-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/supported-response-apis-windows-defender-advanced-threat-protection.md
new file mode 100644
index 0000000000..70bff68a83
--- /dev/null
+++ b/windows/threat-protection/windows-defender-atp/supported-response-apis-windows-defender-advanced-threat-protection.md
@@ -0,0 +1,48 @@
+---
+title: Supported Windows Defender Advanced Threat Protection response APIs
+description: Learn about the specific response related Windows Defender Advanced Threat Protection API calls.
+keywords: response apis, graph api, supported apis, actor, alerts, machine, user, domain, ip, file
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: high
+ms.date: 12/01/2017
+---
+
+# Supported Windows Defender ATP query APIs
+
+**Applies to:**
+
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+
+>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-supported-response-apis-abovefoldlink)
+
+Learn about the supported response related API calls you can run and details such as the required request headers, and expected response from the calls.
+
+## In this section
+Topic | Description
+:---|:---
+Collect investigation package | Run this to collect an investigation package from a machine.
+Isolate machine | Run this to isolate a machine from the network.
+Unisolate machine | Remove a machine from isolation.
+Restrict code execution | Run this to contain an attack by stopping malicious processes. You can also lock down a device and prevent subsequent attempts of potentially malicious programs from running.
+Unrestrict code execution | Run this to reverse the restriction of applications policy after you have verified that the compromised machine has been remediated.
+Run antivirus scan | Remotely initiate an antivirus scan to help identify and remediate malware that might be present on a compromised machine.
+Stop and quarantine file | Run this call to stop running processes, quarantine files, and delete persistency such as registry keys.
+Request sample | Run this call to request a sample of a file from a specific machine. The file will be collected from the machine and uploaded to a secure storage.
+Block file | Run this to prevent further propagation of an attack in your organization by banning potentially malicious files or suspected malware.
+Unblock file | Allow a file run in the organization using Windows Defender Antivirus.
+Get package SAS URI | Run this to get a URI that allows downloading an investigation package.
+Get MachineAction object | Run this to get MachineAction object.
+Get MachineActions collection | Run this to get MachineAction collection.
+Get FileActions collection | Run this to get FileActions collection.
+Get FileMachineAction object | Run this to get FileMachineAction object.
+Get FileMachineActions collection | Run this to get FileMachineAction collection.
+
+
+
diff --git a/windows/threat-protection/windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection.md
index b314b0c51e..54edd18d8c 100644
--- a/windows/threat-protection/windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 10/16/2017
---
# Understand threat intelligence concepts
diff --git a/windows/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md
index de19af3792..1e32ef16a7 100644
--- a/windows/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 10/16/2017
---
# Troubleshoot custom threat intelligence issues
diff --git a/windows/threat-protection/windows-defender-atp/troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md
index bf1c9e6d63..67e7ed903c 100644
--- a/windows/threat-protection/windows-defender-atp/troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: v-tanewt
author: tbit0001
ms.localizationpriority: high
-ms.date: 11/22/2017
+ms.date: 11/28/2017
---
# Troubleshoot subscription and portal access issues
diff --git a/windows/threat-protection/windows-defender-atp/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md
index 0d8d3540c1..487679607d 100644
--- a/windows/threat-protection/windows-defender-atp/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 11/21/2017
---
# Troubleshoot Windows Defender Advanced Threat Protection onboarding issues
@@ -22,6 +22,8 @@ ms.date: 10/17/2017
- Windows 10 Pro
- Windows 10 Pro Education
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+- Windows Server 2012 R2
+- Windows Server 2016
@@ -126,7 +128,7 @@ ID | Severity | Event description | Troubleshooting steps
## Troubleshoot onboarding issues on the endpoint
If the deployment tools used does not indicate an error in the onboarding process, but endpoints are still not appearing in the machines list in an hour, go through the following verification topics to check if an error occurred with the Windows Defender ATP agent:
- [View agent onboarding errors in the endpoint event log](#view-agent-onboarding-errors-in-the-endpoint-event-log)
-- [Ensure the telemetry and diagnostics service is enabled](#ensure-the-telemetry-and-diagnostics-service-is-enabled)
+- [Ensure the diagnostic data service is enabled](#ensure-the-diagnostics-service-is-enabled)
- [Ensure the service is set to start](#ensure-the-service-is-set-to-start)
- [Ensure the endpoint has an Internet connection](#ensure-the-endpoint-has-an-internet-connection)
- [Ensure that Windows Defender Antivirus is not disabled by a policy](#ensure-that-windows-defender-antivirus-is-not-disabled-by-a-policy)
@@ -174,14 +176,15 @@ Event ID | Message | Resolution steps
There are additional components on the endpoint that the Windows Defender ATP agent depends on to function properly. If there are no onboarding related errors in the Windows Defender ATP agent event log, proceed with the following steps to ensure that the additional components are configured correctly.
-### Ensure the telemetry and diagnostics service is enabled
-If the endpoints aren't reporting correctly, you might need to check that the Windows 10 telemetry and diagnostics service is set to automatically start and is running on the endpoint. The service might have been disabled by other programs or user configuration changes.
+
+### Ensure the diagnostic data service is enabled
+If the endpoints aren't reporting correctly, you might need to check that the Windows 10 diagnostic data service is set to automatically start and is running on the endpoint. The service might have been disabled by other programs or user configuration changes.
First, you should check that the service is set to start automatically when Windows starts, then you should check that the service is currently running (and start it if it isn't).
### Ensure the service is set to start
-**Use the command line to check the Windows 10 telemetry and diagnostics service startup type**:
+**Use the command line to check the Windows 10 diagnostic data service startup type**:
1. Open an elevated command-line prompt on the endpoint:
@@ -202,7 +205,7 @@ First, you should check that the service is set to start automatically when Wind
If the `START_TYPE` is not set to `AUTO_START`, then you'll need to set the service to automatically start.
-**Use the command line to set the Windows 10 telemetry and diagnostics service to automatically start:**
+**Use the command line to set the Windows 10 diagnostic data service to automatically start:**
1. Open an elevated command-line prompt on the endpoint:
@@ -265,6 +268,31 @@ If the verification fails and your environment is using a proxy to connect to th
+
+## Troubleshoot onboarding issues on a server
+If you encounter issues while onboarding a server, go through the following verification steps to address possible issues.
+
+- [Ensure Microsoft Monitoring Agent (MMA) is installed and configured to report sensor data to the service](configure-server-endpoints-windows-defender-advanced-threat-protection.md#server-mma)
+- [Ensure that the server endpoint proxy and Internet connectivity settings are configured properly](configure-server-endpoints-windows-defender-advanced-threat-protection.md#server-proxy)
+
+You might also need to check the following:
+- Check that there is a Windows Defender Advanced Threat Protection Service running in the **Processes** tab in **Task Manager**. For example:
+
+ 
+
+- Check **Event Viewer** > **Applications and Services Logs** > **Operation Manager** to see if there are any errors.
+
+- In **Services**, check if the **Microsoft Monitoring Agent** is running on the server. For example,
+
+ 
+
+- In **Microsoft Monitoring Agent** > **Azure Log Analytics (OMS)**, check the Workspaces and verify that the status is running.
+
+ 
+
+- Check to see that machines are reflected in the **Machines list** in the portal.
+
+
## Licensing requirements
Windows Defender Advanced Threat Protection requires one of the following Microsoft Volume Licensing offers:
diff --git a/windows/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md
index 94458ed80b..114d11828b 100644
--- a/windows/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 10/16/2017
---
# Troubleshoot SIEM tool integration issues
diff --git a/windows/threat-protection/windows-defender-atp/troubleshoot-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/troubleshoot-windows-defender-advanced-threat-protection.md
index 61b855dcd8..336ff2d686 100644
--- a/windows/threat-protection/windows-defender-atp/troubleshoot-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/troubleshoot-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 10/23/2017
---
# Troubleshoot Windows Defender Advanced Threat Protection
diff --git a/windows/threat-protection/windows-defender-atp/unblock-file-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/unblock-file-windows-defender-advanced-threat-protection.md
new file mode 100644
index 0000000000..a007aefd5d
--- /dev/null
+++ b/windows/threat-protection/windows-defender-atp/unblock-file-windows-defender-advanced-threat-protection.md
@@ -0,0 +1,89 @@
+---
+title: Unblock file API
+description: Use this API to create calls related to allowing a file to be executed in the organization
+keywords: apis, graph api, supported apis, unblock file
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: high
+ms.date: 12/08/2017
+---
+
+# Unblock file API
+
+**Applies to:**
+
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
+Allow a file to be executed in the organization, using Windows Defender Antivirus.
+
+## Permissions
+Users need to have Security administrator or Global admin directory roles.
+
+## HTTP request
+```
+POST /testwdatppreview/files/{sha1}/unblock
+```
+
+## Request headers
+
+Header | Value
+:---|:---
+Authorization | Bearer {token}. **Required**.
+Content-Type | application/json
+
+## Request body
+In the request body, supply a JSON object with the following parameters:
+
+Parameter | Type | Description
+:---|:---|:---
+Comment | String | Comment to associate with the action. **Required**.
+
+
+## Response
+If successful, this method returns 200, Ok response code with empty body, which indicates that block message was sent to Windows Defender deployed in the organization.
+
+
+## Example
+
+Request
+
+Here is an example of the request.
+
+```
+POST https://graph.microsoft.com/testwdatppreview/files/7327b54fd718525cbca07dacde913b5ac3c85673/unblock
+Content-type: application/json
+{
+ "Comment": "Unblock file since alert 1234 was investigated and discovered to be false alarm",
+}
+```
+
+Response
+
+Here is an example of the response.
+
+
+```
+HTTP/1.1 201 Created
+Content-type: application/json
+{
+ "fileIdentifier": "7327b54fd718525cbca07dacde913b5ac3c85673",
+ "fileIdentifierType": "Sha1",
+ "actionType": "UnBlock",
+ "fileStatus": "Blocked",
+ "creationDateTimeUtc": "2017-12-04T13:06:23.4502191Z",
+ "requestor": "Analyst@contoso.com ",
+ "requestorComment": "test",
+ "cancellationDateTimeUtc": null,
+ "cancellationRequestor": null,
+ "cancellationComment": null,
+ "lastUpdateDateTimeUtc": "2017-12-04T13:06:23.4502191Z"
+}
+
+```
diff --git a/windows/threat-protection/windows-defender-atp/unisolate-machine-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/unisolate-machine-windows-defender-advanced-threat-protection.md
new file mode 100644
index 0000000000..e45662c5cd
--- /dev/null
+++ b/windows/threat-protection/windows-defender-atp/unisolate-machine-windows-defender-advanced-threat-protection.md
@@ -0,0 +1,90 @@
+---
+title: Release machine from isolation API
+description: Use this API to create calls related to release a machine from isolation.
+keywords: apis, graph api, supported apis, remove machine from isolation
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: high
+ms.date: 12/08/2017
+---
+
+# Release machine from isolation API
+
+**Applies to:**
+
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
+Undo isolation of a machine.
+
+## Permissions
+Users need to have Security administrator or Global admin directory roles.
+
+## HTTP request
+```
+POST /testwdatppreview/machines/{id}/unisolate
+```
+
+## Request headers
+
+Header | Value
+:---|:---
+Authorization | Bearer {token}. **Required**.
+Content-Type | application/json
+
+## Request body
+In the request body, supply a JSON object with the following parameters:
+
+Parameter | Type | Description
+:---|:---|:---
+Comment | String | Comment to associate with the action. **Required**.
+
+## Response
+If successful, this method returns 201, Created response code and _MachineAction_ object in the response body.
+
+
+## Example
+
+Request
+
+Here is an example of the request.
+
+```
+POST https://graph.microsoft.com/testwdatppreview/machines/fb9ab6be3965095a09c057be7c90f0a2/unisolate
+Content-type: application/json
+{
+ "Comment": "Unisolate machine since it was clean and validated"
+}
+
+```
+Response
+
+Here is an example of the response.
+
+>[!NOTE]
+>The response object shown here may be truncated for brevity. All of the properties will be returned from an actual call.
+
+```
+HTTP/1.1 201 Created
+Content-type: application/json
+{
+ "@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#MachineActions/$entity",
+ "id": "09a0f91e-a2eb-409d-af33-5577fe9bd558",
+ "type": "Unisolate",
+ "requestor": "Analyst@ contoso.com ",
+ "requestorComment": "Unisolate machine since it was clean and validated ",
+ "status": "InProgress",
+ "error": "None",
+ "machineId": "f46b9bb259ed4a7fb9981b73510e3cc7aa81ec1f",
+ "creationDateTimeUtc": "2017-12-04T12:13:15.0104931Z",
+ "lastUpdateTimeUtc": "2017-12-04T12:13:15.0104931Z"
+}
+
+
+```
diff --git a/windows/threat-protection/windows-defender-atp/unrestrict-code-execution-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/unrestrict-code-execution-windows-defender-advanced-threat-protection.md
new file mode 100644
index 0000000000..67c98f2595
--- /dev/null
+++ b/windows/threat-protection/windows-defender-atp/unrestrict-code-execution-windows-defender-advanced-threat-protection.md
@@ -0,0 +1,91 @@
+---
+title: Remove app restriction API
+description: Use this API to create calls related to removing a restriction from applications from executing.
+keywords: apis, graph api, supported apis, remove machine from isolation
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: high
+ms.date: 12/08/2017
+---
+
+# Remove app restriction API
+
+**Applies to:**
+
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
+Unrestrict execution of set of predefined applications.
+
+## Permissions
+Users need to have Security administrator or Global admin directory roles.
+
+## HTTP request
+```
+POST /testwdatppreview/machines/{id}/unrestrictCodeExecution
+```
+
+## Request headers
+
+Header | Value
+:---|:---
+Authorization | Bearer {token}. Required.
+Content-Type | application/json
+
+## Request body
+In the request body, supply a JSON object with the following parameters:
+
+Parameter | Type | Description
+:---|:---|:---
+Comment | String | Comment to associate with the action. **Required**.
+
+## Response
+If successful, this method returns 201, Created response code and _MachineAction_ object in the response body.
+
+
+## Example
+
+Request
+
+Here is an example of the request.
+
+```
+POST https://graph.microsoft.com/testwdatppreview/machines/fb9ab6be3965095a09c057be7c90f0a2/unrestrictCodeExecution
+Content-type: application/json
+{
+ "Comment": "Unrestrict code execution since machine was cleaned and validated"
+}
+
+```
+
+Response
+
+Here is an example of the response.
+
+>[!NOTE]
+>The response object shown here may be truncated for brevity. All of the properties will be returned from an actual call.
+
+```
+HTTP/1.1 201 Created
+Content-type: application/json
+{
+ "@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#MachineActions/$entity",
+ "id": "44cffc15-0e3d-4cbf-96aa-bf76f9b27f5e",
+ "type": "UnrestrictCodeExecution",
+ "requestor": "Analyst@ contoso.com ",
+ "requestorComment": "Unrestrict code execution since machine was cleaned and validated ",
+ "status": "InProgress",
+ "error": "None",
+ "machineId": "f46b9bb259ed4a7fb9981b73510e3cc7aa81ec1f",
+ "creationDateTimeUtc": "2017-12-04T12:15:40.6052029Z",
+ "lastUpdateTimeUtc": "2017-12-04T12:15:40.6052029Z"
+}
+
+
+```
diff --git a/windows/threat-protection/windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection.md
index 43f09e0864..8e87ecf9ea 100644
--- a/windows/threat-protection/windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 10/16/2017
---
# Use the threat intelligence API to create custom alerts
diff --git a/windows/threat-protection/windows-defender-atp/use-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/use-windows-defender-advanced-threat-protection.md
index f047ce5ac2..7068cb4a06 100644
--- a/windows/threat-protection/windows-defender-atp/use-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/use-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 10/16/2017
---
# Use the Windows Defender Advanced Threat Protection portal
diff --git a/windows/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection.md
index 56df91f582..42fe8383b5 100644
--- a/windows/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/17/2017
+ms.date: 11/13/2017
---
# Windows Defender Advanced Threat Protection
@@ -102,6 +102,7 @@ Topic | Description
[Create and build Power BI reports using Windows Defender ATP data](powerbi-reports-windows-defender-advanced-threat-protection.md) | Understand the security status of your organization, including the status of machines, alerts, and investigations using the Windows Defender ATP reporting feature that integrates with Power BI.
[Check sensor state](check-sensor-status-windows-defender-advanced-threat-protection.md) | Check the sensor health state on endpoints to verify that they are providing sensor data and communicating with the Windows Defender ATP service.
[Configure Windows Defender ATP preferences settings](preferences-setup-windows-defender-advanced-threat-protection.md) | Use the Preferences setup menu to modify general settings, advanced features, enable the preview experience, email notifications, and the custom threat intelligence feature.
+[Access the Windows Defender ATP Community Center](community-windows-defender-advanced-threat-protection.md)| The Windows Defender ATP Community Center is a place where community members can learn, collaborate, and share experiences about the product.
[Windows Defender ATP settings](settings-windows-defender-advanced-threat-protection.md) | Configure time zone settings and view license information.
[Windows Defender ATP service health](service-status-windows-defender-advanced-threat-protection.md) | Verify that the service health is running properly or if there are current issues.
[Troubleshoot Windows Defender Advanced Threat Protection](troubleshoot-windows-defender-advanced-threat-protection.md) | This topic contains information to help IT Pros find workarounds for the known issues and troubleshoot issues in Windows Defender ATP.
diff --git a/windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md
index 7ee1ff05ed..889d969f79 100644
--- a/windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md
+++ b/windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md
@@ -11,7 +11,7 @@ ms.pagetype: security
localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 11/30/2017
---
diff --git a/windows/threat-protection/windows-defender-exploit-guard/audit-windows-defender-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/audit-windows-defender-exploit-guard.md
index 1f91198bed..f3646e3018 100644
--- a/windows/threat-protection/windows-defender-exploit-guard/audit-windows-defender-exploit-guard.md
+++ b/windows/threat-protection/windows-defender-exploit-guard/audit-windows-defender-exploit-guard.md
@@ -11,7 +11,7 @@ ms.pagetype: security
localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 12/12/2017
---
@@ -28,7 +28,7 @@ ms.date: 08/25/2017
- Enterprise security administrators
-You can enable each of the features of Windows Defender Explot Guard in audit mode. This lets you see a record of what *would* have happened if you had enabled the feature.
+You can enable each of the features of Windows Defender Exploit Guard in audit mode. This lets you see a record of what *would* have happened if you had enabled the feature.
You might want to do this when testing how the feature will work in your organization, to ensure it doesn't affect your line-of-business apps, and to get an idea of how many suspicious file modification attempts generally occur over a certain period.
@@ -74,8 +74,7 @@ You can also use the a custom PowerShell script that enables the features in aud
## Related topics
-Topic | Description
----|---
+
- [Protect devices from exploits with Windows Defender Exploit Guard](exploit-protection-exploit-guard.md)
- [Reduce attack surfaces with Windows Defender Exploit Guard](attack-surface-reduction-exploit-guard.md)
- [Protect your network with Windows Defender Exploit Guard](network-protection-exploit-guard.md)
diff --git a/windows/threat-protection/windows-defender-exploit-guard/collect-cab-files-exploit-guard-submission.md b/windows/threat-protection/windows-defender-exploit-guard/collect-cab-files-exploit-guard-submission.md
new file mode 100644
index 0000000000..f63116481c
--- /dev/null
+++ b/windows/threat-protection/windows-defender-exploit-guard/collect-cab-files-exploit-guard-submission.md
@@ -0,0 +1,69 @@
+---
+title: Submit cab files related to Windows Defender EG problems
+description: Use the command-line tool to obtain .cab file that can be used to investigate ASR rule issues.
+keywords: troubleshoot, error, fix, asr, windows defender eg, exploit guard, attack surface reduction
+search.product: eADQiWindows 10XVcnh
+ms.pagetype: security
+ms.prod: w10
+ms.mktglfcycl: manage
+ms.sitesec: library
+ms.pagetype: security
+ms.localizationpriority: medium
+author: iaanw
+ms.author: iawilt
+ms.date: 12/12/2017
+---
+
+# Collect diagnostic data for Windows Defender Exploit Guard file submissions
+
+**Applies to:**
+
+- Windows 10, version 1709
+
+**Audience**
+
+- IT administrators
+
+This topic describes how to collect diagnostic data that can be used by Microsoft support and engineering teams to help troubleshoot issues you may encounter when using Windows Defender Exploit Guard.
+
+In particular, you will be asked to collect and attach this data when using the [Windows Defender Security Intelligence web-based submission form](https://www.microsoft.com/en-us/wdsi/filesubmission) if you indicate that you have encountered a problem with [Attack surface reduction rules](attack-surface-reduction-exploit-guard.md) or [Network protection](network-protection-exploit-guard.md).
+
+Before attempting this process, ensure you have met all required pre-requisites and taken any other suggested troubleshooting steps as described in these topics:
+- [Troubleshoot Windows Defender Exploit Guard ASR rules](troubleshoot-asr.md)
+- [Troubleshoot Windows Defender Network protection](troubleshoot-np.md)
+
+
+
+1. On the endpoint with the issue, obtain the Windows Defender .cab diagnostic file by following this process:
+
+ 1. Open an administrator-level version of the command prompt:
+
+ 1. Open the **Start** menu.
+
+ 2. Type **cmd**. Right-click on **Command Prompt** and click **Run as administrator**.
+
+ 3. Enter administrator credentials or approve the prompt.
+
+ 2. Navigate to the Windows Defender directory. By default, this is C:\Program Files\Windows Defender, as in the following example:
+
+ ```Dos
+ cd c:\program files\windows defender
+ ```
+
+ 3. Enter the following command and press **Enter**
+
+ ```Dos
+ mpcmdrun -getfiles
+ ```
+
+ 4. A .cab file will be generated that contains various diagnostic logs. The location of the file will be specified in the output in the command prompt, but by default it will be in C:\ProgramData\Microsoft\Windows Defender\Support\MpSupportFiles.cab.
+
+2. Attach this .cab file to the submission form where indicated.
+
+
+## Related topics
+
+- [Troubleshoot Windows Defender Exploit Guard ASR rules](troubleshoot-asr.md)
+- [Troubleshoot Windows Defender Network protection](troubleshoot-np.md)
+- [Windows Defender Exploit Guard](windows-defender-exploit-guard.md)
+
diff --git a/windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md
index a2095a35f1..88eeed502e 100644
--- a/windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md
+++ b/windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md
@@ -11,7 +11,7 @@ ms.pagetype: security
localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 11/20/2017
---
@@ -53,7 +53,7 @@ This is especially useful in helping to protect your documents and information f
A notification will appear on the machine where the app attempted to make changes to a protected folder. You can [customize the notification](customize-attack-surface-reduction.md#customize-the-notification) with your company details and contact information. You can also enable the rules individually to customize what techniques the feature monitors.
-The protected folders include common system folders, and you can [add additional folders](customize-controlled-folders-exploit-guard.md#protect-additional-folders). You can also [allow or whitelist apps](customize-controlled-folders-exploit-guard.md#allow-specifc-apps-to-make-changes-to-controlled-folders) to give them access to the protected folders.
+The protected folders include common system folders, and you can [add additional folders](customize-controlled-folders-exploit-guard.md#protect-additional-folders). You can also [allow or whitelist apps](customize-controlled-folders-exploit-guard.md#allow-specific-apps-to-make-changes-to-controlled-folders) to give them access to the protected folders.
As with other features of Windows Defender Exploit Guard, you can use [audit mode](audit-windows-defender-exploit-guard.md) to evaluate how Controlled folder access would impact your organization if it were enabled.
diff --git a/windows/threat-protection/windows-defender-exploit-guard/customize-attack-surface-reduction.md b/windows/threat-protection/windows-defender-exploit-guard/customize-attack-surface-reduction.md
index 421eef2058..b4f01bbee5 100644
--- a/windows/threat-protection/windows-defender-exploit-guard/customize-attack-surface-reduction.md
+++ b/windows/threat-protection/windows-defender-exploit-guard/customize-attack-surface-reduction.md
@@ -11,7 +11,7 @@ ms.pagetype: security
localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 11/09/2017
---
# Customize Attack surface reduction
diff --git a/windows/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md
index 2d64ed10c3..ac6af59799 100644
--- a/windows/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md
+++ b/windows/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md
@@ -11,7 +11,7 @@ ms.pagetype: security
localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 10/18/2017
---
@@ -119,7 +119,7 @@ Use the [./Vendor/MSFT/Policy/Config/Defender/GuardedFoldersList](https://docs.m
- ## Allow specifc apps to make changes to controlled folders
+ ## Allow specific apps to make changes to controlled folders
You can specify if certain apps should always be considered safe and given write access to files in protected folders. Allowing apps can be useful if you're finding a particular app that you know and trust is being blocked by the Controlled folder access feature.
@@ -130,9 +130,9 @@ You can specify if certain apps should always be considered safe and given write
You can use the Windows Defender Security Center app or Group Policy to add and remove apps that should be allowed to access protected folders.
-When you add an app, you have to specify the app's location. Only the app in that location will be permitted access to the protected folders - if the app (with the same name) is located in a different location, then it will not be added to the whitelist and may be blocked by Controlled folder access.
+When you add an app, you have to specify the app's location. Only the app in that location will be permitted access to the protected folders - if the app (with the same name) is located in a different location, then it will not be added to the allow list and may be blocked by Controlled folder access.
-### Use the Windows Defender Security app to whitelist specific apps
+### Use the Windows Defender Security app to allow specific apps
1. Open the Windows Defender Security Center by clicking the shield icon in the task bar or searching the start menu for **Defender**.
@@ -146,7 +146,7 @@ When you add an app, you have to specify the app's location. Only the app in tha
-### Use Group Policy to whitelist specific apps
+### Use Group Policy to allow specific apps
1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
@@ -160,13 +160,13 @@ When you add an app, you have to specify the app's location. Only the app in tha
-### Use PowerShell to whitelist specific apps
+### Use PowerShell to allow specific apps
1. Type **powershell** in the Start menu, right click **Windows PowerShell** and click **Run as administrator**
2. Enter the following cmdlet:
```PowerShell
- Add-MpPreference -ControlledFolderAccessAllowedApplications ""
+ Add-MpPreference -ControlledFolderAccessAllowedApplications ""
```
For example, to add the executable *test.exe*, located in the folder *C:\apps*, the cmdlet would be as follows:
@@ -186,7 +186,7 @@ Continue to use `Add-MpPreference -ControlledFolderAccessAllowedApplications` to
-### Use MDM CSPs to whitelist specific apps
+### Use MDM CSPs to allow specific apps
Use the [./Vendor/MSFT/Policy/Config/Defender/GuardedFoldersAllowedApplications](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender#defender-guardedfoldersallowedapplications) configuration service provider (CSP) to allow apps to make changes to protected folders.
diff --git a/windows/threat-protection/windows-defender-exploit-guard/customize-exploit-protection.md b/windows/threat-protection/windows-defender-exploit-guard/customize-exploit-protection.md
index d1e292f7a7..2da04a15b8 100644
--- a/windows/threat-protection/windows-defender-exploit-guard/customize-exploit-protection.md
+++ b/windows/threat-protection/windows-defender-exploit-guard/customize-exploit-protection.md
@@ -11,7 +11,7 @@ ms.pagetype: security
localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 12/12/2017
---
# Customize Exploit protection
@@ -45,6 +45,8 @@ You configure these settings using the Windows Defender Security Center on an in
It also describes how to enable or configure the mitigations using Windows Defender Security Center, PowerShell, and MDM CSPs. This is the first step in creating a configuration that you can deploy across your network. The next step involves [generating or exporting, importing, and deploying the configuration to multiple devices](import-export-exploit-protection-emet-xml.md).
+>[!WARNING]
+>Some security mitigation technologies may have compatibility issues with some applications. You should test Exploit protection in all target use scenarios by using [audit mode](audit-windows-defender-exploit-guard.md) before deploying the configuration across a production environment or the rest of your network.
## Exploit protection mitigations
@@ -80,11 +82,11 @@ Disable Win32k system calls | Prevents an app from using the Win32k system call
Do not allow child processes | Prevents an app from creating child processes. | App-level only | [!include[Check mark yes](images/svg/check-yes.svg)]
Export address filtering (EAF) | Detects dangerous operations being resolved by malicious code. Can optionally validate access by modules commonly used by exploits. | App-level only | [!include[Check mark yes](images/svg/check-yes.svg)]
Import address filtering (IAF) | Detects dangerous operations being resolved by malicious code. | App-level only | [!include[Check mark yes](images/svg/check-yes.svg)]
-Simulate execution (SimExec) | Ensures that calls to sensitive APIs return to legitimate callers. Only configurable for 32-bit (x86) applications. | App-level only | [!include[Check mark yes](images/svg/check-yes.svg)]
-Validate API invocation (CallerCheck) | Ensures that sensitive APIs are invoked by legitimate callers. Only configurable for 32-bit (x86) applications. | App-level only | [!include[Check mark yes](images/svg/check-yes.svg)]
+Simulate execution (SimExec) | Ensures that calls to sensitive APIs return to legitimate callers. Only configurable for 32-bit (x86) applications. Not compatible with ACG | App-level only | [!include[Check mark yes](images/svg/check-yes.svg)]
+Validate API invocation (CallerCheck) | Ensures that sensitive APIs are invoked by legitimate callers. Only configurable for 32-bit (x86) applications. Not compatible with ACG | App-level only | [!include[Check mark yes](images/svg/check-yes.svg)]
Validate handle usage | Causes an exception to be raised on any invalid handle references. | App-level only | [!include[Check mark no](images/svg/check-no.svg)]
Validate image dependency integrity | Enforces code signing for Windows image dependency loading. | App-level only | [!include[Check mark yes](images/svg/check-yes.svg)]
-Validate stack integrity (StackPivot) | Ensures that the stack has not been redirected for sensitive APIs. | App-level only | [!include[Check mark yes](images/svg/check-yes.svg)]
+Validate stack integrity (StackPivot) | Ensures that the stack has not been redirected for sensitive APIs. Not compatible with ACG | App-level only | [!include[Check mark yes](images/svg/check-yes.svg)]
>[!IMPORTANT]
>If you add an app to the **Program settings** section and configure individual mitigation settings there, they will be honored above the configuration for the same mitigations specified in the **System settings** section. The following matrix and examples help to illustrate how defaults work:
@@ -306,4 +308,4 @@ See the [Windows Defender Security Center](../windows-defender-security-center/w
- [Comparison with Enhanced Mitigation Experience Toolkit](emet-exploit-protection-exploit-guard.md)
- [Evaluate Exploit protection](evaluate-exploit-protection.md)
- [Enable Exploit protection](enable-exploit-protection.md)
-- [Import, export, and deploy Exploit protection configurations](import-export-exploit-protection-emet-xml.md)
\ No newline at end of file
+- [Import, export, and deploy Exploit protection configurations](import-export-exploit-protection-emet-xml.md)
diff --git a/windows/threat-protection/windows-defender-exploit-guard/emet-exploit-protection-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/emet-exploit-protection-exploit-guard.md
index 640893025c..6c15c1d3d2 100644
--- a/windows/threat-protection/windows-defender-exploit-guard/emet-exploit-protection-exploit-guard.md
+++ b/windows/threat-protection/windows-defender-exploit-guard/emet-exploit-protection-exploit-guard.md
@@ -1,6 +1,6 @@
---
title: Compare the features in Exploit protection with EMET
-keywords: emet, enhanced mitigation experience toolkit, configuration, exploit
+keywords: emet, enhanced mitigation experience toolkit, configuration, exploit, compare, difference between, versus, upgrade, convert
description: Exploit protection in Windows 10 provides advanced configuration over the settings offered in EMET.
search.product: eADQiWindows 10XVcnh
ms.pagetype: security
@@ -11,7 +11,7 @@ ms.pagetype: security
localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 12/12/2017
---
@@ -22,6 +22,7 @@ ms.date: 08/25/2017
**Applies to:**
- Windows 10, version 1709
+- Enhanced Mitigation Experience Toolkit version 5.5 (latest version)
@@ -30,17 +31,110 @@ ms.date: 08/25/2017
- Enterprise security administrators
+>[!IMPORTANT]
+>If you are currently using EMET you should be aware that [EMET will reach end of life on July 31, 2018](https://blogs.technet.microsoft.com/srd/2016/11/03/beyond-emet/). You should consider replacing EMET with Exploit protection in Windows 10.
+>
+>You can [convert an existing EMET configuration file into Exploit protection](import-export-exploit-protection-emet-xml.md#convert-an-emet-configuration-file-to-an-exploit-protection-configuration-file) to make the migration easier and keep your existing settings.
+
+This topic describes the differences between the Enhance Mitigation Experience Toolkit (EMET) and its replacement in Windows 10: Windows Defender Exploit Guard.
+
+ In Windows 10, version 1709 (also known as the Fall Creators Update) we released [Windows Defender Exploit Guard](windows-defender-exploit-guard.md), which provides unparalleled mitigation of known and unknown threat attack vectors, including exploits.
+
+ Windows Defender Exploit Guard is our successor to EMET and provides stronger protection, more customization, an easier user interface, and better configuration and management options.
+
+ EMET is a stand-alone product that is available on earlier versions of Windows and provides some mitigation against older, known exploit techniques.
+
+ After July 31, 2018, it will reach its end of life, which means it will not be supported and no additional development will be made on it.
+
+ For more information about the individual features and mitigations available in Windows Defender Exploit Guard, as well as how to enable, configure, and deploy them to better protect your network, see the following topics:
+
+- [Windows Defender Exploit Guard](windows-defender-exploit-guard.md)
+- [Protect devices from exploits with Windows Defender Exploit Guard](exploit-protection-exploit-guard.md)
+- [Configure and audit Exploit protection mitigations](customize-exploit-protection.md)
-We're still working on this content and will have it published soon!
+
+ ## Feature comparison
+
+ The table in this section illustrates the differences between EMET and Windows Defender Exploit Guard.
+
+ | Windows Defender Exploit Guard | EMET
+ -|:-:|:-:
+Windows versions | [!include[Check mark yes](images/svg/check-yes.svg)] All versions of Windows 10 starting with version 1709 | [!include[Check mark yes](images/svg/check-yes.svg)] Windows 8.1; Windows 8; Windows 7 Cannot be installed on Windows 10, version 1709 and later
+Installation requirements | [Windows Defender Security Center in Windows 10](../windows-defender-security-center/windows-defender-security-center.md) (no additional installation required) Windows Defender Exploit Guard is built into Windows - it doesn't require a separate tool or package for management, configuration, or deployment. | Available only as an additional download and must be installed onto a management device
+User interface | Modern interface integrated with the [Windows Defender Security Center](../windows-defender-security-center/windows-defender-security-center.md) | Older, complex interface that requires considerable ramp-up training
+Supportability | [!include[Check mark yes](images/svg/check-yes.svg)] [Dedicated submission-based support channel](https://www.microsoft.com/en-us/wdsi/filesubmission)[[1](#fn1)] [Part of the Windows 10 support lifecycle](https://support.microsoft.com/en-us/help/13853/windows-lifecycle-fact-sheet) | [!include[Check mark no](images/svg/check-no.svg)] Ends after July 31, 2018
+Updates | [!include[Check mark yes](images/svg/check-yes.svg)] Ongoing updates and development of new features, released twice yearly as part of the [Windows 10 semi-annual update channel](https://blogs.technet.microsoft.com/windowsitpro/2017/07/27/waas-simplified-and-aligned/) | [!include[Check mark no](images/svg/check-no.svg)] No planned updates or development
+Exploit protection | [!include[Check mark yes](images/svg/check-yes.svg)] All EMET mitigations plus new, specific mitigations ([see table](#mitigation-comparison)) [Can convert and import existing EMET configurations](import-export-exploit-protection-emet-xml.md) | [!include[Check mark yes](images/svg/check-yes.svg)] Limited set of mitigations
+Attack surface reduction[[2](#fn2)] | [!include[Check mark yes](images/svg/check-yes.svg)] [Helps block known infection vectors](attack-surface-reduction-exploit-guard.md) [Can configure individual rules](enable-attack-surface-reduction.md) | [!include[Check mark yes](images/svg/check-yes.svg)] Limited ruleset configuration only for modules (no processes)
+Network protection[[2](#fn2)] | [!include[Check mark yes](images/svg/check-yes.svg)] [Helps block malicious network connections](network-protection-exploit-guard.md) | [!include[Check mark no](images/svg/check-no.svg)] Not available
+Controlled folder access[[2](#fn2)] | [!include[Check mark yes](images/svg/check-yes.svg)] [Helps protect important folders](controlled-folders-exploit-guard.md) [Configurable for apps and folders](customize-controlled-folders-exploit-guard.md) | [!include[Check mark no](images/svg/check-no.svg)] Not available
+Configuration with GUI (user interface) | [!include[Check mark yes](images/svg/check-yes.svg)] [Use Windows Defender Security Center app to customize and manage configurations](customize-exploit-protection.md) | [!include[Check mark yes](images/svg/check-yes.svg)] Requires installation and use of EMET tool
+Configuration with Group Policy | [!include[Check mark yes](images/svg/check-yes.svg)] [Use Group Policy to deploy and manage configurations](import-export-exploit-protection-emet-xml.md#manage-or-deploy-a-configuration) | [!include[Check mark yes](images/svg/check-yes.svg)] Available
+Configuration with shell tools | [!include[Check mark yes](images/svg/check-yes.svg)] [Use PowerShell to customize and manage configurations](customize-exploit-protection.md#powershell-reference) | [!include[Check mark yes](images/svg/check-yes.svg)] Requires use of EMET tool (EMET_CONF)
+System Center Configuration Manager | [!include[Check mark yes](images/svg/check-yes.svg)] [Use Configuration Manager to customize, deploy, and manage configurations](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/create-deploy-exploit-guard-policy) | [!include[Check mark no](images/svg/check-no.svg)] Not available
+Microsoft Intune | [!include[Check mark yes](images/svg/check-yes.svg)] [Use Intune to customize, deploy, and manage configurations](https://docs.microsoft.com/en-us/intune/whats-new#window-defender-exploit-guard-is-a-new-set-of-intrusion-prevention-capabilities-for-windows-10----1063615---) | [!include[Check mark no](images/svg/check-no.svg)] Not available
+Reporting | [!include[Check mark yes](images/svg/check-yes.svg)] With [Windows event logs](event-views-exploit-guard.md) and [full audit mode reporting](audit-windows-defender-exploit-guard.md) [Full integration with Windows Defender Advanced Threat Protection](../windows-defender-atp/security-analytics-dashboard-windows-defender-advanced-threat-protection.md) | [!include[Check mark yes](images/svg/check-yes.svg)] Limited Windows event log monitoring
+Audit mode | [!include[Check mark yes](images/svg/check-yes.svg)] [Full audit mode with Windows event reporting](audit-windows-defender-exploit-guard.md) | [!include[Check mark no](images/svg/check-no.svg)] Limited to EAF, EAF+, and anti-ROP mitigations
-Check out the following topics for more information about Exploit protection:
+([1](#ref1)) Requires an enterprise subscription with Azure Active Directory or a [Software Assurance ID](https://www.microsoft.com/en-us/licensing/licensing-programs/software-assurance-default.aspx).
+
+([2](#ref2-1)) Additional requirements may apply (such as use of Windows Defender Antivirus). See [Windows Defender Exploit Guard requirements](windows-defender-exploit-guard.md#requirements) for more details. Customizable mitigation options that are configured with [Exploit protection](exploit-protection-exploit-guard.md) do not require Windows Defender Antivirus.
+
+
+
+## Mitigation comparison
+
+The mitigations available in EMET are included in Windows Defender Exploit Guard, under the [Exploit protection feature](exploit-protection-exploit-guard.md).
+
+The table in this section indicates the availability and support of native mitigations between EMET and Exploit protection.
+
+Mitigation | Available in Windows Defender Exploit Guard | Available in EMET
+-|:-:|:-:
+Arbitrary code guard (ACG) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] As "Memory Protection Check"
+Block remote images | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] As "Load Library Check"
+Block untrusted fonts | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)]
+Data Execution Prevention (DEP) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)]
+Export address filtering (EAF) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)]
+Force randomization for images (Mandatory ASLR) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)]
+NullPage Security Mitigation | [!include[Check mark yes](images/svg/check-yes.svg)] Included natively in Windows 10 See [Mitigate threats by using Windows 10 security features](../overview-of-threat-mitigations-in-windows-10.md#understanding-windows-10-in-relation-to-the-enhanced-mitigation-experience-toolkit) for more information | [!include[Check mark yes](images/svg/check-yes.svg)]
+Randomize memory allocations (Bottom-Up ASLR) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)]
+Simulate execution (SimExec) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)]
+Validate API invocation (CallerCheck) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)]
+Validate exception chains (SEHOP) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)]
+Validate stack integrity (StackPivot) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)]
+Certificate trust (configurable certificate pinning) | Windows 10 provides enterprise certificate pinning | [!include[Check mark yes](images/svg/check-yes.svg)]
+Heap spray allocation | Ineffective against newer browser-based exploits; newer mitigations provide better protection See [Mitigate threats by using Windows 10 security features](../overview-of-threat-mitigations-in-windows-10.md#understanding-windows-10-in-relation-to-the-enhanced-mitigation-experience-toolkit) for more information | [!include[Check mark yes](images/svg/check-yes.svg)]
+Block low integrity images | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)]
+Code integrity guard | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)]
+Disable extension points | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)]
+Disable Win32k system calls | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)]
+Do not allow child processes | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)]
+Import address filtering (IAF) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)]
+Validate handle usage | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)]
+Validate heap integrity | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)]
+Validate image dependency integrity | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)]
+
+
+
+
+
+
+>[!NOTE]
+>The Advanced ROP mitigations that are available in EMET are superseded by ACG in Windows 10, which other EMET advanced settings are enabled by default in Windows Defender Exploit Guard as part of enabling the anti-ROP mitigations for a process.
+>
+>See the [Mitigation threats by using Windows 10 security features](../overview-of-threat-mitigations-in-windows-10.md#understanding-windows-10-in-relation-to-the-enhanced-mitigation-experience-toolkit) for more information on how Windows 10 employs existing EMET technology.
+
+
+## Related topics
- [Protect devices from exploits with Windows Defender Exploit Guard](exploit-protection-exploit-guard.md)
- [Evaluate Exploit protection](evaluate-exploit-protection.md)
- [Enable Exploit protection](enable-exploit-protection.md)
- [Configure and audit Exploit protection mitigations](customize-exploit-protection.md)
- [Import, export, and deploy Exploit protection configurations](import-export-exploit-protection-emet-xml.md)
+
+
diff --git a/windows/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md b/windows/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md
index c147b811c2..c7f25e04df 100644
--- a/windows/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md
+++ b/windows/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md
@@ -11,7 +11,7 @@ ms.pagetype: security
localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 11/09/2017
---
diff --git a/windows/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md
index b0bc4e5eac..7511f2b65d 100644
--- a/windows/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md
+++ b/windows/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md
@@ -11,7 +11,7 @@ ms.pagetype: security
localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 12/01/2017
---
diff --git a/windows/threat-protection/windows-defender-exploit-guard/enable-exploit-protection.md b/windows/threat-protection/windows-defender-exploit-guard/enable-exploit-protection.md
index a461a35961..1f24f048fe 100644
--- a/windows/threat-protection/windows-defender-exploit-guard/enable-exploit-protection.md
+++ b/windows/threat-protection/windows-defender-exploit-guard/enable-exploit-protection.md
@@ -11,7 +11,7 @@ ms.pagetype: security
localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 12/12/2017
---
@@ -56,6 +56,9 @@ You can also set mitigations to audit mode. Audit mode allows you to test how th
For background information on how audit mode works, and when you might want to use it, see the [audit Windows Defender Exploit Guard topic](audit-windows-defender-exploit-guard.md).
+>[!WARNING]
+>Some security mitigation technologies may have compatibility issues with some applications. You should test Exploit protection in all target use scenarios by using [audit mode](audit-windows-defender-exploit-guard.md) before deploying the configuration across a production environment or the rest of your network.
+
You can also convert an existing EMET configuration file (in XML format) and import it into Exploit protection. This is useful if you have been using EMET and have a customized series of policies and mitigations that you want to keep using.
See the following topics for instructions on configuring Exploit protection mitigations and importing, exporting, and converting configurations:
diff --git a/windows/threat-protection/windows-defender-exploit-guard/enable-network-protection.md b/windows/threat-protection/windows-defender-exploit-guard/enable-network-protection.md
index 014071b7cf..2f89ddd49a 100644
--- a/windows/threat-protection/windows-defender-exploit-guard/enable-network-protection.md
+++ b/windows/threat-protection/windows-defender-exploit-guard/enable-network-protection.md
@@ -11,7 +11,7 @@ ms.pagetype: security
localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 10/16/2017
---
diff --git a/windows/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md b/windows/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md
index 93cf4d2df8..a282799eb8 100644
--- a/windows/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md
+++ b/windows/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md
@@ -11,7 +11,7 @@ ms.pagetype: security
localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 11/20/2017
---
diff --git a/windows/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md b/windows/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md
index a31b2ff2e6..9768e44f92 100644
--- a/windows/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md
+++ b/windows/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md
@@ -11,7 +11,7 @@ ms.pagetype: security
localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 11/20/2017
---
diff --git a/windows/threat-protection/windows-defender-exploit-guard/evaluate-exploit-protection.md b/windows/threat-protection/windows-defender-exploit-guard/evaluate-exploit-protection.md
index 660b96a36a..b2ee7653e1 100644
--- a/windows/threat-protection/windows-defender-exploit-guard/evaluate-exploit-protection.md
+++ b/windows/threat-protection/windows-defender-exploit-guard/evaluate-exploit-protection.md
@@ -11,7 +11,7 @@ ms.pagetype: security
localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 11/20/2017
---
diff --git a/windows/threat-protection/windows-defender-exploit-guard/evaluate-network-protection.md b/windows/threat-protection/windows-defender-exploit-guard/evaluate-network-protection.md
index f3d44b112d..0d7c214b39 100644
--- a/windows/threat-protection/windows-defender-exploit-guard/evaluate-network-protection.md
+++ b/windows/threat-protection/windows-defender-exploit-guard/evaluate-network-protection.md
@@ -11,7 +11,7 @@ ms.pagetype: security
localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 11/20/2017
---
# Evaluate Network protection
diff --git a/windows/threat-protection/windows-defender-exploit-guard/evaluate-windows-defender-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/evaluate-windows-defender-exploit-guard.md
index 2b0ebfe200..3fc73670a4 100644
--- a/windows/threat-protection/windows-defender-exploit-guard/evaluate-windows-defender-exploit-guard.md
+++ b/windows/threat-protection/windows-defender-exploit-guard/evaluate-windows-defender-exploit-guard.md
@@ -11,7 +11,7 @@ ms.pagetype: security
localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 11/20/2017
---
diff --git a/windows/threat-protection/windows-defender-exploit-guard/event-views-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/event-views-exploit-guard.md
index 292c45961e..687dea2866 100644
--- a/windows/threat-protection/windows-defender-exploit-guard/event-views-exploit-guard.md
+++ b/windows/threat-protection/windows-defender-exploit-guard/event-views-exploit-guard.md
@@ -8,7 +8,7 @@ ms.prod: w10
ms.mktglfcycl: manage
ms.sitesec: library
ms.pagetype: security
-ms.date: 08/25/2017
+ms.date: 12/12/2017
localizationpriority: medium
author: iaanw
ms.author: iawilt
@@ -29,13 +29,13 @@ ms.author: iawilt
- Enterprise security administrators
-Each of the four features in Windows Defender Exploit Guard allow you to review events in the Windos Event log. This is useful so you can monitor what rules or settings are working, and determine if any settings are too "noisy" or impacting your day to day workflow.
+Each of the four features in Windows Defender Exploit Guard allow you to review events in the Windows Event log. This is useful so you can monitor what rules or settings are working, and determine if any settings are too "noisy" or impacting your day to day workflow.
Reviewing the events is also handy when you are evaluating the features, as you can enable audit mode for the features or settings, and then review what would have happened if they were fully enabled.
This topic lists all the events, their associated feature or setting, and describes how to create custom views to filter to specific events.
-You can also get detailed reporting into Windows Defender EG events and blocks as part of the usual [alert investigation scenarios](../windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md) in the Windows Defender Security Center console, which you gain access to if you have an E5 subsciption and use [Windows Defender Advanced Threat Protection](../windows-defender-atp/windows-defender-advanced-threat-protection.md).
+You can also get detailed reporting into Windows Defender EG events and blocks as part of the usual [alert investigation scenarios](../windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md) in the Windows Defender Security Center console, which you gain access to if you have an E5 subscription and use [Windows Defender Advanced Threat Protection](../windows-defender-atp/windows-defender-advanced-threat-protection.md).
## Use custom views to review Windows Defender Exploit Guard features
diff --git a/windows/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md
index 447c78fb6f..a260bf90d4 100644
--- a/windows/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md
+++ b/windows/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md
@@ -11,7 +11,7 @@ ms.pagetype: security
localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 12/12/2017
---
@@ -53,12 +53,13 @@ Exploit protection works best with [Windows Defender Advanced Threat Protection]
You can also use [audit mode](audit-windows-defender-exploit-guard.md) to evaluate how Exploit protection would impact your organization if it were enabled.
- Many of the features in the [Enhanced Mitigation Experience Toolkit (EMET)](https://technet.microsoft.com/en-us/security/jj653751) have been included in Exploit protection, and you can convert and import existing EMET configuration profiles into Exploit protection.
+ Many of the features in the [Enhanced Mitigation Experience Toolkit (EMET)](https://technet.microsoft.com/en-us/security/jj653751) have been included in Exploit protection, and you can convert and import existing EMET configuration profiles into Exploit protection. See the [Comparison between Enhanced Mitigation Experience Toolkit and Windows Defender Exploit Guard topic](emet-exploit-protection-exploit-guard.md) for more information on how Exploit protection supersedes EMET and what the benefits are when considering moving to Exploit protection on Windows 10.
>[!IMPORTANT]
>If you are currently using EMET you should be aware that [EMET will reach end of life on July 31, 2018](https://blogs.technet.microsoft.com/srd/2016/11/03/beyond-emet/). You should consider replacing EMET with Exploit protection in Windows 10. You can [convert an existing EMET configuration file into Exploit protection](import-export-exploit-protection-emet-xml.md#convert-an-emet-configuration-file-to-an-exploit-protection-configuration-file) to make the migration easier and keep your existing settings.
-
+>[!WARNING]
+>Some security mitigation technologies may have compatibility issues with some applications. You should test Exploit protection in all target use scenarios by using [audit mode](audit-windows-defender-exploit-guard.md) before deploying the configuration across a production environment or the rest of your network.
## Requirements
diff --git a/windows/threat-protection/windows-defender-exploit-guard/graphics.md b/windows/threat-protection/windows-defender-exploit-guard/graphics.md
index 62fbf7102a..2066795922 100644
--- a/windows/threat-protection/windows-defender-exploit-guard/graphics.md
+++ b/windows/threat-protection/windows-defender-exploit-guard/graphics.md
@@ -1,3 +1,6 @@
+---
+ms.date: 09/18/2017
+---
diff --git a/windows/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md b/windows/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md
index baf37dc153..1809487c8d 100644
--- a/windows/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md
+++ b/windows/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md
@@ -11,7 +11,7 @@ ms.pagetype: security
localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 11/30/2017
---
diff --git a/windows/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard.md
index a81cd5aa90..772ad2e7b0 100644
--- a/windows/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard.md
+++ b/windows/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard.md
@@ -11,7 +11,7 @@ ms.pagetype: security
localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 11/20/2017
---
@@ -95,5 +95,5 @@ You can review the Windows event log to see events that are created when Network
Topic | Description
---|---
-[Evaluate Network protection](evaluate-network-protection.md) | Undertake aa quick scenario that demonstrate how the feature works, and what events would typically be created.
-[Enable Network protection](enable-network-protection.md) | Use Group Policy, PowerShell, or MDM CSPs to enable and manage the Network protection feature in your network.
\ No newline at end of file
+[Evaluate Network protection](evaluate-network-protection.md) | Undertake a quick scenario that demonstrate how the feature works, and what events would typically be created.
+[Enable Network protection](enable-network-protection.md) | Use Group Policy, PowerShell, or MDM CSPs to enable and manage the Network protection feature in your network.
diff --git a/windows/threat-protection/windows-defender-exploit-guard/prerelease.md b/windows/threat-protection/windows-defender-exploit-guard/prerelease.md
index 1164534c8a..f22001f19d 100644
--- a/windows/threat-protection/windows-defender-exploit-guard/prerelease.md
+++ b/windows/threat-protection/windows-defender-exploit-guard/prerelease.md
@@ -1,2 +1,5 @@
+---
+ms.date: 08/25/2017
+---
> [!IMPORTANT]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
\ No newline at end of file
diff --git a/windows/threat-protection/windows-defender-exploit-guard/troubleshoot-asr.md b/windows/threat-protection/windows-defender-exploit-guard/troubleshoot-asr.md
new file mode 100644
index 0000000000..17d4105837
--- /dev/null
+++ b/windows/threat-protection/windows-defender-exploit-guard/troubleshoot-asr.md
@@ -0,0 +1,128 @@
+---
+title: Troubleshoot problems with Attack surface reduction rules
+description: Check pre-requisites, use audit mode, add exclusions, or collect diagnostic data to help troubleshoot issues
+keywords: troubleshoot, error, fix, windows defender eg, asr, rules, hips, troubleshoot, audit, exclusion, false positive, broken, blocking
+search.product: eADQiWindows 10XVcnh
+ms.pagetype: security
+ms.prod: w10
+ms.mktglfcycl: manage
+ms.sitesec: library
+ms.pagetype: security
+ms.localizationpriority: medium
+author: iaanw
+ms.author: iawilt
+ms.date: 12/12/2017
+---
+
+# Troubleshoot Attack surface reduction rules
+
+**Applies to:**
+
+- Windows 10, version 1709
+
+**Audience**
+
+- IT administrators
+
+When you use [Attack surface reduction rules](attack-surface-reduction-exploit-guard.md) you may encounter issues, such as:
+
+- A rule blocks a file, process, or performs some other action that it should not (false positive)
+- A rule does not work as described, or does not block a file or process that it should (false negative)
+
+
+
+There are four steps to troubleshooting these problems:
+
+1. Confirm that you have met all pre-requisites
+2. Use audit mode to test the rule
+3. Add exclusions for the specified rule (for false positives)
+3. Submit support logs
+
+
+
+## Confirm pre-requisites
+
+Attack surface reduction (ASR) will only work on devices with the following conditions:
+
+>[!div class="checklist"]
+> - Endpoints are running Windows 10, version 1709 (also known as the Fall Creators Update).
+> - Endpoints are using Windows Defender Antivirus as the sole antivirus protection app. [Using any other antivirus app will cause Windows Defender AV to disable itself](../windows-defender-antivirus/windows-defender-antivirus-compatibility.md).
+> - [Real-time protection](../windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) is enabled.
+> - Audit mode is not enabled. Use Group Policy to set the rule to **Disabled** (value: **0**) as described in the [Enable ASR topic](enable-attack-surface-reduction.md#use-group-policy-to-enable-or-audit-attack-surface-reduction-rules).
+
+
+If these pre-requisites have all been met, proceed to the next step to test the rule in audit mode.
+
+## Use audit mode to test the rule
+
+There are two ways that you can test if the rule is working.
+
+You can use a pre-configured demo tool to confirm ASR is generally working on the device, or you can use audit mode, which enables the rule for reporting only.
+
+The demo tool uses pre-configured scenarios and processes, which can be useful to first see if the ASR feature as a whole is operating correctly.
+
+If you encounter problems when running the demo tool, check that the device you are testing the tool on meets the [pre-requisites listed above](#confirm-pre-requisites).
+
+You should follow the instructions in the section [Use the demo tool to see how ASR works](evaluate-attack-surface-reduction.md#use-the-demo-tool-to-see-how-attack-surface-reduction-works) to test the specific rule you are encountering problems with.
+
+>[!TIP]
+>While the instructions for using the demo tool are intended for evaluating or seeing how ASR works, you can use it to test that the rule works on known scenarios that we have already extensively tested before we released the feature.
+
+Audit mode allows the rule to report as if it actually blocked the file or process, but will still allow the file to run.
+
+1. Enable audit mode for the specific rule you want to test. Use Group Policy to set the rule to **Audit mode** (value: **2**) as described in the [Enable ASR topic](enable-attack-surface-reduction.md#use-group-policy-to-enable-or-audit-attack-surface-reduction-rules).
+2. Perform the activity that is causing an issue (for example, open or execute the file or process that should be blocked but is being allowed).
+3. [Review the ASR event logs](attack-surface-reduction-exploit-guard.md#review-attack-surface-reduction-events-in-windows-event-viewer) to see if the rule would have blocked the file or process if the rule had been set to **Enabled**.
+
+
+>[!TIP]
+>Audit mode will stop the rule from blocking the file or process.
+>
+>If a rule is not blocking a file or process that you are expecting it should block, first check if audit mode is enabled.
+>
+>Audit mode may have been enabled for testing another feature in Windows Defender Exploit Guard, or by an automated PowerShell script, and may not have been disabled after the tests were completed.
+
+
+If you've tested the rule with the demo tool and with audit mode, and ASR is working on pre-configured scenarios, but the rule is not working as expected, proceed to either of the following sections based on your situation:
+
+1. If the ASR rule is blocking something that it should not block (also known as a false positive), you can [first add an ASR exclusion](#add-exclusions-for-a-false-positive).
+2. If the ASR rule is not blocking something that it should block (also known as a false negative), you can proceed immediately to the last step, [collecting diagnostic data and submitting the issue to us](#collect-diagnostic-data).
+
+## Add exclusions for a false positive
+
+You can add exclusions to ASR to prevent ASR rules from evaluating the excluded files or folders.
+
+This is useful if you have enabled a rule, and it is blocking a file, process, or action that you believe it should not block. You can then collect data from an endpoint where the rule is not working correctly and send that information to us.
+
+To add an exclusion, see the [Customize Attack surface reduction](customize-attack-surface-reduction.md) topic.
+
+>[!IMPORTANT]
+>You can specify individual files and folders to be excluded, but you cannot specify individual rules.
+>
+>This means any files or folders that are excluded will be excluded from all ASR rules.
+
+
+If you have followed all previous troubleshooting steps, and you still have a problem (in particular, if you have a false positive), you should proceed to the next step to collect diagnostic information and send it to us.
+
+## Collect diagnostic data
+
+You can use the [Windows Defender Security Intelligence web-based submission form](https://www.microsoft.com/en-us/wdsi/filesubmission) to report a problem with ASR.
+
+When you fill out the submission form, you will be asked to specify whether it is a false negative or false positive. If you have an E5 subscription for Windows Defender Advanced Threat Protection, you can also [provide a link to the associated alert](../windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md) (if there is one).
+
+You must also attach associated files in a .zip file (such as the file or executable that is not being blocked, or being incorrectly blocked) along with a diagnostic .cab file to your submission.
+
+Follow the link below for instructions on how to collect the .cab file:
+
+> [!div class="nextstepaction"]
+> [Collect and submit diagnostic data Windows Defender Exploit Guard issues](collect-cab-files-exploit-guard-submission.md)
+
+
+
+
+
+
+## Related topics
+
+- [Windows Defender Exploit Guard](windows-defender-exploit-guard.md)
+- [Attack surface reduction](attack-surface-reduction-exploit-guard.md)
diff --git a/windows/threat-protection/windows-defender-exploit-guard/troubleshoot-np.md b/windows/threat-protection/windows-defender-exploit-guard/troubleshoot-np.md
new file mode 100644
index 0000000000..bb99de7665
--- /dev/null
+++ b/windows/threat-protection/windows-defender-exploit-guard/troubleshoot-np.md
@@ -0,0 +1,104 @@
+---
+title: Troubleshoot problems with Network protection
+description: Check pre-requisites, use audit mode, add exclusions, or collect diagnostic data to help troubleshoot issues
+keywords: troubleshoot, error, fix, windows defender eg, asr, rules, hips, troubleshoot, audit, exclusion, false positive, broken, blocking
+search.product: eADQiWindows 10XVcnh
+ms.pagetype: security
+ms.prod: w10
+ms.mktglfcycl: manage
+ms.sitesec: library
+ms.pagetype: security
+ms.localizationpriority: medium
+author: iaanw
+ms.author: iawilt
+ms.date: 12/12/2017
+---
+
+# Troubleshoot Network protection
+
+**Applies to:**
+
+- Windows 10, version 1709
+
+**Audience**
+
+- IT administrators
+
+When you use [Network protection](network-protection-exploit-guard.md) you may encounter issues, such as:
+
+- Network protection blocks a website that is safe (false positive)
+- Network protection fails to block a suspicious or known malicious website (false negative)
+
+
+
+There are four steps to troubleshooting these problems:
+
+1. Confirm that you have met all pre-requisites
+2. Use audit mode to test the rule
+3. Add exclusions for the specified rule (for false positives)
+3. Submit support logs
+
+
+
+## Confirm pre-requisites
+
+Windows Defender Exploit Guard will only work on devices with the following conditions:
+
+>[!div class="checklist"]
+> - Endpoints are running Windows 10, version 1709 (also known as the Fall Creators Update).
+> - Endpoints are using Windows Defender Antivirus as the sole antivirus protection app. [Using any other antivirus app will cause Windows Defender AV to disable itself](../windows-defender-antivirus/windows-defender-antivirus-compatibility.md).
+> - [Real-time protection](../windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) is enabled.
+> - [Cloud-delivered protection](../windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md) is enabled.
+> - Audit mode is not enabled. Use Group Policy to set the rule to **Disabled** (value: **0**) as described in the [Enable Network protection topic](enable-network-protection.md#use-group-policy-to-enable-or-audit-network-protection).
+
+
+If these pre-requisites have all been met, proceed to the next step to test the rule in audit mode.
+
+## Use audit mode to test the rule
+
+There are two ways that you can test if the feature is working - you can use a demo website, and you can use audit mode.
+
+You can enable Network protection and then visit a website that we've created to demo the feature. The website will always be reported as blocked by Network protection. See the [evaluate Network protection](evaluate-network-protection.md) topic for instructions.
+
+If you encounter problems when running the evaluation scenario, check that the device you are testing the tool on meets the [pre-requisites listed above](#confirm-pre-requisites).
+
+>[!TIP]
+>While the instructions for using the demo website are intended for evaluating or seeing how Network protection works, you can use it to test that the feature is working properly and narrow down on the cause of the problem.
+
+You can also use audit mode and then attempt to visit the site or IP (IPv4) address you do or don't want to block. Audit mode lets Network protection report to the Windows event log as if it actually blocked the site or connection to an IP address, but will still allow the file to run.
+
+1. Enable audit mode for Network protection. Use Group Policy to set the rule to **Audit mode** as described in the [Enable Network protection topic](enable-network-protection.md#use-group-policy-to-enable-or-audit-network-protection).
+2. Perform the connection activity that is causing an issue (for example, attempt to visit the site, or connect to the IP address you do or don't want to block).
+3. [Review the Network protection event logs](network-protection-exploit-guard.md#review-network-protection-events-in-windows-event-viewer) to see if the feature would have blocked the connection if it had been set to **Enabled**.
+
+
+>[!IMPORTANT]
+>Audit mode will stop Network protection from blocking known malicious connections.
+>
+>If Network protection is not blocking a connection that you are expecting it should block, first check if audit mode is enabled.
+>
+>Audit mode may have been enabled for testing another feature in Windows Defender Exploit Guard, or by an automated PowerShell script, and may not have been disabled after the tests were completed.
+
+
+If you've tested the feature with the demo site and with audit mode, and Network protection is working on pre-configured scenarios, but is not working as expected for a specific connection, proceed to the next section to report the site or IP address.
+
+## Report a false positive or false negative
+
+You can use the [Windows Defender Security Intelligence web-based submission form](https://www.microsoft.com/en-us/wdsi/filesubmission) to report a problem with Network protection.
+
+When you fill out the submission form, you will be asked to specify whether it is a false negative or false positive. If you have an E5 subscription for Windows Defender Advanced Threat Protection, you can also [provide a link to the associated alert](../windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md) (if there is one).
+
+You can also attach a diagnostic .cab file to your submission if you wish (this is not required). Follow the link below for instructions on how to collect the .cab file:
+
+> [!div class="nextstepaction"]
+> [Collect and submit diagnostic data Windows Defender Exploit Guard issues](collect-cab-files-exploit-guard-submission.md)
+
+
+
+
+
+
+## Related topics
+
+- [Windows Defender Exploit Guard](windows-defender-exploit-guard.md)
+- [Network protection](network-protection-exploit-guard.md)
diff --git a/windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md
index 22db1ea61d..817038ca1c 100644
--- a/windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md
+++ b/windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md
@@ -11,7 +11,7 @@ ms.pagetype: security
localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 08/25/2017
+ms.date: 12/12/2017
---
@@ -35,7 +35,7 @@ There are four features in Windows Defender EG:
- [Exploit protection](exploit-protection-exploit-guard.md) can apply exploit mitigation techniques to apps your organization uses, both individually and to all apps
- [Attack surface reduction rules](attack-surface-reduction-exploit-guard.md) can reduce the attack surface of your applications with intelligent rules that stop the vectors used by Office-, script- and mail-based malware
-- [Network protection](network-protection-exploit-guard.md) extends the malware and social engineering protection offered by Windows Defender SmartScreen in Edge to cover network traffic and connectivity on your organization's devices
+- [Network protection](network-protection-exploit-guard.md) extends the malware and social engineering protection offered by Windows Defender SmartScreen in Microsoft Edge to cover network traffic and connectivity on your organization's devices
- [Controlled folder access](controlled-folders-exploit-guard.md) helps protect files in key system folders from changes made by malicious and suspicious apps, including file-encrypting ransomware malware
@@ -57,6 +57,8 @@ Windows Defender EG can be managed and reported on in the Windows Defender Secur
You can use the Windows Defender ATP console to obtain detailed reporting into events and blocks as part of the usual [alert investigation scenarios](../windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md). You can [sign up for a free trial of Windows Defender ATP](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=cx-docs-msa4053440) to see how it works.
+## Requirements
+
Each of the features in Windows Defender EG have slightly different requirements:
Feature | [Windows Defender Antivirus](../windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md) | [Windows Defender Advanced Threat Protection license](../windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md)
diff --git a/windows/threat-protection/windows-defender-security-center/images/wdsc-all-hide.png b/windows/threat-protection/windows-defender-security-center/images/wdsc-all-hide.png
new file mode 100644
index 0000000000..98083a937c
Binary files /dev/null and b/windows/threat-protection/windows-defender-security-center/images/wdsc-all-hide.png differ
diff --git a/windows/threat-protection/windows-defender-security-center/wdsc-app-browser-control.md b/windows/threat-protection/windows-defender-security-center/wdsc-app-browser-control.md
index 6ddf83e945..4bc78122e2 100644
--- a/windows/threat-protection/windows-defender-security-center/wdsc-app-browser-control.md
+++ b/windows/threat-protection/windows-defender-security-center/wdsc-app-browser-control.md
@@ -73,4 +73,9 @@ This can only be done in Group Policy.
6. Open the **Hide the App and browser protection area** setting and set it to **Enabled**. Click **OK**.
-7. [Deploy the updated GPO as you normally do](https://msdn.microsoft.com/en-us/library/ee663280(v=vs.85).aspx).
\ No newline at end of file
+7. [Deploy the updated GPO as you normally do](https://msdn.microsoft.com/en-us/library/ee663280(v=vs.85).aspx).
+
+>[!NOTE]
+>If you hide all sections then the app will show a restricted interface, as in the following screenshot:
+>
+>
\ No newline at end of file
diff --git a/windows/threat-protection/windows-defender-security-center/wdsc-device-performance-health.md b/windows/threat-protection/windows-defender-security-center/wdsc-device-performance-health.md
index 0a7dad3e39..088e882a0f 100644
--- a/windows/threat-protection/windows-defender-security-center/wdsc-device-performance-health.md
+++ b/windows/threat-protection/windows-defender-security-center/wdsc-device-performance-health.md
@@ -53,3 +53,7 @@ This can only be done in Group Policy.
7. [Deploy the updated GPO as you normally do](https://msdn.microsoft.com/en-us/library/ee663280(v=vs.85).aspx).
+>[!NOTE]
+>If you hide all sections then the app will show a restricted interface, as in the following screenshot:
+>
+>
\ No newline at end of file
diff --git a/windows/threat-protection/windows-defender-security-center/wdsc-family-options.md b/windows/threat-protection/windows-defender-security-center/wdsc-family-options.md
index 4c92daa4bf..14ba41602f 100644
--- a/windows/threat-protection/windows-defender-security-center/wdsc-family-options.md
+++ b/windows/threat-protection/windows-defender-security-center/wdsc-family-options.md
@@ -50,4 +50,9 @@ This can only be done in Group Policy.
6. Open the **Hide the Family options area** setting and set it to **Enabled**. Click **OK**.
-7. [Deploy the updated GPO as you normally do](https://msdn.microsoft.com/en-us/library/ee663280(v=vs.85).aspx).
\ No newline at end of file
+7. [Deploy the updated GPO as you normally do](https://msdn.microsoft.com/en-us/library/ee663280(v=vs.85).aspx).
+
+>[!NOTE]
+>If you hide all sections then the app will show a restricted interface, as in the following screenshot:
+>
+>
\ No newline at end of file
diff --git a/windows/threat-protection/windows-defender-security-center/wdsc-firewall-network-protection.md b/windows/threat-protection/windows-defender-security-center/wdsc-firewall-network-protection.md
index 3ca618996e..66e975a809 100644
--- a/windows/threat-protection/windows-defender-security-center/wdsc-firewall-network-protection.md
+++ b/windows/threat-protection/windows-defender-security-center/wdsc-firewall-network-protection.md
@@ -50,3 +50,8 @@ This can only be done in Group Policy.
7. [Deploy the updated GPO as you normally do](https://msdn.microsoft.com/en-us/library/ee663280(v=vs.85).aspx).
+>[!NOTE]
+>If you hide all sections then the app will show a restricted interface, as in the following screenshot:
+>
+>
+
diff --git a/windows/threat-protection/windows-defender-security-center/wdsc-virus-threat-protection.md b/windows/threat-protection/windows-defender-security-center/wdsc-virus-threat-protection.md
index 6c7211c75c..1346ef4193 100644
--- a/windows/threat-protection/windows-defender-security-center/wdsc-virus-threat-protection.md
+++ b/windows/threat-protection/windows-defender-security-center/wdsc-virus-threat-protection.md
@@ -53,4 +53,9 @@ This can only be done in Group Policy.
6. Open the **Hide the Virus and threat protection area** setting and set it to **Enabled**. Click **OK**.
-7. [Deploy the updated GPO as you normally do](https://msdn.microsoft.com/en-us/library/ee663280(v=vs.85).aspx).
\ No newline at end of file
+7. [Deploy the updated GPO as you normally do](https://msdn.microsoft.com/en-us/library/ee663280(v=vs.85).aspx).
+
+>[!NOTE]
+>If you hide all sections then the app will show a restricted interface, as in the following screenshot:
+>
+>
\ No newline at end of file
diff --git a/windows/threat-protection/windows-defender-security-center/windows-defender-security-center.md b/windows/threat-protection/windows-defender-security-center/windows-defender-security-center.md
index ddaabe2ec0..8c998be64f 100644
--- a/windows/threat-protection/windows-defender-security-center/windows-defender-security-center.md
+++ b/windows/threat-protection/windows-defender-security-center/windows-defender-security-center.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 10/12/2017
+ms.date: 10/17/2017
---
@@ -55,7 +55,10 @@ You can find more information about each section, including options for configur
- [Family options](wdsc-family-options.md), which includes access to parental controls along with tips and information for keeping kids safe online
-
+>[!NOTE]
+>If you hide all sections then the app will show a restricted interface, as in the following screenshot:
+>
+>
diff --git a/windows/threat-protection/windows-defender-smartscreen/images/windows-defender-smartscreen-control.png b/windows/threat-protection/windows-defender-smartscreen/images/windows-defender-smartscreen-control.png
index b2700addba..e51cd9384c 100644
Binary files a/windows/threat-protection/windows-defender-smartscreen/images/windows-defender-smartscreen-control.png and b/windows/threat-protection/windows-defender-smartscreen/images/windows-defender-smartscreen-control.png differ
diff --git a/windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-available-settings.md b/windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-available-settings.md
index 951336cea2..9bffa0146b 100644
--- a/windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-available-settings.md
+++ b/windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-available-settings.md
@@ -6,8 +6,9 @@ ms.prod: w10
ms.mktglfcycl: explore
ms.sitesec: library
ms.pagetype: security
-author: eross-msft
+author: jasongerend
ms.localizationpriority: high
+ms.date: 1/26/2018
---
# Available Windows Defender SmartScreen Group Policy and mobile device management (MDM) settings
**Applies to:**
@@ -68,7 +69,8 @@ SmartScreen uses registry-based Administrative Template policy settings. For mor
## MDM settings
-If you manage your policies using Microsoft Intune, you'll want to use these MDM policy settings. All settings support both desktop computers (running Windows 10 Pro or Windows 10 Enterprise, enrolled with Microsoft Intune) and Windows 10 Mobile devices.
+If you manage your policies using Microsoft Intune, you'll want to use these MDM policy settings. All settings support both desktop computers (running Windows 10 Pro or Windows 10 Enterprise, enrolled with Microsoft Intune) and Windows 10 Mobile devices.
+For SmartScreen Internet Explorer MDM policies, see [Policy CSP - InternetExplorer](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer).
Setting
@@ -83,8 +85,8 @@ If you manage your policies using Microsoft Intune, you'll want to use these MDM
URI full path. ./Vendor/MSFT/Policy/Config/Browser/AllowSmartScreen
Data type. Integer
Allowed values:
-
0 . Turns off Windows Defender SmartScreen.
-
1. Turns on Windows Defender SmartScreen.
+
0 . Turns off Windows Defender SmartScreen in Edge.
+
1. Turns on Windows Defender SmartScreen in Edge.
@@ -107,8 +109,8 @@ If you manage your policies using Microsoft Intune, you'll want to use these MDM
URI full path. ./Vendor/MSFT/Policy/Config/SmartScreen/EnableSmartScreenInShell
Data type. Integer
Allowed values:
-
0 . Turns off SmartScreen in Windows.
-
1. Turns on SmartScreen in Windows.
+
0 . Turns off SmartScreen in Windows for app and file execution.
+
1. Turns on SmartScreen in Windows for app and file execution.
diff --git a/windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md b/windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md
index 9f850fbb1d..e5b587a7fe 100644
--- a/windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md
+++ b/windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: security
author: eross-msft
ms.localizationpriority: high
+ms.date: 07/27/2017
---
# Windows Defender SmartScreen
@@ -42,7 +43,7 @@ Windows Defender SmartScreen helps to provide an early warning system against we
- **Operating system integration.** SmartScreen is integrated into the Windows 10 operating system, meaning that it checks any files an app (including 3rd-party browsers and email clients) attempts to download and run.
-- **Improved heuristics and telemetry.** SmartScreen is constantly learning and endeavoring to stay up-to-date, so it can help to protect you against potentially malicious sites and files.
+- **Improved heuristics and diagnostic data.** SmartScreen is constantly learning and endeavoring to stay up-to-date, so it can help to protect you against potentially malicious sites and files.
- **Management through Group Policy and Microsoft Intune.** SmartScreen supports using both Group Policy and Microsoft Intune settings. For more info about all available settings, see [Available Windows Defender SmartScreen Group Policy and mobile device management (MDM) settings](windows-defender-smartscreen-available-settings.md).
diff --git a/windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device.md b/windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device.md
index 6d68a0784a..508f23802e 100644
--- a/windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device.md
+++ b/windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: security
author: eross-msft
ms.localizationpriority: high
+ms.date: 10/13/2017
---
# Set up and use Windows Defender SmartScreen on individual devices
@@ -49,7 +50,7 @@ Starting with Windows 10, version 1703 your employees can use Windows Defender S
- In the **SmartScreen from Microsoft Store apps** area:
- - **Block** or **Warn.** Warns employees that the sites and downloads used by Microsoft Store apps are potentially dangerous, but allows the action to continue.
+ - **Warn.** Warns employees that the sites and downloads used by Microsoft Store apps are potentially dangerous, but allows the action to continue.
- **Off.** Turns off SmartScreen, so an employee isn't alerted or stopped from visiting sites or from downloading potentially malicious apps and files.
diff --git a/windows/threat-protection/windows-information-protection/app-behavior-with-wip.md b/windows/threat-protection/windows-information-protection/app-behavior-with-wip.md
index 853ef9a50d..28b4ca2adc 100644
--- a/windows/threat-protection/windows-information-protection/app-behavior-with-wip.md
+++ b/windows/threat-protection/windows-information-protection/app-behavior-with-wip.md
@@ -8,6 +8,7 @@ ms.pagetype: security
ms.sitesec: library
author: eross-msft
ms.localizationpriority: medium
+ms.date: 09/11/2017
---
# Unenlightened and enlightened app behavior while using Windows Information Protection (WIP)
diff --git a/windows/threat-protection/windows-information-protection/collect-wip-audit-event-logs.md b/windows/threat-protection/windows-information-protection/collect-wip-audit-event-logs.md
index 922db68920..c0310f6f4e 100644
--- a/windows/threat-protection/windows-information-protection/collect-wip-audit-event-logs.md
+++ b/windows/threat-protection/windows-information-protection/collect-wip-audit-event-logs.md
@@ -7,6 +7,7 @@ ms.sitesec: library
ms.pagetype: security
author: eross-msft
ms.localizationpriority: medium
+ms.date: 09/11/2017
---
# How to collect Windows Information Protection (WIP) audit event logs
diff --git a/windows/threat-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md b/windows/threat-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md
index a671cb8bc6..862200bf00 100644
--- a/windows/threat-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md
+++ b/windows/threat-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: security
author: eross-msft
ms.localizationpriority: medium
+ms.date: 10/31/2017
---
# Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate
diff --git a/windows/threat-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure.md b/windows/threat-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure.md
index 163ef51a0f..32d3fa955b 100644
--- a/windows/threat-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure.md
+++ b/windows/threat-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: security
author: eross-msft
ms.localizationpriority: medium
+ms.date: 09/11/2017
---
# Associate and deploy a VPN policy for Windows Information Protection (WIP) using the Azure portal for Microsoft Intune
diff --git a/windows/threat-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune.md b/windows/threat-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune.md
index 83010d82bf..b31e26bc2e 100644
--- a/windows/threat-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune.md
+++ b/windows/threat-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune.md
@@ -9,6 +9,7 @@ ms.sitesec: library
ms.pagetype: security
author: eross-msft
ms.localizationpriority: medium
+ms.date: 09/11/2017
---
# Associate and deploy a VPN policy for Windows Information Protection (WIP) using the classic console for Microsoft Intune
diff --git a/windows/threat-protection/windows-information-protection/create-wip-policy-using-intune-azure.md b/windows/threat-protection/windows-information-protection/create-wip-policy-using-intune-azure.md
index 4255d5c2e8..044e461c43 100644
--- a/windows/threat-protection/windows-information-protection/create-wip-policy-using-intune-azure.md
+++ b/windows/threat-protection/windows-information-protection/create-wip-policy-using-intune-azure.md
@@ -7,6 +7,7 @@ ms.sitesec: library
ms.pagetype: security
author: eross-msft
ms.localizationpriority: medium
+ms.date: 10/16/2017
---
# Create a Windows Information Protection (WIP) policy with MDM using the Azure portal for Microsoft Intune
@@ -457,7 +458,7 @@ There are no default locations included with WIP, you must add each of your netw
After you create and deploy your WIP policy to your employees, Windows begins to encrypt your corporate data on the employees’ local device drive. If somehow the employees’ local encryption keys get lost or revoked, the encrypted data can become unrecoverable. To help avoid this possibility, the Data Recovery Agent (DRA) certificate lets Windows use an included public key to encrypt the local data while you maintain the private key that can unencrypt the data.
>[!Important]
->Using a DRA certificate isn’t mandatory. However, we strongly recommend it. For more info about how to find and export your data recovery certificate, see the [Data Recovery and Encrypting File System (EFS)](https://go.microsoft.com/fwlink/p/?LinkId=761462) topic. For more info about creating and verifying your EFS DRA certificate, see the [Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](https://tnstage.redmond.corp.microsoft.com/en-us/itpro/windows/keep-secure/create-and-verify-an-efs-dra-certificate) topic.
+>Using a DRA certificate isn’t mandatory. However, we strongly recommend it. For more info about how to find and export your data recovery certificate, see the [Data Recovery and Encrypting File System (EFS)](https://go.microsoft.com/fwlink/p/?LinkId=761462) topic. For more info about creating and verifying your EFS DRA certificate, see the [Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](https://docs.microsoft.com/en-us/windows/threat-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate) topic.
**To upload your DRA certificate**
1. From the **App policy** blade, click the name of your policy, and then click **Advanced settings** from the menu that appears.
@@ -529,4 +530,4 @@ Optionally, if you don’t want everyone in your organization to be able to shar
- [Azure RMS Documentation Update for May 2016](https://blogs.technet.microsoft.com/enterprisemobility/2016/05/31/azure-rms-documentation-update-for-may-2016/)
>[!NOTE]
->Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Contributing to TechNet content](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md).
\ No newline at end of file
+>Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Contributing to TechNet content](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md).
diff --git a/windows/threat-protection/windows-information-protection/create-wip-policy-using-intune.md b/windows/threat-protection/windows-information-protection/create-wip-policy-using-intune.md
index 54e8e27d8e..e7ab3c4b24 100644
--- a/windows/threat-protection/windows-information-protection/create-wip-policy-using-intune.md
+++ b/windows/threat-protection/windows-information-protection/create-wip-policy-using-intune.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: security
author: eross-msft
ms.localizationpriority: medium
+ms.date: 10/16/2017
---
# Create a Windows Information Protection (WIP) policy using the classic console for Microsoft Intune
diff --git a/windows/threat-protection/windows-information-protection/create-wip-policy-using-mam-intune-azure.md b/windows/threat-protection/windows-information-protection/create-wip-policy-using-mam-intune-azure.md
index f268c002e9..a874b50962 100644
--- a/windows/threat-protection/windows-information-protection/create-wip-policy-using-mam-intune-azure.md
+++ b/windows/threat-protection/windows-information-protection/create-wip-policy-using-mam-intune-azure.md
@@ -7,7 +7,7 @@ ms.sitesec: library
ms.pagetype: security
author: eross-msft
ms.author: lizross
-ms.date: 10/12/2017
+ms.date: 10/13/2017
localizationpriority: medium
---
@@ -72,10 +72,12 @@ After you’ve set up Intune for your organization, you must create a WIP-specif
>Optionally, you can also add your apps and set your settings from the **Add a policy** blade, but for the purposes of this documentation, we recommend instead that you create the policy first, and then use the subsequent menus that become available.
## Add apps to your Allowed apps list
-During the policy-creation process in Intune, you can choose the apps you want to give access to your enterprise data through WIP. Apps included in this list can protect data on behalf of the enterprise and are restricted from copying or moving enterprise data to unprotected apps.
+During the policy-creation process in Intune, you can choose the apps you want to allow, as well as deny, access to your enterprise data through WIP. Apps included in this list can protect data on behalf of the enterprise and are restricted from copying or moving enterprise data to unprotected apps.
The steps to add your apps are based on the type of template being applied. You can add a recommended app, a store app (also known as a Universal Windows Platform (UWP) app), or a signed Windows desktop app. You can also import a list of approved apps or add exempt apps.
+In addition, you can create an app deny list related to the policy based on an **action** value. The action can be either **Allow** or **Deny**. When you specify the deny action for an app using the policy, corporate access is denied to the app.
+
>[!Important]
>Enlightened apps are expected to prevent enterprise data from going to unprotected network locations and to avoid encrypting personal data. On the other hand, WIP-unaware apps might not respect the corporate network boundary, and WIP-unaware apps will encrypt all files they create or modify. This means that they could encrypt personal data and cause data loss during the revocation process.
Care must be taken to get a support statement from the software provider that their app is safe with WIP before adding it to your **Allowed apps** list. If you don’t get this statement, it’s possible that you could experience app compatibility issues due to an app losing the ability to access a necessary file after revocation.
@@ -647,4 +649,4 @@ After you’ve created your policy, you'll need to deploy it to your employees.
- [Deploy your Windows Information Protection (WIP) policy](deploy-wip-policy-using-intune.md)
-- [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md)
\ No newline at end of file
+- [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md)
diff --git a/windows/threat-protection/windows-information-protection/create-wip-policy-using-sccm.md b/windows/threat-protection/windows-information-protection/create-wip-policy-using-sccm.md
index 195f3f3fe2..dbc27f74a8 100644
--- a/windows/threat-protection/windows-information-protection/create-wip-policy-using-sccm.md
+++ b/windows/threat-protection/windows-information-protection/create-wip-policy-using-sccm.md
@@ -9,6 +9,7 @@ ms.sitesec: library
ms.pagetype: security
author: eross-msft
ms.localizationpriority: medium
+ms.date: 10/16/2017
---
# Create and deploy a Windows Information Protection (WIP) policy using System Center Configuration Manager
diff --git a/windows/threat-protection/windows-information-protection/deploy-wip-policy-using-intune-azure.md b/windows/threat-protection/windows-information-protection/deploy-wip-policy-using-intune-azure.md
index 1324eed5be..93cc37550a 100644
--- a/windows/threat-protection/windows-information-protection/deploy-wip-policy-using-intune-azure.md
+++ b/windows/threat-protection/windows-information-protection/deploy-wip-policy-using-intune-azure.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: security
author: eross-msft
ms.localizationpriority: medium
+ms.date: 09/11/2017
---
# Deploy your Windows Information Protection (WIP) policy using the Azure portal for Microsoft Intune
diff --git a/windows/threat-protection/windows-information-protection/deploy-wip-policy-using-intune.md b/windows/threat-protection/windows-information-protection/deploy-wip-policy-using-intune.md
index 8dd0fcf76f..7cc7975a21 100644
--- a/windows/threat-protection/windows-information-protection/deploy-wip-policy-using-intune.md
+++ b/windows/threat-protection/windows-information-protection/deploy-wip-policy-using-intune.md
@@ -9,6 +9,7 @@ ms.sitesec: library
ms.pagetype: security
author: eross-msft
ms.localizationpriority: medium
+ms.date: 09/11/2017
---
# Deploy your Windows Information Protection (WIP) policy using the classic console for Microsoft Intune
diff --git a/windows/threat-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md b/windows/threat-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md
index f3ef168e1c..10a6ed181f 100644
--- a/windows/threat-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md
+++ b/windows/threat-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md
@@ -9,6 +9,7 @@ ms.sitesec: library
ms.pagetype: security
author: eross-msft
ms.localizationpriority: medium
+ms.date: 09/11/2017
---
# List of enlightened Microsoft apps for use with Windows Information Protection (WIP)
diff --git a/windows/threat-protection/windows-information-protection/guidance-and-best-practices-wip.md b/windows/threat-protection/windows-information-protection/guidance-and-best-practices-wip.md
index 08e74a6265..fb8238b948 100644
--- a/windows/threat-protection/windows-information-protection/guidance-and-best-practices-wip.md
+++ b/windows/threat-protection/windows-information-protection/guidance-and-best-practices-wip.md
@@ -9,6 +9,7 @@ ms.sitesec: library
ms.pagetype: security
author: eross-msft
ms.localizationpriority: medium
+ms.date: 09/11/2017
---
# General guidance and best practices for Windows Information Protection (WIP)
diff --git a/windows/threat-protection/windows-information-protection/mandatory-settings-for-wip.md b/windows/threat-protection/windows-information-protection/mandatory-settings-for-wip.md
index 34070f6316..43ee4efa13 100644
--- a/windows/threat-protection/windows-information-protection/mandatory-settings-for-wip.md
+++ b/windows/threat-protection/windows-information-protection/mandatory-settings-for-wip.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: security
author: eross-msft
ms.localizationpriority: medium
+ms.date: 09/11/2017
---
# Mandatory tasks and settings required to turn on Windows Information Protection (WIP)
diff --git a/windows/threat-protection/windows-information-protection/overview-create-wip-policy-sccm.md b/windows/threat-protection/windows-information-protection/overview-create-wip-policy-sccm.md
index 015b3ebccd..71de7778d6 100644
--- a/windows/threat-protection/windows-information-protection/overview-create-wip-policy-sccm.md
+++ b/windows/threat-protection/windows-information-protection/overview-create-wip-policy-sccm.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: security
author: eross-msft
ms.localizationpriority: medium
+ms.date: 10/13/2017
---
# Create a Windows Information Protection (WIP) policy using System Center Configuration Manager
diff --git a/windows/threat-protection/windows-information-protection/overview-create-wip-policy.md b/windows/threat-protection/windows-information-protection/overview-create-wip-policy.md
index 1f70f60d1c..e424f3101d 100644
--- a/windows/threat-protection/windows-information-protection/overview-create-wip-policy.md
+++ b/windows/threat-protection/windows-information-protection/overview-create-wip-policy.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: security
author: eross-msft
ms.localizationpriority: medium
+ms.date: 10/13/2017
---
# Create a Windows Information Protection (WIP) policy using Microsoft Intune
diff --git a/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip.md b/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip.md
index d374d95478..c68ad8e70c 100644
--- a/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip.md
+++ b/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip.md
@@ -9,6 +9,7 @@ ms.sitesec: library
ms.pagetype: security
author: eross-msft
ms.localizationpriority: medium
+ms.date: 09/11/2017
---
# Protect your enterprise data using Windows Information Protection (WIP)
diff --git a/windows/threat-protection/windows-information-protection/recommended-network-definitions-for-wip.md b/windows/threat-protection/windows-information-protection/recommended-network-definitions-for-wip.md
index 5bd3eccc1f..41d141a9d4 100644
--- a/windows/threat-protection/windows-information-protection/recommended-network-definitions-for-wip.md
+++ b/windows/threat-protection/windows-information-protection/recommended-network-definitions-for-wip.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: security
author: eross-msft
ms.localizationpriority: medium
+ms.date: 09/11/2017
---
# Recommended Enterprise Cloud Resources and Neutral Resources network settings with Windows Information Protection (WIP)
diff --git a/windows/threat-protection/windows-information-protection/testing-scenarios-for-wip.md b/windows/threat-protection/windows-information-protection/testing-scenarios-for-wip.md
index 88f14510a5..64ba93e280 100644
--- a/windows/threat-protection/windows-information-protection/testing-scenarios-for-wip.md
+++ b/windows/threat-protection/windows-information-protection/testing-scenarios-for-wip.md
@@ -9,6 +9,7 @@ ms.sitesec: library
ms.pagetype: security
author: eross-msft
ms.localizationpriority: medium
+ms.date: 09/11/2017
---
# Testing scenarios for Windows Information Protection (WIP)
diff --git a/windows/threat-protection/windows-information-protection/using-owa-with-wip.md b/windows/threat-protection/windows-information-protection/using-owa-with-wip.md
index dbba82c416..15ca7a4e9e 100644
--- a/windows/threat-protection/windows-information-protection/using-owa-with-wip.md
+++ b/windows/threat-protection/windows-information-protection/using-owa-with-wip.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: security
author: eross-msft
ms.localizationpriority: medium
+ms.date: 09/11/2017
---
# Using Outlook on the web with Windows Information Protection (WIP)
diff --git a/windows/threat-protection/windows-information-protection/wip-app-enterprise-context.md b/windows/threat-protection/windows-information-protection/wip-app-enterprise-context.md
index bc89db2205..82577755ce 100644
--- a/windows/threat-protection/windows-information-protection/wip-app-enterprise-context.md
+++ b/windows/threat-protection/windows-information-protection/wip-app-enterprise-context.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: security
author: eross-msft
ms.localizationpriority: medium
+ms.date: 09/11/2017
---
# Determine the Enterprise Context of an app running in Windows Information Protection (WIP)
diff --git a/windows/whats-new/contribute-to-a-topic.md b/windows/whats-new/contribute-to-a-topic.md
index 3ad83a94ec..14772f6caf 100644
--- a/windows/whats-new/contribute-to-a-topic.md
+++ b/windows/whats-new/contribute-to-a-topic.md
@@ -5,7 +5,7 @@ keywords: contribute, edit a topic
ms.prod: w10
ms.mktglfcycl: explore
ms.sitesec: library
-ms.date: 10/09/2017
+ms.date: 10/13/2017
---
# Editing existing Windows IT professional documentation
diff --git a/windows/whats-new/get-started-with-1709.md b/windows/whats-new/get-started-with-1709.md
index 43468d37f4..932997f615 100644
--- a/windows/whats-new/get-started-with-1709.md
+++ b/windows/whats-new/get-started-with-1709.md
@@ -7,7 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
author: DaniHalfin
ms.author: daniha
-ms.date: 10/17/2017
+ms.date: 10/16/2017
ms.localizationpriority: high
---
diff --git a/windows/whats-new/images/video-1709.jpg b/windows/whats-new/images/video-1709.jpg
new file mode 100644
index 0000000000..b54fe67cf6
Binary files /dev/null and b/windows/whats-new/images/video-1709.jpg differ
diff --git a/windows/whats-new/images/video-1709s.jpg b/windows/whats-new/images/video-1709s.jpg
new file mode 100644
index 0000000000..7abc313dd8
Binary files /dev/null and b/windows/whats-new/images/video-1709s.jpg differ
diff --git a/windows/whats-new/index.md b/windows/whats-new/index.md
index b902a29e1a..63f5964ba8 100644
--- a/windows/whats-new/index.md
+++ b/windows/whats-new/index.md
@@ -5,7 +5,7 @@ ms.assetid: F1867017-76A1-4761-A200-7450B96AEF44
keywords: ["What's new in Windows 10", "Windows 10", "anniversary update", "contribute", "edit topic", "Creators Update", "Fall Creators Update"]
ms.prod: w10
author: TrudyHa
-ms.date: 10/17/2017
+ms.date: 10/16/2017
ms.localizationpriority: high
---
diff --git a/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md b/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md
index 1553191d6c..d9d240abee 100644
--- a/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md
+++ b/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
author: TrudyHa
ms.localizationpriority: high
+ms.date: 10/16/2017
---
# What's new in Windows 10, versions 1507 and 1511
diff --git a/windows/whats-new/whats-new-windows-10-version-1607.md b/windows/whats-new/whats-new-windows-10-version-1607.md
index 6d2ef45894..fb858f7d9e 100644
--- a/windows/whats-new/whats-new-windows-10-version-1607.md
+++ b/windows/whats-new/whats-new-windows-10-version-1607.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
author: TrudyHa
ms.localizationpriority: high
+ms.date: 10/16/2017
---
# What's new in Windows 10, version 1607
@@ -15,8 +16,6 @@ Below is a list of some of the new and updated features in Windows 10, version 1
>[!NOTE]
>For release dates and servicing options for each version, see [Windows 10 release information](https://technet.microsoft.com/en-us/windows/release-info).
-
-Not finding content you need? Windows 10 users, tell us what you want on [Feedback Hub](feedback-hub://?referrer=techDocsUcPage&tabid=2&contextid=897&newFeedback=true&topic=whats-new-windows-10-version-1607.md).
## Deployment
@@ -36,7 +35,7 @@ Windows ICD now includes simplified workflows for creating provisioning packages
Microsoft developed Upgrade Readiness in response to demand from enterprise customers looking for additional direction and details about upgrading to Windows 10. Upgrade Readiness was built taking into account multiple channels of customer feedback, testing, and Microsoft’s experience upgrading millions of devices to Windows 10.
-With Windows telemetry enabled, Upgrade Readiness collects system, application, and driver data for analysis. We then identify compatibility issues that can block an upgrade and suggest fixes when they are known to Microsoft.
+With Windows diagnostic data enabled, Upgrade Readiness collects system, application, and driver data for analysis. We then identify compatibility issues that can block an upgrade and suggest fixes when they are known to Microsoft.
Use Upgrade Readiness to get:
diff --git a/windows/whats-new/whats-new-windows-10-version-1703.md b/windows/whats-new/whats-new-windows-10-version-1703.md
index 543ae81b7b..3b14218ea5 100644
--- a/windows/whats-new/whats-new-windows-10-version-1703.md
+++ b/windows/whats-new/whats-new-windows-10-version-1703.md
@@ -8,6 +8,7 @@ ms.sitesec: library
author: JasonGerend
ms.localizationpriority: high
ms.assetid: dca7c655-c4f6-45f8-aa02-64187b202617
+ms.date: 10/16/2017
---
# What's new in Windows 10, version 1703 IT pro content
@@ -19,8 +20,6 @@ For more general info about Windows 10 features, see [Features available only on
>[!NOTE]
>Windows 10, version 1703 contains all fixes included in previous cumulative updates to Windows 10, version 1607. For info about each version, see [Windows 10 release information](https://technet.microsoft.com/en-us/windows/release-info). For a list of removed features, see [Features that are removed or deprecated in Windows 10 Creators Update](https://support.microsoft.com/help/4014193/features-that-are-removed-or-deprecated-in-windows-10-creators-update).
-Not finding content you need? Windows 10 users, tell us what you want on [Feedback Hub](feedback-hub://?referrer=techDocsUcPage&tabid=2&contextid=897&newFeedback=true&topic=whats-new-windows-10-version-1703.md).
-
## Configuration
### Windows Configuration Designer
@@ -262,8 +261,8 @@ For more info, see the following topics:
Learn more about the diagnostic data that's collected at the Basic level and some examples of the types of data that is collected at the Full level.
-- [Windows 10, version 1703 basic level Windows diagnostic events and fields](/windows/configuration/basic-level-windows-diagnostic-events-and-fields)
-- [Windows 10, version 1703 Diagnostic Data](/windows/configuration/windows-diagnostic-data)
+- [Windows 10, version 1703 basic level Windows diagnostic events and fields](/windows/configuration/basic-level-windows-diagnostic-events-and-fields-1703)
+- [Windows 10, version 1703 Diagnostic Data](/windows/configuration/windows-diagnostic-data-1703)
### Group Policy spreadsheet
diff --git a/windows/whats-new/whats-new-windows-10-version-1709.md b/windows/whats-new/whats-new-windows-10-version-1709.md
index 1bf9bd3df0..8bf610b344 100644
--- a/windows/whats-new/whats-new-windows-10-version-1709.md
+++ b/windows/whats-new/whats-new-windows-10-version-1709.md
@@ -6,7 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: greg-lindsay
-ms.date: 10/18/2017
+ms.date: 01/24/2018
ms.localizationpriority: high
---
@@ -17,9 +17,11 @@ ms.localizationpriority: high
Below is a list of some of the new and updated content that discusses IT Pro features in Windows 10, version 1709, also known as the Fall Creators Update. Windows 10, version 1709 also contains all features and fixes included in previous cumulative updates to Windows 10, version 1703.
-A brief description of new or updated features in this version of Windows 10 is provided, with links to content with more detailed information.
+A brief description of new or updated features in this version of Windows 10 is provided, with links to content with more detailed information. The following 3-minute video summarizes these features.
-Not finding content you need? Windows 10 users, tell us what you want on [Feedback Hub](feedback-hub:?tabid=2&contextid=897).
+
+
+> [!video https://www.microsoft.com/en-us/videoplayer/embed/43942201-bec9-4f8b-8ba7-2d9bfafa8bba?autoplay=false]
## Deployment
diff --git a/windows/whats-new/windows-10-insider-preview.md b/windows/whats-new/windows-10-insider-preview.md
index c786010f49..5d236f5f30 100644
--- a/windows/whats-new/windows-10-insider-preview.md
+++ b/windows/whats-new/windows-10-insider-preview.md
@@ -5,6 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
author: TrudyHa
+ms.date: 04/14/2017
---
# Documentation for Windows 10 Insider Preview
- 
- 
- --
- --
- --
- --
- --
- --
- --
- --
- --
- --
- --
- --
- --
- --
- --
- --
- --
- --
- --
- --
- --
- --
- --
- --
- --
- --
- --
- --
- --
- --
- --
- --
- --
- --
- --
- 
- 
- 
4
- 
+ 
- 
- 
- 
+ 
- 
+ 
- 
+ 
- 
+ 
- 
+