*.**ms-windows-store-license**, and select the license file.
+
+[Learn more about distributing offline apps from the Windows Store for Business.](../manage/distribute-offline-apps.md)
+
+> [!NOTE]
+> Removing a provisioning package will not remove any apps installed by device context in that provisioning package.
+
+
+
+### Add a certificate to your package
+
+1. In the **Available customizations** pane, go to **Runtime settings** > **Certificates** > **ClientCertificates**.
+
+2. Enter a **CertificateName** and then click **Add**.
+
+2. Enter the **CertificatePassword**.
+
+3. For **CertificatePath**, browse and select the certificate to be used.
+
+4. Set **ExportCertificate** to **False**.
+
+5. For **KeyLocation**, select **Software only**.
+
+
+### Add other settings to your package
+
+For details about the settings you can customize in provisioning packages, see [Windows Provisioning settings reference]( https://go.microsoft.com/fwlink/p/?LinkId=619012).
+
+### Build your package
+
+1. When you are done configuring the provisioning package, on the **File** menu, click **Save**.
+
+2. Read the warning that project files may contain sensitive information, and click **OK**.
+> **Important** When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed.
+
+3. On the **Export** menu, click **Provisioning package**.
+
+1. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next.**
+
+10. Set a value for **Package Version**.
+
+ > [!TIP]
+ > You can make changes to existing packages and change the version number to update previously applied packages.
+
+11. Optional. In the **Provisioning package security** window, you can choose to encrypt the package and enable package signing.
+
+ - **Enable package encryption** - If you select this option, an auto-generated password will be shown on the screen.
+
+ - **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Select...** and choosing the certificate you want to use to sign the package.
+
+ **Important**
+ We recommend that you include a trusted provisioning certificate in your provisioning package. When the package is applied to a device, the certificate is added to the system store and any package signed with that certificate thereafter can be applied silently.
+
+12. Click **Next** to specify the output location where you want the provisioning package to go once it's built. By default, Windows ICD uses the project folder as the output location.
+Optionally, you can click **Browse** to change the default output location.
+
+13. Click **Next**.
+
+14. Click **Build** to start building the package. The project information is displayed in the build page and the progress bar indicates the build status.
+If you need to cancel the build, click **Cancel**. This cancels the current build process, closes the wizard, and takes you back to the **Customizations Page**.
+
+15. If your build fails, an error message will show up that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again.
+If your build is successful, the name of the provisioning package, output directory, and project directory will be shown.
+
+ - If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, click **Back** to change the output package name and path, and then click **Next** to start another build.
+
+ - If you are done, click **Finish** to close the wizard and go back to the **Customizations Page**.
+
+16. Select the **output location** link to go to the location of the package. You can provide that .ppkg to others through any of the following methods:
+
+ - Shared network folder
+
+ - SharePoint site
+
+ - Removable media (USB/SD)
+
+ - Email
+
+ - USB tether (mobile only)
+
+ - NFC (mobile only)
+
+
+
+**Next step**: [How to apply a provisioning package](provisioning-apply-package.md)
+
+## Learn more
+
+- Watch the video: [Provisioning Windows 10 Devices with New Tools](https://go.microsoft.com/fwlink/p/?LinkId=615921)
+
+- Watch the video: [Windows 10 for Mobile Devices: Provisioning Is Not Imaging](https://go.microsoft.com/fwlink/p/?LinkId=615922)
+
+
+## Related topics
+
+- [Provisioning packages for Windows 10](provisioning-packages.md)
+- [How provisioning works in Windows 10](provisioning-how-it-works.md)
+- [Install Windows Configuration Designer](provisioning-install-icd.md)
+- [Create a provisioning package](provisioning-create-package.md)
+- [Apply a provisioning package](provisioning-apply-package.md)
+- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md)
+- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md)
+- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md)
+- [PowerShell cmdlets for provisioning Windows 10 (reference)](provisioning-powershell.md)
+- [NFC-based device provisioning](provisioning-nfc.md)
+- [Use the package splitter tool](provisioning-package-splitter.md)
+- [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md)
+- [Create a provisioning package with multivariant settings](provisioning-multivariant.md)
+
+
diff --git a/windows/configure/provisioning-apply-package.md b/windows/configure/provisioning-apply-package.md
index 1125dd6985..2fa9efb09a 100644
--- a/windows/configure/provisioning-apply-package.md
+++ b/windows/configure/provisioning-apply-package.md
@@ -42,25 +42,7 @@ Provisioning packages can be applied to a device during the first-run experience
-6. Read and accept the Microsoft Software License Terms.
- 
-
-7. Select **Use Express settings**.
-
- 
-
-8. If the PC doesn't use a volume license, you'll see the **Who owns this PC?** screen. Select **My work or school owns it** and tap **Next**.
-
- 
-
-9. On the **Choose how you'll connect** screen, select **Join Azure AD** or **Join a domain** and tap **Next**.
-
- 
-
-10. Sign in with your domain, Azure AD, or Office 365 account and password. When you see the progress ring, you can remove the USB drive.
-
- 
### After setup, from a USB drive, network folder, or SharePoint site
@@ -97,23 +79,17 @@ On a desktop computer, navigate to **Settings** > **Accounts** > **Access work o
-## Learn more
-
-- Watch the video: [Provisioning Windows 10 Devices with New Tools](https://go.microsoft.com/fwlink/p/?LinkId=615921)
-
-- Watch the video: [Windows 10 for Mobile Devices: Provisioning Is Not Imaging](https://go.microsoft.com/fwlink/p/?LinkId=615922)
## Related topics
- [Provisioning packages for Windows 10](provisioning-packages.md)
- [How provisioning works in Windows 10](provisioning-how-it-works.md)
-- [Install Windows Imaging and Configuration Designer](provisioning-install-icd.md)
+- [Install Windows Configuration Designer](provisioning-install-icd.md)
- [Create a provisioning package](provisioning-create-package.md)
- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md)
- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md)
-- [Provision PCs with apps and certificates for initial deployments (advanced provisioning)](provision-pcs-with-apps-and-certificates.md)
- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md)
-- [NFC-based device provisioning](provisioning-nfc.md)
-- [Windows ICD command-line interface (reference)](provisioning-command-line.md)
+- [PowerShell cmdlets for provisioning Windows 10 (reference)](provisioning-powershell.md)
+- [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md)
- [Create a provisioning package with multivariant settings](provisioning-multivariant.md)
\ No newline at end of file
diff --git a/windows/configure/provisioning-command-line.md b/windows/configure/provisioning-command-line.md
index d5c52aabac..a2e16343b0 100644
--- a/windows/configure/provisioning-command-line.md
+++ b/windows/configure/provisioning-command-line.md
@@ -1,5 +1,5 @@
---
-title: Windows ICD command-line interface (Windows 10)
+title: Windows Configuration Designer command-line interface (Windows 10)
description:
ms.prod: w10
ms.mktglfcycl: deploy
@@ -8,7 +8,7 @@ author: jdeckerMS
localizationpriority: high
---
-# Windows ICD command-line interface (reference)
+# Windows Configuration Designer command-line interface (reference)
**Applies to**
@@ -16,11 +16,11 @@ localizationpriority: high
- Windows 10
- Windows 10 Mobile
-You can use the Windows Imaging and Configuration Designer (ICD) command-line interface (CLI) to automate the building of provisioning packages and Windows 10 for desktop editions (Home, Pro, Enterprise, and Education) and Windows 10 Mobile or Windows 10 IoT Core (IoT Core) images.
+You can use the Windows Configuration Designer command-line interface (CLI) to automate the building of provisioning packages and Windows 10 for desktop editions (Home, Pro, Enterprise, and Education) and Windows 10 Mobile or Windows 10 IoT Core (IoT Core) images.
-- IT pros can use the Windows ICD CLI to require less re-tooling of existing processes. You must run the Windows ICD CLI from a command window with administrator privileges.
+- IT pros can use the Windows Configuration Designer CLI to require less re-tooling of existing processes. You must run the Windows Configuration Designer CLI from a command window with administrator privileges.
-- You must use the Windows ICD CLI and edit the customizations.xml sources to create an image and/or provisioning package with multivariant support. You need the customizations.xml file as one of the inputs to the Windows ICD CLI to build a provisioning package. For more information, see [Create a provisioning package with multivariant settings](provisioning-multivariant.md).
+- You must use the Windows Configuration Designer CLI and edit the customizations.xml sources to create an image and/or provisioning package with multivariant support. You need the customizations.xml file as one of the inputs to the Windows Configuration Designer CLI to build a provisioning package. For more information, see [Create a provisioning package with multivariant settings](provisioning-multivariant.md).
@@ -38,9 +38,9 @@ icd.exe /Build-ProvisioningPackage /CustomizationXML: /PackagePath:
| --- | --- | --- |
| /CustomizationXML | No | Specifies the path to a Windows provisioning XML file that contains the customization assets and settings. For more information, see Windows provisioning answer file. |
| /PackagePath | Yes | Specifies the path and the package name where the built provisioning package will be saved. |
-| /StoreFile | NoSee Important note. | For partners using a settings store other than the default store(s) used by Windows ICD, use this parameter to specify the path to one or more comma-separated Windows settings store file. By default, if you don't specify a settings store file, the settings store that's common to all Windows editions will be loaded by Windows ICD.**Important** If you use this parameter, you must not use /MSPackageRoot or /OEMInputXML. |
+| /StoreFile | NoSee Important note. | For partners using a settings store other than the default store(s) used by Windows Configuration Designer, use this parameter to specify the path to one or more comma-separated Windows settings store file. By default, if you don't specify a settings store file, the settings store that's common to all Windows editions will be loaded by Windows Configuration Designer.**Important** If you use this parameter, you must not use /MSPackageRoot or /OEMInputXML. |
| /Variables | No | Specifies a semicolon separated and macro pair. The format for the argument must be =. |
-| Encrypted | No | Denotes whether the provisioning package should be built with encryption. Windows ICD auto-generates the decryption password and includes this information in the output.Precede with + for encryption or - for no encryption. The default is no encryption. |
+| Encrypted | No | Denotes whether the provisioning package should be built with encryption. Windows Configuration Designer auto-generates the decryption password and includes this information in the output.Precede with + for encryption or - for no encryption. The default is no encryption. |
| Overwrite | No | Denotes whether to overwrite an existing provisioning package.Precede with + to overwrite an existing package or - if you don't want to overwrite an existing package. The default is false (don't overwrite). |
| /? | No | Lists the switches and their descriptions for the command-line tool or for certain commands. |
@@ -51,14 +51,13 @@ icd.exe /Build-ProvisioningPackage /CustomizationXML: /PackagePath:
- [Provisioning packages for Windows 10](provisioning-packages.md)
- [How provisioning works in Windows 10](provisioning-how-it-works.md)
-- [Install Windows Imaging and Configuration Designer](provisioning-install-icd.md)
+- [Install Windows Configuration Designer](provisioning-install-icd.md)
- [Create a provisioning package](provisioning-create-package.md)
- [Apply a provisioning package](provisioning-apply-package.md)
- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md)
- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md)
-- [Provision PCs with apps and certificates for initial deployments (advanced provisioning)](provision-pcs-with-apps-and-certificates.md)
- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md)
-- [NFC-based device provisioning](provisioning-nfc.md)
+- [PowerShell cmdlets for provisioning Windows 10 (reference)](provisioning-powershell.md)
- [Create a provisioning package with multivariant settings](provisioning-multivariant.md)
diff --git a/windows/configure/provisioning-configure-mobile.md b/windows/configure/provisioning-configure-mobile.md
index 55a100ecdd..5c1a5048cf 100644
--- a/windows/configure/provisioning-configure-mobile.md
+++ b/windows/configure/provisioning-configure-mobile.md
@@ -1,7 +1,7 @@
---
-title: provisioning mobile (Windows 10)
+title: Use Windows Configuration Designer to configure Windows 10 Mobile devices (Windows 10)
description:
-keywords: Windows 10, MDM, WSUS, Windows update
+keywords: phone, handheld, lockdown, customize
ms.prod: w10
ms.mktglfcycl: manage
ms.sitesec: library
@@ -10,5 +10,77 @@ localizationpriority: high
author: jdeckerMS
---
-# provisioning mobile
+# Use Windows Configuration Designer to configure Windows 10 Mobile devices
+Windows provisioning makes it easy for IT administrators to configure end-user devices without imaging. Using provisioning packages, ayou can easily specify desired configuration, settings, and information required to enroll the devices into management, and then apply that configuration to target devices in a matter of minutes.
+
+A provisioning package (.ppkg) is a container for a collection of configuration settings. Using Windows Configuration Designer, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image.
+
+Windows Configuration Designer can be installed from the [Windows Assessment and Deployment Kit (ADK) for Windows 10](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit). Windows Configuration Designer is also available as an app in the Windows Store. [Learn more about installing Windows Configuration Designer.](provisioning-install-icd.md)
+
+## Create a provisioning package using the wizard
+
+The **Provision Windows mobile devices** wizard lets you configure common settings for devices running Windows 10 Mobile in a simple, graphical workflow.
+
+### Start a new project
+
+1. Open Windows Configuration Designer:
+ - From either the Start screen or Start menu search, type 'Windows Configuration Designer' and click the Windows Configuration Designer shortcut,
+
+ or
+
+ - If you installed Windows Configuration Designer from the ADK, navigate to `C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86` (on an x64 computer) or `C:\Program Files\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86\ICD.exe` (on an x86 computer), and then double-click **ICD.exe**.
+
+2. On the **Start** page, choose **Provision Windows mobile devices**.
+
+3. Enter a name for your project, and then click **Next**.
+
+
+### Configure settings in the wizard
+
+
+| Enter a device name. Optionally, you can enter a product key to upgrade the device from Windows 10 Mobile to Windows 10 Mobile Enterprise. |  |
+|  Toggle **On** or **Off** for wireless network connectivity. If you select **On**, enter the SSID, network type (**Open** or **WPA2-Personal**), and (if **WPA2-Personal**) the password for the wireless network. |  |
+|  Before you use a Windows Configuration Designer wizard to configure bulk Azure AD enrollment, [set up Azure AD join in your organization](https://docs.microsoft.com/azure/active-directory/active-directory-azureadjoin-setup). The **maximum number of devices per user** setting in your Azure AD tenant determines how many times the bulk token that you get in the wizard can be used. Set an expiration date for the token (maximum is 30 days from the date you get the token). Click **Get bulk token**. In the **Let's get you signed in** window, enter an account that has permissions to join a device to Azure AD, and then the password. Click **Accept** to give Windows Configuration Designer the necessary permissions.**Warning:** You must run Windows Configuration Designer on Windows 10 to configure Azure Active Directory enrollment using any of the wizards. |  |
+|  You can set a password to protect your provisioning package. You must enter this password when you apply the provisioning package to a device. |  |
+
+
+After you're done, click **Create**. It only takes a few seconds. When the package is built, the location where the package is stored is displayed as a hyperlink at the bottom of the page.
+
+### Apply provisioning package
+
+You can apply a provisioning package to a device running Windows 10 Mobile by using:
+
+- removable media
+- copying the provisioning package to the device
+- [NFC tags](provisioning-nfc.md)
+- [barcodes](provisioning-package-splitter.md)
+
+### Using removable media
+
+1. Insert an SD card containing the provisioning package into the device.
+2. Navigate to **Settings** > **Accounts** > **Access work or school** > **Add or remove a provisioning package** > **Add a package**, and select the package to install.
+
+ 
+
+3. Click **Add**.
+
+4. On the device, the **Is this package from a source you trust?** message will appear. Tap **Yes, add it**.
+
+ 
+
+### Copying the provisioning package to the device
+
+1. Connect the device to your PC through USB.
+
+2. On the PC, select the provisioning package that you want to use to provision the device and then drag and drop the file to your device.
+
+3. On the device, the **Is this package from a source you trust?** message will appear. Tap **Yes, add it**.
+
+ 
+
+
+## Related topics
+
+- [NFC-based device provisioning](provisioning-nfc.md)
+- [Use the package splitter tool](provisioning-package-splitter.md)
\ No newline at end of file
diff --git a/windows/configure/provisioning-create-package.md b/windows/configure/provisioning-create-package.md
index f543e6d10f..a73b54f4f8 100644
--- a/windows/configure/provisioning-create-package.md
+++ b/windows/configure/provisioning-create-package.md
@@ -16,30 +16,40 @@ localizationpriority: high
- Windows 10
- Windows 10 Mobile
-You use Windows Imaging and Configuration Designer (ICD) to create a provisioning package (.ppkg) that contains customization settings. You can apply the provisioning package to a device running Windows 10.
+You use Windows Configuration Designer to create a provisioning package (.ppkg) that contains customization settings. You can apply the provisioning package to a device running Windows 10 or Windows 10 Mobile.
->[Learn how to install Windows ICD.](provisioning-install-icd.md)
+>[Learn how to install Windows Configuration Designer.](provisioning-install-icd.md)
+
+>[!TIP]
+>We recommend creating a local admin account when developing and testing your provisioning package. We also recommend using a “least privileged” domain user account to join devices to the Active Directory domain.
## Start a new project
-1. Open Windows ICD:
- - From either the Start screen or Start menu search, type 'Imaging and Configuration Designer' and click on the Windows ICD shortcut,
+1. Open Windows Configuration Designer:
+ - From either the Start screen or Start menu search, type 'Windows Configuration Designer' and click on the Windows Configuration Designer shortcut,
or
- - Navigate to `C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86` (on an x64 computer) or `C:\Program Files\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86\ICD.exe` (on an x86 computer), and then double-click **ICD.exe**.
+ - If you installed Windows Configuration Designer from the ADK, navigate to `C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86` (on an x64 computer) or `C:\Program Files\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86\ICD.exe` (on an x86 computer), and then double-click **ICD.exe**.
-2. Select your desired option on the **Start** page, which offers three options for creating a provisioning package, as shown in the following image:
+2. Select your desired option on the **Start** page, which offers multiple options for creating a provisioning package, as shown in the following image:
- 
+ 
- - The **Simple provisioning** and **Provision school devices** options provide wizard-style walkthroughs for creating a provisioning package based on a set of common settings.
- - The **Advanced provisioning** option opens a new project with all **Runtime settings** available.
+ - The wizard options provide a simple interface for configuring common settings for desktop, mobile, and kiosk devices. Wizards are also available for creating provisioning packages for Microsoft Surface Hub and Microsoft HoloLens devices. For a summary of the settings available in the desktop, mobile, and kiosk devices, see [What you can configure using Configuration Designer wizardS](provisioning-packages.md#configuration-designer-wizards).
- >[!TIP]
- >You can start a project in the simple editor and then switch the project to the advanced editor.
- >
- >
+ - [Instructions for the desktop wizard](provision-pcs-for-initial-deployment.md)
+ - [Instructions for the mobile wizard](provisioning-configure-mobile.md)
+ - [Instructions for the kiosk wizard](set-up-a-kiosk-for-windows-10-for-desktop-editions.md#wizard)
+ - [Instructions for HoloLens wizard](https://technet.microsoft.com/itpro/hololens/hololens-provisioning)
+ - [Instructions for Surface Hub wizard](https://technet.microsoft.com/itpro/surface-hub/provisioning-packages-for-certificates-surface-hub)
+
+ - The **Advanced provisioning** option opens a new project with all **Runtime settings** available. *The rest of this procedure uses advanced provisioning.*
+
+ >[!TIP]
+ > You can start a project in the simple wizard editor and then switch the project to the advanced editor.
+ >
+ > 
3. Enter a name for your project, and then click **Next**.
@@ -59,19 +69,18 @@ You use Windows Imaging and Configuration Designer (ICD) to create a provisionin
>[!TIP]
>**Import a provisioning package** can make it easier to create different provisioning packages that all have certain settings in common. For example, you could create a provisioning package that contains the settings for your organization's network, and then import it into other packages you create so you don't have to reconfigure those common settings repeatedly.
-After you click **Finish**, Windows ICD will open the appropriate walkthrough page if you selected **Simple provisioning** or **Provision school devices**, or the **Available customizations** pane if you selected **Advanced provisioning**. The remainder of this topic will explain the **Advanced provisioning scenario**.
+After you click **Finish**, Windows Configuration Designer will open the **Available customizations** pane and you can then configure settings for the package.
+
-- For instructions on **Simple provisioning**, see [Provision PCs with common settings](provision-pcs-for-initial-deployment.md).
-- For instructions on **Provision school devices**, see [Set up student PCs to join domain](https://technet.microsoft.com/edu/windows/set-up-students-pcs-to-join-domain).
## Configure settings
-For an advanced provisioning project, Windows ICD opens the **Available customizations** pane. The example in the following image is based on **All Windows desktop editions** settings.
+For an advanced provisioning project, Windows Configuration Designer opens the **Available customizations** pane. The example in the following image is based on **All Windows desktop editions** settings.
-The settings in Windows ICD are based on Windows 10 configuration service providers (CSPs). To learn more about CSPs, see [Introduction to configuration service providers (CSPs) for IT pros](https://technet.microsoft.com/itpro/windows/manage/how-it-pros-can-use-configuration-service-providers).
+The settings in Windows Configuration Designer are based on Windows 10 configuration service providers (CSPs). To learn more about CSPs, see [Introduction to configuration service providers (CSPs) for IT pros](https://technet.microsoft.com/itpro/windows/manage/how-it-pros-can-use-configuration-service-providers).
The process for configuring settings is similar for all settings. The following table shows an example.
@@ -83,9 +92,9 @@ The process for configuring settings is similar for all settings. The following
| When the setting is configured, it is displayed in the **Selected customizations** pane. |  |
-For details on each specific setting, see [Windows Provisioning settings reference](https://msdn.microsoft.com/library/windows/hardware/dn965990.aspx). The reference topic for a setting is also displayed in Windows ICD when you select the setting, as shown in the following image.
+For details on each specific setting, see [Windows Provisioning settings reference](https://msdn.microsoft.com/library/windows/hardware/dn965990.aspx). The reference topic for a setting is also displayed in Windows Configuration Designer when you select the setting, as shown in the following image.
-
+
## Build package
@@ -110,7 +119,7 @@ For details on each specific setting, see [Windows Provisioning settings referen
>
>If a provisioning package is signed by a trusted provisioner, it can be installed on a device without a prompt for user consent. In order to enable trusted provider certificates, you must set the **TrustedProvisioners** setting prior to installing the trusted provisioning package. This is the only way to install a package without user consent. To provide additional security, you can also set **RequireProvisioningPackageSignature**, which prevents users from installing provisioning packages that are not signed by a trusted provisioner.
-4. In the **Select where to save the provisioning package** window, specify the output location where you want the provisioning package to go once it's built, and then click **Next**. By default, Windows ICD uses the project folder as the output location.
+4. In the **Select where to save the provisioning package** window, specify the output location where you want the provisioning package to go once it's built, and then click **Next**. By default, Windows Configuration Designer uses the project folder as the output location.
5. In the **Build the provisioning package** window, click **Build**. The provisioning package doesn't take long to build. The project information is displayed in the build page and the progress bar indicates the build status.
@@ -128,22 +137,21 @@ For details on each specific setting, see [Windows Provisioning settings referen
## Learn more
-- Watch the video: [Provisioning Windows 10 Devices with New Tools](https://go.microsoft.com/fwlink/p/?LinkId=615921)
-
-- Watch the video: [Windows 10 for Mobile Devices: Provisioning Is Not Imaging](https://go.microsoft.com/fwlink/p/?LinkId=615922)
+- Watch the video: [Provisioning Windows 10 Devices with New Tools](https://go.microsoft.com/fwlink/p/?LinkId=615921)
+- Watch the video: [Windows 10 for Mobile Devices: Provisioning Is Not Imaging](https://go.microsoft.com/fwlink/p/?LinkId=615922)
+- [How to bulk-enroll devices with On-premises Mobile Device Management in System Center Configuration Manager](https://docs.microsoft.com/sccm/mdm/deploy-use/bulk-enroll-devices-on-premises-mdm)
## Related topics
- [Provisioning packages for Windows 10](provisioning-packages.md)
- [How provisioning works in Windows 10](provisioning-how-it-works.md)
-- [Install Windows Imaging and Configuration Designer](provisioning-install-icd.md)
+- [Install Windows Configuration Designer](provisioning-install-icd.md)
- [Apply a provisioning package](provisioning-apply-package.md)
- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md)
- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md)
-- [Provision PCs with apps and certificates for initial deployments (advanced provisioning)](provision-pcs-with-apps-and-certificates.md)
- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md)
-- [NFC-based device provisioning](provisioning-nfc.md)
-- [Windows ICD command-line interface (reference)](provisioning-command-line.md)
+- [PowerShell cmdlets for provisioning Windows 10 (reference)](provisioning-powershell.md)
+- [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md)
- [Create a provisioning package with multivariant settings](provisioning-multivariant.md)
\ No newline at end of file
diff --git a/windows/configure/provisioning-how-it-works.md b/windows/configure/provisioning-how-it-works.md
index 1f9b72eb6c..349dfd08c2 100644
--- a/windows/configure/provisioning-how-it-works.md
+++ b/windows/configure/provisioning-how-it-works.md
@@ -16,7 +16,7 @@ localizationpriority: high
- Windows 10
- Windows 10 Mobile
-Provisioning packages in Windows 10 provide IT administrators with a simplified way to apply configuration settings to Windows 10 devices. Windows Imaging and Configuration Designer (Windows ICD) is a tool that makes it easy to create a provisioning package. Windows ICD is contained in the [Windows Assessment and Deployment Kit (ADK)](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit).
+Provisioning packages in Windows 10 provide IT administrators with a simplified way to apply configuration settings to Windows 10 devices. Windows Configuration Designer is a tool that makes it easy to create a provisioning package. Windows Configuration Designer can be installed from the [Windows Assessment and Deployment Kit (ADK)](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit) or through the Windows Store.
## Provisioning packages
@@ -58,9 +58,9 @@ When setting conflicts are encountered, the final values provisioned on the devi
Windows provisioning XML is the framework that allows Microsoft and OEM components to declare end-user configurable settings and the on-device infrastructure for applying the settings with minimal work by the component owner.
-Settings for each component can be declared within that component's package manifest file. These declarations are turned into settings schema that are used by Windows ICD to expose the potential settings to users to create customizations in the image or in provisioning packages. Windows ICD translates the user configuration, which is declared through Windows provisioning answer file(s), into the on-device provisioning format.
+Settings for each component can be declared within that component's package manifest file. These declarations are turned into settings schema that are used by Windows Configuration Designer to expose the potential settings to users to create customizations in the image or in provisioning packages. Windows Configuration Designer translates the user configuration, which is declared through Windows provisioning answer file(s), into the on-device provisioning format.
-When the provisioning engine selects a configuration, the Windows provisioning XML is contained within the selected provisioning data and is passed through the configuration manager and then to the Windows provisioning CSP. The Windows provisioning CSP then takes and applies the provisioning to the proper location for the actual component to use.
+When the provisioning engine selects a configuration, the Windows provisioning XML is contained within the selected provisioning data and is passed through the configuration manager and then to the [Windows provisioning CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/provisioning-csp). The Windows provisioning CSP then takes and applies the provisioning to the proper location for the actual component to use.
## Provisioning engine
@@ -77,7 +77,7 @@ The provisioning engine provides the following functionality:
## Configuration manager
-The configuration manager provides the unified way of managing Windows 10 devices. Configuration is mainly done through the Open Mobile Alliance (OMA) Device Management (DM) and Client Provisioning (CP) protocols. The configuration manager handles and parses these protocol requests from different channels and passes them down to Configuration Service Providers (CSPs) to perform the specific management requests and settings.
+The configuration manager provides the unified way of managing Windows 10 devices. Configuration is mainly done through the Open Mobile Alliance (OMA) Device Management (DM) and Client Provisioning (CP) protocols. The configuration manager handles and parses these protocol requests from different channels and passes them down to [Configuration Service Providers (CSPs)](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/configuration-service-provider-reference) to perform the specific management requests and settings.
The provisioning engine relies on configuration manager for all of the actual processing and application of a chosen configuration. The provisioning engine determines the stage of provisioning and, based on a set of keys, determines the set of configuration to send to the configuration manager. The configuration manager in turn parses and calls into the CSPs for the setting to be applied.
@@ -115,9 +115,9 @@ When a trigger occurs, provisioning is initiated for a particular provisioning s
## Device provisioning during OOBE
-The provisioning engine always applies provisioning packages persisted in the C:\Recovery\Customizations folder on the OS partition. When the provisioning engine applies provisioning packages in the %ProgramData%\Microsoft\Provisioning folder, certain runtime setting applications, such as the setting to install and configure Windows apps, may be extended past the OOBE pass and continually be processed in the background when the device gets to the desktop. Settings for configuring policies and certain crucial system configurations are always be completed before the first point at which they must take effect.
+The provisioning engine always applies provisioning packages persisted in the `C:\Recovery\Customizations` folder on the OS partition. When the provisioning engine applies provisioning packages in the `%ProgramData%\Microsoft\Provisioning` folder, certain runtime setting applications, such as the setting to install and configure Windows apps, may be extended past the OOBE pass and continually be processed in the background when the device gets to the desktop. Settings for configuring policies and certain crucial system configurations are always be completed before the first point at which they must take effect.
-Device users can apply a provisioning package from a remote source when the device first boots to OOBE. The device provisioning during OOBE is only triggered after the language, locale, time zone, and other settings on the first OOBE UI page are configured. On all Windows devices, device provisioning during OOBE can be triggered by 5 fast taps on the Windows hardware key. When device provisioning is triggered, the provisioning UI is displayed in the OOBE page. The provisioning UI allows users to select a provisioning package acquired from a remote source, such as through NFC or a removable media.
+Device users can apply a provisioning package from a remote source when the device first boots to OOBE. The device provisioning during OOBE is only triggered after the language, locale, time zone, and other settings on the first OOBE UI page are configured. When device provisioning is triggered, the provisioning UI is displayed in the OOBE page. The provisioning UI allows users to select a provisioning package acquired from a remote source, such as through NFC or a removable media.
The following table shows how device provisioning can be initiated when a user first boots to OOBE.
@@ -125,17 +125,15 @@ The following table shows how device provisioning can be initiated when a user f
| Package delivery | Initiation method | Supported device |
| --- | --- | --- |
| Removable media - USB drive or SD card (Packages must be placed at media root) | 5 fast taps on the Windows key to launch the provisioning UI |All Windows devices |
-| From an administrator device through machine to machine NFC or NFC tag(The administrator device must run an app that can transfer the package over NFC) | 5 fast taps on the Windows key to launch the provisioning UI | Windows 10 Mobile devices and IoT Core devices |
+| From an administrator device through machine-to-machine NFC or NFC tag(The administrator device must run an app that can transfer the package over NFC) | 5 fast taps on the Windows key to launch the provisioning UI | Windows 10 Mobile devices and IoT Core devices |
-The provisioning engine always copies the acquired provisioning packages to the %ProgramData%\Microsoft\Provisioning folder before processing them during OOBE. The provisioning engine always applies provisioning packages embedded in the installed Windows image during Windows Setup OOBE pass regardless of whether the package is signed and trusted. When the provisioning engine applies an encrypted provisioning package on an end-user device during OOBE, users must first provide a valid password to decrypt the package. The provisioning engine also checks whether a provisioning package is signed and trusted; if it's not, the user must provide consent before the package is applied to the device.
+The provisioning engine always copies the acquired provisioning packages to the `%ProgramData%\Microsoft\Provisioning` folder before processing them during OOBE. The provisioning engine always applies provisioning packages embedded in the installed Windows image during Windows Setup OOBE pass regardless of whether the package is signed and trusted. When the provisioning engine applies an encrypted provisioning package on an end-user device during OOBE, users must first provide a valid password to decrypt the package. The provisioning engine also checks whether a provisioning package is signed and trusted; if it's not, the user must provide consent before the package is applied to the device.
When the provisioning engine applies provisioning packages during OOBE, it applies only the runtime settings from the package to the device. Runtime settings can be system-wide configuration settings, including security policy, Windows app install/uninstall, network configuration, bootstrapping MDM enrollment, provisioning of file assets, account and domain configuration, Windows edition upgrade, and more. The provisioning engine also checks for the configuration settings on the device, such as region/locale or SIM card, and applies the multivariant settings with matching condition(s).
## Device provisioning at runtime
-At device runtime, standalone provisioning packages can be applied by user initiation. Only runtime configuration settings including multivariant settings contained in a provisioning package can be applied at device runtime.
-
-The following table shows when provisioning at device runtime can be initiated.
+At device runtime, stand-alone provisioning packages can be applied by user initiation. The following table shows when provisioning at device runtime can be initiated.
| Package delivery | Initiation method | Supported device |
| --- | --- | --- |
@@ -147,7 +145,7 @@ When applying provisioning packages from a removable media attached to the devic
When applying multiple provisioning packages to a device, the provisioning engine resolves settings with conflicting configuration values from different packages by evaluating the package ranking using the combination of package owner type and package rank level defined in the package metadata. A configuration setting applied from a provisioning package with the highest package ranking will be the final value applied to the device.
-After a standalone provisioning package is applied to the device, the package is persisted in the %ProgramData%\Microsoft\Provisioning folder on the device. Provisioning packages can be removed by an administrator by using the **Add or remove a provisioning package** available under **Settings** > **Accounts** > **Access work or school**. However, Windows 10 doesn't provide an uninstall option to revert runtime settings when removing a provisioning package from the device.
+After a stand-alone provisioning package is applied to the device, the package is persisted in the `%ProgramData%\Microsoft\Provisioning` folder on the device. Provisioning packages can be removed by an administrator by using the **Add or remove a provisioning package** available under **Settings** > **Accounts** > **Access work or school**.
## Learn more
@@ -160,15 +158,14 @@ After a standalone provisioning package is applied to the device, the package is
## Related topics
- [Provisioning packages for Windows 10](provisioning-packages.md)
-- [Install Windows Imaging and Configuration Designer](provisioning-install-icd.md)
+- [Install Windows Configuration Designer](provisioning-install-icd.md)
- [Create a provisioning package](provisioning-create-package.md)
- [Apply a provisioning package](provisioning-apply-package.md)
- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md)
- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md)
-- [Provision PCs with apps and certificates for initial deployments (advanced provisioning)](provision-pcs-with-apps-and-certificates.md)
- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md)
-- [NFC-based device provisioning](provisioning-nfc.md)
-- [Windows ICD command-line interface (reference)](provisioning-command-line.md)
+- [PowerShell cmdlets for provisioning Windows 10 (reference)](provisioning-powershell.md)
+- [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md)
- [Create a provisioning package with multivariant settings](provisioning-multivariant.md)
diff --git a/windows/configure/provisioning-install-icd.md b/windows/configure/provisioning-install-icd.md
index 9727bc089d..16ae7f94d5 100644
--- a/windows/configure/provisioning-install-icd.md
+++ b/windows/configure/provisioning-install-icd.md
@@ -1,6 +1,6 @@
---
-title: Install Windows Imaging and Configuration Designer (Windows 10)
-description: Learn how to install and run Windows ICD.
+title: Install Windows Configuration Designer (Windows 10)
+description: Learn how to install and run Windows Configuration Designer.
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
@@ -8,7 +8,7 @@ author: jdeckerMS
localizationpriority: high
---
-# Install Windows Imaging and Configuration Designer (ICD)
+# Install Windows Configuration Designer
**Applies to**
@@ -16,11 +16,11 @@ localizationpriority: high
- Windows 10
- Windows 10 Mobile
-Use the Windows Imaging and Configuration Designer (ICD) tool in the Windows Assessment and Deployment Kit (ADK) to create provisioning packages to easily configure devices running Windows 10. Windows ICD is primarily designed for use by IT departments for business and educational institutions who need to provision bring-your-own-device (BYOD) and business-supplied devices.
+Use the Windows Configuration Designer tool to create provisioning packages to easily configure devices running Windows 10. Windows Configuration Designer is primarily designed for use by IT departments for business and educational institutions who need to provision bring-your-own-device (BYOD) and business-supplied devices.
## Supported platforms
-Windows ICD can create provisioning packages for Windows 10 desktop and mobile editions, including Windows 10 IoT Core. You can run Windows ICD on the following operating systems:
+Windows Configuration Designer can create provisioning packages for Windows 10 desktop and mobile editions, including Windows 10 IoT Core, as well as Microsoft Surface Hub and Microsoft HoloLens. You can run Windows Configuration Designer on the following operating systems:
- Windows 10 - x86 and amd64
- Windows 8.1 Update - x86 and amd64
@@ -33,18 +33,28 @@ Windows ICD can create provisioning packages for Windows 10 desktop and mobile e
- Windows Server 2012
- Windows Server 2008 R2
-## Install Windows ICD
+>[!WARNING]
+>You must run Windows Configuration Designer on Windows 10 to configure Azure Active Directory enrollment using any of the wizards.
-1. Go to [Download the Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit) and select **Get Windows ADK** for the version of Windows 10 that you want to create provisioning packages for (version 1511 or version 1607).
+## Install Windows Configuration Designer
+
+On devices running Windows 10, you can install [the Windows Configuration Designer app from the Windows Store](https://www.microsoft.com/store/apps/9nblggh4tx22). To run Windows Configuration Designer on other operating systems or in languages other than English, install it from the [Windows Assessment and Deployment Kit (ADK) for Windows 10](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit).
+
+>[!NOTE]
+>If you install Windows Configuration Designer from both the ADK and Windows Store, the Store app will not open.
+>
+>The Windows Configuration Designer App from Windows Store currently supports only English. For a localized version of the Windows Configuration Designer, install it from the Windows ADK.
+
+1. Go to [Download the Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit) and select **Get Windows ADK** for the version of Windows 10 that you want to create provisioning packages for (version 1511, 1607, or 1703).
>[!NOTE]
- >The rest of this procedure uses Windows ADK for Windows 10, version 1607 as an example.
+ >The rest of this procedure uses Windows ADK for Windows 10, version 1703 as an example.
2. Save **adksetup.exe** and then run it.
3. On the **Specify Location** page, select an installation path and then click **Next**.
>[!NOTE]
- >The estimated disk space listed on this page applies to the full Windows ADK. If you only install Windows ICD, the space requirement is approximately 32 MB.
+ >The estimated disk space listed on this page applies to the full Windows ADK. If you only install Windows Configuration Designer, the space requirement is approximately 32 MB.
4. Make a selection on the **Windows Kits Privacy** page, and then click **Next**.
5. Accept the **License Agreement**, and then click **Next**.
@@ -53,24 +63,24 @@ Windows ICD can create provisioning packages for Windows 10 desktop and mobile e
-## Current Windows ICD limitations
+## Current Windows Configuration Designer limitations
-- You can only run one instance of Windows ICD on your computer at a time.
+- You can only run one instance of Windows Configuration Designer on your computer at a time.
- Be aware that when adding apps and drivers, all files stored in the same folder will be imported and may cause errors during the build process.
-- The Windows ICD UI does not support multivariant configurations. Instead, you must use the Windows ICD command-line interface to configure multivariant settings. For more information, see [Create a provisioning package with multivariant settings](provisioning-multivariant.md).
+- The Windows Configuration Designer UI does not support multivariant configurations. Instead, you must use the Windows Configuration Designer command-line interface to configure multivariant settings. For more information, see [Create a provisioning package with multivariant settings](provisioning-multivariant.md).
-- While you can open multiple projects at the same time within Windows ICD, you can only build one project at a time.
+- While you can open multiple projects at the same time within Windows Configuration Designer, you can only build one project at a time.
-- In order to enable the simplified authoring jscripts to work on a server SKU running Windows ICD, you need to explicitly enable **Allow websites to prompt for information using scripted windows**. Do this by opening Internet Explorer and then navigating to **Settings** > **Internet Options** > **Security** -> **Custom level** > **Allow websites to prompt for information using scripted windows**, and then choose **Enable**.
+- In order to enable the simplified authoring jscripts to work on a server SKU running Windows Configuration Designer, you need to explicitly enable **Allow websites to prompt for information using scripted windows**. Do this by opening Internet Explorer and then navigating to **Settings** > **Internet Options** > **Security** -> **Custom level** > **Allow websites to prompt for information using scripted windows**, and then choose **Enable**.
-- If you copy a Windows ICD project from one PC to another PC, make sure that all the associated files for the deployment assets, such as apps and drivers, are copied along with the project to the same path as it was on the original PC.
+- If you copy a Windows Configuration Designer project from one PC to another PC, make sure that all the associated files for the deployment assets, such as apps and drivers, are copied along with the project to the same path as it was on the original PC.
- For example, when you add a driver to a provisioned package, you must copy the .INF file to a local directory on the PC that is running Windows ICD. If you don't do this, and attempt to use a copied version of this project on a different PC, Windows ICD might attempt to resolve the path to the files that point to the original PC.
+ For example, when you add a driver to a provisioned package, you must copy the .INF file to a local directory on the PC that is running Windows Configuration Designer. If you don't do this, and attempt to use a copied version of this project on a different PC, Windows Configuration Designer might attempt to resolve the path to the files that point to the original PC.
-- **Recommended**: Before starting, copy all source files to the PC running Windows ICD, rather than using external sources like network shares or removable drives. This reduces the risk of interrupting the build process from a temporary network issue or from disconnecting the USB device.
+- **Recommended**: Before starting, copy all source files to the PC running Windows Configuration Designer, rather than using external sources like network shares or removable drives. This reduces the risk of interrupting the build process from a temporary network issue or from disconnecting the USB device.
**Next step**: [How to create a provisioning package](provisioning-create-package.md)
@@ -88,10 +98,9 @@ Windows ICD can create provisioning packages for Windows 10 desktop and mobile e
- [Apply a provisioning package](provisioning-apply-package.md)
- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md)
- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md)
-- [Provision PCs with apps and certificates for initial deployments (advanced provisioning)](provision-pcs-with-apps-and-certificates.md)
- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md)
-- [NFC-based device provisioning](provisioning-nfc.md)
-- [Windows ICD command-line interface (reference)](provisioning-command-line.md)
+- [PowerShell cmdlets for provisioning Windows 10 (reference)](provisioning-powershell.md)
+- [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md)
- [Create a provisioning package with multivariant settings](provisioning-multivariant.md)
diff --git a/windows/configure/provisioning-multivariant.md b/windows/configure/provisioning-multivariant.md
index d33f1206b5..d28ac354ee 100644
--- a/windows/configure/provisioning-multivariant.md
+++ b/windows/configure/provisioning-multivariant.md
@@ -302,15 +302,14 @@ The following events trigger provisioning on Windows 10 devices:
- [Provisioning packages for Windows 10](provisioning-packages.md)
- [How provisioning works in Windows 10](provisioning-how-it-works.md)
-- [Install Windows Imaging and Configuration Designer](provisioning-install-icd.md)
+- [Install Windows Configuration Designer](provisioning-install-icd.md)
- [Create a provisioning package](provisioning-create-package.md)
- [Apply a provisioning package](provisioning-apply-package.md)
- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md)
- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md)
-- [Provision PCs with apps and certificates for initial deployments (advanced provisioning)](provision-pcs-with-apps-and-certificates.md)
- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md)
-- [NFC-based device provisioning](provisioning-nfc.md)
-- [Windows ICD command-line interface (reference)](provisioning-command-line.md)
+- [PowerShell cmdlets for provisioning Windows 10 (reference)](provisioning-powershell.md)
+- [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md)
diff --git a/windows/configure/provisioning-nfc.md b/windows/configure/provisioning-nfc.md
index 114e6d5545..fad3428d0c 100644
--- a/windows/configure/provisioning-nfc.md
+++ b/windows/configure/provisioning-nfc.md
@@ -17,7 +17,7 @@ localizationpriority: high
Near field communication (NFC) enables Windows 10 Mobile Enterprise and Windows 10 Mobile devices to communicate with an NFC tag or another NFC-enabled transmitting device. Enterprises that do bulk provisioning can use NFC-based device provisioning to provide a provisioning package to the device that's being provisioned. NFC provisioning is simple and convenient and it can easily store an entire provisioning package.
-The NFC provisioning option enables the administrator to provide a provisioning package during initial device setup or the out-of-box experience (OOBE) phase. Administrators can use the NFC provisioning option to transfer provisioning information to persistent storage by tapping an unprovisioned mobile device to an NFC tag or NFC-enabled device. To use NFC for pre-provisioning a device, you must either prepare your own NFC tags by storing your provisioning package to a tag as described in this section, or build the infrastructure needed to transmit a provisioning package between an NFC-enabled device and a mobile device during OOBE.
+The NFC provisioning option enables the administrator to provide a provisioning package during initial device setup (the out-of-box experience or OOBE phase). Administrators can use the NFC provisioning option to transfer provisioning information to persistent storage by tapping an unprovisioned mobile device to an NFC tag or NFC-enabled device. To use NFC for pre-provisioning a device, you must either prepare your own NFC tags by storing your provisioning package to a tag as described in this section, or build the infrastructure needed to transmit a provisioning package between an NFC-enabled device and a mobile device during OOBE.
## Provisioning OOBE UI
@@ -131,18 +131,9 @@ For detailed information and code samples on how to implement an NFC-enabled dev
## Related topics
-- [Provisioning packages for Windows 10](provisioning-packages.md)
-- [How provisioning works in Windows 10](provisioning-how-it-works.md)
-- [Install Windows Imaging and Configuration Designer](provisioning-install-icd.md)
-- [Create a provisioning package](provisioning-create-package.md)
-- [Apply a provisioning package](provisioning-apply-package.md)
-- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md)
-- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md)
-- [Provision PCs with apps and certificates for initial deployments (advanced provisioning)](provision-pcs-with-apps-and-certificates.md)
-- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md)
-- [Windows ICD command-line interface (reference)](provisioning-command-line.md)
-- [Create a provisioning package with multivariant settings](provisioning-multivariant.md)
+- [Use Windows Configuration Designer to configure Windows 10 Mobile devices](provisioning-configure-mobile.md)
+- [Barcode provisioning and the package splitter tool](provisioning-package-splitter.md)
diff --git a/windows/configure/provisioning-package-splitter.md b/windows/configure/provisioning-package-splitter.md
new file mode 100644
index 0000000000..00a62a1ae4
--- /dev/null
+++ b/windows/configure/provisioning-package-splitter.md
@@ -0,0 +1,88 @@
+---
+title: Barcode provisioning and the package splitter tool (Windows 10)
+description:
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+author: jdeckerMS
+localizationpriority: high
+---
+
+# Barcode provisioning and the package splitter tool
+
+
+**Applies to**
+
+- Windows 10 Mobile
+
+Enterprises that do bulk provisioning can use barcode-based device provisioning to provide a provisioning package to the device that's being provisioned.
+
+The barcode provisioning option enables the administrator to provide a provisioning package during initial device setup (the out-of-box experience or OOBE phase). To use barcodes to provision a device, your devices must have an integrated barcode scanner. You can get the barcode format that the scanner supports from your OEM or device provider, and use your existing tools and processes to convert a provisioning package into barcodes.
+
+Enterprise IT professionals who want to use a barcode to provision mobile devices during OOBE can use the package splitter tool, **ppkgtobase64.exe**, which is a command-line tool to split the provisioning package into smaller files.
+
+The smallest provisioning package is typically 5-6 KB, which cannot fit into one single barcode. The package splitter tool allows partners to split the original provisioning package into multiple smaller sized chunks that are encoded with Base64 so that enterprises can leverage their existing tools to convert these files into barcodes.
+
+When you [install Windows Configuration Designer](provisioning-install-icd.md) from the Windows Assessment and Deployment Kit (ADK), **ppkgtobase64.exe** is installed to the same folder.
+
+## Prerequisites
+
+Before you can use the tool, you must have a built provisioning package. The package file is the input to the package splitter tool.
+
+- To build a provisioning package using the Windows Configuration Designer UI, see [Use Windows Configuration Designer to configure Windows 10 Mobile devices](provisioning-configure-mobile.md).
+- To build a provisioning package using the Windows Configuration Designer CLI, see [Windows Configuration Designer command-line interface](provisioning-command-line.md).
+
+## To use the package splitter tool (ppkgtobase64.exe)
+
+1. Open a command-line window with administrator privileges.
+
+
+2. From the command-line, navigate to the Windows Configuration Designer install directory.
+
+ On an x64 computer, type:
+ ```
+ cd C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86
+ ```
+
+ - or -
+
+ On an x86 computer, type:
+
+ ```
+ cd C:\Program Files\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86
+ ```
+
+3. Run `ppkgtobase64.exe`. The [syntax](#syntax) and [switches and arguments](#switches-and-arguments) sections provide details for the command.
+
+
+### Syntax
+
+```
+ppkgtobase64.exe -i -o -s [-c] [/?]
+```
+
+### Switches and arguments
+
+| Switch | Required? | Arguments |
+| --- | --- | --- |
+| -i | Yes | Use to specify the path and file name of the provisioning package that you want to divide into smaller files.The tool allows you to specify the absolute path of the provisioning package file. However, if you don't specify the path, the tool will search the current folder for a package that matches the file name you specified. |
+| -o | Yes | Use to specify the directory where the output files will be saved. |
+| -s | Yes | Use to specify the size of the block that will be encoded in Base64. |
+| -c | No | Use to delete any files in the output directory if the directory already exists. This parameter is optional. |
+| /? | No | Lists the switches and their descriptions for the command-line tool or for certain commands. |
+
+
+
+
+
+## Related topics
+
+
+
+
+
+
+
+
+
+
diff --git a/windows/configure/provisioning-packages.md b/windows/configure/provisioning-packages.md
index 557bf3e595..8732d8c5a3 100644
--- a/windows/configure/provisioning-packages.md
+++ b/windows/configure/provisioning-packages.md
@@ -14,8 +14,8 @@ localizationpriority: high
**Applies to**
-- Windows 10
-- Windows 10 Mobile
+- Windows 10
+- Windows 10 Mobile
Windows provisioning makes it easy for IT administrators to configure end-user devices without imaging. Using Windows provisioning, an IT administrator can easily specify desired configuration and settings required to enroll the devices into management and then apply that configuration to target devices in a matter of minutes. It is best suited for small- to medium-sized businesses with deployments that range from tens to a few hundred computers.
@@ -23,59 +23,74 @@ A provisioning package (.ppkg) is a container for a collection of configuration
Provisioning packages are simple enough that with a short set of written instructions, a student or non-technical employee can use them to configure their device. This can result in a significant reduction in the time required to configure multiple devices in your organization.
-The [Windows Assessment and Deployment Kit (ADK) for Windows 10](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit) includes the Imaging and Configuration Designer (ICD), a tool for configuring provisioning packages.
+The [Windows Assessment and Deployment Kit (ADK) for Windows 10](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit) includes the Windows Configuration Designer, a tool for configuring provisioning packages. Windows Configuration Designer is also available as an [app in the Windows Store](https://www.microsoft.com/store/apps/9nblggh4tx22).
-## New in Windows 10, version 1607
-Windows ICD for Windows 10, version 1607, simplifies common provisioning scenarios.
-
-Windows ICD in Windows 10, version 1607, supports the following scenarios for IT administrators:
+## New in Windows 10, version 1703
-* **Simple provisioning** – Enables IT administrators to define a desired configuration in Windows ICD and then apply that configuration on target devices. The simple provisioning wizard makes the entire process quick and easy by guiding an IT administrator through common configuration settings in a step-by-step manner.
+- The tool for creating provisioning packages is renamed Windows Configuration Designer, replacing the Windows Imaging and Configuration Designer (ICD) tool. The components for creating images have been removed from Windows Configuration Designer, which now provides access to runtime settings only.
+- Windows Configuration Designer can still be installed from the Windows ADK. You can also install it from the Windows Store.
+- Windows Configuration Designer adds more wizards to make it easier to create provisioning packages for specific scenarios. See [What you can configure](#configuration-designer-wizards) for wizard descriptions.
+- The wizard **Provision desktop devices** (previously called **Simple provisioning**) now enables joining Azure Active Directory (Azure AD) domains and also allows you to remove non-Microsoft software from Windows desktop devices during provisioning.
+- When provisioning packages are applied to a device, a status screen indicates successful or failed provisioning.
+- Windows 10 includes PowerShell cmdlets that simplify scripted provisioning. Using these cmdlets, you can add provisioning packages, remove provisioning packages and generate log files to investigate provisioning errors.
+- The **Provision school devices** wizard is removed from Windows Configuration Designer. Instead, use the [Setup School PCs app](https://www.microsoft.com/store/p/set-up-school-pcs/9nblggh4ls40) from the Windows Store.
+
- > [Learn how to use simple provisioning to configure Windows 10 computers.](provision-pcs-for-initial-deployment.md)
-
-* **Advanced provisioning (deployment of classic (Win32) and Universal Windows Platform (UWP) apps, and certificates)** – Allows an IT administrator to use Windows ICD to open provisioning packages in the advanced settings editor and include apps for deployment on end-user devices.
-
- > [Learn how to use advanced provisioning to configure Windows 10 computers with apps and certificates.](provision-pcs-with-apps-and-certificates.md)
-
-* **Mobile device enrollment into management** - Enables IT administrators to purchase off-the-shelf retail Windows 10 Mobile devices and enroll them into mobile device management (MDM) before handing them to end-users in the organization. IT administrators can use Windows ICD to specify the management end-point and apply the configuration on target devices by connecting them to a Windows PC (tethered deployment) or through an SD card. Supported management end-points include:
-
- * System Center Configuration Manager and Microsoft Intune hybrid (certificate-based enrollment)
- * AirWatch (password-string based enrollment)
- * Mobile Iron (password-string based enrollment)
- * Other MDMs (cert-based enrollment)
-
-> [!NOTE]
-> Windows ICD in Windows 10, version 1607, also provides a wizard to create provisioning packages for school PCs. To learn more, see [Set up students' PCs to join domain](https://technet.microsoft.com/edu/windows/index).
## Benefits of provisioning packages
Provisioning packages let you:
-- Quickly configure a new device without going through the process of installing a new image.
+- Quickly configure a new device without going through the process of installing a new image.
-- Save time by configuring multiple devices using one provisioning package.
+- Save time by configuring multiple devices using one provisioning package.
-- Quickly configure employee-owned devices in an organization without a mobile device management (MDM) infrastructure.
+- Quickly configure employee-owned devices in an organization without a mobile device management (MDM) infrastructure.
-- Set up a device without the device having network connectivity.
+- Set up a device without the device having network connectivity.
Provisioning packages can be:
-- Installed using removable media such as an SD card or USB flash drive.
+- Installed using removable media such as an SD card or USB flash drive.
-- Attached to an email.
+- Attached to an email.
-- Downloaded from a network share.
+- Downloaded from a network share.
+
+- Deployed in NFC tags or barcodes.
## What you can configure
+### Configuration Designer wizards
-The following table provides some examples of what you can configure using provisioning packages.
+The following table describes settings that you can configure using the wizards in Windows Configuration Designer to create provisioning packages.
+
+| **Step** | **Description** | **Desktopwizard** | **Mobilewizard** | **Kioskwizard** |
+| Set up device | Assign device name,enter product key to upgrade Windows,configure shared used,remove pre-installed software |  | (Only device name and upgrade key) |  |
+| Set up network | Connect to a Wi-Fit network |  |  |  |
+| Account management | Enroll device in Active Directory,enroll device in Azure Active Directory,or create a local administrator account |  |  |  |
+| Bulk Enrollment in Azure AD | Enroll device in Azure Active DirectoryBefore you use a Windows Configuration Designer wizard to configure bulk Azure AD enrollment, [set up Azure AD join in your organization](https://docs.microsoft.com/azure/active-directory/active-directory-azureadjoin-setup). |  |  |  |
+| Add applications | Install applications using the provisioning package. |  |  |  |
+| Add certificates | Include a certificate file in the provisioning package. |  |  |  |
+| Configure kiosk account and app | Create local account to run the kiosk mode app,specify the app to run in kiosk mode |  |  |  |
+| Configure kiosk common settings | Set tablet mode,configure welcome and shutdown screens,turn off timeout settings |  |  |  |
+
+- [Instructions for the desktop wizard](provision-pcs-for-initial-deployment.md)
+- [Instructions for the mobile wizard](provisioning-configure-mobile.md)
+- [Instructions for the kiosk wizard](set-up-a-kiosk-for-windows-10-for-desktop-editions.md#wizard)
+
+
+
+>[!NOTE]
+>After you start a project using a Windows Configuration Designer wizard, you can switch to the advanced editor to configure additional settings in the provisioning package.
+
+### Configuration Designer advanced editor
+
+The following table provides some examples of settings that you can configure using the Windows Configuration Designer advanced editor to create provisioning packages.
| Customization options | Examples |
|--------------------------|-----------------------------------------------------------------------------------------------|
@@ -93,25 +108,52 @@ The following table provides some examples of what you can configure using provi
For details about the settings you can customize in provisioning packages, see [Windows Provisioning settings reference]( https://go.microsoft.com/fwlink/p/?LinkId=619012).
+## Changes to provisioning in Windows 10, version 1607
+
+>[!NOTE]
+>This section is retained for customers using Windows 10, version 1607, on the Current Branch for Business. Some of this information is not applicable in Windows 10, version 1703.
+
+Windows ICD for Windows 10, version 1607, simplified common provisioning scenarios.
+
+
+
+Windows ICD in Windows 10, version 1607, supported the following scenarios for IT administrators:
+
+* **Simple provisioning** – Enables IT administrators to define a desired configuration in Windows ICD and then apply that configuration on target devices. The simple provisioning wizard makes the entire process quick and easy by guiding an IT administrator through common configuration settings in a step-by-step manner.
+
+ > [Learn how to use simple provisioning to configure Windows 10 computers.](provision-pcs-for-initial-deployment.md)
+
+* **Advanced provisioning (deployment of classic (Win32) and Universal Windows Platform (UWP) apps, and certificates)** – Allows an IT administrator to use Windows ICD to open provisioning packages in the advanced settings editor and include apps for deployment on end-user devices.
+
+* **Mobile device enrollment into management** - Enables IT administrators to purchase off-the-shelf retail Windows 10 Mobile devices and enroll them into mobile device management (MDM) before handing them to end-users in the organization. IT administrators can use Windows ICD to specify the management end-point and apply the configuration on target devices by connecting them to a Windows PC (tethered deployment) or through an SD card. Supported management end-points include:
+
+ * System Center Configuration Manager and Microsoft Intune hybrid (certificate-based enrollment)
+ * AirWatch (password-string based enrollment)
+ * Mobile Iron (password-string based enrollment)
+ * Other MDMs (cert-based enrollment)
+
+> [!NOTE]
+> Windows ICD in Windows 10, version 1607, also provided a wizard to create provisioning packages for school PCs. To learn more, see [Set up students' PCs to join domain](https://technet.microsoft.com/edu/windows/index).
+
## Learn more
-- Watch the video: [Provisioning Windows 10 Devices with New Tools](https://go.microsoft.com/fwlink/p/?LinkId=615921)
+- Watch the video: [Provisioning Windows 10 Devices with New Tools](https://go.microsoft.com/fwlink/p/?LinkId=615921)
-- Watch the video: [Windows 10 for Mobile Devices: Provisioning Is Not Imaging](https://go.microsoft.com/fwlink/p/?LinkId=615922)
+- Watch the video: [Windows 10 for Mobile Devices: Provisioning Is Not Imaging](https://go.microsoft.com/fwlink/p/?LinkId=615922)
## Related topics
- [How provisioning works in Windows 10](provisioning-how-it-works.md)
-- [Install Windows Imaging and Configuration Designer](provisioning-install-icd.md)
+- [Install Windows Configuration Designer](provisioning-install-icd.md)
- [Create a provisioning package](provisioning-create-package.md)
- [Apply a provisioning package](provisioning-apply-package.md)
- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md)
- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md)
-- [Provision PCs with apps and certificates for initial deployments (advanced provisioning)](provision-pcs-with-apps-and-certificates.md)
- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md)
-- [NFC-based device provisioning](provisioning-nfc.md)
-- [Windows ICD command-line interface (reference)](provisioning-command-line.md)
+- [PowerShell cmdlets for provisioning Windows 10 (reference)](provisioning-powershell.md)
+- [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md)
- [Create a provisioning package with multivariant settings](provisioning-multivariant.md)
+- [Use Windows Configuration Designer to configure Windows 10 Mobile devices](provisioning-configure-mobile.md)
diff --git a/windows/configure/provisioning-powershell.md b/windows/configure/provisioning-powershell.md
new file mode 100644
index 0000000000..508bada17f
--- /dev/null
+++ b/windows/configure/provisioning-powershell.md
@@ -0,0 +1,72 @@
+---
+title: PowerShell cmdlets for provisioning Windows 10 (Windows 10)
+description:
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+author: jdeckerMS
+localizationpriority: high
+---
+
+# PowerShell cmdlets for provisioning Windows 10 (reference)
+
+
+**Applies to**
+
+- Windows 10
+- Windows 10 Mobile
+
+Windows 10, version 1703, ships with Windows Provisioning PowerShell cmdlets. These cmdlets make it easy to script the following functions.
+
+
+
+| Cmdlet | Use this cmdlet to | Syntax |
|---|
+| Add-ProvisioningPackage | Apply a provisioning package | ```Add-ProvisioningPackage [-Path] [-ForceInstall] [-LogsFolder ] [-WprpFile ] []``` |
+| Remove-ProvisioningPackage | Remove a provisioning package | ```Remove-ProvisioningPackage -PackageId [-LogsFolder ] [-WprpFile ] []``` |
| ```Remove-ProvisioningPackage -Path [-LogsFolder ] [-WprpFile ] []``` |
| ```Remove-ProvisioningPackage -AllInstalledPackages [-LogsFolder ] [-WprpFile ] []``` |
+| Get-ProvisioningPackage | Get information about an installed provisioning package | ```Get-ProvisioningPackage -PackageId [-LogsFolder ] [-WprpFile ] []``` |
| ```Get-ProvisioningPackage -Path [-LogsFolder ] [-WprpFile ] []``` |
| ```Get-ProvisioningPackage -AllInstalledPackages [-LogsFolder ] [-WprpFile ] []``` |
+| Export-ProvisioningPackage | Extract the contents of a provisioning package | ```Export-ProvisioningPackage -PackageId -OutputFolder [-Overwrite] [-AnswerFileOnly] [-LogsFolder ] [-WprpFile ] []``` |
| ```Export-ProvisioningPackage -Path -OutputFolder [-Overwrite] [-AnswerFileOnly] [-LogsFolder ] [-WprpFile ] []``` |
+| Install-TrustedProvisioningCertificate | Adds a certificate to the Trusted Certificate store | ```Install-TrustedProvisioningCertificate ``` |
+| Get-TrustedProvisioningCertificate | List all installed trusted provisioning certificates; use this cmdlet to get the certificate thumbprint to use with the **Uninstall-TrustedProvisioningCertificate** cmdlet | ```Get-TrustedProvisioningCertificate``` |
+| Uninstall-TrustedProvisioningCertificate | Remove a previously installed provisioning certificate | ```Uninstall-TrustedProvisioningCertificate ``` |
+
+
+>[!NOTE]
+> You can use Get-Help to get usage help on any command. For example: `Get-Help Add-ProvisioningPackage`
+
+Trace logs are captured when using cmdlets. The following logs are available in the logs folder after the cmdlet completes:
+
+- ProvTrace.<timestamp>.ETL - ETL trace file, unfiltered
+- ProvTrace.<timestamp>.XML - ETL trace file converted into raw trace events, unfiltered
+- ProvTrace.<timestamp>.TXT - TEXT file containing trace output formatted for easy reading, filtered to only show events logged by providers in the WPRP file
+- ProvLogReport.<timestamp>.XLS - Excel file containing trace output, filtered to only show events logged by providers in WPRP file
+
+
+
+>[!NOTE]
+>When applying provisioning packages using Powershell cmdlets, the default behavior is to suppress the prompt that appears when applying an unsigned provisioning package. This is by design so that provisioning packages can be applied as part of existing scripts.
+
+
+## Related topics
+
+- [How provisioning works in Windows 10](provisioning-how-it-works.md)
+- [Install Windows Configuration Designer](provisioning-install-icd.md)
+- [Create a provisioning package](provisioning-create-package.md)
+- [Apply a provisioning package](provisioning-apply-package.md)
+- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md)
+- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md)
+- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md)
+- [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md)
+- [Create a provisioning package with multivariant settings](provisioning-multivariant.md)
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/windows/configure/provisioning-script-to-install-app.md b/windows/configure/provisioning-script-to-install-app.md
index 8754c66299..20ada61de8 100644
--- a/windows/configure/provisioning-script-to-install-app.md
+++ b/windows/configure/provisioning-script-to-install-app.md
@@ -168,21 +168,21 @@ Here’s a table describing this relationship, using the PowerShell example from
### Add script to provisioning package
-When you have the batch file written and the referenced assets ready to include, you can add them to a provisioning package in the Window Imaging and Configuration Designer (Windows ICD).
+When you have the batch file written and the referenced assets ready to include, you can add them to a provisioning package in the Window Configuration Designer.
-Using ICD, specify the full details of how the script should be run in the CommandLine setting in the provisioning package. This includes flags or any other parameters that you would normally type on the command line. So for example if the package contained an app installer called install.exe and a script used to automate the install called InstallMyApp.bat, the `ProvisioningCommands/DeviceContext/CommandLine` setting should be configured to:
+Using Windows Configuration Designer, specify the full details of how the script should be run in the CommandLine setting in the provisioning package. This includes flags or any other parameters that you would normally type on the command line. So for example if the package contained an app installer called install.exe and a script used to automate the install called InstallMyApp.bat, the `ProvisioningCommands/DeviceContext/CommandLine` setting should be configured to:
```
cmd /c InstallMyApp.bat
```
-In ICD, this looks like:
+In Windows Configuration Designer, this looks like:
You also need to add the relevant assets for that command line including the orchestrator script and any other assets it references such as installers or .cab files.
-In ICD, that is done by adding files under the `ProvisioningCommands/DeviceContext/CommandFiles` setting.
+In Windows Configuration Designer, that is done by adding files under the `ProvisioningCommands/DeviceContext/CommandFiles` setting.
@@ -211,12 +211,11 @@ When you are done, [build the package](provisioning-create-package.md#build-pack
- [Provisioning packages for Windows 10](provisioning-packages.md)
- [How provisioning works in Windows 10](provisioning-how-it-works.md)
-- [Install Windows Imaging and Configuration Designer](provisioning-install-icd.md)
+- [Install Windows Configuration Designer](provisioning-install-icd.md)
- [Create a provisioning package](provisioning-create-package.md)
- [Apply a provisioning package](provisioning-apply-package.md)
- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md)
- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md)
-- [Provision PCs with apps and certificates for initial deployments (advanced provisioning)](provision-pcs-with-apps-and-certificates.md)
-- [NFC-based device provisioning](provisioning-nfc.md)
-- [Windows ICD command-line interface (reference)](provisioning-command-line.md)
+- [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md)
+- [PowerShell cmdlets for provisioning Windows 10 (reference)](provisioning-powershell.md)
- [Create a provisioning package with multivariant settings](provisioning-multivariant.md)
\ No newline at end of file
diff --git a/windows/configure/provisioning-uninstall-package.md b/windows/configure/provisioning-uninstall-package.md
index b3836ede88..e4ee9c442e 100644
--- a/windows/configure/provisioning-uninstall-package.md
+++ b/windows/configure/provisioning-uninstall-package.md
@@ -27,7 +27,7 @@ Only settings in the following lists are revertible.
## Registry-based settings
-The registry-based settings that are revertible when a provisioning package is uninstalled all fall under these categories, which you can find in the Graphical User Interface of the Windows Imaging and Configuration Designer (Windows ICD).
+The registry-based settings that are revertible when a provisioning package is uninstalled all fall under these categories, which you can find in the Windows Configuration Designer.
- [Wi-Fi Sense](https://msdn.microsoft.com/library/windows/hardware/mt219706.aspx)
@@ -78,14 +78,13 @@ Here is the list of revertible settings based on configuration service providers
- [Provisioning packages for Windows 10](provisioning-packages.md)
- [How provisioning works in Windows 10](provisioning-how-it-works.md)
-- [Install Windows Imaging and Configuration Designer](provisioning-install-icd.md)
+- [Install Windows Configuration Designer](provisioning-install-icd.md)
- [Create a provisioning package](provisioning-create-package.md)
- [Apply a provisioning package](provisioning-apply-package.md)
- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md)
-- [Provision PCs with apps and certificates for initial deployments (advanced provisioning)](provision-pcs-with-apps-and-certificates.md)
- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md)
-- [NFC-based device provisioning](provisioning-nfc.md)
-- [Windows ICD command-line interface (reference)](provisioning-command-line.md)
+- [PowerShell cmdlets for provisioning Windows 10 (reference)](provisioning-powershell.md)
+- [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md)
- [Create a provisioning package with multivariant settings](provisioning-multivariant.md)
diff --git a/windows/configure/set-up-a-device-for-anyone-to-use.md b/windows/configure/set-up-a-device-for-anyone-to-use.md
index f274498ed1..7a58deaa8f 100644
--- a/windows/configure/set-up-a-device-for-anyone-to-use.md
+++ b/windows/configure/set-up-a-device-for-anyone-to-use.md
@@ -1,5 +1,5 @@
---
-title: Set up a device for anyone to use (kiosk mode) (Windows 10)
+title: Set up a device for anyone to use in kiosk mode (Windows 10)
description: You can configure Windows 10 as a kiosk device, so that users can only interact with a single app.
ms.assetid: F1F4FF19-188C-4CDC-AABA-977639C53CA8
keywords: ["kiosk", "lockdown", "assigned access"]
@@ -8,6 +8,7 @@ ms.mktglfcycl: manage
ms.sitesec: library
author: jdeckerMS
localizationpriority: high
+redirect_url: https://technet.microsoft.com/itpro/windows/configure/kiosk-shared-pc
---
# Set up a device for anyone to use (kiosk mode)
diff --git a/windows/configure/set-up-a-kiosk-for-windows-10-for-desktop-editions.md b/windows/configure/set-up-a-kiosk-for-windows-10-for-desktop-editions.md
index 211f47f9c2..e9f19dfa8f 100644
--- a/windows/configure/set-up-a-kiosk-for-windows-10-for-desktop-editions.md
+++ b/windows/configure/set-up-a-kiosk-for-windows-10-for-desktop-editions.md
@@ -19,52 +19,65 @@ localizationpriority: high
> **Looking for Windows Embedded 8.1 Industry information?** See [Assigned Access]( https://go.microsoft.com/fwlink/p/?LinkId=613653)
-A single-use or *kiosk* device is easy to set up in Windows 10 for desktop editions (Pro, Enterprise, and Education). For a kiosk device to run a Universal Windows app, use the **assigned access** feature. For a kiosk device (Windows 10 Enterprise or Education) to run a Classic Windows application, use **Shell Launcher** to set a custom user interface as the shell. To return the device to the regular shell, see [Sign out of assigned access](#sign-out-of-assigned-access).
+A single-use or *kiosk* device is easy to set up in Windows 10 for desktop editions.
-**Note**
-A Universal Windows app is built on the Universal Windows Platform (UWP), which was first introduced in Windows 8 as the Windows Runtime. A Classic Windows application uses the Classic Windows Platform (CWP) (e.g., COM, Win32, WPF, WinForms, etc.) and is typically launched using an .EXE or .DLL file.
+- Use the [Provision kiosk devices wizard](#wizard) in Windows Configuration Designer to create a provisioning package that configures a kiosk device running either a Universal Windows app or a Classic Windows application (Windows 10 Enterprise or Education only).
+
+ or
+
+- For a kiosk device to run a Universal Windows app, use the [assigned access](#assigned-access) feature (Windows 10 Pro, Enterprise, or Education).
+
+ or
+
+- For a kiosk device to run a Classic Windows application, use [Shell Launcher](#shell-launcher) to set a custom user interface as the shell (Windows 10 Enterprise or Education only).
+
+To return the device to the regular shell, see [Sign out of assigned access](#sign-out-of-assigned-access).
+
+>[!NOTE]
+>A Universal Windows app is built on the Universal Windows Platform (UWP), which was first introduced in Windows 8 as the Windows Runtime. A Classic Windows application uses the Classic Windows Platform (CWP) (e.g., COM, Win32, WPF, WinForms, etc.) and is typically launched using an .EXE or .DLL file.
-## Other settings to lock down
-For a more secure kiosk experience, we recommend that you make the following configuration changes to the device:
+
+## Set up a kiosk using Windows Configuration Designer
-- Put device in **Tablet mode**.
+When you use the **Provision kiosk devices** wizard in Windows Configuration Designer, you can configure the kiosk to run either a Universal Windows app or a Classic Windows application.
- If you want users to be able to use the touch (on screen) keyboard, go to **Settings** > **System** > **Tablet mode** and choose **On.**
+>[!IMPORTANT]
+>When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed.
-- Hide **Ease of access** feature on the logon screen.
- Go to **Control Panel** > **Ease of Access** > **Ease of Access Center**, and turn off all accessibility tools.
+[Install Windows Configuration Designer](provisioning-install-icd.md), then open Windows Configuration Designer and select **Provision kiosk devices**. After you name your project, and click **Next**, configure the settings as shown in the following table.
-- Disable the hardware power button.
- Go to **Power Options** > **Choose what the power button does**, change the setting to **Do nothing**, and then **Save changes**.
-- Remove the power button from the sign-in screen.
+
+| Enable device setup if you want to configure settings on this page.**If enabled:**Enter a name for the device.(Optional) Select a license file to upgrade Windows 10 to a different edition. [See the permitted upgrades.](https://technet.microsoft.com/itpro/windows/deploy/windows-10-edition-upgrades)Toggle **Configure devices for shared use** off. This setting optimizes Windows 10 for shared use scenarios and isn't necessary for a kiosk scenario.You can also select to remove pre-installed software from the device. |  |
+|  Enable network setup if you want to configure settings on this page.**If enabled:**Toggle **On** or **Off** for wireless network connectivity. If you select **On**, enter the SSID, the network type (**Open** or **WPA2-Personal**), and (if **WPA2-Personal**) the password for the wireless network. |  |
+|  Enable account management if you want to configure settings on this page. **If enabled:**You can enroll the device in Active Directory, enroll in Azure Active Directory, or create a local administrator account on the deviceTo enroll the device in Active Directory, enter the credentials for a least-privileged user account to join the device to the domain.Before you use a Windows Configuration Designer wizard to configure bulk Azure AD enrollment, [set up Azure AD join in your organization](https://docs.microsoft.com/azure/active-directory/active-directory-azureadjoin-setup). The **maximum number of devices per user** setting in your Azure AD tenant determines how many times the bulk token that you get in the wizard can be used. To enroll the device in Azure AD, select that option and enter a friendly name for the bulk token you will get using the wizard. Set an expiration date for the token (maximum is 30 days from the date you get the token). Click **Get bulk token**. In the **Let's get you signed in** window, enter an account that has permissions to join a device to Azure AD, and then the password. Click **Accept** to give Windows Configuration Designer the necessary permissions.**Warning:** You must run Windows Configuration Designer on Windows 10 to configure Azure Active Directory enrollment using any of the wizards.To create a local administrator account, select that option and enter a user name and password. **Important:** If you create a local account in the provisioning package, you must change the password using the **Settings** app every 42 days. If the password is not changed during that period, the account might be locked out and unable to sign in. |  |
+|  You can provision the kiosk app in the **Add applications** step. You can install multiple applications, both Classic Windows (Win32) apps and Universal Windows Platform (UWP) apps, in a provisioning package. The settings in this step vary according to the application that you select. For help with the settings, see [Provision PCs with apps](provision-pcs-with-apps.md)**Warning:** If you click the plus button to add an application, you must specify an application for the provisioning package to validate. If you click the plus button in error, select any executable file in **Installer Path**, and then a **Cancel** button becomes available, allowing you to complete the provisioning package without an application. |  |
+|  To provision the device with a certificate for the kiosk app, click **Add a certificate**. Enter a name for the certificate, and then browse to and select the certificate to be used. |  |
+|  **Important:** You must use the Windows Configuration Designer app from Windows Store to select a Classic Windows application as the kiosk app in a provisioning package.You can create a local standard user account that will be used to run the kiosk app. If you toggle **No**, make sure that you have an existing user account to run the kiosk app.If you want to create an account, enter the user name and password, and then toggle **Yes** or **No** to automatically sign in the account when the device starts.In **Configure the kiosk mode app**, enter the name of the user account that will run the kiosk mode app. Select the type of app to run in kiosk mode, and then enter the path or filename (for a Classic Windows app) or the AUMID (for a Universal Windows app). For a Classic Windows app, you can use the filename if the path to the file is in the PATH environment variable, otherwise the full path is required. |  |
+|  On this step, select your options for tablet mode, the user experience on the Welcome and shutdown screens, and the timeout settings. |  |
+| You can set a password to protect your provisioning package. You must enter this password when you apply the provisioning package to a device. |  |
+
- Go to **Computer Configuration** > **Windows Settings** > **Security Settings** > **Local Policies** >**Security Options** > **Shutdown: Allow system to be shut down without having to log on** and select **Disabled.**
-- Disable the camera.
+>[!NOTE]
+>If you want to use the advanced editor in Windows Configuration Designer, specify the user account and app (by AUMID) in **Runtime settings** > **AssignedAccess** > **AssignedAccessSettings**
- Go to **Settings** > **Privacy** > **Camera**, and turn off **Let apps use my camera**.
-- Turn off app notifications on the lock screen.
- Go to **Group Policy Editor** > **Computer Configuration** > **Administrative Templates\\System\\Logon\\Turn off app notifications on the lock screen**.
-- Disable removable media.
- Go to **Group Policy Editor** > **Computer Configuration** > **Administrative Templates\\System\\Device Installation\\Device Installation Restrictions**. Review the policy settings available in **Device Installation Restrictions** for the settings applicable to your situation.
+[Learn how to apply a provisioning package.](provisioning-apply-package.md)
- **Note**
- To prevent this policy from affecting a member of the Administrators group, in **Device Installation Restrictions**, enable **Allow administrators to override Device Installation Restriction policies**.
-
-## Assigned access method for Universal Windows apps
+
+## Assigned access method for Universal Windows apps
Using assigned access, Windows 10 runs the designated Universal Windows app above the lockscreen, so that the assigned access account has no access to any other functionality on the device. You have these choices for setting up assigned access:
@@ -73,7 +86,7 @@ Using assigned access, Windows 10 runs the designated Universal Windows app abo
| --- | --- | --- |
| [Use Settings on the PC](#set-up-assigned-access-in-pc-settings) | Local standard | Pro, Enterprise, Education |
| [Apply a mobile device management (MDM) policy](#set-up-assigned-access-in-mdm) | All (domain, local standard, local administrator, etc) | Enterprise, Education |
-| [Create a provisioning package using Windows Imaging and Configuration Designer (ICD)](#icd) | All (domain, local standard, local administrator, etc) | Enterprise, Education |
+| [Create a provisioning package using Windows Configuration Designer](#wizard) | All (domain, local standard, local administrator, etc) | Enterprise, Education |
| [Run a PowerShell script](#set-up-assigned-access-using-windows-powershell) | Local standard | Pro, Enterprise, Education |
@@ -88,8 +101,8 @@ Using assigned access, Windows 10 runs the designated Universal Windows app abo
The Universal Windows app must be able to handle multiple views and cannot launch other apps or dialogs.
-**Note**
-Assigned access does not work on a device that is connected to more than one monitor.
+>[!NOTE]
+>Assigned access does not work on a device that is connected to more than one monitor.
@@ -105,7 +118,7 @@ Assigned access does not work on a device that is connected to more than one mon
5. Close **Settings** – your choices are saved automatically, and will be applied the next time that user account logs on.
-To remove assigned access, in step 3, choose **Don't use assigned access**.
+To remove assigned access, choose **Turn off assigned access and sign out of the selected account**.
### Set up assigned access in MDM
@@ -115,69 +128,9 @@ Assigned Access has one setting, KioskModeApp. In the KioskModeApp setting, you
[See the technical reference for the Assigned Access configuration service provider.](https://go.microsoft.com/fwlink/p/?LinkId=626608)
-### Set up assigned access using Windows Imaging and Configuration Designer (ICD)
+
-Use the Windows Imaging and Configuration Designer (ICD) tool included in the Windows Assessment and Deployment Kit (ADK) for Windows 10 to create a provisioning package that configures a device as a kiosk. [Install the ADK.](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit)
-> **Important**
-When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed.
-
-**Create a provisioning package for a kiosk device**
-
-1. Open Windows ICD (by default, %windir%\\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\Imaging and Configuration Designer\\x86\\ICD.exe).
-
-2. Choose **Advanced provisioning**.
-
-3. Name your project, and click **Next**.
-
-4. Choose **All Windows desktop editions** and click **Next**.
-
-5. On **New project**, click **Finish**. The workspace for your package opens.
-
-6. Expand **Runtime settings** > **AssignedAccess**, and click **AssignedAccessSettings**.
-
-7. Enter a string to specify the user account and app (by AUMID). For example:
-
- "Account":"contoso\\\\kiosk","AUMID":"8f82d991-f842-44c3-9a95-521b58fc2084"
-
-8. On the **File** menu, select **Save.**
-
-9. On the **Export** menu, select **Provisioning package**.
-
-10. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next.**
-
-11. Optional. In the **Provisioning package security** window, you can choose to encrypt the package and enable package signing.
-
- - **Enable package encryption** - If you select this option, an auto-generated password will be shown on the screen.
-
- - **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Select** and choosing the certificate you want to use to sign the package.
-
-12. Click **Next** to specify the output location where you want the provisioning package to go when it's built. By default, Windows ICD uses the project folder as the output location.
-
- Optionally, you can click **Browse** to change the default output location.
-
-13. Click **Next**.
-
-14. Click **Build** to start building the package. The provisioning package doesn't take long to build. The project information is displayed in the build page and the progress bar indicates the build status.
-
- If you need to cancel the build, click **Cancel**. This cancels the current build process, closes the wizard, and takes you back to the **Customizations Page**.
-
-15. If your build fails, an error message will show up that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again.
-
- If your build is successful, the name of the provisioning package, output directory, and project directory will be shown.
-
- - If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, click **Back** to change the output package name and path, and then click **Next** to start another build.
- - If you are done, click **Finish** to close the wizard and go back to the **Customizations Page**.
-
-**Apply the provisioning package**
-
-1. Select the provisioning package that you want to apply, double-click the file, and then allow admin privileges.
-
-2. Consent to allow the package to be installed.
-
- After you allow the package to be installed, the settings will be applied to the device
-
-[Learn how to apply a provisioning package in audit mode or OOBE.](https://go.microsoft.com/fwlink/p/?LinkID=692012)
### Set up assigned access using Windows PowerShell
@@ -201,7 +154,9 @@ Set-AssignedAccess -AppName -UserName
Set-AssignedAccess -AppName -UserSID
```
-> **Note:** To set up assigned access using `-AppName`, the user account that you specify for assigned access must have logged on at least once.
+> [!NOTE]
+> To set up assigned access using `-AppName`, the user account that you specify for assigned access must have logged on at least once.
+
[Learn how to get the AUMID](https://go.microsoft.com/fwlink/p/?LinkId=614867).
[Learn how to get the AppName](https://msdn.microsoft.com/library/windows/hardware/mt620046%28v=vs.85%29.aspx) (see **Parameters**).
@@ -223,8 +178,8 @@ Edit the registry to have an account automatically logged on.
1. Open Registry Editor (regedit.exe).
- **Note**
- If you are not familiar with Registry Editor, [learn how to modify the Windows registry](https://go.microsoft.com/fwlink/p/?LinkId=615002).
+ >[!NOTE]
+ >If you are not familiar with Registry Editor, [learn how to modify the Windows registry](https://go.microsoft.com/fwlink/p/?LinkId=615002).
2. Go to
@@ -239,7 +194,8 @@ Edit the registry to have an account automatically logged on.
- *DefaultPassword*: set value as the password for the account.
- > **Note** If *DefaultUserName* and *DefaultPassword* aren't there, add them as **New** > **String Value**.
+ > [!NOTE]
+ > If *DefaultUserName* and *DefaultPassword* aren't there, add them as **New** > **String Value**.
- *DefaultDomainName*: set value for domain, only for domain accounts. For local accounts, do not add this key.
@@ -255,11 +211,15 @@ If you press **Ctrl + Alt + Del** and do not sign in to another account, after a
To change the default time for assigned access to resume, add *IdleTimeOut* (DWORD) and enter the value data as milliseconds in hexadecimal.
-## Shell Launcher for Classic Windows applications
+
+## Shell Launcher for Classic Windows applications
Using Shell Launcher, you can configure a kiosk device that runs a Classic Windows application as the user interface. The application that you specify replaces the default shell (explorer.exe) that usually runs when a user logs on.
+>[!NOTE]
+>You can also configure a kiosk device that runs a Classic Windows application by using the [Provision kiosk devices wizard](#wizard).
+
### Requirements
- A domain or local user account.
@@ -274,10 +234,13 @@ To set a Classic Windows application as the shell, you first turn on the Shell L
**To turn on Shell Launcher in Windows features**
-1. Go to Control Panel > **Programs and Features** > **Turn Windows features on or off**.
-2. Select **Embedded Shell Launcher** and **OK**.
+1. Go to Control Panel > **Programs and features** > **Turn Windows features on or off**.
-Alternatively, you can turn on Shell Launcher using the Deployment Image Servicing and Management (DISM.exe) tool.
+2. Expand **Device Lockdown**.
+
+2. Select **Shell Launcher** and **OK**.
+
+Alternatively, you can turn on Shell Launcher using Windows Configuration Designer in a provisioning package, using `SMISettings > ShellLauncher`, or the Deployment Image Servicing and Management (DISM.exe) tool.
**To turn on Shell Launcher using DISM**
@@ -425,19 +388,46 @@ $IsShellLauncherEnabled = $ShellLauncherClass.IsEnabled()
"`nEnabled is set to " + $IsShellLauncherEnabled.Enabled
```
+## Other settings to lock down
+
+
+For a more secure kiosk experience, we recommend that you make the following configuration changes to the device:
+
+- Put device in **Tablet mode**.
+
+ If you want users to be able to use the touch (on screen) keyboard, go to **Settings** > **System** > **Tablet mode** and choose **On.**
+
+- Hide **Ease of access** feature on the logon screen.
+
+ Go to **Control Panel** > **Ease of Access** > **Ease of Access Center**, and turn off all accessibility tools.
+
+- Disable the hardware power button.
+
+ Go to **Power Options** > **Choose what the power button does**, change the setting to **Do nothing**, and then **Save changes**.
+
+- Remove the power button from the sign-in screen.
+
+ Go to **Computer Configuration** > **Windows Settings** > **Security Settings** > **Local Policies** >**Security Options** > **Shutdown: Allow system to be shut down without having to log on** and select **Disabled.**
+
+- Disable the camera.
+
+ Go to **Settings** > **Privacy** > **Camera**, and turn off **Let apps use my camera**.
+
+- Turn off app notifications on the lock screen.
+
+ Go to **Group Policy Editor** > **Computer Configuration** > **Administrative Templates\\System\\Logon\\Turn off app notifications on the lock screen**.
+
+- Disable removable media.
+
+ Go to **Group Policy Editor** > **Computer Configuration** > **Administrative Templates\\System\\Device Installation\\Device Installation Restrictions**. Review the policy settings available in **Device Installation Restrictions** for the settings applicable to your situation.
+
+ >[!NOTE]
+ >To prevent this policy from affecting a member of the Administrators group, in **Device Installation Restrictions**, enable **Allow administrators to override Device Installation Restriction policies**.
+
+
## Related topics
-
-[Set up a device for anyone to use](set-up-a-device-for-anyone-to-use.md)
-
-[Set up a kiosk for Windows 10 for mobile edition](set-up-a-kiosk-for-windows-10-for-mobile-edition.md)
-
-[Manage and update Windows 10](index.md)
-
-
-
-
-
+- [Set up a kiosk on Windows 10 Mobile or Windows 10 Mobile Enterprise](set-up-a-kiosk-for-windows-10-for-mobile-edition.md)
diff --git a/windows/configure/set-up-a-kiosk-for-windows-10-for-mobile-edition.md b/windows/configure/set-up-a-kiosk-for-windows-10-for-mobile-edition.md
index 1a11ff9c20..3ef7f7e374 100644
--- a/windows/configure/set-up-a-kiosk-for-windows-10-for-mobile-edition.md
+++ b/windows/configure/set-up-a-kiosk-for-windows-10-for-mobile-edition.md
@@ -18,51 +18,18 @@ localizationpriority: high
- Windows 10 Mobile
-A device in kiosk mode runs a specified app with no access to other device functions, menus, or settings. You configure a device running Windows 10 Mobile or Windows 10 Mobile Enterprise for kiosk mode by using the Apps Corner feature. You can also use the Enterprise Assigned Access configuration service provider (CSP) to configure a kiosk experience.
-**Note**
-The specified app must be an above lock screen app. For details on building an above lock screen app, see [Kiosk apps for assigned access: Best practices](https://go.microsoft.com/fwlink/p/?LinkId=708386).
-
-
-
-## Apps Corner
+A device in kiosk mode runs a specified app with no access to other device functions, menus, or settings. You use the [Enterprise Assigned Access](#enterprise-assigned-access) configuration service provider (CSP) to configure a kiosk experience. You can also configure a device running Windows 10 Mobile or Windows 10 Mobile Enterprise, version 1607 or earlier, for kiosk mode by using the [Apps Corner](#apps-corner) feature. (Apps Corner is removed in version 1703.)
-Apps Corner lets you set up a custom Start screen on your Windows 10 Mobile or Windows 10 Mobile Enterprise device, where you can share only the apps you choose with the people you let use your device. You configure a device for kiosk mode by selecting a single app to use in Apps Corner.
-
-**To set up Apps Corner**
-
-1. On Start , swipe over to the App list, then tap **Settings**  > **Accounts** > **Apps Corner**.
-
-2. Tap **Apps**, tap to select the app that you want people to use in the kiosk mode, and then tap done 
-
-3. If your phone doesn't already have a lock screen password, you can set one now to ensure that people can't get to your Start screen from Apps Corner. Tap **Protect my phone with a password**, click **Add**, type a PIN in the **New PIN** box, type it again in the **Confirm PIN** box, and then tap **OK**. Press **Back**  to the Apps Corner settings.
-
-4. Turn **Action center** on or off, depending on whether you want people to be able to use these features when using the device in kiosk mode.
-
-5. Tap **advanced**, and then turn features on or off, depending on whether you want people to be able to use them.
-
-6. Press **Back**  when you're done.
-
-**To use Apps Corner**
-
-1. On Start , swipe over to the App list, then tap **Settings**  > **Accounts** > **Apps Corner** > launch .
-
- **Tip**
- Want to get to Apps Corner with one tap? In **Settings**, tap **Apps Corner** > **pin** to pin the Apps Corner tile to your Start screen.
-
-
-
-2. Give the device to someone else, so they can use the device and only the one app you chose.
-
-3. When they're done and you get the device back, press and hold Power , and then swipe right to exit Apps Corner.
## Enterprise Assigned Access
-Enterprise Assigned Access allows you to lock down your Windows 10 Mobile or Windows 10 Mobile Enterprise device in kiosk mode by creating a user role that has only a single app, set to run automatically, in the Allow list.
+Enterprise Assigned Access allows you to put your Windows 10 Mobile or Windows 10 Mobile Enterprise device in kiosk mode by creating a user role that has only a single app, set to run automatically, in the Allow list.
-**Note** The app can be a Universal Windows app, Universal Windows Phone 8 app, or a legacy Silverlight app.
+>[!NOTE]
+>The app can be a Universal Windows app, Universal Windows Phone 8 app, or a legacy Silverlight app.
@@ -72,21 +39,24 @@ In AssignedAccessXml, for Application, you enter the product ID for the app to r
[See the technical reference for the Enterprise Assigned Access configuration service provider (CSP).](https://go.microsoft.com/fwlink/p/?LinkID=618601)
-### Set up assigned access using Windows Imaging and Configuration Designer (ICD)
+### Set up assigned access using Windows Configuration Designer
-> **Important**
-When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed.
+>[!IMPORTANT]
+>When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed.
-**To create and apply a provisioning package for a kiosk device**
+#### Create the *AssignedAccess*.xml file
1. Create an *AssignedAccess*.xml file that specifies the app the device will run. (You can name use any file name.) For instructions on AssignedAccessXml, see [EnterpriseAssignedAccess CSP](https://go.microsoft.com/fwlink/p/?LinkID=618601).
- **Note**
- Do not escape the xml in *AssignedAccess*.xml file as Windows Imaging and Configuration Designer (ICD) will do that when building the package. Providing escaped xml in Windows ICD will cause building the package fail.
+ >[!NOTE]
+ >Do not escape the xml in *AssignedAccess*.xml file as Windows Configuration Designer will do that when building the package. Providing escaped xml in Windows ICD will cause building the package fail.
+
+#### Create the provisioning package
-
+1. [Install Windows Configuration Designer.](provisioning-install-icd.md)
+
+2. Open Windows Configuration Designer (if you installed it from the Windows ADK, `%windir%\\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\Imaging and Configuration Designer\\x86\\ICD.exe`).
-2. Open Windows ICD (by default, `%windir%\\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\Imaging and Configuration Designer\\x86\\ICD.exe`).
3. Choose **Advanced provisioning**.
@@ -130,55 +100,91 @@ When you build a provisioning package, you may include sensitive information in
- If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, click **Back** to change the output package name and path, and then click **Next** to start another build.
- If you are done, click **Finish** to close the wizard and go back to the **Customizations Page**.
-17. Select the **output location** link to go to the location of the package. You can distribute that .ppkg to mobile devices using any of the following methods:
+17. Select the **output location** link to go to the location of the package.
- - Removable media (USB/SD)
+#### Distribute the provisioning package
- **To apply a provisioning package from removable media**
+You can distribute that .ppkg to mobile devices using any of the following methods:
- 1. Copy the provisioning package file to the root directory on a micro SD card.
+- Removable media (USB/SD)
- 2. On the device, insert the micro SD card containing the provisioning package.
+ **To apply a provisioning package from removable media**
- 3. Go to **Settings** > **Accounts** > **Provisioning.**
+ 1. Copy the provisioning package file to the root directory on a micro SD card.
- 4. Tap **Add a package**.
+ 2. On the device, insert the micro SD card containing the provisioning package.
- 5. On the **Choose a method** screen, in the **Add from** dropdown menu, select **Removable Media**.
+ 3. Go to **Settings** > **Accounts** > **Provisioning.**
- 6. Select a package will list all available provisioning packages on the micro SD card. Tap the desired package, and then tap **Add**.
+ 4. Tap **Add a package**.
- 7. You will see a message that tells you what the package will do the device, such as **Adding it will: Lock down the user interface**. Tap **Yes, add it**.
+ 5. On the **Choose a method** screen, in the **Add from** dropdown menu, select **Removable Media**.
- 8. Restart the device and verify that the runtime settings that were configured in the provisioning package were applied to the device.
+ 6. Select a package will list all available provisioning packages on the micro SD card. Tap the desired package, and then tap **Add**.
- - Email
+ 7. You will see a message that tells you what the package will do the device, such as **Adding it will: Lock down the user interface**. Tap **Yes, add it**.
- **To apply a provisioning package sent in email**
+ 8. Restart the device and verify that the runtime settings that were configured in the provisioning package were applied to the device.
- 1. Send the provisioning package in email to an account on the device.
+- Email
- 2. Open the email on the device, and then double-tap the attached file.
+ **To apply a provisioning package sent in email**
- 3. You will see a message that tells you what the package will do the device, such as **Adding it will: Lock down the user interface**. Tap **Yes, add it**.
+ 1. Send the provisioning package in email to an account on the device.
- 4. Restart the device and verify that the runtime settings that were configured in the provisioning package were applied to the device.
+ 2. Open the email on the device, and then double-tap the attached file.
- - USB tether (mobile only)
+ 3. You will see a message that tells you what the package will do the device, such as **Adding it will: Lock down the user interface**. Tap **Yes, add it**.
- **To apply a provisioning package using USB tether**
+ 4. Restart the device and verify that the runtime settings that were configured in the provisioning package were applied to the device.
- 1. Connect the device to your PC by USB.
+- USB tether
- 2. Select the provisioning package that you want to use to provision the device, and then drag and drop the file to your device.
+ **To apply a provisioning package using USB tether**
- 3. The provisioning package installation dialog will appear on the phone.
+ 1. Connect the device to your PC by USB.
- 4. You will see a message that tells you what the package will do the device, such as **Adding it will: Lock down the user interface**. Tap **Yes, add it**.
+ 2. Select the provisioning package that you want to use to provision the device, and then drag and drop the file to your device.
- 5. Restart the device and verify that the runtime settings that were configured in the provisioning package were applied to the device.
+ 3. The provisioning package installation dialog will appear on the phone.
- [Learn how to apply a provisioning package in audit mode or OOBE.](https://go.microsoft.com/fwlink/p/?LinkID=692012)
+ 4. You will see a message that tells you what the package will do the device, such as **Adding it will: Lock down the user interface**. Tap **Yes, add it**.
+
+ 5. Restart the device and verify that the runtime settings that were configured in the provisioning package were applied to the device.
+
+
+
+## Apps Corner
+
+>[!NOTE]
+>For Windows 10, versions 1507, 1511, and 1607 only.
+
+Apps Corner lets you set up a custom Start screen on your Windows 10 Mobile or Windows 10 Mobile Enterprise device, where you can share only the apps you choose with the people you let use your device. You configure a device for kiosk mode by selecting a single app to use in Apps Corner.
+
+**To set up Apps Corner**
+
+1. On Start , swipe over to the App list, then tap **Settings**  > **Accounts** > **Apps Corner**.
+
+2. Tap **Apps**, tap to select the app that you want people to use in the kiosk mode, and then tap done 
+
+3. If your phone doesn't already have a lock screen password, you can set one now to ensure that people can't get to your Start screen from Apps Corner. Tap **Protect my phone with a password**, click **Add**, type a PIN in the **New PIN** box, type it again in the **Confirm PIN** box, and then tap **OK**. Press **Back**  to the Apps Corner settings.
+
+4. Turn **Action center** on or off, depending on whether you want people to be able to use these features when using the device in kiosk mode.
+
+5. Tap **advanced**, and then turn features on or off, depending on whether you want people to be able to use them.
+
+6. Press **Back**  when you're done.
+
+**To use Apps Corner**
+
+1. On Start , swipe over to the App list, then tap **Settings**  > **Accounts** > **Apps Corner** > launch .
+
+ >[!TIP]
+ >Want to get to Apps Corner with one tap? In **Settings**, tap **Apps Corner** > **pin** to pin the Apps Corner tile to your Start screen.
+
+2. Give the device to someone else, so they can use the device and only the one app you chose.
+
+3. When they're done and you get the device back, press and hold Power , and then swipe right to exit Apps Corner.
## Related topics
@@ -191,9 +197,5 @@ When you build a provisioning package, you may include sensitive information in
-
-
-
-
diff --git a/windows/configure/set-up-shared-or-guest-pc.md b/windows/configure/set-up-shared-or-guest-pc.md
index f641f80569..d0998d18c6 100644
--- a/windows/configure/set-up-shared-or-guest-pc.md
+++ b/windows/configure/set-up-shared-or-guest-pc.md
@@ -16,7 +16,7 @@ localizationpriority: high
- Windows 10
-Windows 10, version 1607, introduces *shared PC mode*, which optimizes Windows 10 for shared use scenarios, such as touchdown spaces in an enterprise and temporary customer use in retail. You can apply shared PC mode to Windows 10 Pro, Pro Education, Education, and Enterprise.
+Windows 10, version 1607, introduced *shared PC mode*, which optimizes Windows 10 for shared use scenarios, such as touchdown spaces in an enterprise and temporary customer use in retail. You can apply shared PC mode to Windows 10 Pro, Pro Education, Education, and Enterprise.
> [!NOTE]
> If you're interested in using Windows 10 for shared PCs in a school, see [Use Set up School PCs app](https://technet.microsoft.com/edu/windows/use-set-up-school-pcs-app) which provides a simple way to configure PCs with shared PC mode plus additional settings specific for education.
@@ -69,16 +69,16 @@ You can configure Windows to be in shared PC mode in a couple different ways:
-- A provisioning package created with the Windows Imaging and Configuration Designer (ICD): You can apply a provisioning package when you initially set up the PC (also known as the out-of-box-experience or OOBE), or you can apply the provisioning package to a Windows 10 PC that is already in use. The provisioning package is created in Windows Imaging and Configuration Designer (ICD). Shared PC mode is enabled by the [SharedPC configuration service provider (CSP)](https://msdn.microsoft.com/library/windows/hardware/mt723294.aspx), exposed in ICD as SharedPC.
+- A provisioning package created with the Windows Configuration Designer: You can apply a provisioning package when you initially set up the PC (also known as the out-of-box-experience or OOBE), or you can apply the provisioning package to a Windows 10 PC that is already in use. The provisioning package is created in Windows Configuration Designer. Shared PC mode is enabled by the [SharedPC configuration service provider (CSP)](https://msdn.microsoft.com/library/windows/hardware/mt723294.aspx), exposed in Windows Configuration Designer as **SharedPC**.
### Create a provisioning package for shared use
-Use the Windows ICD tool included in the Windows Assessment and Deployment Kit (ADK) for Windows 10 to create a provisioning package that configures a device for shared PC mode. [Install the ADK and select **Configuration Designer**.](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit)
+1. [install Windows Configuration Designer](provisioning-install-icd.md)
-1. Open Windows ICD (by default, %windir%\\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\Imaging and Configuration Designer\\x86\\ICD.exe).
+1. Open Windows Configuration Designer.
2. On the **Start page**, select **Advanced provisioning**.
@@ -287,15 +287,10 @@ Shared PC mode sets local group policies to configure the device. Some of these
-## Related topics
-
-[Set up a device for anyone to use (kiosk)](set-up-a-device-for-anyone-to-use.md)
-
-
diff --git a/windows/configure/settings-that-can-be-locked-down.md b/windows/configure/settings-that-can-be-locked-down.md
index c0348677ba..6e0e342400 100644
--- a/windows/configure/settings-that-can-be-locked-down.md
+++ b/windows/configure/settings-that-can-be-locked-down.md
@@ -20,7 +20,15 @@ localizationpriority: high
This topic lists the settings and quick actions that can be locked down in Windows 10 Mobile.
-## Settings lockdown
+## Settings lockdown in Windows 10, version 1703
+
+In earlier versions of Windows 10, you used the page name to define allowed settings. Starting in Windows 10, version 1703, you use the settings URI.
+
+For example, in place of **SettingsPageDisplay**, you would use **ms-settings:display**.
+
+See the [ms-settings: URI scheme reference](https://docs.microsoft.com/windows/uwp/launch-resume/launch-settings-app#ms-settings-uri-scheme-reference) to find the URI for each Settings page.
+
+## Settings lockdown in Windows 10, version 1607 and earlier
You can use Lockdown.xml to configure lockdown settings.
@@ -451,52 +459,26 @@ You can specify the quick actions as follows:
``` syntax
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
```
-Some quick actions are dependent on related settings pages/page groups. When a dependent page/group is not available, then the corresponding quick action will also be hidden.
-**Note**
-Dependent settings group/pages will be automatically enabled when a quick action is specified in the lockdown xml file. For example, if the Rotation quick setting is specified, the following group and page will automatically be added to the allow list: “SettingsPageSystemDisplay” and “SettingsPageDisplay”.
-
-
-
-The following table lists the dependencies between quick actions and Settings groups/pages.
-
-| Quick action | Settings group | Settings page |
-|-----|-------|-------|
-| SystemSettings\_System\_Display\_QuickAction\_Brightness | SettingsPageSystemDisplay| SettingsPageDisplay |
-| SystemSettings\_System\_Display\_Internal\_Rotation | SettingsPageSystemDisplay | SettingsPageDisplay |
-| SystemSettings\_QuickAction\_WiFi | SettingsPageNetworkWiFi | SettingsPageNetworkWiFi |
-| SystemSettings\_QuickAction\_InternetSharing | SettingsPageNetworkInternetSharing | SettingsPageNetworkInternetSharing |
-| SystemSettings\_QuickAction\_CellularData | SettingsGroupCellular | SettingsPageNetworkCellular |
-| SystemSettings\_QuickAction\_AirplaneMode | SettingsPageNetworkAirplaneMode | SettingsPageNetworkAirplaneMode |
-| SystemSettings\_Privacy\_LocationEnabledUserPhone | SettingsGroupPrivacyLocationGlobals | SettingsPagePrivacyLocation |
-| SystemSettings\_Network\_VPN\_QuickAction | SettingsPageNetworkVPN | SettingsPageNetworkVPN |
-| SystemSettings\_Launcher\_QuickNote | N/A | N/A |
-| SystemSettings\_Flashlight\_Toggle | N/A | N/A |
-| SystemSettings\_Device\_BluetoothQuickAction | SettingsPagePCSystemBluetooth | SettingsPagePCSystemBluetooth |
-| SystemSettings\_BatterySaver\_LandingPage\_OverrideControl | BatterySaver\_LandingPage\_SettingsConfiguration | SettingsPageBatterySaver |
-| QuickActions\_Launcher\_DeviceDiscovery | N/A | N/A |
-| QuickActions\_Launcher\_AllSettings | N/A | N/A |
-| SystemSettings\_QuickAction\_QuietHours | N/A | N/A |
-| SystemSettings\_QuickAction\_Camera | N/A | N/A |
diff --git a/windows/configure/start-layout-xml-desktop.md b/windows/configure/start-layout-xml-desktop.md
index db4bf8dd66..2a8a20dfd2 100644
--- a/windows/configure/start-layout-xml-desktop.md
+++ b/windows/configure/start-layout-xml-desktop.md
@@ -30,6 +30,9 @@ On Windows 10 for desktop editions, the customized Start works by:
>[!NOTE]
>Using the layout modification XML to configure Start is not supported with roaming user profiles. For more information, see [Deploy Roaming User Profiles](https://technet.microsoft.com/en-US/library/jj649079.aspx).
+>[!NOTE]
+>Using the layout modification XML to configure Start is not supported with roaming user profiles. For more information, see [Deploy Roaming User Profiles](https://technet.microsoft.com/library/jj649079.aspx).
+
## LayoutModification XML
IT admins can provision the Start layout using a LayoutModification.xml file. This file supports several mechanisms to modify or replace the default Start layout and its tiles. The easiest method for creating a LayoutModification.xml file is by using the Export-StartLayout cmdlet; see [Customize and export Start layout](customize-and-export-start-layout.md) for instructions.
@@ -473,17 +476,13 @@ Once you have created the LayoutModification.xml file and it is present in the d
## Related topics
-[Manage Windows 10 Start layout options](windows-10-start-layout-options-and-policies.md)
-
-[Configure Windows 10 taskbar](configure-windows-10-taskbar.md)
-
-[Customize Windows 10 Start and taskbar with Group Policy](customize-windows-10-start-screens-by-using-group-policy.md)
-
-[Customize Windows 10 Start and taskbar with ICD and provisioning packages](customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md)
-
-[Customize Windows 10 Start with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md)
-
-[Changes to Group Policy settings for Windows 10 Start](changes-to-start-policies-in-windows-10.md)
+- [Manage Windows 10 Start layout options](windows-10-start-layout-options-and-policies.md)
+- [Configure Windows 10 taskbar](configure-windows-10-taskbar.md)
+- [Customize Windows 10 Start and taskbar with Group Policy](customize-windows-10-start-screens-by-using-group-policy.md)
+- [Customize Windows 10 Start and taskbar with ICD and provisioning packages](customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md)
+- [Customize Windows 10 Start with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md)
+- [Changes to Group Policy settings for Windows 10 Start](changes-to-start-policies-in-windows-10.md)
+- [Start layout XML for mobile editions of Windows 10 (reference)](start-layout-xml-mobile.md)
diff --git a/windows/configure/start-layout-xml-mobile.md b/windows/configure/start-layout-xml-mobile.md
index 9d10466302..f25c2d2413 100644
--- a/windows/configure/start-layout-xml-mobile.md
+++ b/windows/configure/start-layout-xml-mobile.md
@@ -370,17 +370,13 @@ This should set the value of **StartLayout**. The setting appears in the **Selec
## Related topics
-[Manage Windows 10 Start layout options](windows-10-start-layout-options-and-policies.md)
-
-[Configure Windows 10 taskbar](configure-windows-10-taskbar.md)
-
-[Customize Windows 10 Start and taskbar with Group Policy](customize-windows-10-start-screens-by-using-group-policy.md)
-
-[Customize Windows 10 Start and taskbar with ICD and provisioning packages](customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md)
-
-[Customize Windows 10 Start with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md)
-
-[Changes to Group Policy settings for Windows 10 Start](changes-to-start-policies-in-windows-10.md)
+- [Manage Windows 10 Start layout options](windows-10-start-layout-options-and-policies.md)
+- [Configure Windows 10 taskbar](configure-windows-10-taskbar.md)
+- [Customize Windows 10 Start and taskbar with Group Policy](customize-windows-10-start-screens-by-using-group-policy.md)
+- [Customize Windows 10 Start and taskbar with ICD and provisioning packages](customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md)
+- [Customize Windows 10 Start with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md)
+- [Changes to Group Policy settings for Windows 10 Start](changes-to-start-policies-in-windows-10.md)
+- [Start layout XML for desktop editions of Windows 10 (reference)](start-layout-xml-desktop.md)
diff --git a/windows/configure/start-taskbar-lockscreen.md b/windows/configure/start-taskbar-lockscreen.md
index 3216cfabda..966ef97fca 100644
--- a/windows/configure/start-taskbar-lockscreen.md
+++ b/windows/configure/start-taskbar-lockscreen.md
@@ -1,7 +1,6 @@
---
-title: start tasbkar lockscreen (Windows 10)
+title: Configure Start layout, taskbar, and lock screen for Windows 10 PCs (Windows 10)
description:
-keywords: Windows 10, MDM, WSUS, Windows update
ms.prod: w10
ms.mktglfcycl: manage
ms.sitesec: library
@@ -10,5 +9,19 @@ localizationpriority: high
author: jdeckerMS
---
-# start taskbar lockscreen
+# Configure Start layout, taskbar, and lock screen for Windows 10 PCs
+
+
+## In this section
+
+| Topic | Description |
+| --- | --- |
+| [Windows Spotlight on the lock screen](windows-spotlight.md) | Windows Spotlight is an option for the lock screen background that displays different background images and occasionally offers suggestions on the lock screen.**Note:** You can also use the [Personalization CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/personalization-csp) settings to set lock screen and desktop background images. |
+| [Manage Windows 10 and Windows Store tips, tricks, and suggestions](manage-tips-and-suggestions.md) | Options to manage the tips, tricks, and suggestions offered by Windows and Windows Store. |
+| [Manage Windows 10 Start and taskbar layout](windows-10-start-layout-options-and-policies.md) | Organizations might want to deploy a customized Start screen and menu to devices running Windows 10 Pro, Enterprise, or Education. A standard Start layout can be useful on devices that are common to multiple users and devices that are locked down for specialized purposes. |
+
+
+## Related topics
+
+- [Configure Windows 10 Mobile devices](configure-mobile.md)
\ No newline at end of file
diff --git a/windows/configure/windows-10-start-layout-options-and-policies.md b/windows/configure/windows-10-start-layout-options-and-policies.md
index b588216cb5..d4669bfaed 100644
--- a/windows/configure/windows-10-start-layout-options-and-policies.md
+++ b/windows/configure/windows-10-start-layout-options-and-policies.md
@@ -1,6 +1,6 @@
---
title: Manage Windows 10 Start and taskbar layout (Windows 10)
-description: Organizations might want to deploy a customized Start and taskbar layout to devices running Windows 10 Enterprise or Windows 10 Education.
+description: Organizations might want to deploy a customized Start and taskbar layout to devices.
ms.assetid: 2E94743B-6A49-463C-9448-B7DD19D9CD6A
keywords: ["start screen", "start menu"]
ms.prod: w10
@@ -19,12 +19,15 @@ localizationpriority: high
> **Looking for consumer information?** See [Customize the Start menu](http://windows.microsoft.com/windows-10/getstarted-see-whats-on-the-menu)
-Organizations might want to deploy a customized Start and taskbar configuration to devices running Windows 10 Enterprise or Windows 10 Education. A standard, customized Start layout can be useful on devices that are common to multiple users and devices that are locked down for specialized purposes. Configuring the taskbar allows the organization to pin useful apps for their employees and to remove apps that are pinned by default.
+Organizations might want to deploy a customized Start and taskbar configuration to devices running Windows 10 Pro, Enterprise, or Education. A standard, customized Start layout can be useful on devices that are common to multiple users and devices that are locked down for specialized purposes. Configuring the taskbar allows the organization to pin useful apps for their employees and to remove apps that are pinned by default.
>[!NOTE]
>Taskbar configuration is available starting in Windows 10, version 1607.
>
->Using the layout modification XML to configure Start is not supported with roaming user profiles. For more information, see [Deploy Roaming User Profiles](https://technet.microsoft.com/en-US/library/jj649079.aspx).
+>Start and taskbar configuration can be applied to devices running Windows 10 Pro, version 1703.
+>
+>Using the layout modification XML to configure Start is not supported with roaming user profiles. For more information, see [Deploy Roaming User Profiles](https://technet.microsoft.com/library/jj649079.aspx).
+
## Start options
@@ -34,87 +37,21 @@ Some areas of Start can be managed using Group Policy. The layout of Start tiles
The following table lists the different parts of Start and any applicable policy settings or Settings options. Group Policy settings are in the **User Configuration**\\**Administrative Templates**\\**Start Menu and Taskbar** path except where a different path is listed in the table.
-
-
-
-
-
-
-| User tile |
-Group Policy: Remove Logoff on the Start menu |
- |
-
-
-| Most used |
-Group Policy: Remove frequent programs from the Start menu |
-Settings > Personalization > Start > Show most used apps |
-
-
-Suggestions
--and-
-Dynamically inserted app tile |
-MDM: Allow Windows Consumer Features
-Group Policy: Computer Configuration\\Administrative Templates\\Windows Components\\Cloud Content\\Turn off Microsoft consumer experiences
-
- Note
- This policy also enables or disables notifications for a user's Microsoft account and app tiles from Microsoft dynamically inserted in the default Start menu.
-
-
- |
-Settings > Personalization > Start > Occasionally show suggestions in Start |
-
-
-| Recently added |
-not applicable |
-Settings > Personalization > Start > Show recently added apps |
-
-
-| Pinned folders |
-not applicable |
-Settings > Personalization > Start > Choose which folders appear on Start |
-
-
-| Power |
-Group Policy: Remove and prevent access to the Shut Down, Restart, Sleep, and Hibernate commands |
-None |
-
-
-| Start layout |
-MDM: Start layout
-Group Policy: Start layout
-Group Policy: Prevent users from customizing their Start Screen
-
- Note
- When a full Start screen layout is imported with Group Policy or MDM, the users cannot pin, unpin, or uninstall apps from the Start screen. Users can view and open all apps in the All Apps view, but they cannot pin any apps to the Start screen. When a partial Start screen layout is imported, users cannot change the tile groups applied by the partial layout, but can modify other tile groups and create their own. Start layout policy can be used to pin apps to the taskbar based on an XML File that you provide. Users will be able to change the order of pinned apps, unpin apps, and pin additional apps to the taskbar.
-
-
- |
-None |
-
-
-| Jump lists |
-Group Policy: Do not keep history of recently opened documents |
-Settings > Personalization > Start > Show recently opened items in Jump Lists on Start or the taskbar |
-
-
-| Start size |
-MDM: Force Start size
-Group Policy: Force Start to be either full screen size or menu size |
-Settings > Personalization > Start > Use Start full screen |
-
-
-| All Settings |
-Group Policy: Prevent changes to Taskbar and Start Menu Settings |
-None |
-
-
-
+| Start | Policy | Local setting |
+| --- | --- | --- |
+| User tile | MDM: **Start/HideUserTile****Start/HideSwitchAccount****Start/HideSignOut****Start/HideLock****Start/HideChangeAccountSettings**Group Policy: **Remove Logoff on the Start menu** | none |
+| Most used | MDM: **Start/HideFrequentlyUsedApps**Group Policy: **Remove frequent programs from the Start menu** | **Settings** > **Personalization** > **Start** > **Show most used apps** |
+| Suggestions-and-Dynamically inserted app tile | MDM: **Allow Windows Consumer Features**Group Policy: **Computer Configuration\Administrative Templates\Windows Components\Cloud Content\Turn off Microsoft consumer experiences****Note:** This policy also enables or disables notifications for a user's Microsoft account and app tiles from Microsoft dynamically inserted in the default Start menu. | **Settings** > **Personalization** > **Start** > **Occasionally show suggestions in Start** |
+| Recently added | MDM: **Start/HideRecentlyAddedApps** | **Settings** > **Personalization** > **Start** > **Show recently added apps** |
+| Pinned folders | MDM: **AllowPinnedFolder** | **Settings** > **Personalization** > **Start** > **Choose which folders appear on Start** |
+| Power | MDM: **Start/HidePowerButton****Start/HideHibernate****Start/HideRestart****Start/HideShutDown****Start/HideSleep**Group Policy: **Remove and prevent access to the Shut Down, Restart, Sleep, and Hibernate commands** | none |
+| Start layout | MDM: **Start layout****ImportEdgeAssets**Group Policy: **Prevent users from customizing their Start screen****Note:** When a full Start screen layout is imported with Group Policy or MDM, the users cannot pin, unpin, or uninstall apps from the Start screen. Users can view and open all apps in the **All Apps** view, but they cannot pin any apps to the Start screen. When a partial Start screen layout is imported, users cannot change the tile groups applied by the partial layout, but can modify other tile groups and create their own.**Start layout** policy can be used to pin apps to the taskbar based on an XML File that you provide. Users will be able to change the order of pinned apps, unpin apps, and pin additional apps to the taskbar. | none |
+| Jump lists | MDM: **Start/HideRecentJumplists**Group Policy: **Do not keep history of recently opened documents** | **Settings** > **Personalization** > **Start** > **Show recently opened items in Jump Lists on Start or the taskbar** |
+| Start size | MDM: **Force Start size**Group Policy: **Force Start to be either full screen size or menu size** | **Settings** > **Personalization** > **Start** > **Use Start full screen** |
+| App list | MDM: **Start/HideAppList** | **Settings** > **Personalization** > **Start** > **Show app list in Start menu** |
+| All Settings | Group Policy: **Prevent changes to Taskbar and Start Menu Settings** | none |
+| Taskbar | MDM: **Start/NoPinningToTaskbar** | none |
+
## Taskbar options
@@ -125,15 +62,18 @@ There are three categories of apps that might be pinned to a taskbar:
* Default Windows apps, pinned during operating system installation (Microsoft Edge, File Explorer, Store)
* Apps pinned by the enterprise, such as in an unattended Windows setup
- **Note**
- The earlier method of using [TaskbarLinks](https://go.microsoft.com/fwlink/p/?LinkId=761230) in an unattended Windows setup file is deprecated in Windows 10, version 1607.
+ >[!NOTE]
+ >The earlier method of using [TaskbarLinks](https://go.microsoft.com/fwlink/p/?LinkId=761230) in an unattended Windows setup file is deprecated in Windows 10, version 1607.
The following example shows how apps will be pinned - Windows default apps to the left (blue circle), apps pinned by the user in the center (orange triangle), and apps that you pin using XML to the right (green square).
-> **Note** In operating systems configured to use a right-to-left language, the taskbar order will be reversed.
-
+>[!NOTE]
+>In operating systems configured to use a right-to-left language, the taskbar order will be reversed.
+
+
+
Whether you apply the taskbar configuration to a clean install or an update, users will still be able to:
* Pin additional apps
* Change the order of pinned apps
diff --git a/windows/configure/windows-spotlight.md b/windows/configure/windows-spotlight.md
index eb3af0eb51..c3a078d793 100644
--- a/windows/configure/windows-spotlight.md
+++ b/windows/configure/windows-spotlight.md
@@ -1,5 +1,5 @@
---
-title: Windows Spotlight on the lock screen (Windows 10)
+title: Configure Windows Spotlight on the lock screen (Windows 10)
description: Windows Spotlight is an option for the lock screen background that displays different background images on the lock screen.
ms.assetid: 1AEA51FA-A647-4665-AD78-2F3FB27AD46A
keywords: ["lockscreen"]
@@ -10,13 +10,14 @@ author: jdeckerMS
localizationpriority: high
---
-# Windows Spotlight on the lock screen
+# Configure Windows Spotlight on the lock screen
**Applies to**
- Windows 10
+
Windows Spotlight is an option for the lock screen background that displays different background images and occasionally offers suggestions on the lock screen. Windows Spotlight is available in all desktop editions of Windows 10.
For managed devices running Windows 10 Enterprise and Windows 10 Education, enterprise administrators can configure a mobile device management (MDM) or Group Policy setting to prevent users from using the Windows Spotlight background. For managed devices running Windows 10 Pro, version 1607, administrators can disable suggestions for third party apps.
@@ -24,6 +25,8 @@ For managed devices running Windows 10 Enterprise and Windows 10 Education, en
>[!NOTE]
>In Windows 10, version 1607, the lock screen background does not display if you disable the **Animate windows when minimizing and mazimizing** setting in **This PC** > **Properties** > **Advanced system settings** > **Performance settings** > **Visual Effects**, or if you enable the Group Policy setting **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Desktop Windows Manager** > **Do not allow windows animations**.
+>
+>In Windows 10, version 1703, you can use the [Personalization CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/personalization-csp) settings to set lock screen and desktop background images.
## What does Windows Spotlight include?
@@ -37,6 +40,8 @@ For managed devices running Windows 10 Enterprise and Windows 10 Education, en
- **Feature suggestions, fun facts, tips**
The lock screen background will occasionally suggest Windows 10 features that the user hasn't tried yet, such as **Snap assist**.
+
+ 
## How do you turn off Windows Spotlight locally?
@@ -48,27 +53,28 @@ To turn off Windows Spotlight locally, go to **Settings** > **Personalization
## How do you disable Windows Spotlight for managed devices?
-Windows 10, version 1607, provides three new Group Policy settings to help you manage Windows Spotlight on enterprise computers.
+Windows Spotlight is enabled by default. Windows 10 provides Group Policy and mobile device management (MDM) settings to help you manage Windows Spotlight on enterprise computers.
-**Windows 10 Pro, Enterprise, and Education**
+| Group Policy | MDM | Description | Applies to |
+| --- | --- | --- | --- |
+| **User Configuration\Administrative Templates\Windows Components\Cloud Content\Do not suggest third-party content in Windows spotlight** | **Experience/Allow ThirdParty Suggestions In Windows Spotlight** | Enables enterprises to restrict suggestions to Microsoft apps and services | Windows 10 Pro, Enterprise, and Education, version 1607 and later |
+| **User Configuration\Administrative Templates\Windows Components\Cloud Content\Turn off all Windows Spotlight features** | **Experience/Allow Windows Spotlight** | Enables enterprises to completely disable all Windows Spotlight features in a single setting | Windows 10 Enterprise and Education, version 1607 and later |
+| **User Configuration\Administrative Templates\Windows Components\Cloud Content\Configure Spotlight on lock screen** | **Experience/Configure Windows Spotlight On Lock Screen** | Specifically controls the use of the dynamic Windows Spotlight image on the lock screen, and can be enabled or disabled | Windows 10 Enterprise and Education, version 1607 and later |
+| **Administrative Templates \ Windows Components \ Cloud Content \ Turn off the Windows Spotlight on Action Center** | **Experience/Allow Windows Spotlight On Action Center** | Turn off Suggestions from Microsoft that show after each clean install, upgrade, or on an on-going basis to introduce users to what is new or changed | Windows 10 Enterprise and Education, version 1703 |
+| **User Configuration \ Administrative Templates \ Windows Components \ Cloud Content \ Do not use diagnostic data for tailored experiences** | **Experience/Allow Tailored Experiences With Diagnostic Data** | Prevent Windows from using diagnostic data to provide tailored experiences to the user | Windows 10 Pro, Enterprise, and Education, version 1703 |
+| **User Configuration \ Administrative Templates \ Windows Components \ Cloud Content \ Turn off the Windows Welcome Experience** | **Experience/Allow Windows Spotlight Windows Welcome Experience** | Turn off the Windows Spotlight Windows Welcome experience which helps introduce users to Windows, such as launching Microsoft Edge with a web page highlighting new features | Windows 10 Enterprise and Education, version 1703 |
-- **User Configuration\Administrative Templates\Windows Components\Cloud Content\Do not suggest third-party content in Windows spotlight** enables enterprises to restrict suggestions to Microsoft apps and services.
-**Windows 10 Enterprise and Education**
-
-* **User Configuration\Administrative Templates\Windows Components\Cloud Content\Turn off all Windows Spotlight features** enables enterprises to completely disable all Windows Spotlight features in a single setting.
-* **User Configuration\Administrative Templates\Windows Components\Cloud Content\Configure Spotlight on lock screen** specifically controls the use of the dynamic Windows Spotlight image on the lock screen, and can be enabled or disabled. (The Group Policy setting **Enterprise Spotlight** does not work in Windows 10, version 1607.)
-
-Windows Spotlight is enabled by default. Administrators can replace Windows Spotlight with a selected image using the Group Policy setting **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Personalization** > **Force a specific default lock screen image**.
+ In addition to the specific policy settings for Windows Spotlight, administrators can replace Windows Spotlight with a selected image using the Group Policy setting **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Personalization** > **Force a specific default lock screen image**.
>[!WARNING]
> In Windows 10, version 1607, the **Force a specific default lock screen image** policy setting will prevent users from changing the lock screen image. This behavior will be corrected in a future release.
-Pay attention to the checkbox in **Options**. In addition to providing the path to the lock screen image, administrators can choose to allow or **Turn off fun facts, tips, tricks, and more on lock screen**. If the checkbox is not selected, users will see the lock screen image that is defined in the policy setting, and will also see occasional messages, such as the example in the following image.
+Pay attention to the checkbox in **Options**. In addition to providing the path to the lock screen image, administrators can choose to allow or **Turn off fun facts, tips, tricks, and more on lock screen**. If the checkbox is not selected, users will see the lock screen image that is defined in the policy setting, and will also see occasional messages.
+
-
## Related topics
diff --git a/windows/deploy/images/icd-create-options-1703.PNG b/windows/deploy/images/icd-create-options-1703.PNG
new file mode 100644
index 0000000000..007e740683
Binary files /dev/null and b/windows/deploy/images/icd-create-options-1703.PNG differ
diff --git a/windows/manage/change-history-for-manage-and-update-windows-10.md b/windows/manage/change-history-for-manage-and-update-windows-10.md
index 168d27d267..21c950edcb 100644
--- a/windows/manage/change-history-for-manage-and-update-windows-10.md
+++ b/windows/manage/change-history-for-manage-and-update-windows-10.md
@@ -97,7 +97,7 @@ The topics in this library have been updated for Windows 10, version 1607 (also
- [Connect to remote Azure Active Directory-joined PC](connect-to-remote-aadj-pc.md)
- [Configure Windows 10 taskbar](configure-windows-10-taskbar.md)
-- [Set up a shared or guest PC with Windows 10](set-up-shared-or-guest-pc.md)
+- [Set up a shared or guest PC with Windows 10](../configure/set-up-shared-or-guest-pc.md)
- [Guidelines for choosing an app for assigned access (kiosk mode)](guidelines-for-assigned-access-app.md)
- [Application Virtualization (App-V) for Windows 10](appv-for-windows.md)
- [User Experience Virtualization (UE-V) for Windows 10](uev-for-windows.md)
diff --git a/windows/manage/manage-windows-10-in-your-organization-modern-management.md b/windows/manage/manage-windows-10-in-your-organization-modern-management.md
index f149335e36..ed2c748110 100644
--- a/windows/manage/manage-windows-10-in-your-organization-modern-management.md
+++ b/windows/manage/manage-windows-10-in-your-organization-modern-management.md
@@ -44,11 +44,10 @@ As indicated in the diagram, Microsoft continues to provide support for deep man
With Windows 10, you can continue to use traditional OS deployment, but you can also “manage out of the box.” To transform new devices into fully-configured, fully-managed devices, you can:
-
- Avoid reimaging by using dynamic provisioning, enabled by a cloud-based device management services like [Microsoft Intune](https://docs.microsoft.com/intune/understand-explore/introduction-to-microsoft-intune).
-- Create self-contained provisioning packages built with the [Windows Imaging and Configuration Designer (ICD)](https://msdn.microsoft.com/library/windows/hardware/dn916113(v=vs.85).aspx).
+- Create self-contained provisioning packages built with the [Windows Configuration Designer](https://technet.microsoft.com/itpro/windows/deploy/provisioning-packages).
- Use traditional imaging techniques such as deploying custom images using [System Center Configuration Manager](https://docs.microsoft.com/sccm/core/understand/introduction).
diff --git a/windows/manage/set-up-shared-or-guest-pc.md b/windows/manage/set-up-shared-or-guest-pc.md
deleted file mode 100644
index f641f80569..0000000000
--- a/windows/manage/set-up-shared-or-guest-pc.md
+++ /dev/null
@@ -1,302 +0,0 @@
----
-title: Set up a shared or guest PC with Windows 10 (Windows 10)
-description: Windows 10, version 1607, introduces *shared PC mode*, which optimizes Windows 10 for shared use scenarios.
-keywords: ["shared pc mode"]
-ms.prod: W10
-ms.mktglfcycl: manage
-ms.sitesec: library
-author: jdeckerMS
-localizationpriority: high
----
-
-# Set up a shared or guest PC with Windows 10
-
-
-**Applies to**
-
-- Windows 10
-
-Windows 10, version 1607, introduces *shared PC mode*, which optimizes Windows 10 for shared use scenarios, such as touchdown spaces in an enterprise and temporary customer use in retail. You can apply shared PC mode to Windows 10 Pro, Pro Education, Education, and Enterprise.
-
-> [!NOTE]
-> If you're interested in using Windows 10 for shared PCs in a school, see [Use Set up School PCs app](https://technet.microsoft.com/edu/windows/use-set-up-school-pcs-app) which provides a simple way to configure PCs with shared PC mode plus additional settings specific for education.
-
-##Shared PC mode concepts
-A Windows 10 PC in shared PC mode is designed to be management- and maintenance-free with high reliability. In shared PC mode, only one user can be signed in at a time. When the PC is locked, the currently signed in user can always be signed out at the lock screen. Users who sign-in are signed in as standard users, not admin users.
-
-###Account models
-It is intended that shared PCs are joined to an Active Directory or Azure Active Directory domain by a user with the necessary rights to perform a domain join as part of a setup process. This enables any user that is part of the directory to sign-in to the PC as a standard user. The user who originally joined the PC to the domain will have administrative rights when they sign in. If using Azure Active Directory Premium, any domain user can also be configured to sign in with administrative rights. Additionally, shared PC mode can be configured to enable a **Start without an account** option on the sign-in screen, which doesn't require any user credentials or authentication and creates a new local account.
-
-###Account management
-When the account management service is turned on in shared PC mode, accounts are automatically deleted. Account deletion applies to Active Directory, Azure Active Directory, and local accounts that are created by the **Start without an account** option. Account management is performed both at sign-off time (to make sure there is enough disk space for the next user) as well as during system maintenance time periods. Shared PC mode can be configured to delete accounts immediately at sign-out or when disk space is low.
-
-###Maintenance and sleep
-Shared PC mode is configured to take advantage of maintenance time periods which run while the PC is not in use. Therefore, sleep is strongly recommended so that the PC can wake up when it is not is use to perform maintenance, clean up accounts, and run Windows Update. The recommended settings can be set by choosing **SetPowerPolicies** in the list of shared PC options. Additionally, on devices without Advanced Configuration and Power Interface (ACPI) wake alarms, shared PC mode will always override real-time clock (RTC) wake alarms to be allowed to wake the PC from sleep (by default, RTC wake alarms are off). This ensures that the widest variety of hardware will take advantage of maintenance periods.
-
-While shared PC mode does not configure Windows Update itself, it is strongly recommended to configure Windows Update to automatically install updates and reboot (if necessary) during maintenance hours. This will help ensure the PC is always up to date and not interrupting users with updates. Use one of the following methods to configure Windows Update:
-
-- Group Policy: Set **Computer Configuration > Administrative Templates > Windows Components > Windows Update > Configure Automatic Updates** to `4` and check **Install during automatic maintenance**.
-- MDM: Set **Update/AllowAutoUpdate** to `4`.
-- Provisioning: In Windows Imaging and Configuration Designer (ICD), set **Policies/Update/AllowAutoUpdate** to `4`.
-
-[Learn more about the AllowAutoUpdate settings](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_AllowAutoUpdate)
-
-###App behavior
-
-Apps can take advantage of shared PC mode by changing their app behavior to align with temporary use scenarios. For example, an app might only download content on demand on a device in shared PC mode, or might skip first run experiences. For information on how an app can query for shared PC mode, see [SharedModeSettings class](https://msdn.microsoft.com/en-us/library/windows/apps/windows.system.profile.sharedmodesettings.aspx).
-
-###Customization
-Shared PC mode exposes a set of customizations to tailor the behavior to your requirements. These customizations are the options that you'll set either using MDM or a provisioning package as explained in [Configuring shared PC mode on Windows](#configuring-shared-pc-mode-on-windows). The options are listed in the following table.
-
-| Setting | Value |
-|:---|:---|
-| EnableSharedPCMode | Set as **True**. If this is not set to **True**, shared PC mode is not turned on and none of the other settings apply. Some of the remaining settings in **SharedPC** are optional, but we strongly recommend that you also set `EnableAccountManager` to **True**. |
-| AccountManagement: AccountModel | This option controls how users can sign-in on the PC. Choosing domain-joined will enable any user in the domain to sign-in. Specifying the guest option will add the **Start without an account** option to the sign-in screen and enable anonymous guest access to the PC.
- **Only guest** allows anyone to use the PC as a local standard (non-admin) account.
- **Domain-joined only** allows users to sign in with an Active Directory or Azure AD account.
- **Domain-joined and guest** allows users to sign in with an Active Directory, Azure AD, or local standard account. |
-| AccountManagement: DeletionPolicy | - **Delete immediately** will delete the account on sign-out.
- **Delete at disk space threshold** will start deleting accounts when available disk space falls below the threshold you set for **DiskLevelDeletion**, and it will stop deleting accounts when the available disk space reaches the threshold you set for **DiskLevelCaching**. Accounts are deleted in order of oldest accessed to most recently accessed.
Example: The caching number is 50 and the deletion number is 25. Accounts will be cached while the free disk space is above 25%. When the free disk space is less than 25% (the deletion number) at a maintenance period, accounts will be deleted (oldest last used first) until the free disk space is above 50% (the caching number). Accounts will be deleted immediately at sign off of an account if free space is under the deletion threshold and disk space is very low, regardless if the PC is actively in use or not. |
-| AccountManagement: DiskLevelCaching | If you set **DeletionPolicy** to **Delete at disk space threshold**, set the percent of total disk space to be used as the disk space threshold for account caching. |
-| AccountManagement: DiskLevelDeletion | If you set **DeletionPolicy** to **Delete at disk space threshold**, set the percent of total disk space to be used as the disk space threshold for account deletion. |
-| AccountManagement: EnableAccountManager | Set as **True** to enable automatic account management. If this is not set to true, no automatic account management will be done. |
-| Customization: MaintenanceStartTime | By default, the maintenance start time (which is when automatic maintenance tasks run, such as Windows Update) is midnight. You can adjust the start time in this setting by entering a new start time in minutes from midnight. For example, if you want maintenance to begin at 2 AM, enter `120` as the value. |
-| Customization: SetEduPolicies | Set to **True** for PCs that will be used in a school. When **SetEduPolicies** is **True**, the following additional settings are applied:
- Local storage locations are restricted. Users can only save files to the cloud.
- Custom Start and taskbar layouts are set.\*
- A custom sign-in screen background image is set.\*
- Additional educational policies are applied (see full list below).
\*Only applies to Windows 10 Pro Education, Enterprise, and Education |
-| Customization: SetPowerPolicies | When set as **True**:
- Prevents users from changing power settings
- Turns off hibernate
- Overrides all power state transitions to sleep (e.g. lid close) |
-| Customization: SignInOnResume | This setting specifies if the user is required to sign in with a password when the PC wakes from sleep. |
-| Customization: SleepTimeout | Specifies all timeouts for when the PC should sleep. Enter the amount of idle time in seconds. If you don't set sleep timeout, the default of 1 hour applies. |
-
-
-##Configuring shared PC mode on Windows
-You can configure Windows to be in shared PC mode in a couple different ways:
-- Mobile device management (MDM): Shared PC mode is enabled by the [SharedPC configuration service provider (CSP)](https://msdn.microsoft.com/library/windows/hardware/mt723294.aspx). Your MDM policy can contain any of the options listed in the [Customization](#customization) section. The following image shows a Microsoft Intune policy with the shared PC options added as OMA-URI settings. [Learn more about Windows 10 policy settings in Microsoft Intune.](https://docs.microsoft.com/intune/deploy-use/windows-10-policy-settings-in-microsoft-intune)
-
-
-
-- A provisioning package created with the Windows Imaging and Configuration Designer (ICD): You can apply a provisioning package when you initially set up the PC (also known as the out-of-box-experience or OOBE), or you can apply the provisioning package to a Windows 10 PC that is already in use. The provisioning package is created in Windows Imaging and Configuration Designer (ICD). Shared PC mode is enabled by the [SharedPC configuration service provider (CSP)](https://msdn.microsoft.com/library/windows/hardware/mt723294.aspx), exposed in ICD as SharedPC.
-
-
-
-
-### Create a provisioning package for shared use
-
-Use the Windows ICD tool included in the Windows Assessment and Deployment Kit (ADK) for Windows 10 to create a provisioning package that configures a device for shared PC mode. [Install the ADK and select **Configuration Designer**.](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit)
-
-1. Open Windows ICD (by default, %windir%\\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\Imaging and Configuration Designer\\x86\\ICD.exe).
-
-2. On the **Start page**, select **Advanced provisioning**.
-
-3. Enter a name and (optionally) a description for the project, and click **Next**.
-
-4. Select **All Windows desktop editions**, and click **Next**.
-
-5. Click **Finish**. Your project opens in Windows ICD.
-
-6. Go to **Runtime settings** > **SharedPC**. [Select the desired settings for shared PC mode.](#customization)
-
-7. On the **File** menu, select **Save.**
-8. On the **Export** menu, select **Provisioning package**.
-9. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next.**
-10. Set a value for **Package Version**.
- > [!TIP]
- > You can make changes to existing packages and change the version number to update previously applied packages.
-
-11. (*Optional*) In the **Provisioning package security** window, you can choose to encrypt the package and enable package signing.
- - **Enable package encryption** - If you select this option, an auto-generated password will be shown on the screen.
- - **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Select...** and choosing the certificate you want to use to sign the package.
-
- > [!IMPORTANT]
- > We recommend that you include a trusted provisioning certificate in your provisioning package. When the package is applied to a device, the certificate is added to the system store and any package signed with that certificate thereafter can be applied silently.
-
-12. Click **Next** to specify the output location where you want the provisioning package to go once it's built. By default, Windows ICD uses the project folder as the output location.
- Optionally, you can click **Browse** to change the default output location.
-13. Click **Next**.
-14. Click **Build** to start building the package. The project information is displayed in the build page and the progress bar indicates the build status.
- If you need to cancel the build, click **Cancel**. This cancels the current build process, closes the wizard, and takes you back to the **Customizations Page**.
-15. If your build fails, an error message will show up that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again.
- If your build is successful, the name of the provisioning package, output directory, and project directory will be shown.
- - If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, click **Back** to change the output package name and path, and then click **Next** to start another build.
- - If you are done, click **Finish** to close the wizard and go back to the **Customizations Page**.
-16. Select the **output location** link to go to the location of the package. You can provide that .ppkg to others through any of the following methods:
-
- - Shared network folder
-
- - SharePoint site
-
- - Removable media (USB/SD) (select this option to apply to a PC during initial setup)
-
-
-### Apply the provisioning package
-
-You can apply the provisioning package to a PC during initial setup or to a PC that has already been set up.
-
-**During initial setup**
-1. Start with a computer on the first-run setup screen. If the PC has gone past this screen, reset the PC to start over. To reset the PC, go to **Settings** > **Update & security** > **Recovery** > **Reset this PC**.
-
- 
-
-2. Insert the USB drive and press the Windows key five times. Windows Setup will recognize the drive and ask if you want to set up the device. If there is only one provisioning package on the USB drive, you don't need to press the Windows key five times, Windows will automatically ask you if you want to set up the device. Select **Set up**.
-
- 
-
-3. The next screen asks you to select a provisioning source. Select **Removable Media** and tap **Next**.
-
- 
-
-4. Select the provisioning package (\*.ppkg) that you want to apply, and tap **Next**.
-
- 
-
-5. Select **Yes, add it**.
-
- 
-
-6. Read and accept the Microsoft Software License Terms.
-
- 
-
-7. Select **Use Express settings**.
-
- 
-
-8. If the PC doesn't use a volume license, you'll see the **Who owns this PC?** screen. Select **My work or school owns it** and tap **Next**.
-
- 
-
-9. On the **Choose how you'll connect** screen, select **Join Azure AD** or **Join a domain** and tap **Next**.
-
- 
-
-10. Sign in with your domain, Azure AD, or Office 365 account and password. When you see the progress ring, you can remove the USB drive.
-
- 
-
-
-**After setup**
-
-On a desktop computer, navigate to **Settings** > **Accounts** > **Work access** > **Add or remove a management package** > **Add a package**, and selects the package to install.
-
-
-
-> [!NOTE]
-> If you apply the setup file to a computer that has already been set up, existing accounts and data might be lost.
-
-## Guidance for accounts on shared PCs
-
-* We recommend no local admin accounts on the PC to improve the reliability and security of the PC.
-* When a PC is set up in shared PC mode, accounts will be cached automatically until disk space is low. Then, accounts will be deleted to reclaim disk space. This account managment happens automatically. Both Azure AD and Active Directory domain accounts are managed in this way. Any accounts created through **Start without an account** will also be deleted automatically at sign out.
-* On a Windows PC joined to Azure Active Directory:
- * By default, the account that joined the PC to Azure AD will have an admin account on that PC. Global administrators for the Azure AD domain will also have admin accounts on the PC.
- * With Azure AD Premium, you can specify which accounts have admin accounts on a PC using the **Additional administrators on Azure AD Joined devices** setting on the Azure portal.
-* Local accounts that already exist on a PC won’t be deleted when turning on shared PC mode. New local accounts that are created using **Settings > Accounts > Other people > Add someone else to this PC** after shared PC mode is turned on won't be deleted. However, any new local accounts created by the **Start without an account** selection on the sign-in screen (if enabled) will automatically be deleted at sign-out.
-* If admin accounts are necessary on the PC
- * Ensure the PC is joined to a domain that enables accounts to be signed on as admin, or
- * Create admin accounts before setting up shared PC mode, or
- * Create exempt accounts before signing out when turning shared pc mode on.
-* The account management service supports accounts that are exempt from deletion.
- * An account can be marked exempt from deletion by adding the account SID to the `HKEY_LOCAL_MACHINE\SOFTARE\Microsoft\Windows\CurrentVersion\SharedPC\Exemptions\` registry key.
- * To add the account SID to the registry key using PowerShell:
- ```
- $adminName = "LocalAdmin"
- $adminPass = 'Pa$$word123'
- iex "net user /add $adminName $adminPass"
- $user = New-Object System.Security.Principal.NTAccount($adminName)
- $sid = $user.Translate([System.Security.Principal.SecurityIdentifier])
- $sid = $sid.Value;
- New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\SharedPC\Exemptions\$sid" -Force
- ```
-
-
-
-
-## Policies set by shared PC mode
-Shared PC mode sets local group policies to configure the device. Some of these are configurable using the shared pc mode options.
-
-> [!IMPORTANT]
-> It is not recommended to set additional policies on PCs configured for **Shared PC Mode**. The shared PC mode has been optimized to be fast and reliable over time with minimal to no manual maintenance required.
-
-
-
-Policy name | Value | When set? |
|---|
-
-Admin Templates > Control Panel > Personalization |
-Prevent enabling lock screen slide show | Enabled | Always |
-Prevent changing lock screen and logon image | Enabled | Always |
-Admin Templates > System > Power Management > Button Settings |
-Select the Power button action (plugged in) | Sleep | SetPowerPolicies=True |
-Select the Power button action (on battery) | Sleep | SetPowerPolicies=True |
-Select the Sleep button action (plugged in) | Sleep | SetPowerPolicies=True |
-Select the lid switch action (plugged in) | Sleep | SetPowerPolicies=True |
-Select the lid switch action (on battery) | Sleep | SetPowerPolicies=True |
-Admin Templates > System > Power Management > Sleep Settings |
-Require a password when a computer wakes (plugged in) | Enabled | SignInOnResume=True |
-Require a password when a computer wakes (on battery) | Enabled | SignInOnResume=True |
-Specify the system sleep timeout (plugged in) | *SleepTimeout* | SetPowerPolicies=True |
-Specify the system sleep timeout (on battery) | *SleepTimeout* | SetPowerPolicies=True |
- | Turn off hybrid sleep (plugged in) | Enabled | SetPowerPolicies=True |
- | Turn off hybrid sleep (on battery) | Enabled | SetPowerPolicies=True |
- | Specify the unattended sleep timeout (plugged in) | *SleepTimeout* | SetPowerPolicies=True |
- | Specify the unattended sleep timeout (on battery) | *SleepTimeout* | SetPowerPolicies=True |
- | Allow standby states (S1-S3) when sleeping (plugged in) | Enabled | SetPowerPolicies=True |
- | Allow standby states (S1-S3) when sleeping (on battery) | Enabled | SetPowerPolicies=True |
- | Specify the system hibernate timeout (plugged in) | Enabled, 0 | SetPowerPolicies=True |
- | Specify the system hibernate timeout (on battery) | Enabled, 0 | SetPowerPolicies=True |
- | Admin Templates>System>Power Management>Video and Display Settings |
- | Turn off the display (plugged in) | *SleepTimeout* | SetPowerPolicies=True |
- | Turn off the display (on battery | *SleepTimeout* | SetPowerPolicies=True |
- | Admin Templates>System>Logon |
- | Show first sign-in animation | Disabled | Always |
- | Hide entry points for Fast User Switching | Enabled | Always |
- | Turn on convenience PIN sign-in | Disabled | Always |
- | Turn off picture password sign-in | Enabled | Always |
- | Turn off app notification on the lock screen | Enabled | Always |
- | Allow users to select when a password is required when resuming from connected standby | Disabled | SignInOnResume=True |
-
- | Block user from showing account details on sign-in | Enabled | Always |
- | Admin Templates>System>User Profiles |
- | Turn off the advertising ID | Enabled | SetEduPolicies=True |
- | Admin Templates>Windows Components |
- | Do not show Windows Tips *Only on Pro, Enterprise, Pro Education, and Education* | Enabled | SetEduPolicies=True |
- | Turn off Microsoft consumer experiences *Only on Pro, Enterprise, Pro Education, and Education* | Enabled | SetEduPolicies=True |
- | Microsoft Passport for Work | Disabled | Always |
- | Prevent the usage of OneDrive for file storage | Enabled | Always |
- | Admin Templates>Windows Components>Biometrics |
- | Allow the use of biometrics | Disabled | Always |
- | Allow users to log on using biometrics | Disabled | Always |
- | Allow domain users to log on using biometrics | Disabled | Always |
- | Admin Templates>Windows Components>Data Collection and Preview Builds |
- | Toggle user control over Insider builds | Disabled | Always |
- | Disable pre-release features or settings | Disabled | Always |
- | Do not show feedback notifications | Enabled | Always |
- | Admin Templates>Windows Components>File Explorer |
- | Show lock in the user tile menu | Disabled | Always |
- | Admin Templates>Windows Components>Maintenance Scheduler |
- | Automatic Maintenance Activation Boundary | *MaintenanceStartTime* | Always |
- | Automatic Maintenance Random Delay | Enabled, 2 hours | Always |
- | Automatic Maintenance WakeUp Policy | Enabled | Always |
- | Admin Templates>Windows Components>Microsoft Edge |
- | Open a new tab with an empty tab | Disabled | SetEduPolicies=True |
- | Configure corporate home pages | Enabled, about:blank | SetEduPolicies=True |
- | Admin Templates>Windows Components>Search |
- | Allow Cortana | Disabled | SetEduPolicies=True |
- | Windows Settings>Security Settings>Local Policies>Security Options |
-
- | Interactive logon: Do not display last user name | Enabled, Disabled when account model is only guest | Always |
- | Interactive logon: Sign-in last interactive user automatically after a system-initiated restart | Disabled | Always |
-
- | Shutdown: Allow system to be shut down without having to log on | Disabled | Always |
- | User Account Control: Behavior of the elevation prompt for standard users | Auto deny | Always |
-
-
-
-
-
-## Related topics
-
-[Set up a device for anyone to use (kiosk)](set-up-a-device-for-anyone-to-use.md)
-
-
-
-
-
-
-
-
-
-
diff --git a/windows/whats-new/images/bulk-token.PNG b/windows/whats-new/images/bulk-token.PNG
new file mode 100644
index 0000000000..b0d2221824
Binary files /dev/null and b/windows/whats-new/images/bulk-token.PNG differ
diff --git a/windows/whats-new/images/wcd-options.png b/windows/whats-new/images/wcd-options.png
index e7a89454b8..b3d998ba1b 100644
Binary files a/windows/whats-new/images/wcd-options.png and b/windows/whats-new/images/wcd-options.png differ
diff --git a/windows/whats-new/whats-new-windows-10-version-1607.md b/windows/whats-new/whats-new-windows-10-version-1607.md
index 1c6c94f739..265b3b3910 100644
--- a/windows/whats-new/whats-new-windows-10-version-1607.md
+++ b/windows/whats-new/whats-new-windows-10-version-1607.md
@@ -130,7 +130,7 @@ Numerous settings have been added to the Windows 10 CSPs to expand MDM capabilit
### Shared PC mode
-Windows 10, Version 1607, introduces shared PC mode, which optimizes Windows 10 for shared use scenarios, such as touchdown spaces in an enterprise and temporary customer use in retail. You can apply shared PC mode to Windows 10 Pro, Education, and Enterprise. [Learn how to set up a shared or guest PC.](../manage/set-up-shared-or-guest-pc.md)
+Windows 10, Version 1607, introduces shared PC mode, which optimizes Windows 10 for shared use scenarios, such as touchdown spaces in an enterprise and temporary customer use in retail. You can apply shared PC mode to Windows 10 Pro, Education, and Enterprise. [Learn how to set up a shared or guest PC.](../configure/set-up-shared-or-guest-pc.md)
### Application Virtualization (App-V) for Windows 10
diff --git a/windows/whats-new/whats-new-windows-10-version-1703.md b/windows/whats-new/whats-new-windows-10-version-1703.md
index 6f4913087b..fe76aacdf4 100644
--- a/windows/whats-new/whats-new-windows-10-version-1703.md
+++ b/windows/whats-new/whats-new-windows-10-version-1703.md
@@ -29,6 +29,12 @@ Windows Configuration Designer in Windows 10, version 1703, includes several new
[Learn more about Windows Configuration Designer.](../configure/provisioning-packages.md)
+### Bulk enrollment in Azure Active Directory
+
+Using the new wizards in Windows Configuration Designer, you can [create provisioning packages to enroll devices in Azure Active Directory](../configure/provisioning-packages.md#configuration-designer-wizards). Bulk enrollment in Azure AD is available in the desktop, mobile, kiosk, and Surface Hub wizards.
+
+
+
### Windows Spotlight
The following new Group Policy and mobile device management (MDM) settings are added to help you configure Windows Spotlight user experiences: