Merge branch 'master' of https://cpubwin.visualstudio.com/_git/it-client into exitcodestablefix

windows/deployment/windows-autopilot/add-devices.md

@@ -9,7 +9,7 @@ ms.sitesec: library
 ms.pagetype: deploy
 author: greg-lindsay
 ms.author: greg-lindsay
-ms.date: 10/02/2018
+ms.date: 12/12/2018
 ---
 
 # Adding devices to Windows Autopilot
@@ -20,6 +20,20 @@ ms.date: 10/02/2018
 
 Before deploying a device using Windows Autopilot, the device must be registered with the Windows Autopilot deployment service. Ideally, this would be performed by the OEM, reseller, or distributor from which the devices were purchased, but this can also be done by the organization by collecting the hardware identity and uploading it manually.
 
+## Manual registration
+
+To perform manual registration of a device, you must caputure its hardware ID (also known as a hardware hash) and upload this to the Windows Autopilot deployment service. See the topics below for detailed information on how to collect and upload hardware IDs.
+
+>[!IMPORTANT]
+>Do not connect devices to the Internet prior to capturing the hardware ID and creating an Autopilot device profile. This includes collecting the hardware ID, uploading the .CSV into MSfB or Intune, assigning the profile, and confirming the profile assignment. Connecting the device to the Internet before this process is complete will result in the device downloading a blank profile that is stored on the device until it is explicity removed. In Windows 10 version 1809, you can clear the cached profile by restarting OOBE. In previous versions, the only way to clear the stored profile is to re-install the OS, reimage the PC, or run **sysprep /generalize /oobe**. <br>
+>After Intune reports the profile ready to go, only then should the device be connected to the Internet.
+
+Also note that if OOBE is restarted too many times it can enter a recovery mode and fail to run the Autopilot configuration. You can identify this scenario if OOBE displays multiple configuration options on the same page, including language, region, and keyboard layout. The normal OOBE displays each of these on a separate page. The following value key tracks the count of OOBE retries:
+
+**HKCU\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\UserOOBE** 
+
+To ensure OOBE has not been restarted too many times, you can change this value to 1.
+
 ## Device identification
 
 To define a device to the Windows Autopilot deployment service, a unique hardware ID for the device needs to be captured and uploaded to the service. While this step is ideally done by the hardware vendor (OEM, reseller, or distributor), automatically associating the device with an organization, it is also possible to do this through a harvesting process that collects the device from within a running Windows 10 version 1703 or later installation.
@@ -32,28 +46,26 @@ Note that the hardware hash also contains details about when it was generated, s
 
 The hardware ID, or hardware hash, for an existing device is available through Windows Management Instrumentation (WMI), as long as that device is running Windows 10 version 1703 or later. To help gather this information, as well as the serial number of the device (useful to see at a glance the machine to which it belongs), a PowerShell script called [Get-WindowsAutoPilotInfo.ps1 has been published to the PowerShell Gallery website](https://www.powershellgallery.com/packages/Get-WindowsAutoPilotInfo).
 
-To use this script, you can download it from the PowerShell Gallery and run it on each computer, or you can install it directly from the PowerShell Gallery. To install it directly and capture the hardware hash from the local computer, these commands can be used:
+To use this script, you can download it from the PowerShell Gallery and run it on each computer, or you can install it directly from the PowerShell Gallery. To install it directly and capture the hardware hash from the local computer, use the following commands from an elevated Windows PowerShell prompt:
 
-*md c:\\HWID*
+```powershell
+md c:\\HWID
+Set-Location c:\\HWID
+Set-ExecutionPolicy Unrestricted
+Install-Script -Name Get-WindowsAutoPilotInfo
+Get-WindowsAutoPilotInfo.ps1 -OutputFile AutoPilotHWID.csv
+```
 
-*Set-Location c:\\HWID*
+The commands can also be run remotely, as long as WMI permissions are in place and WMI is accessible through the Windows Firewall on that remote computer. See the Get-WindowsAutoPilotInfo script’s help (using “Get-Help Get-WindowsAutoPilotInfo.ps1”) for more information about running the script.
-
-*Set-ExecutionPolicy Unrestricted*
-
-*Install-Script -Name Get-WindowsAutoPilotInfo*
-
-*Get-WindowsAutoPilotInfo.ps1 -OutputFile AutoPilotHWID.csv*
-
-You must run this PowerShell script with administrator privileges (elevated). It can also be run remotely, as long as WMI permissions are in place and WMI is accessible through the Windows Firewall on that remote computer. See the Get-WindowsAutoPilotInfo script’s help (using “Get-Help Get-WindowsAutoPilotInfo.ps1”) for more information.
 
 >[!NOTE]
->With Windows 10 version 1803 and above, devices will download an Autopilot profile as soon as they connect to the internet. For devices that are not yet registered with the Autopilot deployment service, a profile will be downloaded that indicates the device should not be deployed using Autopilot. If the device connects to the internet as part of the collection process, you will need to reset the PC, reimage the PC, or re-generalize the OS (using sysprep /generalize /oobe).
+>If you will connect to the device remotely to collect the hardware ID, see the information at the top of this page about device connectivity to the Internet. 
 
 ## Collecting the hardware ID from existing devices using System Center Configuration Manager
 
 Starting with System Center Configuration Manager current branch version 1802, the hardware hashes for existing Windows 10 version 1703 and higher devices are automatically collected by Configuration Manager. See the [What’s new in version 1802](https://docs.microsoft.com/sccm/core/plan-design/changes/whats-new-in-version-1802#report-on-windows-autopilot-device-information) documentation for more details.
 
-## Uploading hardware IDs
+## Registering devices
 
 Once the hardware IDs have been captured from existing devices, they can be uploaded through a variety of means. See the detailed documentation for each available mechanism:
 

windows/deployment/windows-autopilot/profiles.md

@@ -9,7 +9,7 @@ ms.sitesec: library
 ms.pagetype: deploy
 author: greg-lindsay
 ms.author: greg-lindsay
-ms.date: 10/02/2018
+ms.date: 12/12/2018
 ---
 
 # Configure Autopilot profiles
@@ -18,7 +18,12 @@ ms.date: 10/02/2018
 
 -   Windows 10
 
-For each device that has been defined to the Windows Autopilot deployment service, a profile of settings needs to be applied to specify the exact behavior of that device when it is deployed. The following profile settings are available:
+For each device that has been defined to the Windows Autopilot deployment service, a profile of settings needs to be applied to specify the exact behavior of that device when it is deployed. For detailed procedures on how to configure profile settings and register devices, see [Adding devices](add-devices.md#registering-devices).
+
+>[!NOTE]
+>When an Internet-connected Windows 10 device boots up, it will attempt to download an Autopilot profile. In Windows 10 version 1809 and later, the PC will re-fetch the profile after each reboot. In previous versions, the profile is downloaded once. To remove the currently cached local profile in Windows 10 version 1803 and earlier, it is necessary to re-generalize the OS using **sysprep /generalize /oobe**, reinstall the OS, or re-image the PC.
+
+The following profile settings are available:
 
 -   **Skip Cortana, OneDrive and OEM registration setup pages**. All devices registered with Autopilot will automatically skip these pages during the out-of-box experience (OOBE) process.
 

windows/privacy/Microsoft-DiagnosticDataViewer.md

@@ -0,0 +1,197 @@
+---
+title: Diagnostic Data Viewer for PowerShell Overview (Windows 10)
+description: Use this article to use the Diagnostic Data Viewer for PowerShell to review the diagnostic data sent to Microsoft by your device.
+keywords: privacy
+ms.prod: w10
+ms.mktglfcycl: manage
+ms.sitesec: library
+ms.pagetype: security
+ms.localizationpriority: high
+author: brianlic-msft
+ms.author: brianlic
+ms.date: 01/17/2018
+---
+
+# Diagnostic Data Viewer for PowerShell Overview
+
+**Applies to**
+
+-   Windows 10, version 1809
+-   Windows 10, version 1803
+-   Windows Server, version 1803
+-   Windows Server 2019
+
+## Introduction
+The Diagnostic Data Viewer for PowerShell is a PowerShell module that lets you review the diagnostic data your device is sending to Microsoft, grouping the info into simple categories based on how it's used by Microsoft.
+
+## Requirements
+
+You must have administrative privilege on the device in order to use this PowerShell module. This module requires OS version 1803 and higher. 
+
+## Install and Use the Diagnostic Data Viewer for PowerShell
+
+You must install the module before you can use the Diagnostic Data Viewer for PowerShell. 
+
+### Install the Diagnostic Data Viewer for PowerShell
+
+   >[!IMPORTANT]
+   >It is recommended to visit the documentation on [Getting Started](https://docs.microsoft.com/en-us/powershell/gallery/getting-started) with PowerShell Gallery. This page provides more specific details on installing a PowerShell module. 
+
+To install the newest version of the Diagnostic Data Viewer PowerShell module: 
+1. From an elevated Command Prompt, start a PowerShell session by running `C:\> powershell.exe`.  
+2. Install the module by name
+```powershell
+PS C:\> Install-Module -Name Microsoft.DiagnosticDataViewer
+```
+
+To see more information about the module, visit [PowerShell Gallery](https://www.powershellgallery.com/packages/Microsoft.DiagnosticDataViewer).
+
+### Turn on data viewing
+Before you can use this tool, you must turn on data viewing. Turning on data viewing enables Windows to store a local history of your device's diagnostic data for you to view until you turn it off. 
+
+Note that this setting does not control whether your device sends diagnostic data. Instead, it controls whether your Windows device saves a local copy of the diagnostic data sent for your viewing. 
+
+**To turn on data viewing through the Settings page**
+1. Go to **Start**, select **Settings** > **Privacy** > **Diagnostics & feedback**.
+
+2. Under **Diagnostic data**, turn on the **If data viewing is enabled, you can see your diagnostics data** option.
+
+    ![Location to turn on data viewing](images/ddv-data-viewing.png)
+
+**To turn on data viewing through PowerShell**
+
+1. Install the Diagnostic Data Viewer for PowerShell module.
+2. Run the Command prompt **as administrator**. 
+3. Start a PowerShell session by running `C:\> powershell.exe`. 
+4. Run the following commands in the PowerShell session:  
+
+```powershell
+PS C:\> Enable-DiagnosticDataViewing
+```
+
+Once data viewing is enabled, your Windows machine will begin saving a history of diagnostic data that is sent to Microsoft from this point on.
+
+   >[!IMPORTANT]
+   >Turning on data viewing can use up to 1GB (default setting) of disk space on your system drive. We recommend that you turn off data viewing when you're done using the Diagnostic Data Viewer. For info about turning off data viewing, see the [Turn off data viewing](#turn-off-data-viewing) section in this article.
+
+### Start the Diagnostic Data Viewer
+You must start this app from the **Settings** panel.
+
+**To start the Diagnostic Data Viewer**
+1. Go to **Start**, select **Settings** > **Privacy** > **Diagnostics & feedback**.
+
+2. Under **Diagnostic data**, select the **Diagnostic Data Viewer** button.
+
+    ![Location to turn on the Diagnostic Data Viewer](images/ddv-settings-launch.png)<br><br>-OR-<br><br>
+    
+    Go to **Start** and search for _Diagnostic Data Viewer_.
+
+3. Close the Diagnostic Data Viewer app, use your device as you normally would for a few days, and then open Diagnostic Data Viewer again to review the updated list of diagnostic data.
+
+   >[!IMPORTANT]
+   >Turning on data viewing can use up to 1GB of disk space on your system drive. We strongly recommend that your turn off data viewing when you're done using the Diagnostic Data Viewer. For info about turning off data viewing, see the [Turn off data viewing](#turn-off-data-viewing) section in this article.
+
+### Getting Started with Diagnostic Data Viewer for PowerShell
+To see how to use the cmdlet, the parameters it accepts, and examples, run the following command from an elevated PowerShell session: 
+
+```powershell
+PS C:\> Get-Help Get-DiagnosticData
+```
+
+**To Start Viewing Diagnostic Data**
+
+From an elevated PowerShell session, run the following command: 
+
+```powershell
+PS C:\> Get-DiagnosticData
+```
+
+If the number of events is large, and you'd like to stop the command, enter `Ctrl+C`. 
+
+   >[!IMPORTANT]
+   >The above command may produce little to no results if you enabled data viewing recently. It can take several minutes before your Windows device can show diagnostic data it has sent. Use your device as you normally would in the mean time and try again. 
+
+### Doing more with the Diagnostic Data Viewer for PowerShell
+The Diagnostic Data Viewer for PowerShell provides you with the following features to view and filter your device's diagnostic data. You can also use the extensive suite of other PowerShell tools with this module. 
+
+- **View your diagnostic events.** Running `PS C:\> Get-DiagnosticData`, you can review your diagnostic events. These events reflect activities that occurred and were sent to Microsoft. 
+
+    Each event is displayed as a PowerShell Object. By default each event shows the event name, the time when it was seen by your Windows device, whether the event is [Basic](https://docs.microsoft.com/en-us/windows/privacy/configure-windows-diagnostic-data-in-your-organization), its [diagnostic event category](#view-diagnostic-event-categories), and a detailed JSON view of the information it contains, which shows the event exactly as it was when sent to Microsoft. Microsoft uses this info to continually improve the Windows operating system.
+
+- **View Diagnostic event categories.** Each event shows the diagnostic event categories that it belongs to. These categories define how events are used by Microsoft. The categories are shown as numeric identifiers. For more information about these categories, see [Windows Diagnostic Data](https://docs.microsoft.com/en-us/windows/privacy/windows-diagnostic-data).  
+    
+    To view the diagnostic category represented by each numeric identifier and what the category means, you can run the command:
+
+    ```powershell
+    PS C:\> Get-DiagnosticDataTypes
+    ```  
+
+- **Filter events by when they were sent.** You can view events within specified time ranges by specifying a start time and end time of each command. For example, to see all diagnostic data sent between 12 and 6 hours ago, run the following command. Note that data is shown in order of oldest first. 
+    ```powershell
+    PS C:\> Get-DiagnosticData -StartTime (Get-Date).AddHours(-12) -EndTime (Get-Date).AddHours(-6)
+    ```
+
+- **Export the results of each command.** You can export the results of each command to a separate file such as a csv by using pipe `|`. For example, 
+
+    ```powershell
+    PS C:\> Get-DiagnosticData | Export-Csv 'mydata.csv'
+    ```
+
+## Turn off data viewing
+When you're done reviewing your diagnostic data, we recommend turning off data viewing to prevent using up more memory. Turning off data viewing stops Windows from saving a history of your diagnostic data and clears the existing history of diagnostic data from your device. 
+
+**To turn off data viewing through the Settings page**
+1. Go to **Start**, select **Settings** > **Privacy** > **Diagnostics & feedback**.
+
+2. Under **Diagnostic data**, turn off the **If data viewing is enabled, you can see your diagnostics data** option.
+
+    ![Location to turn off data viewing](images/ddv-settings-off.png)
+
+**To turn off data viewing through PowerShell** 
+
+1. Run the Command prompt **as administrator**.
+2. Start a PowerShell session by running `C:\> powershell.exe`. 
+3. Run the following commands in the PowerShell session:  
+
+```powershell
+PS C:\> Disable-DiagnosticDataViewing
+```
+
+## Modifying the size of your data history
+By default, the tool will show you up to 1GB or 30 days of data (whichever comes first). Once either the time or space limit is reached, the data is incrementally dropped with the oldest data points dropped first. 
+
+**Modify the size of your data history**
+
+   >[!IMPORTANT]
+   >Modifying the maximum amount of diagnostic data viewable by the tool may come with performance impacts to your machine.
+
+You can change the maximum data history size (in megabytes) that you can view. For example, to set the maximum data history size to 2048MB (2GB), you can run the following command. 
+
+```powershell
+PS C:\> Set-DiagnosticStoreCapacity -Size 2048
+```
+
+You can change the maximum data history time (in hours) that you can view. For example, to set the maximum data history time to 24 hours, you can run the following command. 
+
+```powershell
+PS C:\> Set-DiagnosticStoreCapacity -Time 24
+```
+
+   >[!IMPORTANT]
+   >You may need to restart your machine for the new settings to take effect. 
+
+   >[!IMPORTANT]
+   >If you have the [Diagnostic Data Viewer](diagnostic-data-viewer-overview.md) store app installed on the same device, modifications to the size of your data history through the PowerShell module will also be reflected in the app.  
+
+**Reset the size of your data history**
+
+To reset the maximum data history size back to its original 1GB default value, run the following command in an elevated PowerShell session: 
+
+```powershell
+PS C:\> Set-DiagnosticStoreCapacity -Size 1024 -Time 720 
+```
+
+
+## Related Links
+- [Module in PowerShell Gallery](https://www.powershellgallery.com/packages/Microsoft.DiagnosticDataViewer)
+- [Documentation for Diagnostic Data Viewer for PowerShell](https://docs.microsoft.com/en-us/powershell/module/microsoft.diagnosticdataviewer/?view=win10-ps)

windows/privacy/TOC.md

@@ -3,7 +3,9 @@
 ## [Windows and the GDPR: Information for IT Administrators and Decision Makers](gdpr-it-guidance.md)
 ## [Windows 10 personal data services configuration](windows-personal-data-services-configuration.md)
 ## [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md)
-## [Diagnostic Data Viewer Overview](diagnostic-data-viewer-overview.md)
+## Diagnostic Data Viewer
+### [Diagnostic Data Viewer Overview](diagnostic-data-viewer-overview.md)
+### [Diagnostic Data Viewer for PowerShell Overview](Microsoft-DiagnosticDataViewer.md)
 ## Basic level Windows diagnostic data events and fields
 ### [Windows 10, version 1809 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md)
 ### [Windows 10, version 1803 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md)

windows/security/threat-protection/windows-defender-atp/onboard-downlevel-windows-defender-advanced-threat-protection.md

@@ -58,9 +58,6 @@ Review the following details to verify minimum system requirements:
   >Only applicable for Windows 7 SP1 Enterprise and Windows 7 SP1 Pro. 
 
 - Install the [Update for customer experience and diagnostic telemetry](https://support.microsoft.com/help/3080149/update-for-customer-experience-and-diagnostic-telemetry)
-  
-  >[!NOTE]
-  >Only applicable for Windows 7 SP1 Enterprise and Windows 7 SP1 Pro.
 
 - Install either [.NET framework 4.5](https://www.microsoft.com/en-us/download/details.aspx?id=30653) (or later) or [KB3154518](https://support.microsoft.com/help/3154518/support-for-tls-system-default-versions-included-in-the-net-framework)