deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-05-13 22:07:22 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

Merging changes synced from https://github.com/MicrosoftDocs/windows-docs-pr (branch live)

Browse Source
This commit is contained in:
dstrome 2020-11-03 23:49:27 +00:00
commit f0dc20e1e1
94 changed files with 444 additions and 396 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
windows/deployment/add-store-apps-to-image.md
View File

@ -1,6 +1,6 @@
--- ---
title: Add Microsoft Store for Business applications to a Windows 10 image title: Add Microsoft Store for Business applications to a Windows 10 image
description: This topic describes how to add Microsoft Store for Business applications to a Windows 10 image. description: This article describes the correct way to add Microsoft Store for Business applications to a Windows 10 image.
keywords: upgrade, update, windows, windows 10, deploy, store, image, wim keywords: upgrade, update, windows, windows 10, deploy, store, image, wim
ms.prod: w10 ms.prod: w10
ms.mktglfcycl: deploy ms.mktglfcycl: deploy
@ -13,6 +13,7 @@ ms.author: greglin
ms.reviewer: ms.reviewer:
manager: laurawi manager: laurawi
ms.topic: article ms.topic: article
ms.custom: seo-marvel-apr2020
--- ---
# Add Microsoft Store for Business applications to a Windows 10 image # Add Microsoft Store for Business applications to a Windows 10 image

3
windows/deployment/configure-a-pxe-server-to-load-windows-pe.md
View File

@ -13,6 +13,7 @@ ms.reviewer:
manager: laurawi manager: laurawi
ms.author: greglin ms.author: greglin
ms.topic: article ms.topic: article
ms.custom: seo-marvel-apr2020
--- ---
# Configure a PXE server to load Windows PE # Configure a PXE server to load Windows PE
@ -21,8 +22,6 @@ ms.topic: article
- Windows 10 - Windows 10
## Summary
This walkthrough describes how to configure a PXE server to load Windows PE by booting a client computer from the network. Using the Windows PE tools and a Windows 10 image file, you can install Windows 10 from the network. This walkthrough describes how to configure a PXE server to load Windows PE by booting a client computer from the network. Using the Windows PE tools and a Windows 10 image file, you can install Windows 10 from the network.
## Prerequisites ## Prerequisites

1
windows/deployment/deploy-m365.md
View File

@ -14,6 +14,7 @@ audience: itpro
author: greg-lindsay author: greg-lindsay
ms.topic: article ms.topic: article
ms.collection: M365-modern-desktop ms.collection: M365-modern-desktop
ms.custom: seo-marvel-apr2020
--- ---
# Deploy Windows 10 with Microsoft 365 # Deploy Windows 10 with Microsoft 365

3
windows/deployment/deploy-whats-new.md
View File

@ -13,6 +13,7 @@ ms.pagetype: deploy
audience: itpro audience: itpro
author: greg-lindsay author: greg-lindsay
ms.topic: article ms.topic: article
ms.custom: seo-marvel-apr2020
--- ---
# What's new in Windows 10 deployment # What's new in Windows 10 deployment
@ -83,7 +84,7 @@ The following Delivery Optimization policies are removed in the Windows 10, vers
- [**Windows Update for Business**](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-Update-for-Business-and-the-retirement-of-SAC-T/ba-p/339523): There will now be a single, common start date for phased deployments (no more SAC-T designation). In addition, there will be a new notification and reboot scheduling experience for end users, the ability to enforce update installation and reboot deadlines, and the ability to provide end user control over reboots for a specific time period. - [**Windows Update for Business**](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-Update-for-Business-and-the-retirement-of-SAC-T/ba-p/339523): There will now be a single, common start date for phased deployments (no more SAC-T designation). In addition, there will be a new notification and reboot scheduling experience for end users, the ability to enforce update installation and reboot deadlines, and the ability to provide end user control over reboots for a specific time period.
- **Update rollback improvements**: You can now automatically recover from startup failures by removing updates if the startup failure was introduced after the installation of recent driver or quality updates. When a device is unable to start up properly after the recent installation of Quality of driver updates, Windows will now automatically uninstall the updates to get the device back up and running normally. - **Update rollback improvements**: You can now automatically recover from startup failures by removing updates if the startup failure was introduced after the installation of recent driver or quality updates. When a device is unable to start up properly after the recent installation of Quality of driver updates, Windows will now automatically uninstall the updates to get the device back up and running normally.
- **Pause updates**: We have extended the ability to pause updates for both feature and monthly updates. This extension ability is for all editions of Windows 10, including Home. You can pause both feature and monthly updates for up to 35 days (seven days at a time, up to five times). Once the 35-day pause period is reached, you will need to update your device before pausing again. - **Pause updates**: We have extended the ability to pause updates for both feature and monthly updates. This extension ability is for all editions of Windows 10, including Home. You can pause both feature and monthly updates for up to 35 days (seven days at a time, up to five times). Once the 35-day pause period is reached, you will need to update your device before pausing again.
- **Improved update notifications**: When there’s an update requiring you to restart your device, you’ll see a colored dot on the Power button in the Start menu and on the Windows icon in your taskbar. - **Improved update notifications**: When there's an update requiring you to restart your device, you'll see a colored dot on the Power button in the Start menu and on the Windows icon in your taskbar.
- **Intelligent active hours**: To further enhance active hours, users will now have the option to let Windows Update intelligently adjust active hours based on their device-specific usage patterns. You must enable the intelligent active hours feature for the system to predict device-specific usage patterns. - **Intelligent active hours**: To further enhance active hours, users will now have the option to let Windows Update intelligently adjust active hours based on their device-specific usage patterns. You must enable the intelligent active hours feature for the system to predict device-specific usage patterns.
- **Improved update orchestration to improve system responsiveness**: This feature will improve system performance by intelligently coordinating Windows updates and Microsoft Store updates, so they occur when users are away from their devices to minimize disruptions. - **Improved update orchestration to improve system responsiveness**: This feature will improve system performance by intelligently coordinating Windows updates and Microsoft Store updates, so they occur when users are away from their devices to minimize disruptions.

3
windows/deployment/deploy-windows-cm/add-a-windows-10-operating-system-image-using-configuration-manager.md
View File

@ -1,5 +1,5 @@
--- ---
title: Add a Windows 10 operating system image using Configuration Manager (Windows 10) title: Add a Windows 10 operating system image using Configuration Manager
description: Operating system images are typically the production image used for deployment throughout the organization. description: Operating system images are typically the production image used for deployment throughout the organization.
ms.assetid: 77f769cc-1a47-4f36-8082-201cd77b8d3b ms.assetid: 77f769cc-1a47-4f36-8082-201cd77b8d3b
ms.reviewer: ms.reviewer:
@ -13,6 +13,7 @@ ms.sitesec: library
audience: itpro audience: itpro
author: greg-lindsay author: greg-lindsay
ms.topic: article ms.topic: article
ms.custom: seo-marvel-apr2020
--- ---
# Add a Windows 10 operating system image using Configuration Manager # Add a Windows 10 operating system image using Configuration Manager

13
windows/deployment/deploy-windows-cm/add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md
View File

@ -1,5 +1,5 @@
--- ---
title: Add drivers to a Windows 10 deployment with Windows PE using Configuration Manager (Windows 10) title: Add drivers to a Windows 10 deployment with Windows PE using Configuration Manager
description: Learn how to configure the Windows Preinstallation Environment (Windows PE) to include required network and storage drivers. description: Learn how to configure the Windows Preinstallation Environment (Windows PE) to include required network and storage drivers.
ms.assetid: 97b3ea46-28d9-407e-8c42-ded2e45e8d5c ms.assetid: 97b3ea46-28d9-407e-8c42-ded2e45e8d5c
ms.reviewer: ms.reviewer:
@ -13,6 +13,7 @@ ms.sitesec: library
audience: itpro audience: itpro
author: greg-lindsay author: greg-lindsay
ms.topic: article ms.topic: article
ms.custom: seo-marvel-apr2020
--- ---
# Add drivers to a Windows 10 deployment with Windows PE using Configuration Manager # Add drivers to a Windows 10 deployment with Windows PE using Configuration Manager
@ -51,10 +52,10 @@ On **CM01**:
6. In the popup window that appears, click **Yes** to automatically update the distribution point. 6. In the popup window that appears, click **Yes** to automatically update the distribution point.
7. Click **Next**, wait for the image to be updated, and then click **Close**. 7. Click **Next**, wait for the image to be updated, and then click **Close**.
![Add drivers to Windows PE](../images/fig21-add-drivers1.png "Add drivers to Windows PE")<br> ![Add drivers to Windows PE step 1](../images/fig21-add-drivers1.png)<br>
![Add drivers to Windows PE](../images/fig21-add-drivers2.png "Add drivers to Windows PE")<br> ![Add drivers to Windows PE step 2](../images/fig21-add-drivers2.png)<br>
![Add drivers to Windows PE](../images/fig21-add-drivers3.png "Add drivers to Windows PE")<br> ![Add drivers to Windows PE step 3](../images/fig21-add-drivers3.png)<br>
![Add drivers to Windows PE](../images/fig21-add-drivers4.png "Add drivers to Windows PE") ![Add drivers to Windows PE step 4](../images/fig21-add-drivers4.png)
Add drivers to Windows PE Add drivers to Windows PE
@ -64,7 +65,7 @@ This section illustrates how to add drivers for Windows 10 using the HP EliteBoo
For the purposes of this section, we assume that you have downloaded the Windows 10 drivers for the HP EliteBook 8560w model and copied them to the **D:\Sources$\OSD\DriverSources\Windows 10 x64\Hewlett-Packard\HP EliteBook 8560w** folder on CM01. For the purposes of this section, we assume that you have downloaded the Windows 10 drivers for the HP EliteBook 8560w model and copied them to the **D:\Sources$\OSD\DriverSources\Windows 10 x64\Hewlett-Packard\HP EliteBook 8560w** folder on CM01.
![Drivers](../images/cm01-drivers-windows.png) ![Drivers in Windows](../images/cm01-drivers-windows.png)
Driver folder structure on CM01 Driver folder structure on CM01

11
windows/deployment/deploy-windows-cm/create-a-custom-windows-pe-boot-image-with-configuration-manager.md
View File

@ -1,6 +1,6 @@
--- ---
title: Create a custom Windows PE boot image with Configuration Manager (Windows 10) title: Create a custom Windows PE boot image with Configuration Manager (Windows 10)
description: In Microsoft Endpoint Configuration Manager, you can create custom Windows Preinstallation Environment (Windows PE) boot images that include extra components and features. description: Learn how to create custom Windows Preinstallation Environment (Windows PE) boot images in Microsoft Endpoint Configuration Manager.
ms.assetid: b9e96974-324d-4fa4-b0ce-33cfc49c4809 ms.assetid: b9e96974-324d-4fa4-b0ce-33cfc49c4809
ms.reviewer: ms.reviewer:
manager: laurawi manager: laurawi
@ -13,6 +13,7 @@ ms.sitesec: library
audience: itpro audience: itpro
author: greg-lindsay author: greg-lindsay
ms.topic: article ms.topic: article
ms.custom: seo-marvel-apr2020
--- ---
# Create a custom Windows PE boot image with Configuration Manager # Create a custom Windows PE boot image with Configuration Manager
@ -71,8 +72,8 @@ On **CM01**:
8. In the Distribute Content Wizard, add the CM01 distribution point, and complete the wizard. 8. In the Distribute Content Wizard, add the CM01 distribution point, and complete the wizard.
9. Using Configuration Manager Trace, review the D:\\Program Files\\Microsoft Configuration Manager\\Logs\\distmgr.log file. Do not continue until you can see that the boot image is distributed. Look for the line that reads **STATMSG: ID=2301**. You also can monitor Content Status in the Configuration Manager Console at **\Monitoring\Overview\Distribution Status\Content Status\Zero Touch WinPE x64**. See the following examples: 9. Using Configuration Manager Trace, review the D:\\Program Files\\Microsoft Configuration Manager\\Logs\\distmgr.log file. Do not continue until you can see that the boot image is distributed. Look for the line that reads **STATMSG: ID=2301**. You also can monitor Content Status in the Configuration Manager Console at **\Monitoring\Overview\Distribution Status\Content Status\Zero Touch WinPE x64**. See the following examples:
![Content status for the Zero Touch WinPE x64 boot image](../images/fig16-contentstatus1.png "Content status for the Zero Touch WinPE x64 boot image")<br> ![Content status for the Zero Touch WinPE x64 boot image step 1](../images/fig16-contentstatus1.png)<br>
![Content status for the Zero Touch WinPE x64 boot image](../images/fig16-contentstatus2.png "Content status for the Zero Touch WinPE x64 boot image") ![Content status for the Zero Touch WinPE x64 boot image step 2](../images/fig16-contentstatus2.png)
Content status for the Zero Touch WinPE x64 boot image Content status for the Zero Touch WinPE x64 boot image
@ -81,8 +82,8 @@ On **CM01**:
12. Using Configuration Manager Trace, review the D:\\Program Files\\Microsoft Configuration Manager\\Logs\\distmgr.log file and look for this text: **Expanding PS100009 to D:\\RemoteInstall\\SMSImages**. 12. Using Configuration Manager Trace, review the D:\\Program Files\\Microsoft Configuration Manager\\Logs\\distmgr.log file and look for this text: **Expanding PS100009 to D:\\RemoteInstall\\SMSImages**.
13. Review the **D:\\RemoteInstall\\SMSImages** folder. You should see three folders containing boot images. Two are from the default boot images, and the third folder (PS100009) is from your new boot image with DaRT. See the examples below: 13. Review the **D:\\RemoteInstall\\SMSImages** folder. You should see three folders containing boot images. Two are from the default boot images, and the third folder (PS100009) is from your new boot image with DaRT. See the examples below:
![PS100009-1](../images/ps100009-1.png)<br> ![PS100009 step 1](../images/ps100009-1.png)<br>
![PS100009-2](../images/ps100009-2.png) ![PS100009 step 2](../images/ps100009-2.png)
>Note: Depending on your infrastructure and the number of packages and boot images present, the Image ID might be a different number than PS100009. >Note: Depending on your infrastructure and the number of packages and boot images present, the Image ID might be a different number than PS100009.

3
windows/deployment/deploy-windows-cm/finalize-the-os-configuration-for-windows-10-deployment-with-configuration-manager.md
View File

@ -1,6 +1,6 @@
--- ---
title: Finalize operating system configuration for Windows 10 deployment title: Finalize operating system configuration for Windows 10 deployment
description: Follow this walk-through to finalize the configuration of your Windows 10 operating deployment. description: This article provides a walk-through to finalize the configuration of your Windows 10 operating deployment.
ms.assetid: 38b55fa8-e717-4689-bd43-8348751d493e ms.assetid: 38b55fa8-e717-4689-bd43-8348751d493e
ms.reviewer: ms.reviewer:
manager: laurawi manager: laurawi
@ -13,6 +13,7 @@ ms.sitesec: library
audience: itpro audience: itpro
author: greg-lindsay author: greg-lindsay
ms.topic: article ms.topic: article
ms.custom: seo-marvel-apr2020
--- ---
# Finalize the operating system configuration for Windows 10 deployment with Configuration Manager # Finalize the operating system configuration for Windows 10 deployment with Configuration Manager

5
windows/deployment/deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md
View File

@ -1,5 +1,5 @@
--- ---
title: Prepare for Zero Touch Installation of Windows 10 with Configuration Manager (Windows 10) title: Prepare for Zero Touch Installation of Windows 10 with Configuration Manager
description: Learn how to prepare a Zero Touch Installation of Windows 10 with Configuration Manager, by integrating Configuration Manager with Microsoft Deployment Toolkit. description: Learn how to prepare a Zero Touch Installation of Windows 10 with Configuration Manager, by integrating Configuration Manager with Microsoft Deployment Toolkit.
ms.assetid: 06e3a221-31ef-47a5-b4da-3b927cb50d08 ms.assetid: 06e3a221-31ef-47a5-b4da-3b927cb50d08
ms.reviewer: ms.reviewer:
@ -13,6 +13,7 @@ ms.sitesec: library
audience: itpro audience: itpro
author: greg-lindsay author: greg-lindsay
ms.topic: article ms.topic: article
ms.custom: seo-marvel-apr2020
--- ---
# Prepare for Zero Touch Installation of Windows 10 with Configuration Manager # Prepare for Zero Touch Installation of Windows 10 with Configuration Manager
@ -240,7 +241,7 @@ On **CM01**:
2. Right-click **PS1 - Primary Site 1**, point to **Configure Site Components**, and then select **Software Distribution**. 2. Right-click **PS1 - Primary Site 1**, point to **Configure Site Components**, and then select **Software Distribution**.
3. On the **Network Access Account** tab, select **Specify the account that accesses network locations** and add the *New Account* **CONTOSO\\CM\_NAA** as the Network Access account (password: pass@word1). Use the new **Verify** option to verify that the account can connect to the **\\\\DC01\\sysvol** network share. 3. On the **Network Access Account** tab, select **Specify the account that accesses network locations** and add the *New Account* **CONTOSO\\CM\_NAA** as the Network Access account (password: pass@word1). Use the new **Verify** option to verify that the account can connect to the **\\\\DC01\\sysvol** network share.
![figure 12](../images/mdt-06-fig12.png) ![figure 11](../images/mdt-06-fig12.png)
Test the connection for the Network Access account. Test the connection for the Network Access account.

27
windows/deployment/deploy-windows-cm/refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md
View File

@ -1,5 +1,5 @@
--- ---
title: Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager (Windows 10) title: Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager
description: Learn how to use Configuration Manager and Microsoft Deployment Toolkit (MDT) to refresh a Windows 7 SP1 client with Windows 10. description: Learn how to use Configuration Manager and Microsoft Deployment Toolkit (MDT) to refresh a Windows 7 SP1 client with Windows 10.
ms.assetid: 57c81667-1019-4711-b3de-15ae9c5387c7 ms.assetid: 57c81667-1019-4711-b3de-15ae9c5387c7
ms.reviewer: ms.reviewer:
@ -13,6 +13,7 @@ ms.sitesec: library
audience: itpro audience: itpro
author: greg-lindsay author: greg-lindsay
ms.topic: article ms.topic: article
ms.custom: seo-marvel-apr2020
--- ---
# Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager # Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager
@ -57,9 +58,9 @@ On **PC0003**:
1. Open the Configuration Manager control panel (control smscfgrc). 1. Open the Configuration Manager control panel (control smscfgrc).
2. On the **Site** tab, click **Configure Settings**, then click **Find Site**. 2. On the **Site** tab, click **Configure Settings**, then click **Find Site**.
3. Verify that Configuration Manager has successfullyl found a site to manage this client is displayed. See the following example. 3. Verify that Configuration Manager has successfully found a site to manage this client is displayed. See the following example.
![pc0003a](../images/pc0003a.png) ![Found a site to manage this client](../images/pc0003a.png)
## Create a device collection and add the PC0003 computer ## Create a device collection and add the PC0003 computer
@ -123,16 +124,16 @@ On **PC0003**:
2. In the **Software Center** warning dialog box, click **Install Operating System**. 2. In the **Software Center** warning dialog box, click **Install Operating System**.
3. The client computer will run the Configuration Manager task sequence, boot into Windows PE, and install the new OS and applications. See the following examples: 3. The client computer will run the Configuration Manager task sequence, boot into Windows PE, and install the new OS and applications. See the following examples:
![pc0003b](../images/pc0003b.png)<br> ![Task sequence example 1](../images/pc0003b.png)<br>
![pc0003c](../images/pc0003c.png)<br> ![Task sequence example 2](../images/pc0003c.png)<br>
![pc0003d](../images/pc0003d.png)<br> ![Task sequence example 3](../images/pc0003d.png)<br>
![pc0003e](../images/pc0003e.png)<br> ![Task sequence example 4](../images/pc0003e.png)<br>
![pc0003f](../images/pc0003f.png)<br> ![Task sequence example 5](../images/pc0003f.png)<br>
![pc0003g](../images/pc0003g.png)<br> ![Task sequence example 6](../images/pc0003g.png)<br>
![pc0003h](../images/pc0003h.png)<br> ![Task sequence example 7](../images/pc0003h.png)<br>
![pc0003i](../images/pc0003i.png)<br> ![Task sequence example 8](../images/pc0003i.png)<br>
![pc0003j](../images/pc0003j.png)<br> ![Task sequence example 9](../images/pc0003j.png)<br>
![pc0003k](../images/pc0003k.png) ![Task sequence example 10](../images/pc0003k.png)
Next, see [Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager](replace-a-windows-7-client-with-windows-10-using-configuration-manager.md). Next, see [Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager](replace-a-windows-7-client-with-windows-10-using-configuration-manager.md).

23
windows/deployment/deploy-windows-cm/replace-a-windows-7-client-with-windows-10-using-configuration-manager.md
View File

@ -1,5 +1,5 @@
--- ---
title: Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager (Windows 10) title: Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager
description: In this topic, you will learn how to replacing a Windows 7 SP1 computer using Microsoft Endpoint Configuration Manager. description: In this topic, you will learn how to replacing a Windows 7 SP1 computer using Microsoft Endpoint Configuration Manager.
ms.assetid: 3c8a2d53-8f08-475f-923a-bca79ca8ac36 ms.assetid: 3c8a2d53-8f08-475f-923a-bca79ca8ac36
ms.reviewer: ms.reviewer:
@ -13,6 +13,7 @@ ms.sitesec: library
audience: itpro audience: itpro
author: greg-lindsay author: greg-lindsay
ms.topic: article ms.topic: article
ms.custom: seo-marvel-apr2020
--- ---
# Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager # Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager
@ -159,7 +160,7 @@ On **PC0004**:
4. Confirm you want to upgrade the operating system on this computer by clicking **Install** again. 4. Confirm you want to upgrade the operating system on this computer by clicking **Install** again.
5. Allow the Replace Task Sequence to complete. The PC0004 computer will gather user data, boot into Windows PE and gather more data, then boot back to the full OS. The entire process should only take a few minutes. 5. Allow the Replace Task Sequence to complete. The PC0004 computer will gather user data, boot into Windows PE and gather more data, then boot back to the full OS. The entire process should only take a few minutes.
![pc0004b](../images/pc0004b.png) ![Task sequence example](../images/pc0004b.png)
Capturing the user state Capturing the user state
@ -190,15 +191,15 @@ On **PC0006**:
When the process is complete, you will have a new Windows 10 computer in your domain with user data and settings restored. See the following examples: When the process is complete, you will have a new Windows 10 computer in your domain with user data and settings restored. See the following examples:
![pc0006a](../images/pc0006a.png)<br> ![User data and setting restored example 1](../images/pc0006a.png)<br>
![pc0006b](../images/pc0006b.png)<br> ![User data and setting restored example 2](../images/pc0006b.png)<br>
![pc0006c](../images/pc0006c.png)<br> ![User data and setting restored example 3](../images/pc0006c.png)<br>
![pc0006d](../images/pc0006d.png)<br> ![User data and setting restored example 4](../images/pc0006d.png)<br>
![pc0006e](../images/pc0006e.png)<br> ![User data and setting restored example 5](../images/pc0006e.png)<br>
![pc0006f](../images/pc0006f.png)<br> ![User data and setting restored example 6](../images/pc0006f.png)<br>
![pc0006g](../images/pc0006g.png)<br> ![User data and setting restored example 7](../images/pc0006g.png)<br>
![pc0006h](../images/pc0006h.png)<br> ![User data and setting restored example 8](../images/pc0006h.png)<br>
![pc0006i](../images/pc0006i.png) ![User data and setting restored example 9](../images/pc0006i.png)
Next, see [Perform an in-place upgrade to Windows 10 using Configuration Manager](upgrade-to-windows-10-with-configuraton-manager.md). Next, see [Perform an in-place upgrade to Windows 10 using Configuration Manager](upgrade-to-windows-10-with-configuraton-manager.md).

17
windows/deployment/deploy-windows-cm/upgrade-to-windows-10-with-configuraton-manager.md
View File

@ -1,6 +1,6 @@
--- ---
title: Perform in-place upgrade to Windows 10 via Configuration Manager title: Perform in-place upgrade to Windows 10 via Configuration Manager
description: In-place upgrades make upgrading Windows 7, Windows 8, and Windows 8.1 to Windows 10 easy -- you can even automate the whole process with a Microsoft Endpoint Configuration Manager task sequence. description: Learn how to perform an in-place upgrade to Windows 10 by automating the process with a Microsoft Endpoint Configuration Manager task sequence.
ms.assetid: F8DF6191-0DB0-4EF5-A9B1-6A11D5DE4878 ms.assetid: F8DF6191-0DB0-4EF5-A9B1-6A11D5DE4878
ms.reviewer: ms.reviewer:
manager: laurawi manager: laurawi
@ -12,6 +12,7 @@ ms.mktglfcycl: deploy
audience: itpro audience: itpro
author: greg-lindsay author: greg-lindsay
ms.topic: article ms.topic: article
ms.custom: seo-marvel-apr2020
--- ---
# Perform an in-place upgrade to Windows 10 using Configuration Manager # Perform an in-place upgrade to Windows 10 using Configuration Manager
@ -126,13 +127,13 @@ On **PC0004**:
4. Confirm you want to upgrade the operating system on this computer by clicking **Install** again. 4. Confirm you want to upgrade the operating system on this computer by clicking **Install** again.
5. Allow the Upgrade Task Sequence to complete. The PC0004 computer will download the install.wim file, perform an in-place upgrade, and install your added applications. See the following examples: 5. Allow the Upgrade Task Sequence to complete. The PC0004 computer will download the install.wim file, perform an in-place upgrade, and install your added applications. See the following examples:
![pc0004-a](../images/pc0004-a.png)<br> ![Upgrade task sequence example 1](../images/pc0004-a.png)<br>
![pc0004-b](../images/pc0004-b.png)<br> ![Upgrade task sequence example 2](../images/pc0004-b.png)<br>
![pc0004-c](../images/pc0004-c.png)<br> ![Upgrade task sequence example 3](../images/pc0004-c.png)<br>
![pc0004-d](../images/pc0004-d.png)<br> ![Upgrade task sequence example 4](../images/pc0004-d.png)<br>
![pc0004-e](../images/pc0004-e.png)<br> ![Upgrade task sequence example 5](../images/pc0004-e.png)<br>
![pc0004-f](../images/pc0004-f.png)<br> ![Upgrade task sequence example 6](../images/pc0004-f.png)<br>
![pc0004-g](../images/pc0004-g.png) ![Upgrade task sequence example 7](../images/pc0004-g.png)
In-place upgrade with Configuration Manager In-place upgrade with Configuration Manager

3
windows/deployment/deploy-windows-mdt/replace-a-windows-7-computer-with-a-windows-10-computer.md
View File

@ -1,6 +1,7 @@
--- ---
title: Replace a Windows 7 computer with a Windows 10 computer (Windows 10) title: Replace a Windows 7 computer with a Windows 10 computer (Windows 10)
description: Learn how to replace a Windows 7 device with a Windows 10 device. Although the process is similar to performing a refresh, you'll need to backup data externally description: In this article, you will learn how to replace a Windows 7 device with a Windows 10 device.
ms.custom: seo-marvel-apr2020
ms.assetid: acf091c9-f8f4-4131-9845-625691c09a2a ms.assetid: acf091c9-f8f4-4131-9845-625691c09a2a
ms.reviewer: ms.reviewer:
manager: laurawi manager: laurawi

3
windows/deployment/deploy-windows-mdt/set-up-mdt-for-bitlocker.md
View File

@ -4,7 +4,7 @@ ms.assetid: 386e6713-5c20-4d2a-a220-a38d94671a38
ms.reviewer: ms.reviewer:
manager: laurawi manager: laurawi
ms.author: greglin ms.author: greglin
description: description: Learn how to configure your environment for BitLocker, the disk volume encryption built into Windows 10 Enterprise and Windows 10 Pro, using MDT.
keywords: disk, encryption, TPM, configure, secure, script keywords: disk, encryption, TPM, configure, secure, script
ms.prod: w10 ms.prod: w10
ms.mktglfcycl: deploy ms.mktglfcycl: deploy
@ -14,6 +14,7 @@ ms.pagetype: mdt
audience: itpro audience: itpro
author: greg-lindsay author: greg-lindsay
ms.topic: article ms.topic: article
ms.custom: seo-marvel-mar2020
--- ---
# Set up MDT for BitLocker # Set up MDT for BitLocker

19
windows/deployment/deploy-windows-to-go.md
View File

@ -14,6 +14,7 @@ ms.sitesec: library
ms.pagetype: mobility ms.pagetype: mobility
audience: itpro audience: itpro
ms.topic: article ms.topic: article
ms.custom: seo-marvel-apr2020
--- ---
# Deploy Windows To Go in your organization # Deploy Windows To Go in your organization
@ -113,7 +114,7 @@ The following Windows PowerShell cmdlet or cmdlets perform the same function as
$Disk = Get-Disk | Where-Object {$_.Path -match "USBSTOR" -and $_.Size -gt 20Gb -and -not $_.IsBoot } $Disk = Get-Disk | Where-Object {$_.Path -match "USBSTOR" -and $_.Size -gt 20Gb -and -not $_.IsBoot }
#Clear the disk. This will delete any data on the disk. (and will fail if the disk is not yet initialized. If that happens, simply continue with ‘New-Partition…) Validate that this is the correct disk that you want to completely erase. #Clear the disk. This will delete any data on the disk. (and will fail if the disk is not yet initialized. If that happens, simply continue with 'New-Partition…) Validate that this is the correct disk that you want to completely erase.
# #
# To skip the confirmation prompt, append –confirm:$False # To skip the confirmation prompt, append –confirm:$False
Clear-Disk –InputObject $Disk[0] -RemoveData Clear-Disk –InputObject $Disk[0] -RemoveData
@ -161,7 +162,7 @@ W:\Windows\System32\bcdboot W:\Windows /f ALL /s S:
``` ```
~~~ ~~~
5. Apply SAN policy—OFFLINE\_INTERNAL - “4” to prevent the operating system from automatically bringing online any internally connected disk. This is done by creating and saving a **san\_policy.xml** file on the disk. The following example illustrates this step: 5. Apply SAN policy—OFFLINE\_INTERNAL - "4" to prevent the operating system from automatically bringing online any internally connected disk. This is done by creating and saving a **san\_policy.xml** file on the disk. The following example illustrates this step:
``` ```
<?xml version='1.0' encoding='utf-8' standalone='yes'?> <?xml version='1.0' encoding='utf-8' standalone='yes'?>
@ -291,7 +292,7 @@ Making sure that Windows To Go workspaces are effective when used off premises i
- A domain-joined computer running Windows 8 or later and is configured as a Windows To Go host computer - A domain-joined computer running Windows 8 or later and is configured as a Windows To Go host computer
- A Windows To Go drive that hasn’t been booted or joined to the domain using unattend settings. - A Windows To Go drive that hasn't been booted or joined to the domain using unattend settings.
- A domain user account with rights to add computer accounts to the domain and is a member of the Administrator group on the Windows To Go host computer - A domain user account with rights to add computer accounts to the domain and is a member of the Administrator group on the Windows To Go host computer
@ -319,7 +320,7 @@ Making sure that Windows To Go workspaces are effective when used off premises i
$Disk = Get-Disk | Where-Object {$_.Path -match "USBSTOR" -and $_.Size -gt 20Gb -and -not $_.IsBoot } $Disk = Get-Disk | Where-Object {$_.Path -match "USBSTOR" -and $_.Size -gt 20Gb -and -not $_.IsBoot }
#Clear the disk. This will delete any data on the disk. (and will fail if the disk is not yet initialized. If that happens, simply continue with ‘New-Partition…) Validate that this is the correct disk that you want to completely erase. #Clear the disk. This will delete any data on the disk. (and will fail if the disk is not yet initialized. If that happens, simply continue with 'New-Partition…) Validate that this is the correct disk that you want to completely erase.
# #
# To skip the confirmation prompt, append –confirm:$False # To skip the confirmation prompt, append –confirm:$False
Clear-Disk –InputObject $Disk[0] -RemoveData Clear-Disk –InputObject $Disk[0] -RemoveData
@ -414,7 +415,7 @@ dism /apply-image /imagefile:n:\imagefolder\deploymentimages\mywtgimage.wim /ind
>[!NOTE] >[!NOTE]
>Depending on your DirectAccess configuration you might be asked to insert your smart card to log on to the domain. >Depending on your DirectAccess configuration you might be asked to insert your smart card to log on to the domain.
You should now be able to access your organization’s network resources and work from your Windows To Go workspace as you would normally work from your standard desktop computer on premises. You should now be able to access your organization's network resources and work from your Windows To Go workspace as you would normally work from your standard desktop computer on premises.
### Enable BitLocker protection for your Windows To Go drive ### Enable BitLocker protection for your Windows To Go drive
@ -467,7 +468,7 @@ BitLocker recovery keys are the keys that can be used to unlock a BitLocker prot
$Disk = Get-Disk | Where-Object {$_.Path -match "USBSTOR" -and $_.Size -gt 20Gb -and -not $_.IsBoot } $Disk = Get-Disk | Where-Object {$_.Path -match "USBSTOR" -and $_.Size -gt 20Gb -and -not $_.IsBoot }
#Clear the disk. This will delete any data on the disk. (and will fail if the disk is not yet initialized. If that happens, simply continue with ‘New-Partition…) Validate that this is the correct disk that you want to completely erase. #Clear the disk. This will delete any data on the disk. (and will fail if the disk is not yet initialized. If that happens, simply continue with 'New-Partition…) Validate that this is the correct disk that you want to completely erase.
# #
# To skip the confirmation prompt, append –confirm:$False # To skip the confirmation prompt, append –confirm:$False
Clear-Disk –InputObject $Disk[0] -RemoveData Clear-Disk –InputObject $Disk[0] -RemoveData
@ -576,17 +577,17 @@ The sample script creates an unattend file that streamlines the deployment proce
* To run this sample script you must open a Windows PowerShell session as an administrator from a domain-joined computer using an account that has permission to create domain accounts. * To run this sample script you must open a Windows PowerShell session as an administrator from a domain-joined computer using an account that has permission to create domain accounts.
* Using offline domain join is required by this script, since the script does not create a local administrator user account. However, domain membership will automatically put “Domain admins” into the local administrators group. Review your domain policies. If you are using DirectAccess you will need to modify the djoin.exe command to include the `policynames` and potentially the `certtemplate` parameters. * Using offline domain join is required by this script, since the script does not create a local administrator user account. However, domain membership will automatically put "Domain admins" into the local administrators group. Review your domain policies. If you are using DirectAccess you will need to modify the djoin.exe command to include the `policynames` and potentially the `certtemplate` parameters.
* The script needs to use drive letters, so you can only provision half as many drives as you have free drive letters. * The script needs to use drive letters, so you can only provision half as many drives as you have free drive letters.
#### To run the advanced deployment sample script #### To run the advanced deployment sample script
1. Copy entire the code sample titled “Windows To Go multiple drive provisioning sample script” into a PowerShell script (.ps1) file. 1. Copy entire the code sample titled "Windows To Go multiple drive provisioning sample script" into a PowerShell script (.ps1) file.
2. Make the modifications necessary for it to be appropriate to your deployment and save the file. 2. Make the modifications necessary for it to be appropriate to your deployment and save the file.
3. Configure the PowerShell execution policy. By default PowerShell’s execution policy is set to Restricted; that means that scripts won’t run until you have explicitly given them permission to. To configure PowerShell’s execution policy to allow the script to run, use the following command from an elevated PowerShell prompt: 3. Configure the PowerShell execution policy. By default PowerShell's execution policy is set to Restricted; that means that scripts won't run until you have explicitly given them permission to. To configure PowerShell's execution policy to allow the script to run, use the following command from an elevated PowerShell prompt:
``` ```
Set-ExecutionPolicy RemoteSigned Set-ExecutionPolicy RemoteSigned

1
windows/deployment/deploy.md
View File

@ -13,6 +13,7 @@ ms.sitesec: library
ms.localizationpriority: medium ms.localizationpriority: medium
audience: itpro audience: itpro
ms.topic: article ms.topic: article
ms.custom: seo-marvel-apr2020
--- ---
# Deploy Windows 10 # Deploy Windows 10

3
windows/deployment/mbr-to-gpt.md
View File

@ -15,6 +15,7 @@ manager: laurawi
ms.audience: itpro ms.audience: itpro
ms.localizationpriority: medium ms.localizationpriority: medium
ms.topic: article ms.topic: article
ms.custom: seo-marvel-apr2020
--- ---
# MBR2GPT.EXE # MBR2GPT.EXE
@ -22,8 +23,6 @@ ms.topic: article
**Applies to** **Applies to**
- Windows 10 - Windows 10
## Summary
**MBR2GPT.EXE** converts a disk from the Master Boot Record (MBR) to the GUID Partition Table (GPT) partition style without modifying or deleting data on the disk. The tool is designed to be run from a Windows Preinstallation Environment (Windows PE) command prompt, but can also be run from the full Windows 10 operating system (OS) by using the **/allowFullOS** option. **MBR2GPT.EXE** converts a disk from the Master Boot Record (MBR) to the GUID Partition Table (GPT) partition style without modifying or deleting data on the disk. The tool is designed to be run from a Windows Preinstallation Environment (Windows PE) command prompt, but can also be run from the full Windows 10 operating system (OS) by using the **/allowFullOS** option.
>MBR2GPT.EXE is located in the **Windows\\System32** directory on a computer running Windows 10 version 1703 (also known as the Creator's Update) or later. >MBR2GPT.EXE is located in the **Windows\\System32** directory on a computer running Windows 10 version 1703 (also known as the Creator's Update) or later.

3
windows/deployment/planning/compatibility-administrator-users-guide.md
View File

@ -4,7 +4,7 @@ ms.assetid: 0ce05f66-9009-4739-a789-60f3ce380e76
ms.reviewer: ms.reviewer:
manager: laurawi manager: laurawi
ms.author: greglin ms.author: greglin
description: description: The Compatibility Administrator tool helps you resolve potential application-compatibility issues before deploying a new version of Windows.
ms.prod: w10 ms.prod: w10
ms.mktglfcycl: plan ms.mktglfcycl: plan
ms.pagetype: appcompat ms.pagetype: appcompat
@ -12,6 +12,7 @@ ms.sitesec: library
audience: itpro audience: itpro
author: greg-lindsay author: greg-lindsay
ms.topic: article ms.topic: article
ms.custom: seo-marvel-mar2020
--- ---
# Compatibility Administrator User's Guide # Compatibility Administrator User's Guide

9
windows/deployment/planning/compatibility-fix-database-management-strategies-and-deployment.md
View File

@ -4,7 +4,7 @@ ms.assetid: fdfbf02f-c4c4-4739-a400-782204fd3c6c
ms.reviewer: ms.reviewer:
manager: laurawi manager: laurawi
ms.author: greglin ms.author: greglin
description: description: Learn about deploying your compatibility fixes as part of an application-installation package or through a centralized compatibility-fix database.
ms.prod: w10 ms.prod: w10
ms.mktglfcycl: plan ms.mktglfcycl: plan
ms.pagetype: appcompat ms.pagetype: appcompat
@ -13,6 +13,7 @@ audience: itpro
author: greg-lindsay author: greg-lindsay
ms.date: 04/19/2017 ms.date: 04/19/2017
ms.topic: article ms.topic: article
ms.custom: seo-marvel-mar2020
--- ---
# Compatibility Fix Database Management Strategies and Deployment # Compatibility Fix Database Management Strategies and Deployment
@ -88,7 +89,7 @@ This approach tends to work best for organizations that have a well-developed de
### Merging Centralized Compatibility-Fix Databases ### Merging Centralized Compatibility-Fix Databases
If you decide to use the centralized compatibility-fix database deployment strategy, you can merge any of your individual compatibility-fix databases. This enables you to create a single custom compatibility-fix database that can be used to search for and determine whether Windows® should apply a fix to a specific executable (.exe) file. We recommend merging your databases based on the following process. If you decide to use the centralized compatibility-fix database deployment strategy, you can merge any of your individual compatibility-fix databases. This enables you to create a single custom compatibility-fix database that can be used to search for and determine whether Windows&reg; should apply a fix to a specific executable (.exe) file. We recommend merging your databases based on the following process.
**To merge your custom-compatibility databases** **To merge your custom-compatibility databases**
@ -113,7 +114,7 @@ If you decide to use the centralized compatibility-fix database deployment strat
Deploying your custom compatibility-fix database into your organization requires you to perform the following actions: Deploying your custom compatibility-fix database into your organization requires you to perform the following actions:
1. Store your custom compatibility-fix database (.sdb file) in a location that is accessible to all of your organization’s computers. 1. Store your custom compatibility-fix database (.sdb file) in a location that is accessible to all of your organization's computers.
2. Use the Sdbinst.exe command-line tool to install the custom compatibility-fix database locally. 2. Use the Sdbinst.exe command-line tool to install the custom compatibility-fix database locally.
@ -124,7 +125,7 @@ In order to meet the two requirements above, we recommend that you use one of th
You can package your .sdb file and a custom deployment script into an .msi file, and then deploy the .msi file into your organization. You can package your .sdb file and a custom deployment script into an .msi file, and then deploy the .msi file into your organization.
> [!IMPORTANT] > [!IMPORTANT]
> You must ensure that you mark your custom script so that it does not impersonate the calling user. For example, if you use Microsoft® Visual Basic® Scripting Edition (VBScript), the custom action type would be: > You must ensure that you mark your custom script so that it does not impersonate the calling user. For example, if you use Microsoft&reg; Visual Basic&reg; Scripting Edition (VBScript), the custom action type would be:
>`msidbCustomActionTypeVBScript + msidbCustomActionTypeInScript + msidbCustomActionTypeNoImpersonate = 0x0006 + 0x0400 + 0x0800 = 0x0C06 = 3078 decimal)` >`msidbCustomActionTypeVBScript + msidbCustomActionTypeInScript + msidbCustomActionTypeNoImpersonate = 0x0006 + 0x0400 + 0x0800 = 0x0C06 = 3078 decimal)`

11
windows/deployment/planning/compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md
View File

@ -1,5 +1,5 @@
--- ---
title: Compatibility Fixes for Windows 10, Windows 8, Windows 7, and Windows Vista (Windows 10) title: Compatibility Fixes for Windows 10, Windows 8, Windows 7, & Windows Vista
description: Find compatibility fixes for all Windows operating systems that have been released from Windows Vista through Windows 10. description: Find compatibility fixes for all Windows operating systems that have been released from Windows Vista through Windows 10.
ms.assetid: cd51c824-557f-462a-83bb-54b0771b7dff ms.assetid: cd51c824-557f-462a-83bb-54b0771b7dff
ms.reviewer: ms.reviewer:
@ -13,6 +13,7 @@ audience: itpro
author: greg-lindsay author: greg-lindsay
ms.date: 04/19/2017 ms.date: 04/19/2017
ms.topic: article ms.topic: article
ms.custom: seo-marvel-apr2020
--- ---
# Compatibility Fixes for Windows 10, Windows 8, Windows 7, and Windows Vista # Compatibility Fixes for Windows 10, Windows 8, Windows 7, and Windows Vista
@ -75,7 +76,7 @@ The following table lists the known compatibility fixes for all Windows operatin
</tr> </tr>
<tr class="even"> <tr class="even">
<td align="left"><p>BIOSRead</p></td> <td align="left"><p>BIOSRead</p></td>
<td align="left"><p>This problem is indicated when an application cannot access the <strong>Device\PhysicalMemory</strong> object beyond the kernel-mode drivers, on any of the Windows Server® 2003 operating systems.</p> <td align="left"><p>This problem is indicated when an application cannot access the <strong>Device\PhysicalMemory</strong> object beyond the kernel-mode drivers, on any of the Windows Server&reg; 2003 operating systems.</p>
<p>The fix enables OEM executable (.exe) files to use the GetSystemFirmwareTable function instead of the NtOpenSection function when the BIOS is queried for the <strong>\Device\Physical</strong> memory information..</p></td> <p>The fix enables OEM executable (.exe) files to use the GetSystemFirmwareTable function instead of the NtOpenSection function when the BIOS is queried for the <strong>\Device\Physical</strong> memory information..</p></td>
</tr> </tr>
<tr class="odd"> <tr class="odd">
@ -92,7 +93,7 @@ The following table lists the known compatibility fixes for all Windows operatin
<tr class="even"> <tr class="even">
<td align="left"><p>ChangeFolderPathToXPStyle</p></td> <td align="left"><p>ChangeFolderPathToXPStyle</p></td>
<td align="left"><p>This fix is required when an application cannot return shell folder paths when it uses the <strong>SHGetFolder</strong> API.</p> <td align="left"><p>This fix is required when an application cannot return shell folder paths when it uses the <strong>SHGetFolder</strong> API.</p>
<p>The fix intercepts the <strong>SHGetFolder</strong> path request to the common <strong>appdata</strong> file path and returns the Windows® XP-style file path instead of the Windows Vista-style file path.</p></td> <p>The fix intercepts the <strong>SHGetFolder</strong> path request to the common <strong>appdata</strong> file path and returns the Windows&reg; XP-style file path instead of the Windows Vista-style file path.</p></td>
</tr> </tr>
<tr class="odd"> <tr class="odd">
<td align="left"><p>ClearLastErrorStatusonIntializeCriticalSection</p></td> <td align="left"><p>ClearLastErrorStatusonIntializeCriticalSection</p></td>
@ -188,7 +189,7 @@ The following table lists the known compatibility fixes for all Windows operatin
</tr> </tr>
<tr class="even"> <tr class="even">
<td align="left"><p>DirectXVersionLie</p></td> <td align="left"><p>DirectXVersionLie</p></td>
<td align="left"><p>This problem occurs when an application fails because it does not find the correct version number for DirectX®.</p> <td align="left"><p>This problem occurs when an application fails because it does not find the correct version number for DirectX&reg;.</p>
<p>The fix modifies the DXDIAGN GetProp function call to return the correct DirectX version.</p> <p>The fix modifies the DXDIAGN GetProp function call to return the correct DirectX version.</p>
<p>You can control this fix further by typing the following command at the command prompt:</p> <p>You can control this fix further by typing the following command at the command prompt:</p>
<p>MAJORVERSION.MINORVERSION.LETTER</p> <p>MAJORVERSION.MINORVERSION.LETTER</p>
@ -456,7 +457,7 @@ The following table lists the known compatibility fixes for all Windows operatin
<tr class="odd"> <tr class="odd">
<td align="left"><p>IgnoreMSOXMLMF</p></td> <td align="left"><p>IgnoreMSOXMLMF</p></td>
<td align="left"><p>The problem is indicated by an error message that states that the operating system cannot locate the MSVCR80D.DLL file.</p> <td align="left"><p>The problem is indicated by an error message that states that the operating system cannot locate the MSVCR80D.DLL file.</p>
<p>The fix ignores the registered MSOXMLMF.DLL object, which Microsoft® Office 2007 loads into the operating system any time that you load an XML file, and then it fails the CoGetClassObject for its CLSID. This compatibility fix will just ignore the registered MSOXMLMF and fail the CoGetClassObject for its CLSID.</p></td> <p>The fix ignores the registered MSOXMLMF.DLL object, which Microsoft&reg; Office 2007 loads into the operating system any time that you load an XML file, and then it fails the CoGetClassObject for its CLSID. This compatibility fix will just ignore the registered MSOXMLMF and fail the CoGetClassObject for its CLSID.</p></td>
</tr> </tr>
<tr class="even"> <tr class="even">
<td align="left"><p>IgnoreSetROP2</p></td> <td align="left"><p>IgnoreSetROP2</p></td>

3
windows/deployment/planning/deployment-considerations-for-windows-to-go.md
View File

@ -13,6 +13,7 @@ ms.sitesec: library
audience: itpro audience: itpro
author: greg-lindsay author: greg-lindsay
ms.topic: article ms.topic: article
ms.custom: seo-marvel-apr2020
--- ---
# Deployment considerations for Windows To Go # Deployment considerations for Windows To Go
@ -51,7 +52,7 @@ When a Windows To Go workspace is first used at the workplace, the Windows To Go
![initial boot off-premises](images/wtg-first-boot-home.gif) ![initial boot off-premises](images/wtg-first-boot-home.gif)
When the Windows To Go workspace is going to be used first on an off-premises computer, such as one at the employee’s home, then the IT professional preparing the Windows To Go drives should configure the drive to be able to connect to organizational resources and to maintain the security of the workspace. In this situation, the Windows To Go workspace needs to be configured for offline domain join and BitLocker needs to be enabled before the workspace has been initialized. When the Windows To Go workspace is going to be used first on an off-premises computer, such as one at the employee's home, then the IT professional preparing the Windows To Go drives should configure the drive to be able to connect to organizational resources and to maintain the security of the workspace. In this situation, the Windows To Go workspace needs to be configured for offline domain join and BitLocker needs to be enabled before the workspace has been initialized.
> [!TIP] > [!TIP]
> Applying BitLocker Drive Encryption to the drives before provisioning is a much faster process than encrypting the drives after data has already been stored on them due to a new feature called used-disk space only encryption. For more information, see [What's New in BitLocker](https://go.microsoft.com/fwlink/p/?LinkId=619076). > Applying BitLocker Drive Encryption to the drives before provisioning is a much faster process than encrypting the drives after data has already been stored on them due to a new feature called used-disk space only encryption. For more information, see [What's New in BitLocker](https://go.microsoft.com/fwlink/p/?LinkId=619076).

3
windows/deployment/planning/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator.md
View File

@ -1,5 +1,5 @@
--- ---
title: Enabling and Disabling Compatibility Fixes in Compatibility Administrator (Windows 10) title: Enabling and Disabling Compatibility Fixes in Compatibility Administrator
description: You can disable and enable individual compatibility fixes in your customized databases for testing and troubleshooting purposes. description: You can disable and enable individual compatibility fixes in your customized databases for testing and troubleshooting purposes.
ms.assetid: 6bd4a7c5-0ed9-4a35-948c-c438aa4d6cb6 ms.assetid: 6bd4a7c5-0ed9-4a35-948c-c438aa4d6cb6
ms.reviewer: ms.reviewer:
@ -12,6 +12,7 @@ ms.sitesec: library
audience: itpro audience: itpro
author: greg-lindsay author: greg-lindsay
ms.topic: article ms.topic: article
ms.custom: seo-marvel-apr2020
--- ---
# Enabling and Disabling Compatibility Fixes in Compatibility Administrator # Enabling and Disabling Compatibility Fixes in Compatibility Administrator

3
windows/deployment/planning/features-lifecycle.md
View File

@ -10,6 +10,7 @@ author: greg-lindsay
manager: laurawi manager: laurawi
ms.author: greglin ms.author: greglin
ms.topic: article ms.topic: article
ms.custom: seo-marvel-apr2020
--- ---
# Windows 10 features lifecycle # Windows 10 features lifecycle
@ -21,7 +22,7 @@ Each release of Windows 10 contains many new and improved features. Occasionally
The following topic lists features that are no longer being developed. These features might be removed in a future release. The following topic lists features that are no longer being developed. These features might be removed in a future release.
[Windows 10 features we’re no longer developing](windows-10-deprecated-features.md) [Windows 10 features we're no longer developing](windows-10-deprecated-features.md)
## Features removed ## Features removed

13
windows/deployment/planning/prepare-your-organization-for-windows-to-go.md
View File

@ -13,6 +13,7 @@ ms.sitesec: library
audience: itpro audience: itpro
author: greg-lindsay author: greg-lindsay
ms.topic: article ms.topic: article
ms.custom: seo-marvel-apr2020
--- ---
# Prepare your organization for Windows To Go # Prepare your organization for Windows To Go
@ -25,7 +26,7 @@ ms.topic: article
> [!IMPORTANT] > [!IMPORTANT]
> Windows To Go is removed in Windows 10, version 2004 and later operating systems. The feature does not support feature updates and therefore does not enable you to stay current. It also requires a specific type of USB that is no longer supported by many OEMs. > Windows To Go is removed in Windows 10, version 2004 and later operating systems. The feature does not support feature updates and therefore does not enable you to stay current. It also requires a specific type of USB that is no longer supported by many OEMs.
The following information is provided to help you plan and design a new deployment of a Windows To Go in your production environment. It provides answers to the “what”, “why”, and “when” questions an IT professional might have when planning to deploy Windows To Go. The following information is provided to help you plan and design a new deployment of a Windows To Go in your production environment. It provides answers to the "what", "why", and "when" questions an IT professional might have when planning to deploy Windows To Go.
## What is Windows To Go? ## What is Windows To Go?
@ -51,16 +52,16 @@ The following scenarios are examples of situations in which Windows To Go worksp
- **Continuance of operations (COO).** In this scenario, selected employees receive a USB drive with a Windows To Go workspace, which includes all of the applications that the employees use at work. The employees can keep the device at home, in a briefcase, or wherever they want to store it until needed. When the users boot their home computer from the USB drive, it will create a corporate desktop experience so that they can quickly start working. On the very first boot, the employee sees that Windows is installing devices; after that one time, the Windows To Go drive boots like a normal computer. If they have enterprise network access, employees can use a virtual private network (VPN) connection or DirectAccess to access corporate resources. If the enterprise network is available, the Windows To Go workspace will automatically be updated using your standard client management processes. - **Continuance of operations (COO).** In this scenario, selected employees receive a USB drive with a Windows To Go workspace, which includes all of the applications that the employees use at work. The employees can keep the device at home, in a briefcase, or wherever they want to store it until needed. When the users boot their home computer from the USB drive, it will create a corporate desktop experience so that they can quickly start working. On the very first boot, the employee sees that Windows is installing devices; after that one time, the Windows To Go drive boots like a normal computer. If they have enterprise network access, employees can use a virtual private network (VPN) connection or DirectAccess to access corporate resources. If the enterprise network is available, the Windows To Go workspace will automatically be updated using your standard client management processes.
- **Contractors and temporary workers.** In this situation, an enterprise IT pro or manager would distribute the Windows To Go drive directly to the worker where they can be assisted with any necessary additional user education needs or address any possible compatibility issues. While the worker is on assignment, they can boot their computer exclusively from the Windows To Go drive and run all applications in that environment until the end of the assignment when the device is returned. No installation of software is required on the worker’s personal computer. - **Contractors and temporary workers.** In this situation, an enterprise IT pro or manager would distribute the Windows To Go drive directly to the worker where they can be assisted with any necessary additional user education needs or address any possible compatibility issues. While the worker is on assignment, they can boot their computer exclusively from the Windows To Go drive and run all applications in that environment until the end of the assignment when the device is returned. No installation of software is required on the worker's personal computer.
- **Managed free seating.** The employee is issued a Windows To Go drive that is then used with the host computer assigned to that employee for a given session (this could be a vehicle, workspace, or standalone laptop). When the employee leaves the session, the next time they return they use the same USB flash drive but use a different host computer. - **Managed free seating.** The employee is issued a Windows To Go drive that is then used with the host computer assigned to that employee for a given session (this could be a vehicle, workspace, or standalone laptop). When the employee leaves the session, the next time they return they use the same USB flash drive but use a different host computer.
- **Work from home.** In this situation, the Windows To Go drive can be provisioned for employees using various methods including Microsoft Endpoint Configuration Manager or other deployment tools and then distributed to employees. The employee is instructed to boot the Windows To Go drive initially at work, which caches the employee’s credentials on the Windows To Go workspace and allows the initial data synchronization between the enterprise network and the Windows To Go workspace. The user can then bring the Windows To Go drive home where it can be used with their home computer, with or without enterprise network connectivity. - **Work from home.** In this situation, the Windows To Go drive can be provisioned for employees using various methods including Microsoft Endpoint Configuration Manager or other deployment tools and then distributed to employees. The employee is instructed to boot the Windows To Go drive initially at work, which caches the employee's credentials on the Windows To Go workspace and allows the initial data synchronization between the enterprise network and the Windows To Go workspace. The user can then bring the Windows To Go drive home where it can be used with their home computer, with or without enterprise network connectivity.
- **Travel lightly.** In this situation you have employees who are moving from site to site, but who always will have access to a compatible host computer on site. Using Windows To Go workspaces allows them to travel without the need to pack their PC. - **Travel lightly.** In this situation you have employees who are moving from site to site, but who always will have access to a compatible host computer on site. Using Windows To Go workspaces allows them to travel without the need to pack their PC.
> [!NOTE] > [!NOTE]
> If the employee wants to work offline for the majority of the time, but still maintain the ability to use the drive on the enterprise network, they should be informed of how often the Windows To Go workspace needs to be connected to the enterprise network. Doing so will ensure that the drive retains its access privileges and the workspace’s computer object is not potentially deleted from Active Directory Domain Services (AD DS). > If the employee wants to work offline for the majority of the time, but still maintain the ability to use the drive on the enterprise network, they should be informed of how often the Windows To Go workspace needs to be connected to the enterprise network. Doing so will ensure that the drive retains its access privileges and the workspace's computer object is not potentially deleted from Active Directory Domain Services (AD DS).
@ -76,7 +77,7 @@ Windows To Go uses volume activation. You can use either Active Directory-based
Microsoft software, such as Microsoft Office, distributed to a Windows To Go workspace must also be activated. Office deployment is fully supported on Windows To Go. Please note, due to the retail subscription activation method associated with Microsoft 365 Apps for enterprise, Microsoft 365 Apps for enterprise subscribers are provided volume licensing activation rights for Office Professional Plus 2013 MSI for local installation on the Windows To Go drive. This is available to organizations who purchase Microsoft 365 Apps for enterprise or Office 365 Enterprise SKUs containing Microsoft 365 Apps for enterprise via volume licensing channels. For more information about activating Microsoft Office, see [Volume activation methods in Office 2013](https://go.microsoft.com/fwlink/p/?LinkId=618922). Microsoft software, such as Microsoft Office, distributed to a Windows To Go workspace must also be activated. Office deployment is fully supported on Windows To Go. Please note, due to the retail subscription activation method associated with Microsoft 365 Apps for enterprise, Microsoft 365 Apps for enterprise subscribers are provided volume licensing activation rights for Office Professional Plus 2013 MSI for local installation on the Windows To Go drive. This is available to organizations who purchase Microsoft 365 Apps for enterprise or Office 365 Enterprise SKUs containing Microsoft 365 Apps for enterprise via volume licensing channels. For more information about activating Microsoft Office, see [Volume activation methods in Office 2013](https://go.microsoft.com/fwlink/p/?LinkId=618922).
You should investigate other software manufacturer’s licensing requirements to ensure they are compatible with roaming usage before deploying them to a Windows To Go workspace. You should investigate other software manufacturer's licensing requirements to ensure they are compatible with roaming usage before deploying them to a Windows To Go workspace.
> [!NOTE] > [!NOTE]
> Using Multiple Activation Key (MAK) activation is not a supported activation method for Windows To Go as each different PC-host would require separate activation. MAK activation should not be used for activating Windows, Office, or any other application on a Windows To Go drive. > Using Multiple Activation Key (MAK) activation is not a supported activation method for Windows To Go as each different PC-host would require separate activation. MAK activation should not be used for activating Windows, Office, or any other application on a Windows To Go drive.
@ -102,7 +103,7 @@ If you configure Windows To Go drives for scenarios where drives may remain unus
## User account and data management ## User account and data management
People use computers to work with data and consume content - that is their core function. The data must be stored and retrievable for it to be useful. When users are working in a Windows To Go workspace, they need to have the ability to get to the data that they work with and to keep it accessible when the workspace is not being used. For this reason we recommend that you use folder redirection and offline files to redirect the path of local folders (such as the Documents folder) to a network location, while caching the contents locally for increased speed and availability. We also recommend that you use roaming user profiles to synchronize user specific settings so that users receive the same operating system and application settings when using their Windows To Go workspace and their desktop computer. When a user signs in using a domain account that is set up with a file share as the profile path, the user’s profile is downloaded to the local computer and merged with the local profile (if present). When the user logs off the computer, the local copy of their profile, including any changes, is merged with the server copy of the profile. For more information, see [Folder Redirection, Offline Files, and Roaming User Profiles overview](https://go.microsoft.com/fwlink/p/?LinkId=618924). People use computers to work with data and consume content - that is their core function. The data must be stored and retrievable for it to be useful. When users are working in a Windows To Go workspace, they need to have the ability to get to the data that they work with and to keep it accessible when the workspace is not being used. For this reason we recommend that you use folder redirection and offline files to redirect the path of local folders (such as the Documents folder) to a network location, while caching the contents locally for increased speed and availability. We also recommend that you use roaming user profiles to synchronize user specific settings so that users receive the same operating system and application settings when using their Windows To Go workspace and their desktop computer. When a user signs in using a domain account that is set up with a file share as the profile path, the user's profile is downloaded to the local computer and merged with the local profile (if present). When the user logs off the computer, the local copy of their profile, including any changes, is merged with the server copy of the profile. For more information, see [Folder Redirection, Offline Files, and Roaming User Profiles overview](https://go.microsoft.com/fwlink/p/?LinkId=618924).
Windows To Go is fully integrated with your Microsoft account. Setting synchronization is accomplished by connecting a Microsoft account to a user account. Windows To Go devices fully support this feature and can be managed by Group Policy so that the customization and configurations you prefer will be applied to your Windows To Go workspace. Windows To Go is fully integrated with your Microsoft account. Setting synchronization is accomplished by connecting a Microsoft account to a user account. Windows To Go devices fully support this feature and can be managed by Group Policy so that the customization and configurations you prefer will be applied to your Windows To Go workspace.

4
windows/deployment/planning/sua-users-guide.md
View File

@ -1,6 +1,7 @@
--- ---
title: SUA User's Guide (Windows 10) title: SUA User's Guide (Windows 10)
description: Standard User Analyzer (SUA) can test your apps and monitor API calls to detect compatibility issues related to Windows' User Account Control (UAC) feature. description: Learn how to use Standard User Analyzer (SUA). SUA can test your apps and monitor API calls to detect compatibility issues related to the Windows User Account Control (UAC) feature.
ms.custom: seo-marvel-apr2020
ms.assetid: ea525c25-b557-4ed4-b042-3e4d0e543e10 ms.assetid: ea525c25-b557-4ed4-b042-3e4d0e543e10
ms.reviewer: ms.reviewer:
manager: laurawi manager: laurawi
@ -67,4 +68,3 @@ You can use SUA in either of the following ways:

1
windows/deployment/planning/windows-10-removed-features.md
View File

@ -10,6 +10,7 @@ author: greg-lindsay
ms.author: greglin ms.author: greglin
manager: laurawi manager: laurawi
ms.topic: article ms.topic: article
ms.custom: seo-marvel-apr2020
--- ---
# Features and functionality removed in Windows 10 # Features and functionality removed in Windows 10

56
windows/deployment/planning/windows-to-go-frequently-asked-questions.md
View File

@ -49,13 +49,13 @@ The following list identifies some commonly asked questions about Windows To Go.
- [How do I make my computer boot from USB?](#wtf-faq-startup) - [How do I make my computer boot from USB?](#wtf-faq-startup)
- [Why isn’t my computer booting from USB?](#wtg-faq-noboot) - [Why isn't my computer booting from USB?](#wtg-faq-noboot)
- [What happens if I remove my Windows To Go drive while it is running?](#wtg-faq-surprise) - [What happens if I remove my Windows To Go drive while it is running?](#wtg-faq-surprise)
- [Can I use BitLocker to protect my Windows To Go drive?](#wtg-faq-bitlocker) - [Can I use BitLocker to protect my Windows To Go drive?](#wtg-faq-bitlocker)
- [Why can’t I enable BitLocker from Windows To Go Creator?](#wtg-faq-blfail) - [Why can't I enable BitLocker from Windows To Go Creator?](#wtg-faq-blfail)
- [What power states does Windows To Go support?](#wtg-faq-power) - [What power states does Windows To Go support?](#wtg-faq-power)
@ -63,11 +63,11 @@ The following list identifies some commonly asked questions about Windows To Go.
- [Does Windows To Go support crash dump analysis?](#wtg-faq-crashdump) - [Does Windows To Go support crash dump analysis?](#wtg-faq-crashdump)
- [Do “Windows To Go Startup Options” work with dual boot computers?](#wtg-faq-dualboot) - [Do "Windows To Go Startup Options" work with dual boot computers?](#wtg-faq-dualboot)
- [I plugged my Windows To Go drive into a running computer and I can’t see the partitions on the drive. Why not?](#wtg-faq-diskpart) - [I plugged my Windows To Go drive into a running computer and I can't see the partitions on the drive. Why not?](#wtg-faq-diskpart)
- [I’m booted into Windows To Go, but I can’t browse to the internal hard drive of the host computer. Why not?](#wtg-faq-san4) - [I'm booted into Windows To Go, but I can't browse to the internal hard drive of the host computer. Why not?](#wtg-faq-san4)
- [Why does my Windows To Go drive have an MBR disk format with a FAT32 system partition?](#wtg-faq-fatmbr) - [Why does my Windows To Go drive have an MBR disk format with a FAT32 system partition?](#wtg-faq-fatmbr)
@ -95,17 +95,17 @@ The following list identifies some commonly asked questions about Windows To Go.
- [How is Windows To Go licensed?](#wtg-faq-lic) - [How is Windows To Go licensed?](#wtg-faq-lic)
- [Does Windows Recovery Environment work with Windows To Go? What’s the guidance for recovering a Windows To Go drive?](#wtg-faq-recovery) - [Does Windows Recovery Environment work with Windows To Go? What's the guidance for recovering a Windows To Go drive?](#wtg-faq-recovery)
- [Why won’t Windows To Go work on a computer running Windows XP or Windows Vista?](#wtg-faq-oldos) - [Why won't Windows To Go work on a computer running Windows XP or Windows Vista?](#wtg-faq-oldos)
- [Why does the operating system on the host computer matter?](#wtg-faq-oldos2) - [Why does the operating system on the host computer matter?](#wtg-faq-oldos2)
- [My host computer running Windows 7 is protected by BitLocker Drive Encryption. Why did I need to use the recovery key to unlock and reboot my host computer after using Windows To Go?](#wtg-faq-blreckey) - [My host computer running Windows 7 is protected by BitLocker Drive Encryption. Why did I need to use the recovery key to unlock and reboot my host computer after using Windows To Go?](#wtg-faq-blreckey)
- [I decided to stop using a drive for Windows To Go and reformatted it – why doesn’t it have a drive letter assigned and how can I fix it?](#wtg-faq-reformat) - [I decided to stop using a drive for Windows To Go and reformatted it – why doesn't it have a drive letter assigned and how can I fix it?](#wtg-faq-reformat)
- [Why do I keep on getting the message “Installing devices…” when I boot Windows To Go?](#bkmk-roamconflict) - [Why do I keep on getting the message "Installing devices…" when I boot Windows To Go?](#bkmk-roamconflict)
- [How do I upgrade the operating system on my Windows To Go drive?](#bkmk-upgradewtg) - [How do I upgrade the operating system on my Windows To Go drive?](#bkmk-upgradewtg)
@ -188,7 +188,7 @@ In the **Windows To Go Startup Options** dialog box select **Yes** and then clic
If the host computer is running an earlier version of the Windows operating system need to configure the computer to boot from USB manually. If the host computer is running an earlier version of the Windows operating system need to configure the computer to boot from USB manually.
To do this, early during boot time (usually when you see the manufacturer’s logo), enter your firmware/BIOS setup. (This method to enter firmware/BIOS setup differs with different computer manufacturers, but is usually entered by pressing one of the function keys, such as F12, F2, F1, Esc, and so forth. You should check the manufacturer’s site to be sure if you do not know which key to use to enter firmware setup.) To do this, early during boot time (usually when you see the manufacturer's logo), enter your firmware/BIOS setup. (This method to enter firmware/BIOS setup differs with different computer manufacturers, but is usually entered by pressing one of the function keys, such as F12, F2, F1, Esc, and so forth. You should check the manufacturer's site to be sure if you do not know which key to use to enter firmware setup.)
After you have entered firmware setup, make sure that boot from USB is enabled. Then change the boot order to boot from USB drives first. After you have entered firmware setup, make sure that boot from USB is enabled. Then change the boot order to boot from USB drives first.
@ -201,14 +201,14 @@ Configuring a computer to boot from USB will cause your computer to attempt to b
## <a href="" id="wtg-faq-noboot"></a>Why isn’t my computer booting from USB? ## <a href="" id="wtg-faq-noboot"></a>Why isn't my computer booting from USB?
Computers certified for Windows 7 and later are required to have support for USB boot. Check to see if any of the following items apply to your situation: Computers certified for Windows 7 and later are required to have support for USB boot. Check to see if any of the following items apply to your situation:
1. Ensure that your computer has the latest BIOS installed and the BIOS is configured to boot from a USB device. 1. Ensure that your computer has the latest BIOS installed and the BIOS is configured to boot from a USB device.
2. Ensure that the Windows To Go drive is connected directly to a USB port on the computer. Many computers don’t support booting from a device connected to a USB 3 PCI add-on card or external USB hubs. 2. Ensure that the Windows To Go drive is connected directly to a USB port on the computer. Many computers don't support booting from a device connected to a USB 3 PCI add-on card or external USB hubs.
3. If the computer is not booting from a USB 3.0 port, try to boot from a USB 2.0 port. 3. If the computer is not booting from a USB 3.0 port, try to boot from a USB 2.0 port.
@ -229,7 +229,7 @@ You should never remove your Windows To Go drive when your workspace is running.
Yes. In Windows 8 and later, BitLocker has added support for using a password to protect operating system drives. This means that you can use a password to secure your Windows To Go workspace and you will be prompted to enter this password every time you use the Windows To Go workspace. Yes. In Windows 8 and later, BitLocker has added support for using a password to protect operating system drives. This means that you can use a password to secure your Windows To Go workspace and you will be prompted to enter this password every time you use the Windows To Go workspace.
## <a href="" id="wtg-faq-blfail"></a>Why can’t I enable BitLocker from Windows To Go Creator? ## <a href="" id="wtg-faq-blfail"></a>Why can't I enable BitLocker from Windows To Go Creator?
Several different Group Policies control the use of BitLocker on your organizations computers. These policies are located in the **Computer Configuration\\Policies\\Administrative Templates\\Windows Components\\BitLocker Drive Encryption** folder of the local Group Policy editor. The folder contains three sub-folders for fixed, operating system and removable data drive types. Several different Group Policies control the use of BitLocker on your organizations computers. These policies are located in the **Computer Configuration\\Policies\\Administrative Templates\\Windows Components\\BitLocker Drive Encryption** folder of the local Group Policy editor. The folder contains three sub-folders for fixed, operating system and removable data drive types.
@ -265,27 +265,27 @@ When a Windows To Go workspace is hibernated, it will only successfully resume o
Yes. Windows 8 and later support crash dump stack analysis for both USB 2.0 and 3.0. Yes. Windows 8 and later support crash dump stack analysis for both USB 2.0 and 3.0.
## <a href="" id="wtg-faq-dualboot"></a>Do “Windows To Go Startup Options” work with dual boot computers? ## <a href="" id="wtg-faq-dualboot"></a>Do "Windows To Go Startup Options" work with dual boot computers?
Yes, if both operating systems are running the Windows 8 operating system. Enabling “Windows To Go Startup Options” should cause the computer to boot from the Windows To Go workspace when the drive is plugged in before the computer is turned on. Yes, if both operating systems are running the Windows 8 operating system. Enabling "Windows To Go Startup Options" should cause the computer to boot from the Windows To Go workspace when the drive is plugged in before the computer is turned on.
If you have configured a dual boot computer with a Windows operating system and another operating system it might work occasionally and fail occasionally. Using this configuration is unsupported. If you have configured a dual boot computer with a Windows operating system and another operating system it might work occasionally and fail occasionally. Using this configuration is unsupported.
## <a href="" id="wtg-faq-diskpart"></a>I plugged my Windows To Go drive into a running computer and I can’t see the partitions on the drive. Why not? ## <a href="" id="wtg-faq-diskpart"></a>I plugged my Windows To Go drive into a running computer and I can't see the partitions on the drive. Why not?
Windows To Go Creator and the recommended deployment steps for Windows To Go set the NO\_DEFAULT\_DRIVE\_LETTER flag on the Windows To Go drive. This flag prevents Windows from automatically assigning drive letters to the partitions on the Windows To Go drive. That’s why you can’t see the partitions on the drive when you plug your Windows To Go drive into a running computer. This helps prevent accidental data leakage between the Windows To Go drive and the host computer. If you really need to access the files on the Windows To Go drive from a running computer, you can use diskmgmt.msc or diskpart to assign a drive letter. Windows To Go Creator and the recommended deployment steps for Windows To Go set the NO\_DEFAULT\_DRIVE\_LETTER flag on the Windows To Go drive. This flag prevents Windows from automatically assigning drive letters to the partitions on the Windows To Go drive. That's why you can't see the partitions on the drive when you plug your Windows To Go drive into a running computer. This helps prevent accidental data leakage between the Windows To Go drive and the host computer. If you really need to access the files on the Windows To Go drive from a running computer, you can use diskmgmt.msc or diskpart to assign a drive letter.
**Warning**   **Warning**  
It is strongly recommended that you do not plug your Windows To Go drive into a running computer. If the computer is compromised, your Windows To Go workspace can also be compromised. It is strongly recommended that you do not plug your Windows To Go drive into a running computer. If the computer is compromised, your Windows To Go workspace can also be compromised.
## <a href="" id="wtg-faq-san4"></a>I’m booted into Windows To Go, but I can’t browse to the internal hard drive of the host computer. Why not? ## <a href="" id="wtg-faq-san4"></a>I'm booted into Windows To Go, but I can't browse to the internal hard drive of the host computer. Why not?
Windows To Go Creator and the recommended deployment steps for Windows To Go set SAN Policy 4 on Windows To Go drive. This policy prevents Windows from automatically mounting internal disk drives. That’s why you can’t see the internal hard drives of the host computer when you are booted into Windows To Go. This is done to prevent accidental data leakage between Windows To Go and the host system. This policy also prevents potential corruption on the host drives or data loss if the host operating system is in a hibernation state. If you really need to access the files on the internal hard drive, you can use diskmgmt.msc to mount the internal drive. Windows To Go Creator and the recommended deployment steps for Windows To Go set SAN Policy 4 on Windows To Go drive. This policy prevents Windows from automatically mounting internal disk drives. That's why you can't see the internal hard drives of the host computer when you are booted into Windows To Go. This is done to prevent accidental data leakage between Windows To Go and the host system. This policy also prevents potential corruption on the host drives or data loss if the host operating system is in a hibernation state. If you really need to access the files on the internal hard drive, you can use diskmgmt.msc to mount the internal drive.
**Warning**   **Warning**  
It is strongly recommended that you do not mount internal hard drives when booted into the Windows To Go workspace. If the internal drive contains a hibernated Windows 8 or later operating system, mounting the drive will lead to loss of hibernation state and therefor user state or any unsaved user data when the host operating system is booted. If the internal drive contains a hibernated Windows 7 or earlier operating system, mounting the drive will lead to corruption when the host operating system is booted. It is strongly recommended that you do not mount internal hard drives when booted into the Windows To Go workspace. If the internal drive contains a hibernated Windows 8 or later operating system, mounting the drive will lead to loss of hibernation state and therefor user state or any unsaved user data when the host operating system is booted. If the internal drive contains a hibernated Windows 7 or earlier operating system, mounting the drive will lead to corruption when the host operating system is booted.
@ -340,7 +340,7 @@ If you are using a USB 3.0 port and a Windows To Go certified device, there shou
## <a href="" id="wtg-faq-safeloss"></a>If I lose my Windows To Go drive, will my data be safe? ## <a href="" id="wtg-faq-safeloss"></a>If I lose my Windows To Go drive, will my data be safe?
Yes! If you enable BitLocker on your Windows To Go drive, all your data will be encrypted and protected and a malicious user will not be able to access your data without your password. If you don’t enable BitLocker, your data will be vulnerable if you lose your Windows To Go drive. Yes! If you enable BitLocker on your Windows To Go drive, all your data will be encrypted and protected and a malicious user will not be able to access your data without your password. If you don't enable BitLocker, your data will be vulnerable if you lose your Windows To Go drive.
## <a href="" id="wtg-faq-mac"></a>Can I boot Windows To Go on a Mac? ## <a href="" id="wtg-faq-mac"></a>Can I boot Windows To Go on a Mac?
@ -361,12 +361,12 @@ For more information, see the MSDN article on the [Win32\_OperatingSystem class]
Windows To Go allows organization to support the use of privately owned PCs at the home or office with more secure access to their organizational resources. With Windows To Go use rights under [Software Assurance](https://go.microsoft.com/fwlink/p/?LinkId=619062), an employee will be able to use Windows To Go on any company PC licensed with Software Assurance as well as from their home PC. Windows To Go allows organization to support the use of privately owned PCs at the home or office with more secure access to their organizational resources. With Windows To Go use rights under [Software Assurance](https://go.microsoft.com/fwlink/p/?LinkId=619062), an employee will be able to use Windows To Go on any company PC licensed with Software Assurance as well as from their home PC.
## <a href="" id="wtg-faq-recovery"></a>Does Windows Recovery Environment work with Windows To Go? What’s the guidance for recovering a Windows To Go drive? ## <a href="" id="wtg-faq-recovery"></a>Does Windows Recovery Environment work with Windows To Go? What's the guidance for recovering a Windows To Go drive?
No, use of Windows Recovery Environment is not supported on Windows To Go. It is recommended that you implement user state virtualization technologies like Folder Redirection to centralize and back up user data in the data center. If any corruption occurs on a Windows To Go drive, you should re-provision the workspace. No, use of Windows Recovery Environment is not supported on Windows To Go. It is recommended that you implement user state virtualization technologies like Folder Redirection to centralize and back up user data in the data center. If any corruption occurs on a Windows To Go drive, you should re-provision the workspace.
## <a href="" id="wtg-faq-oldos"></a>Why won’t Windows To Go work on a computer running Windows XP or Windows Vista? ## <a href="" id="wtg-faq-oldos"></a>Why won't Windows To Go work on a computer running Windows XP or Windows Vista?
Actually it might. If you have purchased a computer certified for Windows 7 or later and then installed an older operating system, Windows To Go will boot and run as expected as long as you have configured the firmware to boot from USB. However, if the computer was certified for Windows XP or Windows Vista, it might not meet the hardware requirements for Windows To Go to run. Typically computers certified for Windows Vista and earlier operating systems have less memory, less processing power, reduced video rendering, and slower USB ports. Actually it might. If you have purchased a computer certified for Windows 7 or later and then installed an older operating system, Windows To Go will boot and run as expected as long as you have configured the firmware to boot from USB. However, if the computer was certified for Windows XP or Windows Vista, it might not meet the hardware requirements for Windows To Go to run. Typically computers certified for Windows Vista and earlier operating systems have less memory, less processing power, reduced video rendering, and slower USB ports.
@ -374,7 +374,7 @@ Actually it might. If you have purchased a computer certified for Windows 7 or
## <a href="" id="wtg-faq-oldos2"></a>Why does the operating system on the host computer matter? ## <a href="" id="wtg-faq-oldos2"></a>Why does the operating system on the host computer matter?
It doesn’t other than to help visually identify if the PC has compatible hardware. For a PC to be certified for Windows 7 or later it had to support booting from USB. If a computer cannot boot from USB there is no way that it can be used with Windows To Go. The Windows To Go workspace is a full Windows 10 environment, so all of the hardware requirements of Windows 10 with respect to processing speed, memory usage, and graphics rendering need to be supported to be assured that it will work as expected. It doesn't other than to help visually identify if the PC has compatible hardware. For a PC to be certified for Windows 7 or later it had to support booting from USB. If a computer cannot boot from USB there is no way that it can be used with Windows To Go. The Windows To Go workspace is a full Windows 10 environment, so all of the hardware requirements of Windows 10 with respect to processing speed, memory usage, and graphics rendering need to be supported to be assured that it will work as expected.
## <a href="" id="wtg-faq-blreckey"></a>My host computer running Windows 7 is protected by BitLocker Drive Encryption. Why did I need to use the recovery key to unlock and reboot my host computer after using Windows To Go? ## <a href="" id="wtg-faq-blreckey"></a>My host computer running Windows 7 is protected by BitLocker Drive Encryption. Why did I need to use the recovery key to unlock and reboot my host computer after using Windows To Go?
@ -406,10 +406,10 @@ The host computer will now be able to be booted from a USB drive without trigger
## <a href="" id="wtg-faq-reformat"></a>I decided to stop using a drive for Windows To Go and reformatted it – why doesn’t it have a drive letter assigned and how can I fix it? ## <a href="" id="wtg-faq-reformat"></a>I decided to stop using a drive for Windows To Go and reformatted it – why doesn't it have a drive letter assigned and how can I fix it?
Reformatting the drive erases the data on the drive, but doesn’t reconfigure the volume attributes. When a drive is provisioned for use as a Windows To Go drive the NODEFAULTDRIVELETTER attribute is set on the volume. To remove this attribute, use the following steps: Reformatting the drive erases the data on the drive, but doesn't reconfigure the volume attributes. When a drive is provisioned for use as a Windows To Go drive the NODEFAULTDRIVELETTER attribute is set on the volume. To remove this attribute, use the following steps:
1. Open a command prompt with full administrator permissions. 1. Open a command prompt with full administrator permissions.
@ -424,14 +424,14 @@ Reformatting the drive erases the data on the drive, but doesn’t reconfigure t
4. After selecting the disk, run the `clean` command to remove all data, formatting, and initialization information from the drive. 4. After selecting the disk, run the `clean` command to remove all data, formatting, and initialization information from the drive.
## <a href="" id="bkmk-roamconflict"></a>Why do I keep on getting the message “Installing devices…” when I boot Windows To Go? ## <a href="" id="bkmk-roamconflict"></a>Why do I keep on getting the message "Installing devices…" when I boot Windows To Go?
One of the challenges involved in moving the Windows To Go drive between PCs while seamlessly booting Windows with access to all of their applications and data is that for Windows to be fully functional, specific drivers need to be installed for the hardware in each machine that runs Windows. Windows 8 or later has a process called respecialize which will identify new drivers that need to be loaded for the new PC and disable drivers which are not present on the new configuration. In general this feature is reliable and efficient when roaming between PCs of widely varying hardware configurations. One of the challenges involved in moving the Windows To Go drive between PCs while seamlessly booting Windows with access to all of their applications and data is that for Windows to be fully functional, specific drivers need to be installed for the hardware in each machine that runs Windows. Windows 8 or later has a process called respecialize which will identify new drivers that need to be loaded for the new PC and disable drivers which are not present on the new configuration. In general this feature is reliable and efficient when roaming between PCs of widely varying hardware configurations.
In certain cases, third party drivers for different hardware models or versions can reuse device ID’s, driver file names, registry keys (or any other operating system constructs which do not support side-by-side storage) for similar hardware. For example, Touchpad drivers on different laptops often reuse the same device ID’s, and video cards from the same manufacturer may often reuse service names. Windows handles these situations by marking the non-present device node with a flag that indicates the existing driver needs to be reinstalled before continuing to install the new driver. In certain cases, third party drivers for different hardware models or versions can reuse device ID's, driver file names, registry keys (or any other operating system constructs which do not support side-by-side storage) for similar hardware. For example, Touchpad drivers on different laptops often reuse the same device ID's, and video cards from the same manufacturer may often reuse service names. Windows handles these situations by marking the non-present device node with a flag that indicates the existing driver needs to be reinstalled before continuing to install the new driver.
This process will occur on any boot that a new driver is found and a driver conflict is detected. In some cases that will result in a respecialize progress message “Installing devices…” displaying every time that a Windows to Go drive is roamed between two PCs which require conflicting drivers. This process will occur on any boot that a new driver is found and a driver conflict is detected. In some cases that will result in a respecialize progress message "Installing devices…" displaying every time that a Windows to Go drive is roamed between two PCs which require conflicting drivers.
## <a href="" id="bkmk-upgradewtg"></a>How do I upgrade the operating system on my Windows To Go drive? ## <a href="" id="bkmk-upgradewtg"></a>How do I upgrade the operating system on my Windows To Go drive?

1
windows/deployment/s-mode.md
View File

@ -14,6 +14,7 @@ author: greg-lindsay
ms.author: greglin ms.author: greglin
audience: itpro audience: itpro
ms.topic: article ms.topic: article
ms.custom: seo-marvel-apr2020
--- ---
# Windows 10 in S mode - What is it? # Windows 10 in S mode - What is it?

3
windows/deployment/update/PSFxWhitepaper.md
View File

@ -12,6 +12,7 @@ ms.author: jaimeo
ms.reviewer: ms.reviewer:
manager: laurawi manager: laurawi
ms.topic: article ms.topic: article
ms.custom: seo-marvel-apr2020
--- ---
# Windows Updates using forward and reverse differentials # Windows Updates using forward and reverse differentials
@ -37,8 +38,6 @@ The following general terms apply throughout this document:
- *Revision*: Minor releases in between the major version releases, such as KB4464330 (Windows 10 Build 17763.55) - *Revision*: Minor releases in between the major version releases, such as KB4464330 (Windows 10 Build 17763.55)
- *Baseless Patch Storage Files (Baseless PSF)*: Patch storage files that contain full binaries or files - *Baseless Patch Storage Files (Baseless PSF)*: Patch storage files that contain full binaries or files
## Introduction
In this paper, we introduce a new technique that can produce compact software In this paper, we introduce a new technique that can produce compact software
updates optimized for any origin/destination revision pair. It does this by updates optimized for any origin/destination revision pair. It does this by
calculating forward the differential of a changed file from the base version and calculating forward the differential of a changed file from the base version and

3
windows/deployment/update/WIP4Biz-intro.md
View File

@ -1,7 +1,8 @@
--- ---
title: Introduction to the Windows Insider Program for Business title: Introduction to the Windows Insider Program for Business
description: Introduction to the Windows Insider Program for Business and why IT Pros should join description: In this article, you'll learn about the Windows Insider Program for Business and why IT Pros should join.
keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, insider, WiP4Biz, enterprise, rings, flight keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, insider, WiP4Biz, enterprise, rings, flight
ms.custom: seo-marvel-apr2020
ms.prod: w10 ms.prod: w10
ms.mktglfcycl: manage ms.mktglfcycl: manage
audience: itpro audience: itpro

1
windows/deployment/update/feature-update-conclusion.md
View File

@ -12,6 +12,7 @@ ms.reviewer:
manager: laurawi manager: laurawi
ms.collection: M365-modern-desktop ms.collection: M365-modern-desktop
ms.topic: article ms.topic: article
ms.custom: seo-marvel-apr2020
--- ---
# Conclusion # Conclusion

5
windows/deployment/update/feature-update-maintenance-window.md
View File

@ -11,6 +11,7 @@ ms.reviewer:
manager: laurawi manager: laurawi
ms.collection: M365-modern-desktop ms.collection: M365-modern-desktop
ms.topic: article ms.topic: article
ms.custom: seo-marvel-apr2020
--- ---
# Deploy feature updates during maintenance windows # Deploy feature updates during maintenance windows
@ -33,7 +34,7 @@ Use the following information to deploy feature updates during a maintenance win
### Step 2: Review computer restart device settings ### Step 2: Review computer restart device settings
If you’re not suppressing computer restarts and the feature update will be installed when no users are present, consider deploying a custom client settings policy to your feature update target collection to shorten the settings below or consider the total duration of these settings when defining your maintenance window duration. If you're not suppressing computer restarts and the feature update will be installed when no users are present, consider deploying a custom client settings policy to your feature update target collection to shorten the settings below or consider the total duration of these settings when defining your maintenance window duration.
For example, by default, 90 minutes will be honored before the system is rebooted after the feature update install. If users will not be impacted by the user logoff or restart, there is no need to wait a full 90 minutes before rebooting the computer. If a delay and notification is needed, ensure that the maintenance window takes this into account along with the total time needed to install the feature update. For example, by default, 90 minutes will be honored before the system is rebooted after the feature update install. If users will not be impacted by the user logoff or restart, there is no need to wait a full 90 minutes before rebooting the computer. If a delay and notification is needed, ensure that the maintenance window takes this into account along with the total time needed to install the feature update.
@ -50,7 +51,7 @@ Use **Peer Cache** to help manage deployment of content to clients in remote loc
### Step 4: Override the default Windows setup priority (Windows 10, version 1709 and later) ### Step 4: Override the default Windows setup priority (Windows 10, version 1709 and later)
If you’re deploying **Feature update to Windows 10, version 1709** or later, by default, portions of setup are configured to run at a lower priority. This can result in a longer total install time for the feature update. When deploying within a maintenance window, we recommend that you override this default behavior to benefit from faster total install times. To override the default priority, create a file called SetupConfig.ini on each machine to be upgraded in the below location containing the single section noted. If you're deploying **Feature update to Windows 10, version 1709** or later, by default, portions of setup are configured to run at a lower priority. This can result in a longer total install time for the feature update. When deploying within a maintenance window, we recommend that you override this default behavior to benefit from faster total install times. To override the default priority, create a file called SetupConfig.ini on each machine to be upgraded in the below location containing the single section noted.
%systemdrive%\Users\Default\AppData\Local\Microsoft\Windows\WSUS\SetupConfig.ini %systemdrive%\Users\Default\AppData\Local\Microsoft\Windows\WSUS\SetupConfig.ini

3
windows/deployment/update/feature-update-mission-critical.md
View File

@ -12,13 +12,14 @@ ms.reviewer:
manager: laurawi manager: laurawi
ms.collection: M365-modern-desktop ms.collection: M365-modern-desktop
ms.topic: article ms.topic: article
ms.custom: seo-marvel-apr2020
--- ---
# Best practices and recommendations for deploying Windows 10 Feature updates to mission critical devices # Best practices and recommendations for deploying Windows 10 Feature updates to mission critical devices
**Applies to**: Windows 10 **Applies to**: Windows 10
Managing an environment with devices that provide mission critical services 24 hours a day, 7 days a week, can present challenges in keeping these devices current with Windows 10 feature updates. The processes that you use to keep regular devices current with Windows 10 feature updates, often aren’t the most effective to service mission critical devices. This whitepaper will focus on the recommended approach of using the Microsoft Endpoint Configuration Manager (current branch) software updates feature to deploy Windows 10 semi-annual feature updates. Managing an environment with devices that provide mission critical services 24 hours a day, 7 days a week, can present challenges in keeping these devices current with Windows 10 feature updates. The processes that you use to keep regular devices current with Windows 10 feature updates, often aren't the most effective to service mission critical devices. This whitepaper will focus on the recommended approach of using the Microsoft Endpoint Configuration Manager (current branch) software updates feature to deploy Windows 10 semi-annual feature updates.
For simplicity, we will outline the steps to deploy a feature update manually. If you prefer an automated approach, see [Manage Windows as a service using Configuration Manager](https://docs.microsoft.com/configmgr/osd/deploy-use/manage-windows-as-a-service). For simplicity, we will outline the steps to deploy a feature update manually. If you prefer an automated approach, see [Manage Windows as a service using Configuration Manager](https://docs.microsoft.com/configmgr/osd/deploy-use/manage-windows-as-a-service).

3
windows/deployment/update/feature-update-user-install.md
View File

@ -12,6 +12,7 @@ ms.reviewer:
manager: laurawi manager: laurawi
ms.collection: M365-modern-desktop ms.collection: M365-modern-desktop
ms.topic: article ms.topic: article
ms.custom: seo-marvel-apr2020
--- ---
# Deploy feature updates for user-initiated installations (during a fixed service window) # Deploy feature updates for user-initiated installations (during a fixed service window)
@ -29,7 +30,7 @@ Use **Peer Cache** to help manage deployment of content to clients in remote loc
### Step 2: Override the default Windows setup priority (Windows 10, version 1709 and later) ### Step 2: Override the default Windows setup priority (Windows 10, version 1709 and later)
If you’re deploying **Feature update to Windows 10, version 1709** or later, by default, portions of setup are configured to run at a lower priority. This can result in a longer total install time for the feature update. When deploying within a maintenance window, we recommend that you override this default behavior to benefit from faster total install times. To override the default priority, create a file called SetupConfig.ini on each machine to be upgraded in the below location containing the single section noted. If you're deploying **Feature update to Windows 10, version 1709** or later, by default, portions of setup are configured to run at a lower priority. This can result in a longer total install time for the feature update. When deploying within a maintenance window, we recommend that you override this default behavior to benefit from faster total install times. To override the default priority, create a file called SetupConfig.ini on each machine to be upgraded in the below location containing the single section noted.
%systemdrive%\Users\Default\AppData\Local\Microsoft\Windows\WSUS\SetupConfig.ini %systemdrive%\Users\Default\AppData\Local\Microsoft\Windows\WSUS\SetupConfig.ini

10
windows/deployment/update/fod-and-lang-packs.md
View File

@ -1,9 +1,8 @@
--- ---
title: Windows 10 - How to make FoD and language packs available when you're using WSUS or Configuration Manager title: Make FoD and language packs available for WSUS/Configuration Manager
description: Learn how to make FoD and language packs available when you're using WSUS or Configuration Manager description: Learn how to make FoD and language packs available when you're using WSUS/Configuration Manager.
ms.prod: w10 ms.prod: w10
ms.mktglfcycl: manage ms.mktglfcycl: manage
ms.pagetype: article ms.pagetype: article
ms.author: jaimeo ms.author: jaimeo
audience: itpro audience: itpro
@ -13,6 +12,7 @@ ms.date: 03/13/2019
ms.reviewer: ms.reviewer:
manager: laurawi manager: laurawi
ms.topic: article ms.topic: article
ms.custom: seo-marvel-apr2020
--- ---
# How to make Features on Demand and language packs available when you're using WSUS or Configuration Manager # How to make Features on Demand and language packs available when you're using WSUS or Configuration Manager
@ -20,11 +20,11 @@ ms.topic: article
As of Windows 10 version 1709, you can't use Windows Server Update Services (WSUS) to host [Features on Demand](https://docs.microsoft.com/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities) (FODs) locally. Starting with Windows 10 version 1803, language packs can no longer be hosted on WSUS. As of Windows 10 version 1709, you can't use Windows Server Update Services (WSUS) to host [Features on Demand](https://docs.microsoft.com/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities) (FODs) locally. Starting with Windows 10 version 1803, language packs can no longer be hosted on WSUS.
The **Specify settings for optional component installation and component repair** policy, located under `Computer Configuration\Administrative Templates\System` in the Group Policy Editor, can be used to specify alternate ways to acquire FOD packages, language packages, and content for corruption repair. However, it’s important to note this policy only allows specifying one alternate location and behaves differently across OS versions. The **Specify settings for optional component installation and component repair** policy, located under `Computer Configuration\Administrative Templates\System` in the Group Policy Editor, can be used to specify alternate ways to acquire FOD packages, language packages, and content for corruption repair. However, it's important to note this policy only allows specifying one alternate location and behaves differently across OS versions.
In Windows 10 version 1709 and 1803, changing the **Specify settings for optional component installation and component repair** policy to download content from Windows Update enables acquisition of FOD packages while also enabling corruption repair. Specifying a network location works for either, depending on the content is found at that location. Changing this policy on these OS versions does not influence how language packs are acquired. In Windows 10 version 1709 and 1803, changing the **Specify settings for optional component installation and component repair** policy to download content from Windows Update enables acquisition of FOD packages while also enabling corruption repair. Specifying a network location works for either, depending on the content is found at that location. Changing this policy on these OS versions does not influence how language packs are acquired.
In Windows 10 version 1809 and beyond, changing the **Specify settings for optional component installation and component repair** policy also influences how language packs are acquired, however language packs can only be acquired directly from Windows Update. It’s currently not possible to acquire them from a network share. Specifying a network location works for FOD packages or corruption repair, depending on the content at that location. In Windows 10 version 1809 and beyond, changing the **Specify settings for optional component installation and component repair** policy also influences how language packs are acquired, however language packs can only be acquired directly from Windows Update. It's currently not possible to acquire them from a network share. Specifying a network location works for FOD packages or corruption repair, depending on the content at that location.
For all OS versions, changing the **Specify settings for optional component installation and component repair** policy does not affect how OS updates are distributed. They continue to come from WSUS, Configuration Manager, or other sources as you have scheduled them, even while optional content is sourced from Windows Update or a network location. For all OS versions, changing the **Specify settings for optional component installation and component repair** policy does not affect how OS updates are distributed. They continue to come from WSUS, Configuration Manager, or other sources as you have scheduled them, even while optional content is sourced from Windows Update or a network location.

7
windows/deployment/update/how-windows-update-works.md
View File

@ -1,6 +1,6 @@
--- ---
title: How Windows Update works title: How Windows Update works
description: Learn how Windows Update works, including architecture and troubleshooting. description: In this article, learn about the process Windows Update uses to download and install updates on a Windows 10 devices.
ms.prod: w10 ms.prod: w10
ms.mktglfcycl: ms.mktglfcycl:
audience: itpro audience: itpro
@ -12,6 +12,7 @@ ms.reviewer:
manager: laurawi manager: laurawi
ms.collection: M365-modern-desktop ms.collection: M365-modern-desktop
ms.topic: article ms.topic: article
ms.custom: seo-marvel-apr2020
--- ---
# How does Windows Update work? # How does Windows Update work?
@ -45,7 +46,7 @@ The Windows Update workflow has four core areas of functionality:
## How updating works ## How updating works
During the updating process, the Windows Update Orchestrator operates in the background to scan, download, and install updates. It does this automatically, according to your settings, and in a silent manner that doesn’t disrupt your computer usage. During the updating process, the Windows Update Orchestrator operates in the background to scan, download, and install updates. It does this automatically, according to your settings, and in a silent manner that doesn't disrupt your computer usage.
## Scanning updates ## Scanning updates
![Windows Update scanning step](images/update-scan-step.png) ![Windows Update scanning step](images/update-scan-step.png)
@ -127,7 +128,7 @@ Common update failure is caused due to network issues. To find the root of the i
Once the Windows Update Orchestrator determines which updates apply to your computer, it will begin downloading the updates, if you have selected the option to automatically download updates. It does this in the background without interrupting your normal use of the computer. Once the Windows Update Orchestrator determines which updates apply to your computer, it will begin downloading the updates, if you have selected the option to automatically download updates. It does this in the background without interrupting your normal use of the computer.
To ensure that your other downloads aren’t affected or slowed down because updates are downloading, Windows Update uses the Delivery Optimization (DO) technology which downloads updates and reduces bandwidth consumption. To ensure that your other downloads aren't affected or slowed down because updates are downloading, Windows Update uses the Delivery Optimization technology which downloads updates and reduces bandwidth consumption.
For more information see [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md). For more information see [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md).

7
windows/deployment/update/olympia/olympia-enrollment-guidelines.md
View File

@ -11,6 +11,7 @@ author: jaimeo
ms.reviewer: ms.reviewer:
manager: laurawi manager: laurawi
keywords: insider, trial, enterprise, lab, corporation, test keywords: insider, trial, enterprise, lab, corporation, test
ms.custom: seo-marvel-apr2020
--- ---
# Olympia Corp # Olympia Corp
@ -60,7 +61,7 @@ This is the Bring Your Own Device (BYOD) method--your device will receive Olympi
3. Click **Connect** and enter your **Olympia corporate account** (e.g., username@olympia.windows.com). Click **Next**. 3. Click **Connect** and enter your **Olympia corporate account** (e.g., username@olympia.windows.com). Click **Next**.
![Set up a work or school account](images/1-3.png) ![Entering account information when setting up a work or school account](images/1-3.png)
4. Enter the temporary password that was sent to you. Click **Sign in**. Follow the instructions to set a new password. 4. Enter the temporary password that was sent to you. Click **Sign in**. Follow the instructions to set a new password.
@ -99,7 +100,7 @@ This is the Bring Your Own Device (BYOD) method--your device will receive Olympi
3. Click **Connect**, then click **Join this device to Azure Active Directory**. 3. Click **Connect**, then click **Join this device to Azure Active Directory**.
![Update your password](images/2-3.png) ![Joining device to Azure AD]](images/2-3.png)
4. Enter your **Olympia corporate account** (e.g., username@olympia.windows.com). Click **Next**. 4. Enter your **Olympia corporate account** (e.g., username@olympia.windows.com). Click **Next**.
@ -110,7 +111,7 @@ This is the Bring Your Own Device (BYOD) method--your device will receive Olympi
> [!NOTE] > [!NOTE]
> Passwords should contain 8-16 characters, including at least one special character or number. > Passwords should contain 8-16 characters, including at least one special character or number.
![Update your password](images/2-5.png) ![Entering temporary password](images/2-5.png)
6. When asked to make sure this is your organization, verify that the information is correct. If so, click **Join**. 6. When asked to make sure this is your organization, verify that the information is correct. If so, click **Join**.

3
windows/deployment/update/servicing-stack-updates.md
View File

@ -1,6 +1,6 @@
--- ---
title: Servicing stack updates (Windows 10) title: Servicing stack updates (Windows 10)
description: Servicing stack updates improve the code that installs the other updates. description: In this article, learn how servicing stack updates improve the code that installs the other updates.
ms.prod: w10 ms.prod: w10
ms.mktglfcycl: manage ms.mktglfcycl: manage
audience: itpro audience: itpro
@ -12,6 +12,7 @@ ms.reviewer:
manager: laurawi manager: laurawi
ms.collection: M365-modern-desktop ms.collection: M365-modern-desktop
ms.topic: article ms.topic: article
ms.custom: seo-marvel-apr2020
--- ---
# Servicing stack updates # Servicing stack updates

3
windows/deployment/update/update-compliance-delivery-optimization.md
View File

@ -13,6 +13,7 @@ keywords: oms, operations management suite, optimization, downloads, updates, lo
ms.localizationpriority: medium ms.localizationpriority: medium
ms.collection: M365-analytics ms.collection: M365-analytics
ms.topic: article ms.topic: article
ms.custom: seo-marvel-apr2020
--- ---
# Delivery Optimization in Update Compliance # Delivery Optimization in Update Compliance
@ -41,5 +42,5 @@ The table breaks down the number of bytes from each download source into specifi
The download sources that could be included are: The download sources that could be included are:
- LAN Bytes: Bytes downloaded from LAN Peers which are other devices on the same local network - LAN Bytes: Bytes downloaded from LAN Peers which are other devices on the same local network
- Group Bytes: Bytes downloaded from Group Peers which are other devices that belong to the same Group (available when the “Group” download mode is used) - Group Bytes: Bytes downloaded from Group Peers which are other devices that belong to the same Group (available when the "Group" download mode is used)
- HTTP Bytes: Non-peer bytes. The HTTP download source can be Microsoft Servers, Windows Update Servers, a WSUS server or an SCCM Distribution Point for Express Updates. - HTTP Bytes: Non-peer bytes. The HTTP download source can be Microsoft Servers, Windows Update Servers, a WSUS server or an SCCM Distribution Point for Express Updates.

1
windows/deployment/update/update-compliance-feature-update-status.md
View File

@ -12,6 +12,7 @@ author: jaimeo
ms.author: jaimeo ms.author: jaimeo
ms.collection: M365-analytics ms.collection: M365-analytics
ms.topic: article ms.topic: article
ms.custom: seo-marvel-apr2020
--- ---
# Feature Update Status # Feature Update Status

1
windows/deployment/update/update-compliance-monitor.md
View File

@ -13,6 +13,7 @@ ms.author: jaimeo
ms.localizationpriority: medium ms.localizationpriority: medium
ms.collection: M365-analytics ms.collection: M365-analytics
ms.topic: article ms.topic: article
ms.custom: seo-marvel-apr2020
--- ---
# Monitor Windows Updates with Update Compliance # Monitor Windows Updates with Update Compliance

2
windows/deployment/update/update-compliance-need-attention.md
View File

@ -1,7 +1,7 @@
--- ---
title: Update Compliance - Need Attention! report title: Update Compliance - Need Attention! report
manager: laurawi manager: laurawi
description: Learn how the Needs attention! section provides a breakdown of all Windows 10 device and update issues detected by Update Compliance. description: Learn how the Need attention! section provides a breakdown of all Windows 10 device and update issues detected by Update Compliance.
ms.mktglfcycl: deploy ms.mktglfcycl: deploy
ms.pagetype: deploy ms.pagetype: deploy
audience: itpro audience: itpro

1
windows/deployment/update/update-compliance-security-update-status.md
View File

@ -10,6 +10,7 @@ author: jaimeo
ms.author: jaimeo ms.author: jaimeo
ms.collection: M365-analytics ms.collection: M365-analytics
ms.topic: article ms.topic: article
ms.custom: seo-marvel-apr2020
--- ---
# Security Update Status # Security Update Status

3
windows/deployment/update/update-compliance-using.md
View File

@ -2,7 +2,7 @@
title: Using Update Compliance (Windows 10) title: Using Update Compliance (Windows 10)
ms.reviewer: ms.reviewer:
manager: laurawi manager: laurawi
description: Learn how to use Update Compliance to monitor your device's Windows updates and Microsoft Defender Antivirus status. description: Learn how to use Update Compliance to monitor your device's Windows updates.
keywords: oms, operations management suite, wdav, updates, upgrades, antivirus, antimalware, signature, log analytics keywords: oms, operations management suite, wdav, updates, upgrades, antivirus, antimalware, signature, log analytics
ms.prod: w10 ms.prod: w10
ms.mktglfcycl: deploy ms.mktglfcycl: deploy
@ -13,6 +13,7 @@ ms.author: jaimeo
ms.localizationpriority: medium ms.localizationpriority: medium
ms.collection: M365-analytics ms.collection: M365-analytics
ms.topic: article ms.topic: article
ms.custom: seo-marvel-apr2020
--- ---
# Use Update Compliance # Use Update Compliance

7
windows/deployment/update/waas-branchcache.md
View File

@ -1,6 +1,6 @@
--- ---
title: Configure BranchCache for Windows 10 updates (Windows 10) title: Configure BranchCache for Windows 10 updates (Windows 10)
description: Use BranchCache to optimize network bandwidth during update deployment. description: In this article, learn how to use BranchCache to optimize network bandwidth during update deployment.
ms.prod: w10 ms.prod: w10
ms.mktglfcycl: manage ms.mktglfcycl: manage
author: jaimeo author: jaimeo
@ -9,6 +9,7 @@ ms.author: jaimeo
ms.reviewer: ms.reviewer:
manager: laurawi manager: laurawi
ms.topic: article ms.topic: article
ms.custom: seo-marvel-apr2020
--- ---
# Configure BranchCache for Windows 10 updates # Configure BranchCache for Windows 10 updates
@ -20,7 +21,7 @@ ms.topic: article
> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) > **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq)
BranchCache is a bandwidth-optimization feature that has been available since the Windows Server 2008 R2 and Windows 7 operating systems. Each client has a cache and acts as an alternate source for content that devices on its own network request. Windows Server Update Services (WSUS) and Microsoft Endpoint Configuration Manager can use BranchCache to optimize network bandwidth during update deployment, and it’s easy to configure for either of them. BranchCache has two operating modes: Distributed Cache mode and Hosted Cache mode. BranchCache is a bandwidth-optimization feature that has been available since the Windows Server 2008 R2 and Windows 7 operating systems. Each client has a cache and acts as an alternate source for content that devices on its own network request. Windows Server Update Services (WSUS) and Microsoft Endpoint Configuration Manager can use BranchCache to optimize network bandwidth during update deployment, and it's easy to configure for either of them. BranchCache has two operating modes: Distributed Cache mode and Hosted Cache mode.
- Distributed Cache mode operates like the [Delivery Optimization](waas-delivery-optimization.md) feature in Windows 10: each client contains a cached version of the BranchCache-enabled files it requests and acts as a distributed cache for other clients requesting that same file. - Distributed Cache mode operates like the [Delivery Optimization](waas-delivery-optimization.md) feature in Windows 10: each client contains a cached version of the BranchCache-enabled files it requests and acts as a distributed cache for other clients requesting that same file.
@ -33,7 +34,7 @@ For detailed information about how Distributed Cache mode and Hosted Cache mode
## Configure clients for BranchCache ## Configure clients for BranchCache
Whether you use BranchCache with Configuration Manager or WSUS, each client that uses BranchCache must be configured to do so. You typically make your configurations through Group Policy. For step-by-step instructions on how to use Group Policy to configure BranchCache for Windows clients, see [Client Configuration](https://technet.microsoft.com/library/dd637820%28v=ws.10%29.aspx) in the [BranchCache Early Adopter’s Guide](https://technet.microsoft.com/library/dd637762(v=ws.10).aspx). Whether you use BranchCache with Configuration Manager or WSUS, each client that uses BranchCache must be configured to do so. You typically make your configurations through Group Policy. For step-by-step instructions on how to use Group Policy to configure BranchCache for Windows clients, see [Client Configuration](https://technet.microsoft.com/library/dd637820%28v=ws.10%29.aspx) in the [BranchCache Early Adopter's Guide](https://technet.microsoft.com/library/dd637762(v=ws.10).aspx).
In Windows 10, version 1607, the Windows Update Agent uses Delivery Optimization by default, even when the updates are retrieved from WSUS. When using BranchCache with Windows 10, simply set the Delivery Optimization mode to Bypass to allow clients to use the Background Intelligent Transfer Service (BITS) protocol with BranchCache instead. For instructions on how to use BranchCache in Distributed Cache mode with WSUS, see the section WSUS and Configuration Manager with BranchCache in Distributed Cache mode. In Windows 10, version 1607, the Windows Update Agent uses Delivery Optimization by default, even when the updates are retrieved from WSUS. When using BranchCache with Windows 10, simply set the Delivery Optimization mode to Bypass to allow clients to use the Background Intelligent Transfer Service (BITS) protocol with BranchCache instead. For instructions on how to use BranchCache in Distributed Cache mode with WSUS, see the section WSUS and Configuration Manager with BranchCache in Distributed Cache mode.

10
windows/deployment/update/waas-delivery-optimization-reference.md
View File

@ -2,17 +2,17 @@
title: Delivery Optimization reference title: Delivery Optimization reference
ms.reviewer: ms.reviewer:
manager: laurawi manager: laurawi
description: Reference of all Delivery Optimization settings and descriptions of same description: This article provides a summary of references and descriptions for all of the Delivery Optimization settings.
keywords: oms, operations management suite, wdav, updates, downloads, log analytics keywords: oms, operations management suite, wdav, updates, downloads, log analytics
ms.prod: w10 ms.prod: w10
ms.mktglfcycl: deploy ms.mktglfcycl: deploy
audience: itpro audience: itpro
author: jaimeo author: jaimeo
ms.localizationpriority: medium ms.localizationpriority: medium
ms.author: jaimeo ms.author: jaimeo
ms.collection: M365-modern-desktop ms.collection: M365-modern-desktop
ms.topic: article ms.topic: article
ms.custom: seo-marvel-apr2020
--- ---
# Delivery Optimization reference # Delivery Optimization reference
@ -111,7 +111,7 @@ Download mode dictates which download sources clients are allowed to use when do
| --- | --- | | --- | --- |
| HTTP Only (0) | This setting disables peer-to-peer caching but still allows Delivery Optimization to download content over HTTP from the download's original source. This mode uses additional metadata provided by the Delivery Optimization cloud services for a peerless reliable and efficient download experience. | | HTTP Only (0) | This setting disables peer-to-peer caching but still allows Delivery Optimization to download content over HTTP from the download's original source. This mode uses additional metadata provided by the Delivery Optimization cloud services for a peerless reliable and efficient download experience. |
| LAN (1 – Default) | This default operating mode for Delivery Optimization enables peer sharing on the same network. The Delivery Optimization cloud service finds other clients that connect to the Internet using the same public IP as the target client. These clients then attempts to connect to other peers on the same network by using their private subnet IP.| | LAN (1 – Default) | This default operating mode for Delivery Optimization enables peer sharing on the same network. The Delivery Optimization cloud service finds other clients that connect to the Internet using the same public IP as the target client. These clients then attempts to connect to other peers on the same network by using their private subnet IP.|
| Group (2) | When group mode is set, the group is automatically selected based on the device’s Active Directory Domain Services (AD DS) site (Windows 10, version 1607) or the domain the device is authenticated to (Windows 10, version 1511). In group mode, peering occurs across internal subnets, between devices that belong to the same group, including devices in remote offices. You can use GroupID option to create your own custom group independently of domains and AD DS sites. Starting with Windows 10, version 1803, you can use the GroupIDSource parameter to take advantage of other method to create groups dynamically. Group download mode is the recommended option for most organizations looking to achieve the best bandwidth optimization with Delivery Optimization. | | Group (2) | When group mode is set, the group is automatically selected based on the device's Active Directory Domain Services (AD DS) site (Windows 10, version 1607) or the domain the device is authenticated to (Windows 10, version 1511). In group mode, peering occurs across internal subnets, between devices that belong to the same group, including devices in remote offices. You can use GroupID option to create your own custom group independently of domains and AD DS sites. Starting with Windows 10, version 1803, you can use the GroupIDSource parameter to take advantage of other method to create groups dynamically. Group download mode is the recommended option for most organizations looking to achieve the best bandwidth optimization with Delivery Optimization. |
| Internet (3) | Enable Internet peer sources for Delivery Optimization. | | Internet (3) | Enable Internet peer sources for Delivery Optimization. |
| Simple (99) | Simple mode disables the use of Delivery Optimization cloud services completely (for offline environments). Delivery Optimization switches to this mode automatically when the Delivery Optimization cloud services are unavailable, unreachable or when the content file size is less than 10 MB. In this mode, Delivery Optimization provides a reliable download experience, with no peer-to-peer caching. | | Simple (99) | Simple mode disables the use of Delivery Optimization cloud services completely (for offline environments). Delivery Optimization switches to this mode automatically when the Delivery Optimization cloud services are unavailable, unreachable or when the content file size is less than 10 MB. In this mode, Delivery Optimization provides a reliable download experience, with no peer-to-peer caching. |
|Bypass (100) | Bypass Delivery Optimization and use BITS, instead. You should only select this mode if you use WSUS and prefer to use BranchCache. You do not need to set this option if you are using Configuration Manager. If you want to disable peer-to-peer functionality, it's best to set **DownloadMode** to **0** or **99**. | |Bypass (100) | Bypass Delivery Optimization and use BITS, instead. You should only select this mode if you use WSUS and prefer to use BranchCache. You do not need to set this option if you are using Configuration Manager. If you want to disable peer-to-peer functionality, it's best to set **DownloadMode** to **0** or **99**. |
@ -156,7 +156,7 @@ This setting specifies the required minimum disk size (capacity in GB) for the d
### Max Cache Age ### Max Cache Age
In environments configured for Delivery Optimization, you might want to set an expiration on cached updates and Windows application installation files. If so, this setting defines the maximum number of seconds each file can be held in the Delivery Optimization cache on each Windows 10 client device. The default Max Cache Age value is 259,200 seconds (3 days). Alternatively, organizations might choose to set this value to “0” which means “unlimited” to avoid peers re-downloading content. When “Unlimited” value is set, Delivery Optimization will hold the files in the cache longer and will clean up the cache as needed (for example when the cache size exceeded the maximum space allowed). In environments configured for Delivery Optimization, you might want to set an expiration on cached updates and Windows application installation files. If so, this setting defines the maximum number of seconds each file can be held in the Delivery Optimization cache on each Windows 10 client device. The default Max Cache Age value is 259,200 seconds (3 days). Alternatively, organizations might choose to set this value to "0" which means "unlimited" to avoid peers re-downloading content. When "Unlimited" value is set, Delivery Optimization will hold the files in the cache longer and will clean up the cache as needed (for example when the cache size exceeded the maximum space allowed).
### Max Cache Size ### Max Cache Size
@ -188,7 +188,7 @@ This setting specifies the maximum download bandwidth that Delivery Optimization
### Max Upload Bandwidth ### Max Upload Bandwidth
This setting allows you to limit the amount of upload bandwidth individual clients can use for Delivery Optimization. Consider this setting when clients are providing content to requesting peers on the network. This option is set in kilobytes per second (KB/s). The default setting is 0, or “unlimited” which means Delivery Optimization dynamically optimizes for minimal usage of upload bandwidth; however it does not cap the upload bandwidth rate at a set rate. This setting allows you to limit the amount of upload bandwidth individual clients can use for Delivery Optimization. Consider this setting when clients are providing content to requesting peers on the network. This option is set in kilobytes per second (KB/s). The default setting is 0, or "unlimited" which means Delivery Optimization dynamically optimizes for minimal usage of upload bandwidth; however it does not cap the upload bandwidth rate at a set rate.
### Set Business Hours to Limit Background Download Bandwidth ### Set Business Hours to Limit Background Download Bandwidth
Starting in Windows 10, version 1803, specifies the maximum background download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth. Starting in Windows 10, version 1803, specifies the maximum background download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth.

7
windows/deployment/update/waas-delivery-optimization-setup.md
View File

@ -2,7 +2,7 @@
title: Set up Delivery Optimization title: Set up Delivery Optimization
ms.reviewer: ms.reviewer:
manager: laurawi manager: laurawi
description: Delivery Optimization is a new peer-to-peer distribution method in Windows 10 description: In this article, learn how to set up Delivery Optimization, a new peer-to-peer distribution method in Windows 10.
keywords: oms, operations management suite, wdav, updates, downloads, log analytics keywords: oms, operations management suite, wdav, updates, downloads, log analytics
ms.prod: w10 ms.prod: w10
ms.mktglfcycl: deploy ms.mktglfcycl: deploy
@ -12,6 +12,7 @@ ms.localizationpriority: medium
ms.author: jaimeo ms.author: jaimeo
ms.collection: M365-modern-desktop ms.collection: M365-modern-desktop
ms.topic: article ms.topic: article
ms.custom: seo-marvel-apr2020
--- ---
# Set up Delivery Optimization for Windows 10 updates # Set up Delivery Optimization for Windows 10 updates
@ -50,7 +51,7 @@ Quick-reference table:
### Hybrid WAN scenario ### Hybrid WAN scenario
For this scenario, grouping devices by domain allows devices to be included in peer downloads and uploads across VLANs. **Set Download Mode to 2 - Group**. The default group is the authenticated domain or Active Directory site. If your domain-based group is too wide, or your Active Directory sites aren’t aligned with your site network topology, then you should consider additional options for dynamically creating groups, for example by using the GroupIDSrc parameter. For this scenario, grouping devices by domain allows devices to be included in peer downloads and uploads across VLANs. **Set Download Mode to 2 - Group**. The default group is the authenticated domain or Active Directory site. If your domain-based group is too wide, or your Active Directory sites aren't aligned with your site network topology, then you should consider additional options for dynamically creating groups, for example by using the GroupIDSrc parameter.
@ -103,7 +104,7 @@ To do this with MDM, go to **.Vendor/MSFT/Policy/Config/DeliveryOptimization/**
## Monitor Delivery Optimization ## Monitor Delivery Optimization
[//]: # (How to tell if it’s working? What values are reasonable; which are not? If not, which way to adjust and how? -- check PercentPeerCaching for files > minimum >= 50%) [//]: # (How to tell if it's working? What values are reasonable; which are not? If not, which way to adjust and how? -- check PercentPeerCaching for files > minimum >= 50%)
### Windows PowerShell cmdlets ### Windows PowerShell cmdlets

7
windows/deployment/update/waas-delivery-optimization.md
View File

@ -1,7 +1,7 @@
--- ---
title: Delivery Optimization for Windows 10 updates title: Delivery Optimization for Windows 10 updates
manager: laurawi manager: laurawi
description: Delivery Optimization is a peer-to-peer distribution method in Windows 10 description: This article provides information about Delivery Optimization, a peer-to-peer distribution method in Windows 10.
keywords: oms, operations management suite, wdav, updates, downloads, log analytics keywords: oms, operations management suite, wdav, updates, downloads, log analytics
ms.prod: w10 ms.prod: w10
ms.mktglfcycl: deploy ms.mktglfcycl: deploy
@ -13,6 +13,7 @@ ms.collection:
- M365-modern-desktop - M365-modern-desktop
- m365initiative-coredeploy - m365initiative-coredeploy
ms.topic: article ms.topic: article
ms.custom: seo-marvel-apr2020
--- ---
# Delivery Optimization for Windows 10 updates # Delivery Optimization for Windows 10 updates
@ -120,7 +121,7 @@ For complete list of every possible Delivery Optimization setting, see [Delivery
## How Microsoft uses Delivery Optimization ## How Microsoft uses Delivery Optimization
At Microsoft, to help ensure that ongoing deployments weren’t affecting our network and taking away bandwidth for other services, Microsoft IT used a couple of different bandwidth management strategies. Delivery Optimization, peer-to-peer caching enabled through Group Policy, was piloted and then deployed to all managed devices using Group Policy. Based on recommendations from the Delivery Optimization team, we used the "group" configuration to limit sharing of content to only the devices that are members of the same Active Directory domain. The content is cached for 24 hours. More than 76 percent of content came from peer devices versus the Internet. At Microsoft, to help ensure that ongoing deployments weren't affecting our network and taking away bandwidth for other services, Microsoft IT used a couple of different bandwidth management strategies. Delivery Optimization, peer-to-peer caching enabled through Group Policy, was piloted and then deployed to all managed devices using Group Policy. Based on recommendations from the Delivery Optimization team, we used the "group" configuration to limit sharing of content to only the devices that are members of the same Active Directory domain. The content is cached for 24 hours. More than 76 percent of content came from peer devices versus the Internet.
For more details, check out the [Adopting Windows as a Service at Microsoft](https://www.microsoft.com/itshowcase/Article/Content/851/Adopting-Windows-as-a-service-at-Microsoft) technical case study. For more details, check out the [Adopting Windows as a Service at Microsoft](https://www.microsoft.com/itshowcase/Article/Content/851/Adopting-Windows-as-a-service-at-Microsoft) technical case study.
@ -188,7 +189,7 @@ This section summarizes common problems and some solutions to try.
### If you don't see any bytes from peers ### If you don't see any bytes from peers
If you don’t see any bytes coming from peers the cause might be one of the following issues: If you don't see any bytes coming from peers the cause might be one of the following issues:
- Clients aren’t able to reach the Delivery Optimization cloud services. - Clients aren’t able to reach the Delivery Optimization cloud services.
- The cloud service doesn’t see other peers on the network. - The cloud service doesn’t see other peers on the network.

5
windows/deployment/update/waas-manage-updates-wufb.md
View File

@ -2,13 +2,14 @@
title: Windows Update for Business (Windows 10) title: Windows Update for Business (Windows 10)
ms.reviewer: ms.reviewer:
manager: laurawi manager: laurawi
description: Windows Update for Business lets you manage when devices received updates from Windows Update. description: Learn how Windows Update for Business lets you manage when devices receive updates from Windows Update.
ms.prod: w10 ms.prod: w10
ms.mktglfcycl: manage ms.mktglfcycl: manage
author: jaimeo author: jaimeo
ms.localizationpriority: medium ms.localizationpriority: medium
ms.author: jaimeo ms.author: jaimeo
ms.topic: article ms.topic: article
ms.custom: seo-marvel-apr2020
--- ---
# What is Windows Update for Business? # What is Windows Update for Business?
@ -187,7 +188,7 @@ The branch readiness level enables administrators to specify which channel of fe
- Windows Insider Release Preview - Windows Insider Release Preview
- Semi-annual Channel for released updates - Semi-annual Channel for released updates
Prior to Windows 10, version 1903, there are two channels for released updates: Semi-annual Channel and Semi-annual Channel (Targeted). Deferral days are calculated against the release date of the chosen channel. Starting with Windows 10, version 1903 there is only the one release channel: Semi-annual Channel. All deferral days will be calculated against a release’s Semi-annual Channel release date. To see release dates, visit [Windows Release Information](https://docs.microsoft.com/windows/release-information/). You can set the branch readiness level by using the **Select when Preview Builds and Feature Updates are Received** policy. In order to use this to manage pre-release builds, first enable preview builds by using the **Manage preview Builds** policy. Prior to Windows 10, version 1903, there are two channels for released updates: Semi-annual Channel and Semi-annual Channel (Targeted). Deferral days are calculated against the release date of the chosen channel. Starting with Windows 10, version 1903 there is only the one release channel: Semi-annual Channel. All deferral days will be calculated against a release's Semi-annual Channel release date. To see release dates, visit [Windows Release Information](https://docs.microsoft.com/windows/release-information/). You can set the branch readiness level by using the **Select when Preview Builds and Feature Updates are Received** policy. In order to use this to manage pre-release builds, first enable preview builds by using the **Manage preview Builds** policy.
### Recommendations ### Recommendations

5
windows/deployment/update/waas-morenews.md
View File

@ -1,5 +1,6 @@
--- ---
title: Windows as a service news & resources title: Windows as a service news & resources
description: The latest news for Windows as a service with resources to help you learn more about them.
ms.prod: w10 ms.prod: w10
ms.topic: article ms.topic: article
ms.manager: elizapo ms.manager: elizapo
@ -17,8 +18,8 @@ Here's more news about [Windows as a service](windows-as-a-service.md):
<ul> <ul>
<li><a href="https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-10-Enterprise-vs-Windows-10-Pro-Modern-management/ba-p/720445">Windows 10 Enterprise vs. Windows 10 Pro: Modern management considerations for your organization </a> - June 25, 2019</li> <li><a href="https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-10-Enterprise-vs-Windows-10-Pro-Modern-management/ba-p/720445">Windows 10 Enterprise vs. Windows 10 Pro: Modern management considerations for your organization </a> - June 25, 2019</li>
<li><a href="https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Updating-Windows-10-version-1903-using-Configuration-Manager-or/ba-p/639100">Updating Windows 10, version 1903 using Configuration Manager or WSUS</a> - May 23, 2019</li> <li><a href="https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Updating-Windows-10-version-1903-using-Configuration-Manager-or/ba-p/639100">Updating Windows 10, version 1903 using Configuration Manager or WSUS</a> - May 23, 2019</li>
<li><a href="https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/What-s-new-in-Windows-Update-for-Business-in-Windows-10-version/ba-p/622064">What’s new in Windows Update for Business in Windows 10, version 1903</a> - May 21, 2019</li> <li><a href="https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/What-s-new-in-Windows-Update-for-Business-in-Windows-10-version/ba-p/622064">What's new in Windows Update for Business in Windows 10, version 1903</a> - May 21, 2019</li>
<li><a href="https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/What-s-new-for-IT-pros-in-Windows-10-version-1903/ba-p/622024">What’s new for IT pros in Windows 10, version 1903</a> - May 21, 2019</li> <li><a href="https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/What-s-new-for-IT-pros-in-Windows-10-version-1903/ba-p/622024">What's new for IT pros in Windows 10, version 1903</a> - May 21, 2019</li>
<li><a href="https://blogs.windows.com/windowsexperience/2019/05/21/how-to-get-the-windows-10-may-2019-update">How to get the Windows 10 May 2019 Update</a> - May 21, 2019</li> <li><a href="https://blogs.windows.com/windowsexperience/2019/05/21/how-to-get-the-windows-10-may-2019-update">How to get the Windows 10 May 2019 Update</a> - May 21, 2019</li>
<li><a href="https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/The-benefits-of-Windows-10-Dynamic-Update/ba-p/467847">The benefits of Windows 10 Dynamic Update</a> - April 17, 2019</li> <li><a href="https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/The-benefits-of-Windows-10-Dynamic-Update/ba-p/467847">The benefits of Windows 10 Dynamic Update</a> - April 17, 2019</li>
<li><a href="https://blogs.windows.com/windowsexperience/2019/04/04/improving-the-windows-10-update-experience-with-control-quality-and-transparency">Improving the Windows 10 update experience with control, quality and transparency</a> - April 4, 2019</li> <li><a href="https://blogs.windows.com/windowsexperience/2019/04/04/improving-the-windows-10-update-experience-with-control-quality-and-transparency">Improving the Windows 10 update experience with control, quality and transparency</a> - April 4, 2019</li>

3
windows/deployment/update/waas-restart.md
View File

@ -3,13 +3,14 @@ title: Manage device restarts after updates (Windows 10)
description: Use Group Policy settings, mobile device management (MDM) or Registry to configure when devices will restart after a Windows 10 update is installed. description: Use Group Policy settings, mobile device management (MDM) or Registry to configure when devices will restart after a Windows 10 update is installed.
ms.prod: w10 ms.prod: w10
ms.mktglfcycl: deploy ms.mktglfcycl: deploy
author: jaimeo author: jaimeo
ms.localizationpriority: medium ms.localizationpriority: medium
ms.author: jaimeo ms.author: jaimeo
ms.reviewer: ms.reviewer:
manager: laurawi manager: laurawi
ms.topic: article ms.topic: article
ms.custom:
- seo-marvel-apr2020
--- ---
# Manage device restarts after updates # Manage device restarts after updates

3
windows/deployment/update/waas-servicing-channels-windows-10-updates.md
View File

@ -3,13 +3,14 @@ title: Assign devices to servicing channels for Windows 10 updates (Windows 10)
description: Learn how to assign devices to servicing channels for Windows 10 updates locally, by using Group Policy, and by using MDM . description: Learn how to assign devices to servicing channels for Windows 10 updates locally, by using Group Policy, and by using MDM .
ms.prod: w10 ms.prod: w10
ms.mktglfcycl: deploy ms.mktglfcycl: deploy
author: jaimeo author: jaimeo
ms.localizationpriority: medium ms.localizationpriority: medium
ms.author: jaimeo ms.author: jaimeo
ms.reviewer: ms.reviewer:
manager: laurawi manager: laurawi
ms.topic: article ms.topic: article
ms.custom:
- seo-marvel-apr2020
--- ---
# Assign devices to servicing channels for Windows 10 updates # Assign devices to servicing channels for Windows 10 updates

15
windows/deployment/update/waas-servicing-differences.md
View File

@ -2,7 +2,7 @@
title: Servicing differences between Windows 10 and older operating systems title: Servicing differences between Windows 10 and older operating systems
ms.reviewer: ms.reviewer:
manager: laurawi manager: laurawi
description: Learn the differences between servicing Windows 10 and servicing older operating systems. description: In this article, learn the differences between servicing Windows 10 and servicing older operating systems.
keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, insider, tools keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, insider, tools
ms.prod: w10 ms.prod: w10
ms.mktglfcycl: manage ms.mktglfcycl: manage
@ -12,6 +12,7 @@ ms.audience: itpro
author: jaimeo author: jaimeo
ms.topic: article ms.topic: article
ms.collection: M365-modern-desktop ms.collection: M365-modern-desktop
ms.custom: seo-marvel-apr2020
--- ---
# Understanding the differences between servicing Windows 10-era and legacy Windows operating systems # Understanding the differences between servicing Windows 10-era and legacy Windows operating systems
@ -31,7 +32,7 @@ Prior to Windows 10, all updates to operating system (OS) components were publis
As a result, each environment within the global Windows ecosystem that had only a subset of security and non-security fixes installed had a different set of binaries and behaviors than those that consistently installed every available update as tested by Microsoft. As a result, each environment within the global Windows ecosystem that had only a subset of security and non-security fixes installed had a different set of binaries and behaviors than those that consistently installed every available update as tested by Microsoft.
This resulted in a fragmented ecosystem that created diverse challenges in predictively testing interoperability, resulting in high update failure rates - which were subsequently mitigated by customers removing individual updates that were causing issues. Each customer that selectively removed individual updates amplified this fragmentation by creating more diverse environment permutations across the ecosystem. As an IT Administrator once quipped, "If you’ve seen one Windows 7 PC, you have seen one Windows 7 PC," suggesting no consistency or predictability across more than 250M commercial devices at the time. This resulted in a fragmented ecosystem that created diverse challenges in predictively testing interoperability, resulting in high update failure rates - which were subsequently mitigated by customers removing individual updates that were causing issues. Each customer that selectively removed individual updates amplified this fragmentation by creating more diverse environment permutations across the ecosystem. As an IT Administrator once quipped, "If you've seen one Windows 7 PC, you have seen one Windows 7 PC," suggesting no consistency or predictability across more than 250M commercial devices at the time.
## Windows 10 – Next generation ## Windows 10 – Next generation
Windows 10 provided an opportunity to end the era of infinite fragmentation. With Windows 10 and the Windows as a service model, updates came rolled together in the "latest cumulative update" (LCU) packages for both client and server. Every new update published includes all changes from previous updates, as well as new fixes. Since Windows client and server share the same code base, these LCUs allow the same update to be installed on the same client and server OS family, further reducing fragmentation. Windows 10 provided an opportunity to end the era of infinite fragmentation. With Windows 10 and the Windows as a service model, updates came rolled together in the "latest cumulative update" (LCU) packages for both client and server. Every new update published includes all changes from previous updates, as well as new fixes. Since Windows client and server share the same code base, these LCUs allow the same update to be installed on the same client and server OS family, further reducing fragmentation.
@ -64,12 +65,12 @@ While Windows 10 updates could have been controlled as cumulative from "Day 1,"
Customers saw the LCU model used for Windows 10 as having packages that were too large and represented too much of a change for legacy operating systems, so a different model was implemented. Windows instead offered one cumulative package (Monthly Rollup) and one individual package (Security Only) for all legacy operating systems. Customers saw the LCU model used for Windows 10 as having packages that were too large and represented too much of a change for legacy operating systems, so a different model was implemented. Windows instead offered one cumulative package (Monthly Rollup) and one individual package (Security Only) for all legacy operating systems.
The Monthly Rollup includes new non-security (if appropriate), security updates, Internet Explorer (IE) updates, and all updates from the previous month similar to the Windows 10 model. The Security-only package includes only new security updates for the month. This means that any security updates from any previous month are not included in current month’s Security-Only Package. If a Security-Only update is missed, it is missed. Those updates will not appear in a future Security-Only update. Additionally, a cumulative package is offered for IE, which can be tested and installed separately, reducing the total update package size. The IE cumulative update includes both security and non-security fixes following the same model as Windows 10. The Monthly Rollup includes new non-security (if appropriate), security updates, Internet Explorer (IE) updates, and all updates from the previous month similar to the Windows 10 model. The Security-only package includes only new security updates for the month. This means that any security updates from any previous month are not included in current month's Security-Only Package. If a Security-Only update is missed, it is missed. Those updates will not appear in a future Security-Only update. Additionally, a cumulative package is offered for IE, which can be tested and installed separately, reducing the total update package size. The IE cumulative update includes both security and non-security fixes following the same model as Windows 10.
![Legacy OS security-only update model](images/security-only-update.png) ![Legacy OS security-only update model](images/security-only-update.png)
*Figure 2.0 - Legacy OS security-only update model* *Figure 2.0 - Legacy OS security-only update model*
Moving to the cumulative model for legacy OS versions continues to improve predictability of update quality. The Windows legacy environments which have fully updated machines with Monthly Rollups are running the same baseline against which all legacy OS version updates are tested. These include all of the updates (security and non-security) prior to and after October 2016. Many customer environments do not have all updates prior to this change installed, which leaves some continued fragmentation in the ecosystem. Further, customers who are installing Security-Only Updates and potentially doing so inconsistently are also more fragmented than Microsoft’s test environments for legacy OS version. This remaining fragmentation results in issues like those seen when the September 2016 Servicing Stack Update (SSU) was needed for smooth installation of the August 2018 security update. These environments did not have the SSU applied previously. Moving to the cumulative model for legacy OS versions continues to improve predictability of update quality. The Windows legacy environments which have fully updated machines with Monthly Rollups are running the same baseline against which all legacy OS version updates are tested. These include all of the updates (security and non-security) prior to and after October 2016. Many customer environments do not have all updates prior to this change installed, which leaves some continued fragmentation in the ecosystem. Further, customers who are installing Security-Only Updates and potentially doing so inconsistently are also more fragmented than Microsoft's test environments for legacy OS version. This remaining fragmentation results in issues like those seen when the September 2016 Servicing Stack Update (SSU) was needed for smooth installation of the August 2018 security update. These environments did not have the SSU applied previously.
### Points to consider ### Points to consider
- Windows 7 and Windows 8 legacy operating system updates [moved from individual to cumulative in October 2016](https://techcommunity.microsoft.com/t5/Windows-Blog-Archive/More-on-Windows-7-and-Windows-8-1-servicing-changes/ba-p/166783). Devices with updates missing prior to that point are still missing those updates, as they were not included in the subsequent cumulative packages. - Windows 7 and Windows 8 legacy operating system updates [moved from individual to cumulative in October 2016](https://techcommunity.microsoft.com/t5/Windows-Blog-Archive/More-on-Windows-7-and-Windows-8-1-servicing-changes/ba-p/166783). Devices with updates missing prior to that point are still missing those updates, as they were not included in the subsequent cumulative packages.
@ -83,7 +84,7 @@ Moving to the cumulative model for legacy OS versions continues to improve predi
- For [Windows Server 2008 SP2](https://cloudblogs.microsoft.com/windowsserver/2018/06/12/windows-server-2008-sp2-servicing-changes/), cumulative updates began in October 2018, and follow the same model as Windows 7. Updates for IE9 are included in those packages, as the last supported version of Internet Explorer for that Legacy OS version. - For [Windows Server 2008 SP2](https://cloudblogs.microsoft.com/windowsserver/2018/06/12/windows-server-2008-sp2-servicing-changes/), cumulative updates began in October 2018, and follow the same model as Windows 7. Updates for IE9 are included in those packages, as the last supported version of Internet Explorer for that Legacy OS version.
## Public preview releases ## Public preview releases
Lastly, the cumulative update model directly impacts the public Preview releases offered in the 3rd and/or 4th weeks of the month. Update Tuesday, also referred to as the "B" week release occurs on the second Tuesday of the month. It is always a required security update across all operating systems. In addition to this monthly release, Windows also releases non-security update "previews" targeting the 3rd (C) and the 4th (D) weeks of the month. These preview releases include that month’s B-release plus a set of non-security updates for testing and validation as a cumulative package. We recommend IT Administrators uses the C/D previews to test the update in their environments. Any issues identified with the updates in the C/D releases are identified and then fixed or removed, prior to being rolled up in to the next month’s B release package together with new security updates. Security-only Packages are not part of the C/D preview program. Lastly, the cumulative update model directly impacts the public Preview releases offered in the 3rd and/or 4th weeks of the month. Update Tuesday, also referred to as the "B" week release occurs on the second Tuesday of the month. It is always a required security update across all operating systems. In addition to this monthly release, Windows also releases non-security update "previews" targeting the 3rd (C) and the 4th (D) weeks of the month. These preview releases include that month's B-release plus a set of non-security updates for testing and validation as a cumulative package. We recommend IT Administrators uses the C/D previews to test the update in their environments. Any issues identified with the updates in the C/D releases are identified and then fixed or removed, prior to being rolled up in to the next month's B release package together with new security updates. Security-only Packages are not part of the C/D preview program.
> [!NOTE] > [!NOTE]
> Only preview updates for the most recent release of Windows 10 are published to Windows Server Update Services (WSUS). For customers using the WSUS channel, and products such as Microsoft Endpoint Configuration Manager that rely on it, will not see preview updates for older versions of Windows 10. > Only preview updates for the most recent release of Windows 10 are published to Windows Server Update Services (WSUS). For customers using the WSUS channel, and products such as Microsoft Endpoint Configuration Manager that rely on it, will not see preview updates for older versions of Windows 10.
@ -102,9 +103,9 @@ All of these updates are cumulative and build on each other for Windows 10. This
*Figure 3.0 - Preview releases within the Windows 10 LCU model* *Figure 3.0 - Preview releases within the Windows 10 LCU model*
## Previews vs. on-demand releases ## Previews vs. on-demand releases
In 2018, we experienced incidents which required urgent remediation that didn’t map to the monthly update release cadence. These incidents were situations that required an immediate fix to an Update Tuesday release. While Windows engineering worked aggressively to respond within a week of the B-release, these "on-demand" releases created confusion with the C Preview releases. In 2018, we experienced incidents which required urgent remediation that didn't map to the monthly update release cadence. These incidents were situations that required an immediate fix to an Update Tuesday release. While Windows engineering worked aggressively to respond within a week of the B-release, these "on-demand" releases created confusion with the C Preview releases.
As a general policy, if a Security-Only package has a regression, which is defined as an unintentional error in the code of an update, then the fix for that regression will be added to the next month’s Security-Only Update. The fix for that regression may also be offered as part an On-Demand release and will be rolled into the next Monthly Update. (Note: Exceptions do exist to this policy, based on timing.) As a general policy, if a Security-Only package has a regression, which is defined as an unintentional error in the code of an update, then the fix for that regression will be added to the next month's Security-Only Update. The fix for that regression may also be offered as part an On-Demand release and will be rolled into the next Monthly Update. (Note: Exceptions do exist to this policy, based on timing.)
### Point to consider ### Point to consider
- When Windows identifies an issue with a Update Tuesday release, engineering teams work to remediate or fix the issue as quickly as possible. The outcome is often a new update which may be released at any time, including during the 3rd or 4th week of the month. Such updates are independent of the regularly scheduled "C" and "D" update previews. These updates are created on-demand to remediate a customer impacting issue. In most cases they are qualified as a "non-security" update, and do not require a system reboot. - When Windows identifies an issue with a Update Tuesday release, engineering teams work to remediate or fix the issue as quickly as possible. The outcome is often a new update which may be released at any time, including during the 3rd or 4th week of the month. Such updates are independent of the regularly scheduled "C" and "D" update previews. These updates are created on-demand to remediate a customer impacting issue. In most cases they are qualified as a "non-security" update, and do not require a system reboot.

13
windows/deployment/update/waas-wu-settings.md
View File

@ -1,6 +1,6 @@
--- ---
title: Manage additional Windows Update settings (Windows 10) title: Manage additional Windows Update settings (Windows 10)
description: Additional settings to control the behavior of Windows Update (WU) in Windows 10 description: In this article, learn about additional settings to control the behavior of Windows Update in Windows 10.
ms.prod: w10 ms.prod: w10
ms.mktglfcycl: deploy ms.mktglfcycl: deploy
audience: itpro audience: itpro
@ -10,6 +10,7 @@ author: jaimeo
ms.reviewer: ms.reviewer:
manager: laurawi manager: laurawi
ms.topic: article ms.topic: article
ms.custom: seo-marvel-apr2020
--- ---
# Manage additional Windows Update settings # Manage additional Windows Update settings
@ -61,7 +62,7 @@ This setting lets you specify a server on your network to function as an interna
To use this setting in Group Policy, go to **Computer Configuration\Administrative Templates\Windows Components\Windows Update\Specify Intranet Microsoft update service location**. You must set two server name values: the server from which the Automatic Updates client detects and downloads updates, and the server to which updated workstations upload statistics. You can set both values to be the same server. An optional server name value can be specified to configure Windows Update Agent to download updates from an alternate download server instead of the intranet update service. To use this setting in Group Policy, go to **Computer Configuration\Administrative Templates\Windows Components\Windows Update\Specify Intranet Microsoft update service location**. You must set two server name values: the server from which the Automatic Updates client detects and downloads updates, and the server to which updated workstations upload statistics. You can set both values to be the same server. An optional server name value can be specified to configure Windows Update Agent to download updates from an alternate download server instead of the intranet update service.
If the setting is set to **Enabled**, the Automatic Updates client connects to the specified intranet Microsoft update service (or alternate download server), instead of Windows Update, to search for and download updates. Enabling this setting means that end users in your organization don’t have to go through a firewall to get updates, and it gives you the opportunity to test updates after deploying them. If the setting is set to **Enabled**, the Automatic Updates client connects to the specified intranet Microsoft update service (or alternate download server), instead of Windows Update, to search for and download updates. Enabling this setting means that end users in your organization don't have to go through a firewall to get updates, and it gives you the opportunity to test updates after deploying them.
If the setting is set to **Disabled** or **Not Configured**, and if Automatic Updates is not disabled by policy or user preference, the Automatic Updates client connects directly to the Windows Update site on the Internet. If the setting is set to **Disabled** or **Not Configured**, and if Automatic Updates is not disabled by policy or user preference, the Automatic Updates client connects directly to the Windows Update site on the Internet.
The alternate download server configures the Windows Update Agent to download files from an alternative download server instead of the intranet update service. The alternate download server configures the Windows Update Agent to download files from an alternative download server instead of the intranet update service.
@ -86,9 +87,9 @@ If the setting is set to **Enabled**, Windows will check for available updates a
If the setting is set to **Disabled** or **Not Configured**, Windows will check for available updates at the default interval of 22 hours. If the setting is set to **Disabled** or **Not Configured**, Windows will check for available updates at the default interval of 22 hours.
>[!NOTE] >[!NOTE]
>The “Specify intranet Microsoft update service location” setting must be enabled for this policy to have effect. >The "Specify intranet Microsoft update service location" setting must be enabled for this policy to have effect.
> >
>If the “Configure Automatic Updates” policy is disabled, this policy has no effect. >If the "Configure Automatic Updates" policy is disabled, this policy has no effect.
To configure this policy with MDM, use [DetectionFrequency](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#update-detectionfrequency). To configure this policy with MDM, use [DetectionFrequency](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#update-detectionfrequency).
@ -116,7 +117,7 @@ If the setting is set to **Disabled** or **Not Configured**, no target group inf
If the intranet Microsoft update service supports multiple target groups, this policy can specify multiple group names separated by semicolons. Otherwise, a single group must be specified. If the intranet Microsoft update service supports multiple target groups, this policy can specify multiple group names separated by semicolons. Otherwise, a single group must be specified.
>[!NOTE] >[!NOTE]
>This policy applies only when the intranet Microsoft update service the device is directed to is configured to support client-side targeting. If the “Specify intranet Microsoft update service location” policy is disabled or not configured, this policy has no effect. >This policy applies only when the intranet Microsoft update service the device is directed to is configured to support client-side targeting. If the "Specify intranet Microsoft update service location" policy is disabled or not configured, this policy has no effect.
### Allow signed updates from an intranet Microsoft update service location ### Allow signed updates from an intranet Microsoft update service location
@ -124,7 +125,7 @@ This policy setting allows you to manage whether Automatic Updates accepts updat
To configure this setting in Group Policy, go to **Computer Configuration\Administrative Templates\Windows Components\Windows update\Allow signed updates from an intranet Microsoft update service location**. To configure this setting in Group Policy, go to **Computer Configuration\Administrative Templates\Windows Components\Windows update\Allow signed updates from an intranet Microsoft update service location**.
If you enable this policy setting, Automatic Updates accepts updates received through an intranet Microsoft update service location, as specified by [Specify Intranet Microsoft update service location](#specify-intranet-microsoft-update-service-location), if they are signed by a certificate found in the “Trusted Publishers” certificate store of the local computer. If you enable this policy setting, Automatic Updates accepts updates received through an intranet Microsoft update service location, as specified by [Specify Intranet Microsoft update service location](#specify-intranet-microsoft-update-service-location), if they are signed by a certificate found in the "Trusted Publishers" certificate store of the local computer.
If you disable or do not configure this policy setting, updates from an intranet Microsoft update service location must be signed by Microsoft. If you disable or do not configure this policy setting, updates from an intranet Microsoft update service location must be signed by Microsoft.
>[!NOTE] >[!NOTE]

22
windows/deployment/update/waas-wufb-intune.md
View File

@ -1,6 +1,6 @@
--- ---
title: Walkthrough use Intune to configure Windows Update for Business (Windows 10) title: Walkthrough use Intune to configure Windows Update for Business (Windows 10)
description: Configure Windows Update for Business settings using Microsoft Intune. description: In this article, learn how to configure Windows Update for Business settings using Microsoft Intune.
ms.prod: w10 ms.prod: w10
ms.mktglfcycl: manage ms.mktglfcycl: manage
audience: itpro audience: itpro
@ -29,7 +29,7 @@ author: jaimeo
> >
>In the following settings CB refers to Semi-Annual Channel (Targeted), while CBB refers to Semi-Annual Channel. >In the following settings CB refers to Semi-Annual Channel (Targeted), while CBB refers to Semi-Annual Channel.
You can use Intune to configure Windows Update for Business even if you don’t have on-premises infrastructure when you use Intune in conjunction with Azure AD. Before configuring Windows Update for Business, consider a [deployment strategy](waas-servicing-strategy-windows-10-updates.md) for updates and feature updates in your environment. You can use Intune to configure Windows Update for Business even if you don't have on-premises infrastructure when you use Intune in conjunction with Azure AD. Before configuring Windows Update for Business, consider a [deployment strategy](waas-servicing-strategy-windows-10-updates.md) for updates and feature updates in your environment.
Windows Update for Business in Windows 10 version 1511 allows you to delay quality updates up to 4 weeks and feature updates up to an additional 8 months after Microsoft releases builds to the Current Branch for Business (CBB) servicing branch. In Windows 10 version 1607 and later, you can delay quality updates for up to 30 days and feature updates up to an additional 180 days after the release of either a Current Branch (CB) or CBB build. Windows Update for Business in Windows 10 version 1511 allows you to delay quality updates up to 4 weeks and feature updates up to an additional 8 months after Microsoft releases builds to the Current Branch for Business (CBB) servicing branch. In Windows 10 version 1607 and later, you can delay quality updates for up to 30 days and feature updates up to an additional 180 days after the release of either a Current Branch (CB) or CBB build.
@ -42,7 +42,7 @@ To use Intune to manage quality and feature updates in your environment, you mus
In this example, you use two security groups to manage your updates: **Ring 4 Broad business users** and **Ring 5 Broad business users #2** from Table 1 in [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md). In this example, you use two security groups to manage your updates: **Ring 4 Broad business users** and **Ring 5 Broad business users #2** from Table 1 in [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md).
- The **Ring 4 Broad business users** group contains PCs of IT members who test the updates as soon as they’re released for Windows clients in the Current Branch for Business (CBB) servicing branch. This phase typically occurs after testing on Current Branch (CB) devices. - The **Ring 4 Broad business users** group contains PCs of IT members who test the updates as soon as they're released for Windows clients in the Current Branch for Business (CBB) servicing branch. This phase typically occurs after testing on Current Branch (CB) devices.
- The **Ring 5 Broad business users #2** group consists of the first line-of-business (LOB) users, who consume quality updates after 1 week and feature updates 1 month after the CBB release. - The **Ring 5 Broad business users #2** group consists of the first line-of-business (LOB) users, who consume quality updates after 1 week and feature updates 1 month after the CBB release.
>[!NOTE] >[!NOTE]
@ -69,9 +69,9 @@ In this example, you use two security groups to manage your updates: **Ring 4 Br
>[!NOTE] >[!NOTE]
>The OMA-URI settings are case sensitive, so be sure to review [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) for the proper syntax. >The OMA-URI settings are case sensitive, so be sure to review [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) for the proper syntax.
![Settings for this policy](images/waas-wufb-intune-step7a.png) ![Settings for the RequireDeferUpgrade policy](images/waas-wufb-intune-step7a.png)
8. For this deployment ring, you’re required to enable only CBB, so click **Save Policy**. 8. For this deployment ring, you're required to enable only CBB, so click **Save Policy**.
9. In the **Deploy Policy: Windows Update for Business – CBB1** dialog box, click **Yes**. 9. In the **Deploy Policy: Windows Update for Business – CBB1** dialog box, click **Yes**.
@ -156,7 +156,7 @@ In this example, you use three security groups from Table 1 in [Build deployment
>[!NOTE] >[!NOTE]
>The OMA-URI settings are case sensitive, so be sure to review [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) for the proper syntax. >The OMA-URI settings are case sensitive, so be sure to review [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) for the proper syntax.
![Settings for this policy](images/waas-wufb-intune-cb2a.png) ![Settings for the BranchReadinessLevel policy](images/waas-wufb-intune-cb2a.png)
8. Because the **Ring 2 Pilot Business Users** deployment ring receives the CB feature updates after 28 days, in the **OMA-URI Settings** section, click **Add** to add another OMA-URI setting. 8. Because the **Ring 2 Pilot Business Users** deployment ring receives the CB feature updates after 28 days, in the **OMA-URI Settings** section, click **Add** to add another OMA-URI setting.
@ -164,7 +164,7 @@ In this example, you use three security groups from Table 1 in [Build deployment
10. In the **OMA-URI** box, type **./Vendor/MSFT/Policy/Config/Update/DeferFeatureUpdatesPeriodInDays**. 10. In the **OMA-URI** box, type **./Vendor/MSFT/Policy/Config/Update/DeferFeatureUpdatesPeriodInDays**.
11. In the **Value** box, type **28**, and then click **OK**. 11. In the **Value** box, type **28**, and then click **OK**.
![Settings for this policy](images/waas-wufb-intune-step11a.png) ![Settings for the DeferFeatureUpdatesPeriodInDays policy step 11](images/waas-wufb-intune-step11a.png)
9. Click **Save Policy**. 9. Click **Save Policy**.
@ -175,7 +175,7 @@ In this example, you use three security groups from Table 1 in [Build deployment
10. In the **Manage Deployment: Windows Update for Business – CB2** dialog box, select the **Ring 2 Pilot Business Users** group, click **Add**, and then click **OK**. 10. In the **Manage Deployment: Windows Update for Business – CB2** dialog box, select the **Ring 2 Pilot Business Users** group, click **Add**, and then click **OK**.
You have now configured the **Ring 2 Pilot Business Users** deployment ring to enable CB feature update deferment for 14 days. Now, you must configure **Ring 4 Broad business users** to receive CBB features updates as soon as they’re available. You have now configured the **Ring 2 Pilot Business Users** deployment ring to enable CB feature update deferment for 14 days. Now, you must configure **Ring 4 Broad business users** to receive CBB features updates as soon as they're available.
### Configure Ring 4 Broad business users policy ### Configure Ring 4 Broad business users policy
@ -205,7 +205,7 @@ You have now configured the **Ring 2 Pilot Business Users** deployment ring to e
11. In the **Value** box, type **0**, and then click **OK**. 11. In the **Value** box, type **0**, and then click **OK**.
![Settings for this policy](images/waas-wufb-intune-cbb1a.png) ![Settings for the DeferFeatureUpdatesPeriodInDays policy for broad business](images/waas-wufb-intune-cbb1a.png)
12. Click **Save Policy**. 12. Click **Save Policy**.
@ -216,7 +216,7 @@ You have now configured the **Ring 2 Pilot Business Users** deployment ring to e
14. In the **Manage Deployment: Windows Update for Business – CBB1** dialog box, select the **Ring 4 Broad business users** group, click **Add**, and then click **OK**. 14. In the **Manage Deployment: Windows Update for Business – CBB1** dialog box, select the **Ring 4 Broad business users** group, click **Add**, and then click **OK**.
You have now configured the **Ring 4 Broad business users** deployment ring to receive CBB feature updates as soon as they’re available. Finally, configure **Ring 5 Broad business users #2** to accommodate a 7-day delay for quality updates and a 14-day delay for feature updates. You have now configured the **Ring 4 Broad business users** deployment ring to receive CBB feature updates as soon as they're available. Finally, configure **Ring 5 Broad business users #2** to accommodate a 7-day delay for quality updates and a 14-day delay for feature updates.
### Configure Ring 5 Broad business users \#2 policy ### Configure Ring 5 Broad business users \#2 policy
@ -255,7 +255,7 @@ You have now configured the **Ring 4 Broad business users** deployment ring to r
15. In the **Value** box, type **14**, and then click **OK**. 15. In the **Value** box, type **14**, and then click **OK**.
![Settings for this policy](images/waas-wufb-intune-cbb2a.png) ![Settings for the DeferFeatureUpdatesPeriodInDays policy](images/waas-wufb-intune-cbb2a.png)
16. Click **Save Policy**. 16. Click **Save Policy**.

1
windows/deployment/update/windows-update-error-reference.md
View File

@ -12,6 +12,7 @@ ms.date: 09/18/2018
ms.reviewer: ms.reviewer:
manager: laurawi manager: laurawi
ms.topic: article ms.topic: article
ms.custom: seo-marvel-apr2020
--- ---
# Windows Update error codes by component # Windows Update error codes by component

3
windows/deployment/update/windows-update-errors.md
View File

@ -1,6 +1,6 @@
--- ---
title: Windows Update common errors and mitigation title: Windows Update common errors and mitigation
description: Learn about some common issues you might experience with Windows Update description: In this article, learn about some common issues you might experience with Windows Update, as well as steps to resolve them.
ms.prod: w10 ms.prod: w10
ms.mktglfcycl: ms.mktglfcycl:
audience: itpro audience: itpro
@ -11,6 +11,7 @@ ms.date: 09/18/2018
ms.reviewer: ms.reviewer:
manager: laurawi manager: laurawi
ms.topic: article ms.topic: article
ms.custom: seo-marvel-apr2020
--- ---
# Windows Update common errors and mitigation # Windows Update common errors and mitigation

13
windows/deployment/update/windows-update-logs.md
View File

@ -11,6 +11,7 @@ ms.date: 09/18/2018
ms.reviewer: ms.reviewer:
manager: laurawi manager: laurawi
ms.topic: article ms.topic: article
ms.custom: seo-marvel-apr2020
--- ---
# Windows Update log files # Windows Update log files
@ -28,7 +29,7 @@ The following table describes the log files created by Windows Update.
|CBS.log|%systemroot%\Logs\CBS|This logs provides insight on the update installation part in the servicing stack.|To troubleshoot the issues related to WU installation.| |CBS.log|%systemroot%\Logs\CBS|This logs provides insight on the update installation part in the servicing stack.|To troubleshoot the issues related to WU installation.|
## Generating WindowsUpdate.log ## Generating WindowsUpdate.log
To merge and convert WU trace files (.etl files) into a single readable WindowsUpdate.log file, see [Get-WindowsUpdateLog](https://docs.microsoft.com/powershell/module/windowsupdate/get-windowsupdatelog?view=win10-ps). To merge and convert WU trace files (.etl files) into a single readable WindowsUpdate.log file, see [Get-WindowsUpdateLog](https://docs.microsoft.com/powershell/module/windowsupdate/get-windowsupdatelog?view=win10-ps&preserve-view=tru).
>[!NOTE] >[!NOTE]
>When you run the **Get-WindowsUpdateLog** cmdlet, an copy of WindowsUpdate.log file is created as a static log file. It does not update as the old WindowsUpate.log unless you run **Get-WindowsUpdateLog** again. >When you run the **Get-WindowsUpdateLog** cmdlet, an copy of WindowsUpdate.log file is created as a static log file. It does not update as the old WindowsUpate.log unless you run **Get-WindowsUpdateLog** again.
@ -64,7 +65,7 @@ The WU engine has different component names. The following are some of the most
- IdleTimer - Tracking active calls, stopping a service - IdleTimer - Tracking active calls, stopping a service
>[!NOTE] >[!NOTE]
>Many component log messages are invaluable if you are looking for problems in that specific area. However, they can be useless if you don't filter to exclude irrelevant components so that you can focus on what’s important. >Many component log messages are invaluable if you are looking for problems in that specific area. However, they can be useless if you don't filter to exclude irrelevant components so that you can focus on what's important.
### Windows Update log structure ### Windows Update log structure
The Windows update log structure is separated into four main identities: The Windows update log structure is separated into four main identities:
@ -112,7 +113,7 @@ Search for and identify the components that are associated with the IDs. Differe
#### Update identifiers #### Update identifiers
##### Update ID and revision number ##### Update ID and revision number
There are different identifiers for the same update in different contexts. It’s important to know the identifier schemes. There are different identifiers for the same update in different contexts. It's important to know the identifier schemes.
- Update ID: A GUID (indicated in the previous screen shot) that's assigned to a given update at publication time - Update ID: A GUID (indicated in the previous screen shot) that's assigned to a given update at publication time
- Revision number: A number incremented every time that a given update (that has a given update ID) is modified and republished on a service - Revision number: A number incremented every time that a given update (that has a given update ID) is modified and republished on a service
- Revision numbers are reused from one update to another (not a unique identifier). - Revision numbers are reused from one update to another (not a unique identifier).
@ -121,8 +122,8 @@ There are different identifiers for the same update in different contexts. It’
##### Revision ID ##### Revision ID
- A Revision ID (do no confuse this with “revision number”) is a serial number that's issued when an update is initially published or revised on a given service. - A Revision ID (do no confuse this with "revision number") is a serial number that's issued when an update is initially published or revised on a given service.
- An existing update that’s revised keeps the same update ID (GUID), has its revision number incremented (for example, from 100 to 101), but gets a completely new revision ID that is not related to the previous ID. - An existing update that's revised keeps the same update ID (GUID), has its revision number incremented (for example, from 100 to 101), but gets a completely new revision ID that is not related to the previous ID.
- Revision IDs are unique on a given update source, but not across multiple sources. - Revision IDs are unique on a given update source, but not across multiple sources.
- The same update revision may have completely different revision IDs on WU and WSUS. - The same update revision may have completely different revision IDs on WU and WSUS.
- The same revision ID may represent different updates on WU and WSUS. - The same revision ID may represent different updates on WU and WSUS.
@ -131,7 +132,7 @@ There are different identifiers for the same update in different contexts. It’
- Local ID is a serial number issued when an update is received from a service by a given WU client - Local ID is a serial number issued when an update is received from a service by a given WU client
- Usually seen in debug logs, especially involving the local cache for update info (Datastore) - Usually seen in debug logs, especially involving the local cache for update info (Datastore)
- Different client PCs will assign different Local IDs to the same update - Different client PCs will assign different Local IDs to the same update
- You can find the local IDs that a client is using by getting the client’s %WINDIR%\SoftwareDistribution\Datastore\Datastore.edb file - You can find the local IDs that a client is using by getting the client's %WINDIR%\SoftwareDistribution\Datastore\Datastore.edb file
##### Inconsistent terminology ##### Inconsistent terminology
- Sometimes the logs use terms inconsistently. For example, the InstalledNonLeafUpdateIDs list actually contains revision IDs, not update IDs. - Sometimes the logs use terms inconsistently. For example, the InstalledNonLeafUpdateIDs list actually contains revision IDs, not update IDs.

1
windows/deployment/update/windows-update-troubleshooting.md
View File

@ -10,6 +10,7 @@ author: jaimeo
ms.reviewer: ms.reviewer:
manager: laurawi manager: laurawi
ms.topic: article ms.topic: article
ms.custom: seo-marvel-apr2020
--- ---
# Windows Update troubleshooting # Windows Update troubleshooting

3
windows/deployment/update/wufb-basics.md
View File

@ -1,6 +1,7 @@
--- ---
title: Configure the Basic group policy for Windows Update for Business title: Configure the Basic group policy for Windows Update for Business
description: Learn how to get started using the Basic GPO in Windows Update for Business. description: In this article, you will learn how to configure the basic group policy for Windows Update for Business.
ms.custom: seo-marvel-apr2020
ms.prod: w10 ms.prod: w10
ms.mktglfcycl: manage ms.mktglfcycl: manage
audience: itpro audience: itpro

11
windows/deployment/update/wufb-compliancedeadlines.md
View File

@ -1,6 +1,7 @@
--- ---
title: Enforce compliance deadlines with policies in Windows Update for Business (Windows 10) title: Enforce compliance deadlines with policies in Windows Update for Business (Windows 10)
description: Learn how to enforce compliance deadlines using Windows Update for Business. description: This article contains information on how to enforce compliance deadlines using Windows Update for Business.
ms.custom: seo-marvel-apr2020
ms.prod: w10 ms.prod: w10
ms.mktglfcycl: manage ms.mktglfcycl: manage
author: jaimeo author: jaimeo
@ -151,17 +152,17 @@ Before the deadline the device will be in two states: auto-restart period and en
Notification users get for quality update engaged deadline: Notification users get for quality update engaged deadline:
![The notification users get for an impending engaged quality update deadline](images/wufb-quality-engaged-notification.png) ![The notification users get for an impending engaged quality update deadline example](images/wufb-quality-engaged-notification.png)
Notification users get for a quality update deadline: Notification users get for a quality update deadline:
![The notification users get for an impending quality update deadline](images/wufb-quality-notification.png) ![The notification users get for an impending quality update deadline example](images/wufb-quality-notification.png)
Notification users get for a feature update engaged deadline: Notification users get for a feature update engaged deadline:
![The notification users get for an impending feature update engaged deadline](images/wufb-feature-update-engaged-notification.png) ![The notification users get for an impending feature update engaged deadline example](images/wufb-feature-update-engaged-notification.png)
Notification users get for a feature update deadline: Notification users get for a feature update deadline:
![The notification users get for an impending feature update deadline](images/wufb-feature-update-deadline-notification.png) ![The notification users get for an impending feature update deadline example](images/wufb-feature-update-deadline-notification.png)

2
windows/deployment/update/wufb-onboard.md
View File

@ -1,6 +1,6 @@
--- ---
title: Onboarding to Windows Update for Business (Windows 10) title: Onboarding to Windows Update for Business (Windows 10)
description: Get started using Windows Update for Business, a tool that enables IT pros and power users to manage content they want to receive from Windows Update Service. description: Get started using Windows Update for Business, a tool that enables IT pros and power users to manage content they want to receive from Windows Update.
ms.prod: w10 ms.prod: w10
ms.mktglfcycl: manage ms.mktglfcycl: manage
audience: itpro audience: itpro

5
windows/deployment/upgrade/log-files.md
View File

@ -1,10 +1,11 @@
--- ---
title: Log files - Windows IT Pro title: Log files and resolving upgrade errors
ms.reviewer: ms.reviewer:
manager: laurawi manager: laurawi
ms.author: greglin ms.author: greglin
description: Learn how to interpret the log files generated during the Windows 10 upgrade process. description: Learn how to interpret and analyze the log files that are generated during the Windows 10 upgrade process.
keywords: deploy, error, troubleshoot, windows, 10, upgrade, code, rollback, ITPro keywords: deploy, error, troubleshoot, windows, 10, upgrade, code, rollback, ITPro
ms.custom: seo-marvel-apr2020
ms.prod: w10 ms.prod: w10
ms.mktglfcycl: deploy ms.mktglfcycl: deploy
ms.sitesec: library ms.sitesec: library

1
windows/deployment/upgrade/quick-fixes.md
View File

@ -5,6 +5,7 @@ manager: laurawi
ms.author: greglin ms.author: greglin
description: Learn how to quickly resolve many problems, which may come up during a Windows 10 upgrade. description: Learn how to quickly resolve many problems, which may come up during a Windows 10 upgrade.
keywords: deploy, error, troubleshoot, windows, 10, upgrade, code, rollback, ITPro keywords: deploy, error, troubleshoot, windows, 10, upgrade, code, rollback, ITPro
ms.custom: seo-marvel-apr2020
ms.prod: w10 ms.prod: w10
ms.mktglfcycl: deploy ms.mktglfcycl: deploy
ms.sitesec: library ms.sitesec: library

3
windows/deployment/upgrade/setupdiag.md
View File

@ -5,6 +5,7 @@ manager: laurawi
ms.author: greglin ms.author: greglin
description: SetupDiag works by examining Windows Setup log files. This article shows how to use the SetupDiag tool to diagnose Windows Setup errors. description: SetupDiag works by examining Windows Setup log files. This article shows how to use the SetupDiag tool to diagnose Windows Setup errors.
keywords: deploy, troubleshoot, windows, 10, upgrade, update, setup, diagnose keywords: deploy, troubleshoot, windows, 10, upgrade, update, setup, diagnose
ms.custom: seo-marvel-apr2020
ms.prod: w10 ms.prod: w10
ms.mktglfcycl: deploy ms.mktglfcycl: deploy
ms.sitesec: library ms.sitesec: library
@ -552,7 +553,7 @@ Refer to "https://docs.microsoft.com/windows/desktop/Debug/system-error-codes" f
## Sample registry key ## Sample registry key
![Addreg](./../images/addreg.png) ![Example of Addreg](./../images/addreg.png)
## Related topics ## Related topics

6
windows/deployment/usmt/getting-started-with-the-user-state-migration-tool.md
View File

@ -16,7 +16,7 @@ ms.topic: article
# Getting Started with the User State Migration Tool (USMT) # Getting Started with the User State Migration Tool (USMT)
This topic outlines the general process that you should follow to migrate files and settings. This topic outlines the general process that you should follow to migrate files and settings.
## In this Topic ## In this topic
- [Step 1: Plan Your Migration](#step-1-plan-your-migration) - [Step 1: Plan Your Migration](#step-1-plan-your-migration)
- [Step 2: Collect files and settings from the source computer](#step-2-collect-files-and-settings-from-the-source-computer) - [Step 2: Collect files and settings from the source computer](#step-2-collect-files-and-settings-from-the-source-computer)
@ -48,7 +48,7 @@ This topic outlines the general process that you should follow to migrate files
## Step 2: Collect files and settings from the source computer ## Step 2: Collect files and settings from the source computer
1. Back up the source computer. 1. Back up the source computer.
2. Close all applications. If some applications are running when you run the **ScanState** command, USMT might not migrate all of the specified data. For example, if Microsoft® Office Outlook® is open, USMT might not migrate PST files. 2. Close all applications. If some applications are running when you run the **ScanState** command, USMT might not migrate all of the specified data. For example, if Microsoft&reg; Office Outlook&reg; is open, USMT might not migrate PST files.
**Note**   **Note**  
USMT will fail if it cannot migrate a file or setting unless you specify the **/C** option. When you specify the **/C** option, USMT will ignore the errors, and log an error every time that it encounters a file that is being used that USMT did not migrate. You can use the **&lt;ErrorControl&gt;** section in the Config.xml file to specify which errors should be ignored, and which should cause the migration to fail. USMT will fail if it cannot migrate a file or setting unless you specify the **/C** option. When you specify the **/C** option, USMT will ignore the errors, and log an error every time that it encounters a file that is being used that USMT did not migrate. You can use the **&lt;ErrorControl&gt;** section in the Config.xml file to specify which errors should be ignored, and which should cause the migration to fail.
@ -68,7 +68,7 @@ This topic outlines the general process that you should follow to migrate files
2. Install all applications that were on the source computer. Although it is not always required, we recommend installing all applications on the destination computer before you restore the user state. This makes sure that migrated settings are preserved. 2. Install all applications that were on the source computer. Although it is not always required, we recommend installing all applications on the destination computer before you restore the user state. This makes sure that migrated settings are preserved.
**Note**   **Note**  
The application version that is installed on the destination computer should be the same version as the one on the source computer. USMT does not support migrating the settings for an older version of an application to a newer version. The exception to this is Microsoft® Office, which USMT can migrate from an older version to a newer version. The application version that is installed on the destination computer should be the same version as the one on the source computer. USMT does not support migrating the settings for an older version of an application to a newer version. The exception to this is Microsoft&reg; Office, which USMT can migrate from an older version to a newer version.
3. Close all applications. If some applications are running when you run the **LoadState** command, USMT might not migrate all of the specified data. For example, if Microsoft Office Outlook is open, USMT might not migrate PST files. 3. Close all applications. If some applications are running when you run the **LoadState** command, USMT might not migrate all of the specified data. For example, if Microsoft Office Outlook is open, USMT might not migrate PST files.

12
windows/deployment/usmt/offline-migration-reference.md
View File

@ -17,7 +17,7 @@ ms.topic: article
# Offline Migration Reference # Offline Migration Reference
Offline migration enables the ScanState tool to run inside a different Windows® operating system than the Windows operating system from which ScanState is gathering files and settings. There are two primary offline scenarios: Offline migration enables the ScanState tool to run inside a different Windows&reg; operating system than the Windows operating system from which ScanState is gathering files and settings. There are two primary offline scenarios:
- **Windows PE.** The ScanState tool can be run from within Windows PE, gathering files and settings from the offline Windows operating system on that machine. - **Windows PE.** The ScanState tool can be run from within Windows PE, gathering files and settings from the offline Windows operating system on that machine.
@ -31,7 +31,7 @@ When you use User State Migration Tool (USMT) 10.0 to gather and restore user s
- **New recovery scenario.** In scenarios where a machine no longer restarts properly, it might be possible to gather user state with the ScanState tool from within WinPE. - **New recovery scenario.** In scenarios where a machine no longer restarts properly, it might be possible to gather user state with the ScanState tool from within WinPE.
## In This Topic ## In This topic
- [What Will Migrate Offline?](#bkmk-whatwillmigrate) - [What Will Migrate Offline?](#bkmk-whatwillmigrate)
@ -61,7 +61,7 @@ The following user data and settings migrate offline, similar to an online migra
- EFS files - EFS files
- Internet Explorer® Favorites - Internet Explorer&reg; Favorites
For exceptions to what you can migrate offline, see [What Does USMT Migrate?](usmt-what-does-usmt-migrate.md) For exceptions to what you can migrate offline, see [What Does USMT Migrate?](usmt-what-does-usmt-migrate.md)
@ -192,7 +192,7 @@ The following system environment variables are necessary in the scenarios outlin
<tr class="even"> <tr class="even">
<td align="left"><p>MIG_OFFLINE_PLATFORM_ARCH</p></td> <td align="left"><p>MIG_OFFLINE_PLATFORM_ARCH</p></td>
<td align="left"><p>32 or 64</p></td> <td align="left"><p>32 or 64</p></td>
<td align="left"><p>While operating offline, this environment variable defines the architecture of the offline system, if the system does not match the WinPE and Scanstate.exe architecture. This environment variable enables the 32-bit ScanState application to gather data from a computer with 64-bit architecture, or the 64-bit ScanState application to gather data from a computer with 32-bit architecture. This is required when auto-detection of the offline architecture doesn’t function properly, for example, when the source system is running a 64-bit version of Windows XP. For example, to set this system environment variable for a 32-bit architecture, at a command prompt type the following:</p> <td align="left"><p>While operating offline, this environment variable defines the architecture of the offline system, if the system does not match the WinPE and Scanstate.exe architecture. This environment variable enables the 32-bit ScanState application to gather data from a computer with 64-bit architecture, or the 64-bit ScanState application to gather data from a computer with 32-bit architecture. This is required when auto-detection of the offline architecture doesn't function properly, for example, when the source system is running a 64-bit version of Windows XP. For example, to set this system environment variable for a 32-bit architecture, at a command prompt type the following:</p>
<pre class="syntax" space="preserve"><code>Set MIG_OFFLINE_PLATFORM_ARCH=32</code></pre></td> <pre class="syntax" space="preserve"><code>Set MIG_OFFLINE_PLATFORM_ARCH=32</code></pre></td>
</tr> </tr>
</tbody> </tbody>
@ -219,7 +219,7 @@ Syntax: &lt; winDir &gt; &lt;/ winDir &gt;
### <a href="" id="-path-"></a>&lt;path&gt; ### <a href="" id="-path-"></a>&lt;path&gt;
This element is a required child of **&lt;winDir&gt;** and contains a file path pointing to a valid Windows directory. Relative paths are interpreted from the ScanState tool’s working directory. This element is a required child of **&lt;winDir&gt;** and contains a file path pointing to a valid Windows directory. Relative paths are interpreted from the ScanState tool's working directory.
Syntax: &lt;path&gt; c:\\windows &lt;/path&gt; Syntax: &lt;path&gt; c:\\windows &lt;/path&gt;
@ -235,7 +235,7 @@ Syntax: &lt;mappings&gt; &lt;/mappings&gt;
### <a href="" id="-failonmultiplewindir-"></a>&lt;failOnMultipleWinDir&gt; ### <a href="" id="-failonmultiplewindir-"></a>&lt;failOnMultipleWinDir&gt;
This element is an optional child of **&lt;offline&gt;**. The **&lt;failOnMultipleWinDir&gt;** element allows the user to specify that the migration should fail when USMT detects that there are multiple instances of Windows installed on the source machine. When the **&lt;failOnMultipleWinDir&gt;** element isn’t present, the default behavior is that the migration does not fail. This element is an optional child of **&lt;offline&gt;**. The **&lt;failOnMultipleWinDir&gt;** element allows the user to specify that the migration should fail when USMT detects that there are multiple instances of Windows installed on the source machine. When the **&lt;failOnMultipleWinDir&gt;** element isn't present, the default behavior is that the migration does not fail.
Syntax: &lt;failOnMultipleWinDir&gt;1&lt;/failOnMultipleWinDir&gt; or Syntax: &lt;failOnMultipleWinDir&gt;0&lt;/failOnMultipleWinDir&gt; Syntax: &lt;failOnMultipleWinDir&gt;1&lt;/failOnMultipleWinDir&gt; or Syntax: &lt;failOnMultipleWinDir&gt;0&lt;/failOnMultipleWinDir&gt;

4
windows/deployment/usmt/understanding-migration-xml-files.md
View File

@ -21,7 +21,7 @@ You can modify the behavior of a basic User State Migration Tool (USMT)10.0 migr
This topic provides an overview of the default and custom migration XML files and includes guidelines for creating and editing a customized version of the MigDocs.xml file. The MigDocs.xml file uses the new **GenerateDocPatterns** function available in USMT to automatically find user documents on a source computer. This topic provides an overview of the default and custom migration XML files and includes guidelines for creating and editing a customized version of the MigDocs.xml file. The MigDocs.xml file uses the new **GenerateDocPatterns** function available in USMT to automatically find user documents on a source computer.
## In This Topic ## In This topic
[Overview of the Config.xml file](#bkmk-config) [Overview of the Config.xml file](#bkmk-config)
@ -435,7 +435,7 @@ In the examples below, the source computer has a .txt file called "new text docu
To exclude the new text document.txt file as well as any .txt files in “new folder”, you can do the following: To exclude the new text document.txt file as well as any .txt files in "new folder", you can do the following:
**Example 1: Exclude all .txt files in a folder** **Example 1: Exclude all .txt files in a folder**

3
windows/deployment/usmt/usmt-best-practices.md
View File

@ -1,6 +1,7 @@
--- ---
title: USMT Best Practices (Windows 10) title: USMT Best Practices (Windows 10)
description: Learn about general and security-related best practices when using User State Migration Tool (USMT) 10.0. description: This article discusses general and security-related best practices when using User State Migration Tool (USMT) 10.0.
ms.custom: seo-marvel-apr2020
ms.assetid: e3cb1e78-4230-4eae-b179-e6e9160542d2 ms.assetid: e3cb1e78-4230-4eae-b179-e6e9160542d2
ms.reviewer: ms.reviewer:
manager: laurawi manager: laurawi

12
windows/deployment/usmt/usmt-common-migration-scenarios.md
View File

@ -21,7 +21,7 @@ You use the User State Migration Tool (USMT) 10.0 when hardware and/or operatin
One common scenario when only the operating system, and not the hardware, is being upgraded is referred to as *PC refresh*. A second common scenario is known as *PC replacement*, where one piece of hardware is being replaced, typically by newer hardware and a newer operating system. One common scenario when only the operating system, and not the hardware, is being upgraded is referred to as *PC refresh*. A second common scenario is known as *PC replacement*, where one piece of hardware is being replaced, typically by newer hardware and a newer operating system.
## In This Topic ## In this topic
[PC Refresh](#bkmk-pcrefresh) [PC Refresh](#bkmk-pcrefresh)
@ -59,7 +59,7 @@ A company has just received funds to update the operating system on all of its c
1. On each computer, the administrator boots the machine into WinPE and runs the ScanState command-line tool, specifying the **/hardlink /nocompress** command-line options. ScanState saves the user state to a hard-link migration store on each computer, improving performance by minimizing network traffic as well as minimizing migration failures on computers with very limited space available on the hard drive. 1. On each computer, the administrator boots the machine into WinPE and runs the ScanState command-line tool, specifying the **/hardlink /nocompress** command-line options. ScanState saves the user state to a hard-link migration store on each computer, improving performance by minimizing network traffic as well as minimizing migration failures on computers with very limited space available on the hard drive.
2. On each computer, the administrator installs the company’s standard operating environment (SOE) which includes Windows 10 and other company applications. 2. On each computer, the administrator installs the company's standard operating environment (SOE) which includes Windows 10 and other company applications.
3. The administrator runs the LoadState command-line tool on each computer. LoadState restores each user state back to each computer. 3. The administrator runs the LoadState command-line tool on each computer. LoadState restores each user state back to each computer.
@ -89,7 +89,7 @@ A company has decided to update the operating system on all of its computers to
1. The administrator clean installs Windows 10 on each computer, making sure that the Windows.old directory is created by installing Windows 10 without formatting or repartitioning and by selecting a partition that contains the previous version of Windows. 1. The administrator clean installs Windows 10 on each computer, making sure that the Windows.old directory is created by installing Windows 10 without formatting or repartitioning and by selecting a partition that contains the previous version of Windows.
2. On each computer, the administrator installs the company’s SOE which includes company applications. 2. On each computer, the administrator installs the company's SOE which includes company applications.
3. The administrator runs the ScanState and LoadState command-line tools successively on each computer while specifying the **/hardlink /nocompress** command-line options. 3. The administrator runs the ScanState and LoadState command-line tools successively on each computer while specifying the **/hardlink /nocompress** command-line options.
@ -118,13 +118,13 @@ A company is allocating 20 new computers to users in the accounting department.
A company receives 50 new laptops for their managers and needs to reallocate 50 older laptops to new employees. In this scenario, an administrator runs the ScanState tool from the cmd prompt on each computer to collect the user states and save them to a server in a compressed migration store. A company receives 50 new laptops for their managers and needs to reallocate 50 older laptops to new employees. In this scenario, an administrator runs the ScanState tool from the cmd prompt on each computer to collect the user states and save them to a server in a compressed migration store.
1. The administrator runs the ScanState tool on each of the manager’s old laptops, and saves each user state to a server. 1. The administrator runs the ScanState tool on each of the manager's old laptops, and saves each user state to a server.
2. On the new laptops, the administrator installs the company's SOE, which includes Windows 10 and other company applications. 2. On the new laptops, the administrator installs the company's SOE, which includes Windows 10 and other company applications.
3. The administrator runs the LoadState tool on the new laptops to migrate the managers’ user states to the appropriate computer. The new laptops are now ready for the managers to use. 3. The administrator runs the LoadState tool on the new laptops to migrate the managers' user states to the appropriate computer. The new laptops are now ready for the managers to use.
4. On the old computers, the administrator installs the company’s SOE, which includes Windows 10, Microsoft Office, and other company applications. The old computers are now ready for the new employees to use. 4. On the old computers, the administrator installs the company's SOE, which includes Windows 10, Microsoft Office, and other company applications. The old computers are now ready for the new employees to use.
### <a href="" id="bkmk-threepcreplace"></a>Scenario Three: Managed network migration ### <a href="" id="bkmk-threepcreplace"></a>Scenario Three: Managed network migration

2
windows/deployment/usmt/usmt-configxml-file.md
View File

@ -33,7 +33,7 @@ To exclude a component from the Config.xml file, set the **migrate** value to **
## In This Topic ## In this topic
In USMT there are new migration policies that can be configured in the Config.xml file. For example, you can configure additional **&lt;ErrorControl&gt;**, **&lt;ProfileControl&gt;**, and **&lt;HardLinkStoreControl&gt;** options. The following elements and parameters are for use in the Config.xml file only. In USMT there are new migration policies that can be configured in the Config.xml file. For example, you can configure additional **&lt;ErrorControl&gt;**, **&lt;ProfileControl&gt;**, and **&lt;HardLinkStoreControl&gt;** options. The following elements and parameters are for use in the Config.xml file only.

2
windows/deployment/usmt/usmt-conflicts-and-precedence.md
View File

@ -31,7 +31,7 @@ When you include, exclude, and reroute files and settings, it is important to kn
- **You can use the &lt;unconditionalExclude&gt; element to globally exclude data.** This element excludes objects, regardless of any other &lt;include&gt; rules that are in the .xml files. For example, you can use the &lt;unconditionalExclude&gt; element to exclude all MP3 files on the computer or to exclude all files from C:\\UserData. - **You can use the &lt;unconditionalExclude&gt; element to globally exclude data.** This element excludes objects, regardless of any other &lt;include&gt; rules that are in the .xml files. For example, you can use the &lt;unconditionalExclude&gt; element to exclude all MP3 files on the computer or to exclude all files from C:\\UserData.
## In This Topic ## In this topic
**General** **General**

4
windows/deployment/usmt/usmt-hard-link-migration-store.md
View File

@ -19,7 +19,7 @@ ms.topic: article
A *hard-link migration store* enables you to perform an in-place migration where all user state is maintained on the computer while the old operating system is removed and the new operating system is installed; this is why it is best suited for the computer-refresh scenario. Use of a hard-link migration store for a computer-refresh scenario drastically improves migration performance and significantly reduces hard-disk utilization, reduces deployment costs and enables entirely new migration scenarios. A *hard-link migration store* enables you to perform an in-place migration where all user state is maintained on the computer while the old operating system is removed and the new operating system is installed; this is why it is best suited for the computer-refresh scenario. Use of a hard-link migration store for a computer-refresh scenario drastically improves migration performance and significantly reduces hard-disk utilization, reduces deployment costs and enables entirely new migration scenarios.
## In This Topic ## In this topic
[When to Use a Hard-Link Migration](#bkmk-when) [When to Use a Hard-Link Migration](#bkmk-when)
@ -75,7 +75,7 @@ A hard link can only be created for a file on the same volume. If you copy a har
For more information about hard links, please see [Hard Links and Junctions](https://go.microsoft.com/fwlink/p/?LinkId=132934) For more information about hard links, please see [Hard Links and Junctions](https://go.microsoft.com/fwlink/p/?LinkId=132934)
In most aspects, a hard-link migration store is identical to an uncompressed migration store. It is located where specified by the Scanstate command-line tool and you can view the contents of the store by using Windows® Explorer. Once created, it can be deleted or copied to another location without changing user state. Restoring a hard-link migration store is similar to restoring any other migration store; however, as with creating the store, the same hard-link functionality is used to keep files in-place. In most aspects, a hard-link migration store is identical to an uncompressed migration store. It is located where specified by the Scanstate command-line tool and you can view the contents of the store by using Windows&reg; Explorer. Once created, it can be deleted or copied to another location without changing user state. Restoring a hard-link migration store is similar to restoring any other migration store; however, as with creating the store, the same hard-link functionality is used to keep files in-place.
As a best practice, we recommend that you delete the hard-link migration store after you confirm that the Loadstate tool has successfully migrated the files. Since Loadstate has created new paths to the files on your new installation of a Windows operating system, deleting the hard links in the migration store will only delete one path to the files and will not delete the actual files or the paths to them from your new operating system. As a best practice, we recommend that you delete the hard-link migration store after you confirm that the Loadstate tool has successfully migrated the files. Since Loadstate has created new paths to the files on your new installation of a Windows operating system, deleting the hard links in the migration store will only delete one path to the files and will not delete the actual files or the paths to them from your new operating system.

2
windows/deployment/usmt/usmt-identify-users.md
View File

@ -18,7 +18,7 @@ ms.localizationpriority: medium
It is important to carefully consider how you plan to migrate users. By default, all users are migrated by User State Migration Tool (USMT) 5.0. You must specify which users to include by using the command line. You cannot specify users in the .xml files. For instructions on how to migrate users, see [Migrate User Accounts](usmt-migrate-user-accounts.md). It is important to carefully consider how you plan to migrate users. By default, all users are migrated by User State Migration Tool (USMT) 5.0. You must specify which users to include by using the command line. You cannot specify users in the .xml files. For instructions on how to migrate users, see [Migrate User Accounts](usmt-migrate-user-accounts.md).
## In This Topic ## In this topic
- [Migrating Local Accounts](#bkmk-8) - [Migrating Local Accounts](#bkmk-8)
- [Migrating Domain Accounts](#bkmk-9) - [Migrating Domain Accounts](#bkmk-9)

6
windows/deployment/usmt/usmt-loadstate-syntax.md
View File

@ -17,9 +17,9 @@ ms.topic: article
# LoadState Syntax # LoadState Syntax
This topic discusses the **LoadState** command syntax and options. This topic discusses the **LoadState** command syntax and options available with it.
## In This Topic ## In this topic
[Before You Begin](#before) [Before You Begin](#before)
@ -462,7 +462,7 @@ You can use the **/uel**, **/ue** and **/ui** options together to migrate only t
**The /ui option has precedence over the /ue and /uel options.** If a user is specified to be included using the **/ui** option, and also specified to be excluded using either the **/ue** or **/uel** options, the user will be included in the migration. For example, if you specify `/ui:contoso\* /ue:contoso\user1`, then User1 will be migrated, because the **/ui** option takes precedence over the **/ue** option. **The /ui option has precedence over the /ue and /uel options.** If a user is specified to be included using the **/ui** option, and also specified to be excluded using either the **/ue** or **/uel** options, the user will be included in the migration. For example, if you specify `/ui:contoso\* /ue:contoso\user1`, then User1 will be migrated, because the **/ui** option takes precedence over the **/ue** option.
**The /uel option takes precedence over the /ue option.** If a user has logged on within the specified time period set by the **/uel** option, that user’s profile will be migrated even if they are excluded by using the **/ue** option. For example, if you specify `/ue:contoso\user1 /uel:14`, the User1 will be migrated if they have logged on to the computer within the last 14 days. **The /uel option takes precedence over the /ue option.** If a user has logged on within the specified time period set by the **/uel** option, that user's profile will be migrated even if they are excluded by using the **/ue** option. For example, if you specify `/ue:contoso\user1 /uel:14`, the User1 will be migrated if they have logged on to the computer within the last 14 days.
<table> <table>
<colgroup> <colgroup>

10
windows/deployment/usmt/usmt-log-files.md
View File

@ -251,7 +251,7 @@ The following examples describe common scenarios in which you can use the diagno
**Why is this file not migrating when I authored an "include" rule for it?** **Why is this file not migrating when I authored an "include" rule for it?**
Let’s imagine that we have the following directory structure and that we want the “data” directory to be included in the migration along with the “New Text Document.txt” file in the “New Folder.” The directory of **C:\\data** contains: Let's imagine that we have the following directory structure and that we want the "data" directory to be included in the migration along with the "New Text Document.txt" file in the "New Folder." The directory of **C:\\data** contains:
``` ```
01/21/2009 10:08 PM <DIR> . 01/21/2009 10:08 PM <DIR> .
@ -293,7 +293,7 @@ To migrate these files you author the following migration XML:
</migration> </migration>
``` ```
However, upon testing the migration you notice that the “New Text Document.txt” file isn’t included in the migration. To troubleshoot this failure, the migration can be repeated with the environment variable MIG\_ENABLE\_DIAG set such that the diagnostic log is generated. Upon searching the diagnostic log for the component “DATA1”, the following XML section is discovered: However, upon testing the migration you notice that the "New Text Document.txt" file isn't included in the migration. To troubleshoot this failure, the migration can be repeated with the environment variable MIG\_ENABLE\_DIAG set such that the diagnostic log is generated. Upon searching the diagnostic log for the component "DATA1", the following XML section is discovered:
``` xml ``` xml
<MigUnitList> <MigUnitList>
@ -312,7 +312,7 @@ However, upon testing the migration you notice that the “New Text Document.txt
</Perform> </Perform>
``` ```
Analysis of this XML section reveals the migunit that was created when the migration rule was processed. The &lt;Perform&gt; section details the actual files that were scheduled for gathering and the result of the gathering operation. The “New Text Document.txt” file doesn’t appear in this section, which confirms that the migration rule was not correctly authored. Analysis of this XML section reveals the migunit that was created when the migration rule was processed. The &lt;Perform&gt; section details the actual files that were scheduled for gathering and the result of the gathering operation. The "New Text Document.txt" file doesn't appear in this section, which confirms that the migration rule was not correctly authored.
An analysis of the XML elements reference topic reveals that the &lt;pattern&gt; tag needs to be modified as follows: An analysis of the XML elements reference topic reveals that the &lt;pattern&gt; tag needs to be modified as follows:
@ -345,7 +345,7 @@ This diagnostic log confirms that the modified &lt;pattern&gt; value enables the
**Why is this file migrating when I authored an exclude rule excluding it?** **Why is this file migrating when I authored an exclude rule excluding it?**
In this scenario, you have the following directory structure and you want all files in the “data” directory to migrate, except for text files. The **C:\\Data** folder contains: In this scenario, you have the following directory structure and you want all files in the "data" directory to migrate, except for text files. The **C:\\Data** folder contains:
``` ```
Directory of C:\Data Directory of C:\Data
@ -395,7 +395,7 @@ You author the following migration XML:
</component> </component>
``` ```
However, upon testing the migration you notice that all the text files are still included in the migration. In order to troubleshoot this issue, the migration can be performed with the environment variable MIG\_ENABLE\_DIAG set so that the diagnostic log is generated. Upon searching the diagnostic log for the component “DATA1”, the following XML section is discovered: However, upon testing the migration you notice that all the text files are still included in the migration. In order to troubleshoot this issue, the migration can be performed with the environment variable MIG\_ENABLE\_DIAG set so that the diagnostic log is generated. Upon searching the diagnostic log for the component "DATA1", the following XML section is discovered:
``` xml ``` xml
<MigUnitList> <MigUnitList>

8
windows/deployment/usmt/usmt-overview.md
View File

@ -51,11 +51,3 @@ There are some scenarios in which the use of USMT is not recommended. These incl
## Related topics ## Related topics
- [User State Migration Tool (USMT) Technical Reference](usmt-technical-reference.md) - [User State Migration Tool (USMT) Technical Reference](usmt-technical-reference.md)
 

7
windows/deployment/usmt/usmt-technical-reference.md
View File

@ -12,6 +12,7 @@ audience: itpro
author: greg-lindsay author: greg-lindsay
ms.date: 04/19/2017 ms.date: 04/19/2017
ms.topic: article ms.topic: article
ms.custom: seo-marvel-apr2020
--- ---
# User State Migration Tool (USMT) Technical Reference # User State Migration Tool (USMT) Technical Reference
@ -37,12 +38,12 @@ USMT also includes a set of three modifiable .xml files:
Additionally, you can create custom .xml files to support your migration needs. You can also create a Config.xml file to specify files or settings to exclude from the migration. Additionally, you can create custom .xml files to support your migration needs. You can also create a Config.xml file to specify files or settings to exclude from the migration.
USMT tools can be used on several versions of Windows operating systems, for more information, see [USMT Requirements](usmt-requirements.md). For more information about previous releases of the USMT tools, see [User State Migration Tool (USMT) 4.0 User’s Guide](https://go.microsoft.com/fwlink/p/?LinkId=246564). USMT tools can be used on several versions of Windows operating systems, for more information, see [USMT Requirements](usmt-requirements.md). For more information about previous releases of the USMT tools, see [User State Migration Tool (USMT) 4.0 User's Guide](https://go.microsoft.com/fwlink/p/?LinkId=246564).
## In This Section ## In this section
|Topic |Description| |Topic |Description|
|------|-----------| |------|-----------|
|[User State Migration Tool (USMT) Overview Topics](usmt-topics.md)|Describes what’s new in USMT, how to get started with USMT, and the benefits and limitations of using USMT.| |[User State Migration Tool (USMT) Overview Topics](usmt-topics.md)|Describes what's new in USMT, how to get started with USMT, and the benefits and limitations of using USMT.|
|[User State Migration Tool (USMT) How-to topics](usmt-how-to.md)|Includes step-by-step instructions for using USMT, as well as how-to topics for conducting tasks in USMT.| |[User State Migration Tool (USMT) How-to topics](usmt-how-to.md)|Includes step-by-step instructions for using USMT, as well as how-to topics for conducting tasks in USMT.|
|[User State Migration Tool (USMT) Troubleshooting](usmt-troubleshooting.md)|Provides answers to frequently asked questions and common issues in USMT, as well as a reference for return codes used in USMT.| |[User State Migration Tool (USMT) Troubleshooting](usmt-troubleshooting.md)|Provides answers to frequently asked questions and common issues in USMT, as well as a reference for return codes used in USMT.|
|[User State Migration Toolkit (USMT) Reference](usmt-reference.md)|Includes reference information for migration planning, migration best practices, command-line syntax, using XML, and requirements for using USMT.| |[User State Migration Toolkit (USMT) Reference](usmt-reference.md)|Includes reference information for migration planning, migration best practices, command-line syntax, using XML, and requirements for using USMT.|

9
windows/deployment/usmt/usmt-test-your-migration.md
View File

@ -43,12 +43,3 @@ For testing purposes, you can create an uncompressed store using the **/hardlink
[Plan Your Migration](usmt-plan-your-migration.md) [Plan Your Migration](usmt-plan-your-migration.md)
[Log Files](usmt-log-files.md) [Log Files](usmt-log-files.md)

46
windows/deployment/usmt/usmt-xml-elements-library.md
View File

@ -17,12 +17,10 @@ ms.topic: article
# XML Elements Library # XML Elements Library
## Overview
This topic describes the XML elements and helper functions that you can employ to author migration .xml files to use with User State Migration Tool (USMT). It is assumed that you understand the basics of XML. . This topic describes the XML elements and helper functions that you can employ to author migration .xml files to use with User State Migration Tool (USMT). It is assumed that you understand the basics of XML. .
## In This Topic ## In this topic
In addition to XML elements and helper functions, this topic describes how to specify encoded locations and locations patterns, functions that are for internal USMT use only, and the version tags that you can use with helper functions. In addition to XML elements and helper functions, this topic describes how to specify encoded locations and locations patterns, functions that are for internal USMT use only, and the version tags that you can use with helper functions.
@ -326,7 +324,7 @@ Syntax:
## <a href="" id="component"></a>&lt;component&gt; ## <a href="" id="component"></a>&lt;component&gt;
The &lt;component&gt; element is required in a custom .xml file. This element defines the most basic construct of a migration .xml file. For example, in the MigApp.xml file, "Microsoft® Office 2003" is a component that contains another component, "Microsoft Office Access® 2003". You can use the child elements to define the component. The &lt;component&gt; element is required in a custom .xml file. This element defines the most basic construct of a migration .xml file. For example, in the MigApp.xml file, "Microsoft&reg; Office 2003" is a component that contains another component, "Microsoft Office Access&reg; 2003". You can use the child elements to define the component.
A component can be nested inside another component; that is, the &lt;component&gt; element can be a child of the &lt;role&gt; element within the &lt;component&gt; element in two cases: 1) when the parent &lt;component&gt; element is a container or 2) if the child &lt;component&gt; element has the same role as the parent &lt;component&gt; element. A component can be nested inside another component; that is, the &lt;component&gt; element can be a child of the &lt;role&gt; element within the &lt;component&gt; element in two cases: 1) when the parent &lt;component&gt; element is a container or 2) if the child &lt;component&gt; element has the same role as the parent &lt;component&gt; element.
@ -365,7 +363,7 @@ hidden="Yes|No"&gt;
<td align="left"><p>Yes</p></td> <td align="left"><p>Yes</p></td>
<td align="left"><p>You can use the following to group settings, and define the type of the component.</p> <td align="left"><p>You can use the following to group settings, and define the type of the component.</p>
<ul> <ul>
<li><p><strong>System:</strong> Operating system settings. All Windows® components are defined by this type.</p> <li><p><strong>System:</strong> Operating system settings. All Windows&reg; components are defined by this type.</p>
<p>When type=&quot;System&quot; and defaultSupported=&quot;FALSE&quot; the settings will not migrate unless there is an equivalent component in the .xml files that is specified on the LoadState command line. For example, the default MigSys.xml file contains components with type=&quot;System&quot; and defaultSupported=&quot;FALSE&quot;. If you specify this file on the ScanState command line, you must also specify the file on the LoadState command line for the settings to migrate. This is because the LoadState tool must detect an equivalent component. That is, the component must have the same migration urlid of the .xml file and an identical display name. Otherwise, the LoadState tool will not migrate those settings from the store. This is helpful when the source computer is running Windows XP, and you are migrating to both Windows Vista and Windows XP because you can use the same store for both destination computers.</p></li> <p>When type=&quot;System&quot; and defaultSupported=&quot;FALSE&quot; the settings will not migrate unless there is an equivalent component in the .xml files that is specified on the LoadState command line. For example, the default MigSys.xml file contains components with type=&quot;System&quot; and defaultSupported=&quot;FALSE&quot;. If you specify this file on the ScanState command line, you must also specify the file on the LoadState command line for the settings to migrate. This is because the LoadState tool must detect an equivalent component. That is, the component must have the same migration urlid of the .xml file and an identical display name. Otherwise, the LoadState tool will not migrate those settings from the store. This is helpful when the source computer is running Windows XP, and you are migrating to both Windows Vista and Windows XP because you can use the same store for both destination computers.</p></li>
<li><p><strong>Application:</strong> Settings for an application.</p></li> <li><p><strong>Application:</strong> Settings for an application.</p></li>
<li><p><strong>Device:</strong> Settings for a device.</p></li> <li><p><strong>Device:</strong> Settings for a device.</p></li>
@ -556,7 +554,7 @@ For example:
<tr class="odd"> <tr class="odd">
<td align="left"><p><em>OSType</em></p></td> <td align="left"><p><em>OSType</em></p></td>
<td align="left"><p>Yes</p></td> <td align="left"><p>Yes</p></td>
<td align="left"><p>Can be <strong>9x</strong> or <strong>NT</strong>. If <em>OSType</em> does not match the type of the current operating system, then it returns FALSE. For example, if the current operating system is Windows NT-based and <em>OSType</em> is “9x”, the result will be FALSE.</p></td> <td align="left"><p>Can be <strong>9x</strong> or <strong>NT</strong>. If <em>OSType</em> does not match the type of the current operating system, then it returns FALSE. For example, if the current operating system is Windows NT-based and <em>OSType</em> is "9x", the result will be FALSE.</p></td>
</tr> </tr>
<tr class="even"> <tr class="even">
<td align="left"><p><em>OSVersion</em></p></td> <td align="left"><p><em>OSVersion</em></p></td>
@ -598,7 +596,7 @@ For example:
<tr class="odd"> <tr class="odd">
<td align="left"><p><em>OSType</em></p></td> <td align="left"><p><em>OSType</em></p></td>
<td align="left"><p>Yes</p></td> <td align="left"><p>Yes</p></td>
<td align="left"><p>Can be <strong>9x</strong> or <strong>NT</strong>. If <em>OSType</em> does not match the type of the current operating system, then it returns FALSE. For example, if the current operating system is Windows NT-based and <em>OSType</em> is “9x” the result will be FALSE.</p></td> <td align="left"><p>Can be <strong>9x</strong> or <strong>NT</strong>. If <em>OSType</em> does not match the type of the current operating system, then it returns FALSE. For example, if the current operating system is Windows NT-based and <em>OSType</em> is "9x" the result will be FALSE.</p></td>
</tr> </tr>
<tr class="even"> <tr class="even">
<td align="left"><p><em>OSVersion</em></p></td> <td align="left"><p><em>OSVersion</em></p></td>
@ -3131,8 +3129,8 @@ This filter helper function can be used to filter the migration of files based o
<tr class="odd"> <tr class="odd">
<td align="left"><p>valueToCompare</p></td> <td align="left"><p>valueToCompare</p></td>
<td align="left"><p>The value we are comparing. For example:</p> <td align="left"><p>The value we are comparing. For example:</p>
<p>Date: “2008/05/15-2005/05/17”, “2008/05/15”</p> <p>Date: "2008/05/15-2005/05/17", "2008/05/15"</p>
<p>Size: A numeral with B, KB, MB, or GB at the end. “5GB”, “1KB-1MB”</p></td> <p>Size: A numeral with B, KB, MB, or GB at the end. "5GB", "1KB-1MB"</p></td>
</tr> </tr>
</tbody> </tbody>
</table> </table>
@ -3464,8 +3462,8 @@ Syntax:
</ul> </ul>
<p>You can either:</p> <p>You can either:</p>
<ol> <ol>
<li><p>Specify up to three &lt;role&gt; elements within a &lt;component&gt; — one “Binaries” role element, one “Settings” role element and one “Data” role element. These parameters do not change the migration behavior — their only purpose is to help you categorize the settings that you are migrating. You can nest these &lt;role&gt; elements, but each nested element must be of the same role parameter.</p></li> <li><p>Specify up to three &lt;role&gt; elements within a &lt;component&gt; — one "Binaries" role element, one "Settings" role element and one "Data" role element. These parameters do not change the migration behavior — their only purpose is to help you categorize the settings that you are migrating. You can nest these &lt;role&gt; elements, but each nested element must be of the same role parameter.</p></li>
<li><p>Specify one “Container” &lt;role&gt; element within a &lt;component&gt; element. In this case, you cannot specify any child &lt;rules&gt; elements, only other &lt;component&gt; elements. And each child &lt;component&gt; element must have the same type as that of parent &lt;component&gt; element. For example:</p></li> <li><p>Specify one "Container" &lt;role&gt; element within a &lt;component&gt; element. In this case, you cannot specify any child &lt;rules&gt; elements, only other &lt;component&gt; elements. And each child &lt;component&gt; element must have the same type as that of parent &lt;component&gt; element. For example:</p></li>
</ol> </ol>
<pre class="syntax" space="preserve"><code>&lt;component context=&quot;UserAndSystem&quot; type=&quot;Application&quot;&gt; <pre class="syntax" space="preserve"><code>&lt;component context=&quot;UserAndSystem&quot; type=&quot;Application&quot;&gt;
&lt;displayName _locID=&quot;migapp.msoffice2003&quot;&gt;Microsoft Office 2003&lt;/displayName&gt; &lt;displayName _locID=&quot;migapp.msoffice2003&quot;&gt;Microsoft Office 2003&lt;/displayName&gt;
@ -3846,7 +3844,7 @@ See the last component in the MigUser.xml file for an example of this element.
~~~ ~~~
**Example:** **Example:**
If GenerateUserPattens('File','%userprofile% \[\*.doc\]','FALSE') is called while USMT is processing user A, then this function will only generate patterns for users B and C. You can use this helper function to build complex rules. For example, to migrate all .doc files from the source computer — but if user X is not migrated, then do not migrate any of the .doc files from user X’s profile. If GenerateUserPattens('File','%userprofile% \[\*.doc\]','FALSE') is called while USMT is processing user A, then this function will only generate patterns for users B and C. You can use this helper function to build complex rules. For example, to migrate all .doc files from the source computer — but if user X is not migrated, then do not migrate any of the .doc files from user X's profile.
The following is example code for this scenario. The first &lt;rules&gt; element migrates all.doc files on the source computer with the exception of those inside C:\\Documents and Settings. The second &lt;rules&gt; elements will migrate all .doc files from C:\\Documents and Settings with the exception of the .doc files in the profiles of the other users. Because the second &lt;rules&gt; element will be processed in each migrated user context, the end result will be the desired behavior. The end result is the one we expected. The following is example code for this scenario. The first &lt;rules&gt; element migrates all.doc files on the source computer with the exception of those inside C:\\Documents and Settings. The second &lt;rules&gt; elements will migrate all .doc files from C:\\Documents and Settings with the exception of the .doc files in the profiles of the other users. Because the second &lt;rules&gt; element will be processed in each migrated user context, the end result will be the desired behavior. The end result is the one we expected.
@ -4103,12 +4101,12 @@ Syntax:
<tr class="odd"> <tr class="odd">
<td align="left"><p>name</p></td> <td align="left"><p>name</p></td>
<td align="left"><p>Yes</p></td> <td align="left"><p>Yes</p></td>
<td align="left"><p><em>ID</em> is a string value that is the name used to reference the environment variable. We recommend that <em>ID</em> start with the component’s name to avoid namespace collisions. For example, if your component’s name is MyComponent, and you want a variable that is your component’s install path, you could specify <code>MyComponent.InstallPath</code>.</p></td> <td align="left"><p><em>ID</em> is a string value that is the name used to reference the environment variable. We recommend that <em>ID</em> start with the component's name to avoid namespace collisions. For example, if your component's name is MyComponent, and you want a variable that is your component's install path, you could specify <code>MyComponent.InstallPath</code>.</p></td>
</tr> </tr>
<tr class="even"> <tr class="even">
<td align="left"><p>remap</p></td> <td align="left"><p>remap</p></td>
<td align="left"><p>No, default = FALSE</p></td> <td align="left"><p>No, default = FALSE</p></td>
<td align="left"><p>Specifies whether to evaluate this environment variable as a remapping environment variable. Objects that are located in a path that is underneath this environment variable’s value are automatically moved to where the environment variable points on the destination computer.</p></td> <td align="left"><p>Specifies whether to evaluate this environment variable as a remapping environment variable. Objects that are located in a path that is underneath this environment variable's value are automatically moved to where the environment variable points on the destination computer.</p></td>
</tr> </tr>
</tbody> </tbody>
</table> </table>
@ -4227,27 +4225,27 @@ The following functions are for internal USMT use only. Do not use them in an .x
You can use the following version tags with various helper functions: You can use the following version tags with various helper functions:
- “CompanyName” - "CompanyName"
- “FileDescription” - "FileDescription"
- “FileVersion” - "FileVersion"
- “InternalName” - "InternalName"
- “LegalCopyright” - "LegalCopyright"
- “OriginalFilename” - "OriginalFilename"
- “ProductName” - "ProductName"
- “ProductVersion” - "ProductVersion"
The following version tags contain values that can be compared: The following version tags contain values that can be compared:
- “FileVersion” - "FileVersion"
- “ProductVersion” - "ProductVersion"
## Related topics ## Related topics

1
windows/deployment/vda-subscription-activation.md
View File

@ -7,6 +7,7 @@ ms.author: greglin
author: greg-lindsay author: greg-lindsay
description: Learn how to configure virtual machines (VMs) to enable Windows 10 Subscription Activation in a Windows Virtual Desktop Access (VDA) scenario. description: Learn how to configure virtual machines (VMs) to enable Windows 10 Subscription Activation in a Windows Virtual Desktop Access (VDA) scenario.
keywords: upgrade, update, task sequence, deploy keywords: upgrade, update, task sequence, deploy
ms.custom: seo-marvel-apr2020
ms.prod: w10 ms.prod: w10
ms.mktglfcycl: deploy ms.mktglfcycl: deploy
ms.localizationpriority: medium ms.localizationpriority: medium

3
windows/deployment/volume-activation/activate-using-active-directory-based-activation-client.md
View File

@ -1,6 +1,7 @@
--- ---
title: Activate using Active Directory-based activation (Windows 10) title: Activate using Active Directory-based activation (Windows 10)
description: Active Directory-based activation is implemented as a role service that relies on AD DS to store activation objects. description: Learn how active directory-based activation is implemented as a role service that relies on AD DS to store activation objects.
ms.custom: seo-marvel-apr2020
ms.assetid: 08cce6b7-7b5b-42cf-b100-66c363a846af ms.assetid: 08cce6b7-7b5b-42cf-b100-66c363a846af
ms.reviewer: ms.reviewer:
manager: laurawi manager: laurawi

4
windows/deployment/volume-activation/configure-client-computers-vamt.md
View File

@ -24,8 +24,8 @@ To enable the Volume Activation Management Tool (VAMT) to function correctly, ce
Organizations where the VAMT will be widely used may benefit from making these changes inside the master image for Windows. Organizations where the VAMT will be widely used may benefit from making these changes inside the master image for Windows.
> [IMPORTANT]   > [IMPORTANT]
> This procedure only applies to clients running Windows Vista or later. For clients running Windows XP Service Pack 1, see [Connecting Through Windows Firewall](https://docs.microsoft.com/windows/win32/wmisdk/connecting-to-wmi-remotely-with-vbscript). > This procedure only applies to clients running Windows Vista or later. For clients running Windows XP Service Pack 1, see [Connecting Through Windows Firewall](https://docs.microsoft.com/windows/win32/wmisdk/connecting-to-wmi-remotely-with-vbscript).
## Configuring the Windows Firewall to allow VAMT access ## Configuring the Windows Firewall to allow VAMT access

7
windows/deployment/volume-activation/volume-activation-management-tool.md
View File

@ -13,13 +13,14 @@ audience: itpro
author: greg-lindsay author: greg-lindsay
ms.date: 04/25/2017 ms.date: 04/25/2017
ms.topic: article ms.topic: article
ms.custom: seo-marvel-apr2020
--- ---
# Volume Activation Management Tool (VAMT) Technical Reference # Volume Activation Management Tool (VAMT) Technical Reference
The Volume Activation Management Tool (VAMT) enables network administrators and other IT professionals to automate and centrally manage the Windows®, Microsoft® Office, and select other Microsoft products volume and retail-activation process. The Volume Activation Management Tool (VAMT) enables network administrators and other IT professionals to automate and centrally manage the Windows&reg;, Microsoft&reg; Office, and select other Microsoft products volume and retail-activation process.
VAMT can manage volume activation using Multiple Activation Keys (MAKs) or the Windows Key Management Service (KMS). VAMT is a standard Microsoft Management Console (MMC) snap-in that requires the Microsoft Management Console (MMC) 3.0. VAMT can be installed on any computer that has one of the following Windows operating systems: VAMT can manage volume activation using Multiple Activation Keys (MAKs) or the Windows Key Management Service (KMS). VAMT is a standard Microsoft Management Console (MMC) snap-in that requires the Microsoft Management Console (MMC) 3.0. VAMT can be installed on any computer that has one of the following Windows operating systems:
- Windows® 7 or above - Windows&reg; 7 or above
- Windows Server 2008 R2 or above - Windows Server 2008 R2 or above
@ -28,7 +29,7 @@ VAMT is designed to manage volume activation for: Windows 7, Windows 8, Window
VAMT is only available in an EN-US (x86) package. VAMT is only available in an EN-US (x86) package.
## In this Section ## In this section
|Topic |Description | |Topic |Description |
|------|------------| |------|------------|

2
windows/deployment/windows-10-deployment-tools-reference.md
View File

@ -26,5 +26,5 @@ Learn about the tools available to deploy Windows 10.
|[Configure a PXE server to load Windows PE](configure-a-pxe-server-to-load-windows-pe.md) |This guide describes how to configure a PXE server to load Windows PE by booting a client computer from the network. | |[Configure a PXE server to load Windows PE](configure-a-pxe-server-to-load-windows-pe.md) |This guide describes how to configure a PXE server to load Windows PE by booting a client computer from the network. |
|[Windows ADK for Windows 10 scenarios for IT Pros](windows-adk-scenarios-for-it-pros.md) |The Windows Assessment and Deployment Kit (Windows ADK) contains tools that can be used by IT Pros to deploy Windows. | |[Windows ADK for Windows 10 scenarios for IT Pros](windows-adk-scenarios-for-it-pros.md) |The Windows Assessment and Deployment Kit (Windows ADK) contains tools that can be used by IT Pros to deploy Windows. |
|[Deploy Windows To Go in your organization](deploy-windows-to-go.md) |This topic helps you to deploy Windows To Go in your organization. Before you begin deployment, make sure that you have reviewed the topics [Windows To Go: feature overview](planning/windows-to-go-overview.md) and [Prepare your organization for Windows To Go](planning/prepare-your-organization-for-windows-to-go.md) to ensure that you have the correct hardware and are prepared to complete the deployment. You can then use the steps in this topic to start your Windows To Go deployment. | |[Deploy Windows To Go in your organization](deploy-windows-to-go.md) |This topic helps you to deploy Windows To Go in your organization. Before you begin deployment, make sure that you have reviewed the topics [Windows To Go: feature overview](planning/windows-to-go-overview.md) and [Prepare your organization for Windows To Go](planning/prepare-your-organization-for-windows-to-go.md) to ensure that you have the correct hardware and are prepared to complete the deployment. You can then use the steps in this topic to start your Windows To Go deployment. |
|[Volume Activation Management Tool (VAMT) Technical Reference](volume-activation/volume-activation-management-tool.md) |The Volume Activation Management Tool (VAMT) enables network administrators and other IT professionals to automate and centrally manage the Windows®, Microsoft® Office, and select other Microsoft products volume and retail-activation process. | |[Volume Activation Management Tool (VAMT) Technical Reference](volume-activation/volume-activation-management-tool.md) |The Volume Activation Management Tool (VAMT) enables network administrators and other IT professionals to automate and centrally manage the Windows&reg;, Microsoft&reg; Office, and select other Microsoft products volume and retail-activation process. |
|[User State Migration Tool (USMT) Technical Reference](usmt/usmt-technical-reference.md) |The User State Migration Tool (USMT) 10.0 is included with the Windows Assessment and Deployment Kit (Windows ADK) for Windows 10. USMT provides a highly customizable user-profile migration experience for IT professionals | |[User State Migration Tool (USMT) Technical Reference](usmt/usmt-technical-reference.md) |The User State Migration Tool (USMT) 10.0 is included with the Windows Assessment and Deployment Kit (Windows ADK) for Windows 10. USMT provides a highly customizable user-profile migration experience for IT professionals |

2
windows/deployment/windows-10-deployment-tools.md
View File

@ -26,5 +26,5 @@ Learn about the tools available to deploy Windows 10.
|[Configure a PXE server to load Windows PE](configure-a-pxe-server-to-load-windows-pe.md) |This guide describes how to configure a PXE server to load Windows PE by booting a client computer from the network. | |[Configure a PXE server to load Windows PE](configure-a-pxe-server-to-load-windows-pe.md) |This guide describes how to configure a PXE server to load Windows PE by booting a client computer from the network. |
|[Windows ADK for Windows 10 scenarios for IT Pros](windows-adk-scenarios-for-it-pros.md) |The Windows Assessment and Deployment Kit (Windows ADK) contains tools that can be used by IT Pros to deploy Windows. | |[Windows ADK for Windows 10 scenarios for IT Pros](windows-adk-scenarios-for-it-pros.md) |The Windows Assessment and Deployment Kit (Windows ADK) contains tools that can be used by IT Pros to deploy Windows. |
|[Deploy Windows To Go in your organization](deploy-windows-to-go.md) |This topic helps you to deploy Windows To Go in your organization. Before you begin deployment, make sure that you have reviewed the topics [Windows To Go: feature overview](planning/windows-to-go-overview.md) and [Prepare your organization for Windows To Go](planning/prepare-your-organization-for-windows-to-go.md) to ensure that you have the correct hardware and are prepared to complete the deployment. You can then use the steps in this topic to start your Windows To Go deployment. | |[Deploy Windows To Go in your organization](deploy-windows-to-go.md) |This topic helps you to deploy Windows To Go in your organization. Before you begin deployment, make sure that you have reviewed the topics [Windows To Go: feature overview](planning/windows-to-go-overview.md) and [Prepare your organization for Windows To Go](planning/prepare-your-organization-for-windows-to-go.md) to ensure that you have the correct hardware and are prepared to complete the deployment. You can then use the steps in this topic to start your Windows To Go deployment. |
|[Volume Activation Management Tool (VAMT) Technical Reference](volume-activation/volume-activation-management-tool.md) |The Volume Activation Management Tool (VAMT) enables network administrators and other IT professionals to automate and centrally manage the Windows®, Microsoft® Office, and select other Microsoft products volume and retail-activation process. | |[Volume Activation Management Tool (VAMT) Technical Reference](volume-activation/volume-activation-management-tool.md) |The Volume Activation Management Tool (VAMT) enables network administrators and other IT professionals to automate and centrally manage the Windows&reg;, Microsoft&reg; Office, and select other Microsoft products volume and retail-activation process. |
|[User State Migration Tool (USMT) Technical Reference](usmt/usmt-technical-reference.md) |The User State Migration Tool (USMT) 10.0 is included with the Windows Assessment and Deployment Kit (Windows ADK) for Windows 10. USMT provides a highly customizable user-profile migration experience for IT professionals | |[User State Migration Tool (USMT) Technical Reference](usmt/usmt-technical-reference.md) |The User State Migration Tool (USMT) 10.0 is included with the Windows Assessment and Deployment Kit (Windows ADK) for Windows 10. USMT provides a highly customizable user-profile migration experience for IT professionals |

3
windows/deployment/windows-10-poc-mdt.md
View File

@ -1,6 +1,7 @@
--- ---
title: Step by step - Deploy Windows 10 in a test lab using MDT title: Step by step - Deploy Windows 10 in a test lab using MDT
description: Deploy Windows 10 in a test lab using Microsoft Deployment Toolkit (MDT) description: In this article, you'll learn how to deploy Windows 10 in a test lab using Microsoft Deployment Toolkit (MDT).
ms.custom: seo-marvel-apr2020
ms.prod: w10 ms.prod: w10
ms.mktglfcycl: deploy ms.mktglfcycl: deploy
ms.sitesec: library ms.sitesec: library

5
windows/deployment/windows-10-poc-sc-config-mgr.md
View File

@ -1,6 +1,6 @@
--- ---
title: Step by step - Deploy Windows 10 using Microsoft Endpoint Configuration Manager title: Steps to deploy Windows 10 with Microsoft Endpoint Configuration Manager
description: Deploy Windows 10 in a test lab using Microsoft Endpoint Configuration Manager description: In this article, you'll learn how to deploy Windows 10 in a test lab using Microsoft endpoint configuration manager.
ms.prod: w10 ms.prod: w10
ms.mktglfcycl: deploy ms.mktglfcycl: deploy
ms.sitesec: library ms.sitesec: library
@ -14,6 +14,7 @@ ms.author: greglin
author: greg-lindsay author: greg-lindsay
audience: itpro audience: itpro
ms.topic: article ms.topic: article
ms.custom: seo-marvel-apr2020
--- ---
# Deploy Windows 10 in a test lab using Microsoft Endpoint Configuration Manager # Deploy Windows 10 in a test lab using Microsoft Endpoint Configuration Manager

3
windows/deployment/windows-10-poc.md
View File

@ -1,11 +1,12 @@
--- ---
title: Configure a test lab to deploy Windows 10 title: Configure a test lab to deploy Windows 10
description: In this article, you will learn about concepts and procedures for deploying Windows 10 in a proof of concept lab environment.
ms.custom: seo-marvel-apr2020
ms.reviewer: ms.reviewer:
manager: laurawi manager: laurawi
ms.audience: itpro ms.audience: itpro
ms.author: greglin ms.author: greglin
author: greg-lindsay author: greg-lindsay
description: Concepts and procedures for deploying Windows 10 in a proof of concept lab environment.
ms.prod: w10 ms.prod: w10
ms.mktglfcycl: deploy ms.mktglfcycl: deploy
ms.sitesec: library ms.sitesec: library

26
windows/deployment/windows-10-subscription-activation.md
View File

@ -1,7 +1,8 @@
--- ---
title: Windows 10 Subscription Activation title: Windows 10 Subscription Activation
description: How to dynamically enable Windows 10 Enterprise or Education subscriptions description: In this article, you will learn how to dynamically enable Windows 10 Enterprise or Education subscriptions.
keywords: upgrade, update, task sequence, deploy keywords: upgrade, update, task sequence, deploy
ms.custom: seo-marvel-apr2020
ms.prod: w10 ms.prod: w10
ms.mktglfcycl: deploy ms.mktglfcycl: deploy
ms.localizationpriority: medium ms.localizationpriority: medium
@ -39,7 +40,7 @@ Organizations that have an Enterprise agreement can also benefit from the new se
Subscription Activation for Education works the same as the Enterprise version, but in order to use Subscription Activation for Education, you must have a device running Windows 10 Pro Education, version 1903 or later and an active subscription plan with a Windows 10 Enterprise license. For more information, see the [requirements](#windows-10-education-requirements) section. Subscription Activation for Education works the same as the Enterprise version, but in order to use Subscription Activation for Education, you must have a device running Windows 10 Pro Education, version 1903 or later and an active subscription plan with a Windows 10 Enterprise license. For more information, see the [requirements](#windows-10-education-requirements) section.
## In this article ## Summary
- [Inherited Activation](#inherited-activation): Description of a new feature available in Windows 10, version 1803 and later. - [Inherited Activation](#inherited-activation): Description of a new feature available in Windows 10, version 1803 and later.
- [The evolution of Windows 10 deployment](#the-evolution-of-deployment): A short history of Windows deployment. - [The evolution of Windows 10 deployment](#the-evolution-of-deployment): A short history of Windows deployment.
@ -60,7 +61,6 @@ To support Inherited Activation, both the host computer and the VM must be runni
## The evolution of deployment ## The evolution of deployment
> [!NOTE]
> The original version of this section can be found at [Changing between Windows SKUs](https://blogs.technet.microsoft.com/mniehaus/2017/10/09/changing-between-windows-skus/). > The original version of this section can be found at [Changing between Windows SKUs](https://blogs.technet.microsoft.com/mniehaus/2017/10/09/changing-between-windows-skus/).
The following figure illustrates how deploying Windows 10 has evolved with each release. With this release, deployment is automatic. The following figure illustrates how deploying Windows 10 has evolved with each release. With this release, deployment is automatic.
@ -105,9 +105,9 @@ If the device is running Windows 10, version 1809 or later:
1. Windows 10, version 1809 must be updated with [KB4497934](https://support.microsoft.com/help/4497934/windows-10-update-kb4497934). Later versions of Windows 10 automatically include this patch. 1. Windows 10, version 1809 must be updated with [KB4497934](https://support.microsoft.com/help/4497934/windows-10-update-kb4497934). Later versions of Windows 10 automatically include this patch.
2. When the user signs in on a Hybrid Azure AD joined device with MFA enabled, a notification will indicate that there is a problem. Click the notification and then click **Fix now** to step through the subscription activation process. See the example below: 2. When the user signs in on a Hybrid Azure AD joined device with MFA enabled, a notification will indicate that there is a problem. Click the notification and then click **Fix now** to step through the subscription activation process. See the example below:
![Subscription Activation with MFA1](images/sa-mfa1.png)<br> ![Subscription Activation with MFA example 1](images/sa-mfa1.png)<br>
![Subscription Activation with MFA2](images/sa-mfa2.png)<br> ![Subscription Activation with MFA example 2](images/sa-mfa2.png)<br>
![Subscription Activation with MFA2](images/sa-mfa3.png) ![Subscription Activation with MFA example 3](images/sa-mfa3.png)
### Windows 10 Education requirements ### Windows 10 Education requirements
@ -116,8 +116,8 @@ If the device is running Windows 10, version 1809 or later:
3. The Education tenant must have an active subscription to Microsoft 365 with a Windows 10 Enterprise license or a Windows 10 Enterprise or Education subscription. 3. The Education tenant must have an active subscription to Microsoft 365 with a Windows 10 Enterprise license or a Windows 10 Enterprise or Education subscription.
4. Devices must be Azure AD-joined or Hybrid Azure AD joined. Workgroup-joined or Azure AD registered devices are not supported. 4. Devices must be Azure AD-joined or Hybrid Azure AD joined. Workgroup-joined or Azure AD registered devices are not supported.
> [!IMPORTANT] > If Windows 10 Pro is converted to Windows 10 Pro Education [using benefits available in Store for Education](https://docs.microsoft.com/education/windows/change-to-pro-education#change-using-microsoft-store-for-education), then the feature will not work. You will need to re-image the device using a Windows 10 Pro Education edition.
> If Windows 10 Pro is converted to Windows 10 Pro Education [by using benefits available in Store for Education](https://docs.microsoft.com/education/windows/change-to-pro-education#change-using-microsoft-store-for-education), then the feature will not work. You will need to re-image the device by using a Windows 10 Pro Education edition.
## Benefits ## Benefits
@ -154,10 +154,9 @@ Before Windows 10, version 1903:<br>
After Windows 10, version 1903:<br> After Windows 10, version 1903:<br>
![1903](images/after.png) ![1903](images/after.png)
> [!NOTE] Note:
> - A Windows 10 Pro Education device will only step up to Windows 10 Education edition when “Windows 10 Enterprise” license is assigned from M365 Admin center (as of May 2019). 1. A Windows 10 Pro Education device will only step up to Windows 10 Education edition when “Windows 10 Enterprise” license is assigned from M365 Admin center (as of May 2019).
> 2. A Windows 10 Pro device will only step up to Windows 10 Enterprise edition when “Windows 10 Enterprise” license is assigned from M365 Admin center (as of May 2019).
> - A Windows 10 Pro device will only step up to Windows 10 Enterprise edition when “Windows 10 Enterprise” license is assigned from M365 Admin center (as of May 2019).
### Scenarios ### Scenarios
@ -196,8 +195,7 @@ When you have the required Azure AD subscription, group-based licensing is the p
If you are running Windows 10, version 1803 or later, Subscription Activation will automatically pull the firmware-embedded Windows 10 activation key and activate the underlying Pro License. The license will then step-up to Windows 10 Enterprise using Subscription Activation. This automatically migrates your devices from KMS or MAK activated Enterprise to Subscription activated Enterprise. If you are running Windows 10, version 1803 or later, Subscription Activation will automatically pull the firmware-embedded Windows 10 activation key and activate the underlying Pro License. The license will then step-up to Windows 10 Enterprise using Subscription Activation. This automatically migrates your devices from KMS or MAK activated Enterprise to Subscription activated Enterprise.
> [!CAUTION] Caution: Firmware-embedded Windows 10 activation happens automatically only when we go through OOBE(Out Of Box Experience)
> Firmware-embedded Windows 10 activation happens automatically only when we go through the Out-of-Box Experience (OOBE).
If you are using Windows 10, version 1607, 1703, or 1709 and have already deployed Windows 10 Enterprise, but you want to move away from depending on KMS servers and MAK keys for Windows client machines, you can seamlessly transition as long as the computer has been activated with a firmware-embedded Windows 10 Pro product key. If you are using Windows 10, version 1607, 1703, or 1709 and have already deployed Windows 10 Enterprise, but you want to move away from depending on KMS servers and MAK keys for Windows client machines, you can seamlessly transition as long as the computer has been activated with a firmware-embedded Windows 10 Pro product key.

134
windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md
View File

@ -2,7 +2,7 @@
title: Demonstrate Autopilot deployment title: Demonstrate Autopilot deployment
ms.reviewer: ms.reviewer:
manager: laurawi manager: laurawi
description: Step-by-step instructions on how to set-up a Virtual Machine with a Windows Autopilot deployment description: In this article, find step-by-step instructions on how to set-up a Virtual Machine with a Windows Autopilot deployment.
keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune, upgrade keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune, upgrade
ms.prod: w10 ms.prod: w10
ms.mktglfcycl: deploy ms.mktglfcycl: deploy
@ -13,7 +13,9 @@ author: greg-lindsay
ms.author: greglin ms.author: greglin
ms.collection: M365-modern-desktop ms.collection: M365-modern-desktop
ms.topic: article ms.topic: article
ms.custom: autopilot ms.custom:
- autopilot
- seo-marvel-apr2020
--- ---
@ -218,20 +220,20 @@ PS C:\autopilot&gt;
Ensure the VM booted from the installation ISO, click **Next** then click **Install now** and complete the Windows installation process. See the following examples: Ensure the VM booted from the installation ISO, click **Next** then click **Install now** and complete the Windows installation process. See the following examples:
![Windows setup](images/winsetup1.png) ![Windows setup example 1](images/winsetup1.png)
![Windows setup](images/winsetup2.png) ![Windows setup example 2](images/winsetup2.png)
![Windows setup](images/winsetup3.png) ![Windows setup example 3](images/winsetup3.png)
![Windows setup](images/winsetup4.png) ![Windows setup example 4](images/winsetup4.png)
![Windows setup](images/winsetup5.png) ![Windows setup example 5](images/winsetup5.png)
![Windows setup](images/winsetup6.png) ![Windows setup example 6](images/winsetup6.png)
After the VM restarts, during OOBE, it’s fine to select **Set up for personal use** or **Domain join instead** and then choose an offline account on the **Sign in** screen. This will offer the fastest way to the desktop. For example: After the VM restarts, during OOBE, it's fine to select **Set up for personal use** or **Domain join instead** and then choose an offline account on the **Sign in** screen. This will offer the fastest way to the desktop. For example:
![Windows setup](images/winsetup7.png) ![Windows setup example 7](images/winsetup7.png)
Once the installation is complete, sign in and verify that you are at the Windows 10 desktop, then create your first Hyper-V checkpoint. Checkpoints are used to restore the VM to a previous state. You will create multiple checkpoints throughout this lab, which can be used later to go through the process again. Once the installation is complete, sign in and verify that you are at the Windows 10 desktop, then create your first Hyper-V checkpoint. Checkpoints are used to restore the VM to a previous state. You will create multiple checkpoints throughout this lab, which can be used later to go through the process again.
![Windows setup](images/winsetup8.png) ![Windows setup example 8](images/winsetup8.png)
To create your first checkpoint, open an elevated Windows PowerShell prompt on the computer running Hyper-V (not on the VM) and run the following: To create your first checkpoint, open an elevated Windows PowerShell prompt on the computer running Hyper-V (not on the VM) and run the following:
@ -244,7 +246,7 @@ Click on the **WindowsAutopilot** VM in Hyper-V Manager and verify that you see
## Capture the hardware ID ## Capture the hardware ID
> [!NOTE] > [!NOTE]
> Normally, the Device ID is captured by the OEM as they run the OA3 Tool on each device in the factory. The OEM then submits the 4K HH created by the OA3 Tool to Microsoft by submitting it with a Computer Build Report (CBR). For purposes of this lab, you are acting as the OEM (capturing the 4K HH), but you’re not going to use the OA3 Tool to capture the full 4K HH for various reasons (you’d have to install the OA3 tool, your device couldn’t have a volume license version of Windows, it’s a more complicated process than using a PS script, etc.). Instead, you’ll simulate running the OA3 tool by running a PowerShell script, which captures the device 4K HH just like the OA3 tool. > Normally, the Device ID is captured by the OEM as they run the OA3 Tool on each device in the factory. The OEM then submits the 4K HH created by the OA3 Tool to Microsoft by submitting it with a Computer Build Report (CBR). For purposes of this lab, you are acting as the OEM (capturing the 4K HH), but you're not going to use the OA3 Tool to capture the full 4K HH for various reasons (you'd have to install the OA3 tool, your device couldn't have a volume license version of Windows, it's a more complicated process than using a PS script, etc.). Instead, you'll simulate running the OA3 tool by running a PowerShell script, which captures the device 4K HH just like the OA3 tool.
Follow these steps to run the PS script: Follow these steps to run the PS script:
@ -303,7 +305,7 @@ Verify that there is an **AutopilotHWID.csv** file in the **c:\HWID** directory
![Serial number and hardware hash](images/hwid.png) ![Serial number and hardware hash](images/hwid.png)
You will need to upload this data into Intune to register your device for Autopilot, so it needs to be transferred to the computer you will use to access the Azure portal. If you are using a physical device instead of a VM, you can copy the file to a USB stick. If you’re using a VM, you can right-click the AutopilotHWID.csv file and copy it, then right-click and paste the file to your desktop (outside the VM). You will need to upload this data into Intune to register your device for Autopilot, so it needs to be transferred to the computer you will use to access the Azure portal. If you are using a physical device instead of a VM, you can copy the file to a USB stick. If you're using a VM, you can right-click the AutopilotHWID.csv file and copy it, then right-click and paste the file to your desktop (outside the VM).
If you have trouble copying and pasting the file, just view the contents in Notepad on the VM and copy the text into Notepad outside the VM. Do not use another text editor to do this. If you have trouble copying and pasting the file, just view the contents in Notepad on the VM and copy the text into Notepad outside the VM. Do not use another text editor to do this.
@ -331,11 +333,11 @@ For this lab, you need an AAD Premium subscription. You can tell if you have a
![MDM and Intune](images/mdm-intune2.png) ![MDM and Intune](images/mdm-intune2.png)
If the configuration blade shown above does not appear, it’s likely that you don’t have a **Premium** subscription. Auto-enrollment is a feature only available in AAD Premium. If the configuration blade shown above does not appear, it's likely that you don't have a **Premium** subscription. Auto-enrollment is a feature only available in AAD Premium.
To convert your Intune trial account to a free Premium trial account, navigate to **Azure Active Directory** > **Licenses** > **All products** > **Try / Buy** and select **Free trial** for Azure AD Premium, or EMS E5. To convert your Intune trial account to a free Premium trial account, navigate to **Azure Active Directory** > **Licenses** > **All products** > **Try / Buy** and select **Free trial** for Azure AD Premium, or EMS E5.
![Reset this PC final prompt](images/aad-lic1.png) ![License conversion option](images/aad-lic1.png)
## Configure company branding ## Configure company branding
@ -376,7 +378,7 @@ Your VM (or device) can be registered either via Intune or Microsoft Store for B
> [!NOTE] > [!NOTE]
> If menu items like **Windows enrollment** are not active for you, then look to the far-right blade in the UI. You might need to provide Intune configuration privileges in a challenge window that appeared. > If menu items like **Windows enrollment** are not active for you, then look to the far-right blade in the UI. You might need to provide Intune configuration privileges in a challenge window that appeared.
2. Under **Add Windows Autopilot devices** in the far right pane, browse to the **AutopilotHWID.csv** file you previously copied to your local computer. The file should contain the serial number and 4K HH of your VM (or device). It’s okay if other fields (Windows Product ID) are left blank. 2. Under **Add Windows Autopilot devices** in the far right pane, browse to the **AutopilotHWID.csv** file you previously copied to your local computer. The file should contain the serial number and 4K HH of your VM (or device). It's okay if other fields (Windows Product ID) are left blank.
![HWID CSV](images/hwid-csv.png) ![HWID CSV](images/hwid-csv.png)
@ -409,7 +411,7 @@ Select **Manage** from the top menu, then click the **Windows Autopilot Deployme
Click the **Add devices** link to upload your CSV file. A message will appear indicating your request is being processed. Wait a few moments before refreshing to see your new device has been added. Click the **Add devices** link to upload your CSV file. A message will appear indicating your request is being processed. Wait a few moments before refreshing to see your new device has been added.
![Devices](images/msfb-device.png) ![Microsoft Store for Business Devices](images/msfb-device.png)
## Create and assign a Windows Autopilot deployment profile ## Create and assign a Windows Autopilot deployment profile
@ -425,7 +427,7 @@ Pick one:
> [!NOTE] > [!NOTE]
> Even if you registered your device in MSfB, it will still appear in Intune, though you might have to **sync** and then **refresh** your device list first: > Even if you registered your device in MSfB, it will still appear in Intune, though you might have to **sync** and then **refresh** your device list first:
![Devices](images/intune-devices.png) ![Intune Devices](images/intune-devices.png)
> The example above lists both a physical device and a VM. Your list should only include only one of these. > The example above lists both a physical device and a VM. Your list should only include only one of these.
@ -473,7 +475,7 @@ To create a Group, open the Azure portal and select **Azure Active Directory** >
![All groups](images/all-groups.png) ![All groups](images/all-groups.png)
Select New group from the Groups blade to open the new groups UI. Select the “Security” group type, name the group, and select the “Assigned” membership type: Select New group from the Groups blade to open the new groups UI. Select the "Security" group type, name the group, and select the "Assigned" membership type:
Before clicking **Create**, expand the **Members** panel, click your device's serial number (it will then appear under **Selected members**) and then click **Select** to add that device to this group. Before clicking **Create**, expand the **Members** panel, click your device's serial number (it will then appear under **Selected members**) and then click **Select** to add that device to this group.
@ -495,9 +497,9 @@ Under **Manage**, click **Assignments**, and then with the **Include** tab highl
Click **Select** and then click **Save**. Click **Select** and then click **Save**.
![Include group](images/include-group2.png) ![Include group save](images/include-group2.png)
It’s also possible to assign specific users to a profile, but we will not cover this scenario in the lab. For more detailed information, see [Enroll Windows devices in Intune by using Windows Autopilot](https://docs.microsoft.com/intune/enrollment-autopilot). It's also possible to assign specific users to a profile, but we will not cover this scenario in the lab. For more detailed information, see [Enroll Windows devices in Intune by using Windows Autopilot](https://docs.microsoft.com/intune/enrollment-autopilot).
### Create a Windows Autopilot deployment profile using MSfB ### Create a Windows Autopilot deployment profile using MSfB
@ -517,15 +519,15 @@ To CREATE the profile:
Select your device from the **Devices** list: Select your device from the **Devices** list:
![MSfB create](images/msfb-create1.png) ![MSfB create step 1](images/msfb-create1.png)
On the Autopilot deployment dropdown menu, select **Create new profile**: On the Autopilot deployment dropdown menu, select **Create new profile**:
![MSfB create](images/msfb-create2.png) ![MSfB create step 2](images/msfb-create2.png)
Name the profile, choose your desired settings, and then click **Create**: Name the profile, choose your desired settings, and then click **Create**:
![MSfB create](images/msfb-create3.png) ![MSfB create step 3](images/msfb-create3.png)
The new profile is added to the Autopilot deployment list. The new profile is added to the Autopilot deployment list.
@ -533,25 +535,25 @@ To ASSIGN the profile:
To assign (or reassign) the profile to a device, select the checkboxes next to the device you registered for this lab, then select the profile you want to assign from the **Autopilot deployment** dropdown menu as shown: To assign (or reassign) the profile to a device, select the checkboxes next to the device you registered for this lab, then select the profile you want to assign from the **Autopilot deployment** dropdown menu as shown:
![MSfB assign](images/msfb-assign1.png) ![MSfB assign step 1](images/msfb-assign1.png)
Confirm the profile was successfully assigned to the intended device by checking the contents of the **Profile** column: Confirm the profile was successfully assigned to the intended device by checking the contents of the **Profile** column:
![MSfB assign](images/msfb-assign2.png) ![MSfB assign step 2](images/msfb-assign2.png)
> [!IMPORTANT] > [!IMPORTANT]
> The new profile will only be applied if the device has not been started, and gone through OOBE. Settings from a different profile can't be applied when another profile has been applied. Windows would need to be reinstalled on the device for the second profile to be applied to the device. > The new profile will only be applied if the device has not been started, and gone through OOBE. Settings from a different profile can't be applied when another profile has been applied. Windows would need to be reinstalled on the device for the second profile to be applied to the device.
## See Windows Autopilot in action ## See Windows Autopilot in action
If you shut down your VM after the last reset, it’s time to start it back up again, so it can progress through the Autopilot OOBE experience but do not attempt to start your device again until the **PROFILE STATUS** for your device in Intune has changed from **Not assigned** to **Assigning** and finally **Assigned**: If you shut down your VM after the last reset, it's time to start it back up again, so it can progress through the Autopilot OOBE experience but do not attempt to start your device again until the **PROFILE STATUS** for your device in Intune has changed from **Not assigned** to **Assigning** and finally **Assigned**:
![Device status](images/device-status.png) ![Device status](images/device-status.png)
Also, make sure to wait at least 30 minutes from the time you've [configured company branding](#configure-company-branding), otherwise these changes might not show up. Also, make sure to wait at least 30 minutes from the time you've [configured company branding](#configure-company-branding), otherwise these changes might not show up.
> [!TIP] > [!TIP]
> If you reset your device previously after collecting the 4K HH info, and then let it restart back to the first OOBE screen, then you might need to restart the device again to ensure the device is recognized as an Autopilot device and displays the Autopilot OOBE experience you’re expecting. If you do not see the Autopilot OOBE experience, then reset the device again (Settings > Update & Security > Recovery and click on Get started. Under Reset this PC, select Remove everything and Just remove my files. Click on Reset). > If you reset your device previously after collecting the 4K HH info, and then let it restart back to the first OOBE screen, then you might need to restart the device again to ensure the device is recognized as an Autopilot device and displays the Autopilot OOBE experience you're expecting. If you do not see the Autopilot OOBE experience, then reset the device again (Settings > Update & Security > Recovery and click on Get started. Under Reset this PC, select Remove everything and Just remove my files. Click on Reset).
- Ensure your device has an internet connection. - Ensure your device has an internet connection.
- Turn on the device - Turn on the device
@ -569,21 +571,21 @@ Windows Autopilot will now take over to automatically join your device into Azur
## Remove devices from Autopilot ## Remove devices from Autopilot
To use the device (or VM) for other purposes after completion of this lab, you will need to remove (deregister) it from Autopilot via either Intune or MSfB, and then reset it. Instructions for deregistering devices can be found [here](https://docs.microsoft.com/intune/enrollment-autopilot#create-an-autopilot-device-group) and [here](https://docs.microsoft.com/intune/devices-wipe#delete-devices-from-the-azure-active-directory-portal) and below. To use the device (or VM) for other purposes after completion of this lab, you will need to remove (deregister) it from Autopilot via either Intune or MSfB, and then reset it. Instructions for deregistering devices can be found at [Enroll Windows devices in Intune by using Windows Autopilot](https://docs.microsoft.com/intune/enrollment-autopilot#create-an-autopilot-device-group) and [Remove devices by using wipe, retire, or manually unenrolling the device](https://docs.microsoft.com/intune/devices-wipe#delete-devices-from-the-azure-active-directory-portal) and below.
### Delete (deregister) Autopilot device ### Delete (deregister) Autopilot device
You need to delete (or retire, or factory reset) the device from Intune before deregistering the device from Autopilot. To delete the device from Intune (not Azure Active Directory), log into your Intune Azure portal, then navigate to **Intune > Devices > All Devices**. Select the checkbox next to the device you want to delete, then click the Delete button along the top menu. You need to delete (or retire, or factory reset) the device from Intune before deregistering the device from Autopilot. To delete the device from Intune (not Azure Active Directory), log into your Intune Azure portal, then navigate to **Intune > Devices > All Devices**. Select the checkbox next to the device you want to delete, then click the Delete button along the top menu.
![Delete device](images/delete-device1.png) ![Delete device step 1](images/delete-device1.png)
Click **X** when challenged to complete the operation: Click **X** when challenged to complete the operation:
![Delete device](images/delete-device2.png) ![Delete device step 2](images/delete-device2.png)
This will remove the device from Intune management, and it will disappear from **Intune > Devices > All devices**. But this does not yet deregister the device from Autopilot, so the device should still appear under **Intune > Device Enrollment > Windows Enrollment > Windows Autopilot Deployment Program > Devices**. This will remove the device from Intune management, and it will disappear from **Intune > Devices > All devices**. But this does not yet deregister the device from Autopilot, so the device should still appear under **Intune > Device Enrollment > Windows Enrollment > Windows Autopilot Deployment Program > Devices**.
![Delete device](images/delete-device3.png) ![Delete device step 3](images/delete-device3.png)
The **Intune > Devices > All Devices** list and the **Intune > Device Enrollment > Windows Enrollment > Windows Autopilot Deployment Program > Devices** list mean different things and are two completely separate datastores. The former (All devices) is the list of devices currently enrolled into Intune. The **Intune > Devices > All Devices** list and the **Intune > Device Enrollment > Windows Enrollment > Windows Autopilot Deployment Program > Devices** list mean different things and are two completely separate datastores. The former (All devices) is the list of devices currently enrolled into Intune.
@ -592,25 +594,25 @@ The **Intune > Devices > All Devices** list and the **Intune > Device Enrollment
To remove the device from the Autopilot program, select the device and click Delete. To remove the device from the Autopilot program, select the device and click Delete.
![Delete device](images/delete-device4.png) ![Delete device step 4](images/delete-device4.png)
A warning message appears reminding you to first remove the device from Intune, which we previously did. A warning message appears reminding you to first remove the device from Intune, which we previously did.
![Delete device](images/delete-device5.png) ![Delete device step 5](images/delete-device5.png)
At this point, your device has been unenrolled from Intune and also deregistered from Autopilot. After several minutes, click the **Sync** button, followed by the **Refresh** button to confirm the device is no longer listed in the Autopilot program: At this point, your device has been unenrolled from Intune and also deregistered from Autopilot. After several minutes, click the **Sync** button, followed by the **Refresh** button to confirm the device is no longer listed in the Autopilot program:
![Delete device](images/delete-device6.png) ![Delete device step 6](images/delete-device6.png)
Once the device no longer appears, you are free to reuse it for other purposes. Once the device no longer appears, you are free to reuse it for other purposes.
If you also (optionally) want to remove your device from AAD, navigate to **Azure Active Directory > Devices > All Devices**, select your device, and click the delete button: If you also (optionally) want to remove your device from AAD, navigate to **Azure Active Directory > Devices > All Devices**, select your device, and click the delete button:
![Delete device](images/delete-device7.png) ![Delete device step 7](images/delete-device7.png)
## Appendix A: Verify support for Hyper-V ## Appendix A: Verify support for Hyper-V
Starting with Windows 8, the host computer’s microprocessor must support second level address translation (SLAT) to install Hyper-V. See [Hyper-V: List of SLAT-Capable CPUs for Hosts](https://social.technet.microsoft.com/wiki/contents/articles/1401.hyper-v-list-of-slat-capable-cpus-for-hosts.aspx) for more information. Starting with Windows 8, the host computer's microprocessor must support second level address translation (SLAT) to install Hyper-V. See [Hyper-V: List of SLAT-Capable CPUs for Hosts](https://social.technet.microsoft.com/wiki/contents/articles/1401.hyper-v-list-of-slat-capable-cpus-for-hosts.aspx) for more information.
To verify your computer supports SLAT, open an administrator command prompt, type **systeminfo**, press ENTER, scroll down, and review the section displayed at the bottom of the output, next to Hyper-V Requirements. See the following example: To verify your computer supports SLAT, open an administrator command prompt, type **systeminfo**, press ENTER, scroll down, and review the section displayed at the bottom of the output, next to Hyper-V Requirements. See the following example:
@ -654,19 +656,19 @@ EPT * Supports Intel extended page tables (SLAT)
#### Prepare the app for Intune #### Prepare the app for Intune
Before we can pull an application into Intune to make it part of our AP profile, we need to “package” the application for delivery using the [IntuneWinAppUtil.exe command-line tool](https://github.com/Microsoft/Microsoft-Win32-Content-Prep-Tool). After downloading the tool, gather the following three bits of information to use the tool: Before we can pull an application into Intune to make it part of our AP profile, we need to "package" the application for delivery using the [IntuneWinAppUtil.exe command-line tool](https://github.com/Microsoft/Microsoft-Win32-Content-Prep-Tool). After downloading the tool, gather the following three bits of information to use the tool:
1. The source folder for your application 1. The source folder for your application
2. The name of the setup executable file 2. The name of the setup executable file
3. The output folder for the new file 3. The output folder for the new file
For the purposes of this lab, we’ll use the Notepad++ tool as our Win32 app. For the purposes of this lab, we'll use the Notepad++ tool as our Win32 app.
Download the Notepad++ msi package [here](https://www.hass.de/content/notepad-msi-package-enterprise-deployment-available) and then copy the file to a known location, such as C:\Notepad++msi. Download the Notepad++ msi package [here](https://www.hass.de/content/notepad-msi-package-enterprise-deployment-available) and then copy the file to a known location, such as C:\Notepad++msi.
Run the IntuneWinAppUtil tool, supplying answers to the three questions, for example: Run the IntuneWinAppUtil tool, supplying answers to the three questions, for example:
![Add app](images/app01.png) ![Add app example](images/app01.png)
After the tool finishes running, you should have an .intunewin file in the Output folder, which you can now upload into Intune using the following steps. After the tool finishes running, you should have an .intunewin file in the Output folder, which you can now upload into Intune using the following steps.
@ -676,19 +678,19 @@ Log into the Azure portal and select **Intune**.
Navigate to **Intune > Clients apps > Apps**, and then click the **Add** button to create a new app package. Navigate to **Intune > Clients apps > Apps**, and then click the **Add** button to create a new app package.
![Add app](images/app02.png) ![Add app step 1](images/app02.png)
Under **App Type**, select **Windows app (Win32)**: Under **App Type**, select **Windows app (Win32)**:
![Add app](images/app03.png) ![Add app step 2](images/app03.png)
On the **App package file** blade, browse to the **npp.7.6.3.installer.x64.intunewin** file in your output folder, open it, then click **OK**: On the **App package file** blade, browse to the **npp.7.6.3.installer.x64.intunewin** file in your output folder, open it, then click **OK**:
![Add app](images/app04.png) ![Add app step 3](images/app04.png)
On the **App Information Configure** blade, provide a friendly name, description, and publisher, such as: On the **App Information Configure** blade, provide a friendly name, description, and publisher, such as:
![Add app](images/app05.png) ![Add app step 4](images/app05.png)
On the **Program Configuration** blade, supply the install and uninstall commands: On the **Program Configuration** blade, supply the install and uninstall commands:
@ -698,29 +700,29 @@ Uninstall: msiexec /x "{F188A506-C3C6-4411-BE3A-DA5BF1EA6737}" /q
> [!NOTE] > [!NOTE]
> Likely, you do not have to write the install and uninstall commands yourself because the [IntuneWinAppUtil.exe command-line tool](https://github.com/Microsoft/Microsoft-Win32-Content-Prep-Tool) automatically generated them when it converted the .msi file into a .intunewin file. > Likely, you do not have to write the install and uninstall commands yourself because the [IntuneWinAppUtil.exe command-line tool](https://github.com/Microsoft/Microsoft-Win32-Content-Prep-Tool) automatically generated them when it converted the .msi file into a .intunewin file.
![Add app](images/app06.png) ![Add app step 5](images/app06.png)
Simply using an install command like “notepad++.exe /S” will not actually install Notepad++; it will only launch the app. To actually install the program, we need to use the .msi file instead. Notepad++ doesn’t actually have an .msi version of their program, but we got an .msi version from a [third party provider](https://www.hass.de/content/notepad-msi-package-enterprise-deployment-available). Simply using an install command like "notepad++.exe /S" will not actually install Notepad++; it will only launch the app. To actually install the program, we need to use the .msi file instead. Notepad++ doesn't actually have an .msi version of their program, but we got an .msi version from a [third party provider](https://www.hass.de/content/notepad-msi-package-enterprise-deployment-available).
Click **OK** to save your input and activate the **Requirements** blade. Click **OK** to save your input and activate the **Requirements** blade.
On the **Requirements Configuration** blade, specify the **OS architecture** and the **Minimum OS version**: On the **Requirements Configuration** blade, specify the **OS architecture** and the **Minimum OS version**:
![Add app](images/app07.png) ![Add app step 6](images/app07.png)
Next, configure the **Detection rules**. For our purposes, we will select manual format: Next, configure the **Detection rules**. For our purposes, we will select manual format:
![Add app](images/app08.png) ![Add app step 7](images/app08.png)
Click **Add** to define the rule properties. For **Rule type**, select **MSI**, which will automatically import the right MSI product code into the rule: Click **Add** to define the rule properties. For **Rule type**, select **MSI**, which will automatically import the right MSI product code into the rule:
![Add app](images/app09.png) ![Add app step 8](images/app09.png)
Click **OK** twice to save, as you back out to the main **Add app** blade again for the final configuration. Click **OK** twice to save, as you back out to the main **Add app** blade again for the final configuration.
**Return codes**: For our purposes, leave the return codes at their default values: **Return codes**: For our purposes, leave the return codes at their default values:
![Add app](images/app10.png) ![Add app step 9](images/app10.png)
Click **OK** to exit. Click **OK** to exit.
@ -730,11 +732,11 @@ Click the **Add** button to finalize and save your app package.
Once the indicator message says the addition has completed. Once the indicator message says the addition has completed.
![Add app](images/app11.png) ![Add app step 10](images/app11.png)
You will be able to find your app in your app list: You will be able to find your app in your app list:
![Add app](images/app12.png) ![Add app step 11](images/app12.png)
#### Assign the app to your Intune profile #### Assign the app to your Intune profile
@ -743,7 +745,7 @@ You will be able to find your app in your app list:
In the **Intune > Client Apps > Apps** pane, select the app package you already created to reveal its properties blade. Then click **Assignments** from the menu: In the **Intune > Client Apps > Apps** pane, select the app package you already created to reveal its properties blade. Then click **Assignments** from the menu:
![Add app](images/app13.png) ![Assign app step 1](images/app13.png)
Select **Add Group** to open the **Add group** pane that is related to the app. Select **Add Group** to open the **Add group** pane that is related to the app.
@ -753,9 +755,9 @@ For our purposes, select **Required** from the **Assignment type** dropdown menu
Select **Included Groups** and assign the groups you previously created that will use this app: Select **Included Groups** and assign the groups you previously created that will use this app:
![Add app](images/app14.png) ![Assign app step 2](images/app14.png)
![Add app](images/app15.png) ![Assign app step 3](images/app15.png)
In the **Select groups** pane, click the **Select** button. In the **Select groups** pane, click the **Select** button.
@ -765,7 +767,7 @@ In the **Add group** pane, select **OK**.
In the app **Assignments** pane, select **Save**. In the app **Assignments** pane, select **Save**.
![Add app](images/app16.png) ![Assign app step 4](images/app16.png)
At this point, you have completed steps to add a Win32 app to Intune. At this point, you have completed steps to add a Win32 app to Intune.
@ -779,15 +781,15 @@ Log into the Azure portal and select **Intune**.
Navigate to **Intune > Clients apps > Apps**, and then click the **Add** button to create a new app package. Navigate to **Intune > Clients apps > Apps**, and then click the **Add** button to create a new app package.
![Add app](images/app17.png) ![Create app step 1](images/app17.png)
Under **App Type**, select **Office 365 Suite > Windows 10**: Under **App Type**, select **Office 365 Suite > Windows 10**:
![Add app](images/app18.png) ![Create app step 2](images/app18.png)
Under the **Configure App Suite** pane, select the Office apps you want to install. For the purposes of this labe we have only selected Excel: Under the **Configure App Suite** pane, select the Office apps you want to install. For the purposes of this labe we have only selected Excel:
![Add app](images/app19.png) ![Create app step 3](images/app19.png)
Click **OK**. Click **OK**.
@ -795,13 +797,13 @@ In the **App Suite Information** pane, enter a <i>unique</i> suite name, and a s
> Enter the name of the app suite as it is displayed in the company portal. Make sure that all suite names that you use are unique. If the same app suite name exists twice, only one of the apps is displayed to users in the company portal. > Enter the name of the app suite as it is displayed in the company portal. Make sure that all suite names that you use are unique. If the same app suite name exists twice, only one of the apps is displayed to users in the company portal.
![Add app](images/app20.png) ![Create app step 4](images/app20.png)
Click **OK**. Click **OK**.
In the **App Suite Settings** pane, select **Monthly** for the **Update channel** (any selection would be fine for the purposes of this lab). Also select **Yes** for **Automatically accept the app end user license agreement**: In the **App Suite Settings** pane, select **Monthly** for the **Update channel** (any selection would be fine for the purposes of this lab). Also select **Yes** for **Automatically accept the app end user license agreement**:
![Add app](images/app21.png) ![Create app step 5](images/app21.png)
Click **OK** and then click **Add**. Click **OK** and then click **Add**.
@ -812,7 +814,7 @@ Click **OK** and then click **Add**.
In the **Intune > Client Apps > Apps** pane, select the Office package you already created to reveal its properties blade. Then click **Assignments** from the menu: In the **Intune > Client Apps > Apps** pane, select the Office package you already created to reveal its properties blade. Then click **Assignments** from the menu:
![Add app](images/app22.png) ![Create app step 6](images/app22.png)
Select **Add Group** to open the **Add group** pane that is related to the app. Select **Add Group** to open the **Add group** pane that is related to the app.
@ -822,9 +824,9 @@ For our purposes, select **Required** from the **Assignment type** dropdown menu
Select **Included Groups** and assign the groups you previously created that will use this app: Select **Included Groups** and assign the groups you previously created that will use this app:
![Add app](images/app23.png) ![Create app step 7](images/app23.png)
![Add app](images/app24.png) ![Create app step 8](images/app24.png)
In the **Select groups** pane, click the **Select** button. In the **Select groups** pane, click the **Select** button.
@ -834,7 +836,7 @@ In the **Add group** pane, select **OK**.
In the app **Assignments** pane, select **Save**. In the app **Assignments** pane, select **Save**.
![Add app](images/app25.png) ![Create app step 9](images/app25.png)
At this point, you have completed steps to add Office to Intune. At this point, you have completed steps to add Office to Intune.
@ -842,7 +844,7 @@ For more information on adding Office apps to Intune, see [Assign Office 365 app
If you installed both the win32 app (Notepad++) and Office (just Excel) per the instructions in this lab, your VM will show them in the apps list, although it could take several minutes to populate: If you installed both the win32 app (Notepad++) and Office (just Excel) per the instructions in this lab, your VM will show them in the apps list, although it could take several minutes to populate:
![Add app](images/app26.png) ![Create app step 10](images/app26.png)
## Glossary ## Glossary

13
windows/security/threat-protection/microsoft-defender-atp/enable-siem-integration.md
View File

@ -28,7 +28,7 @@ ms.topic: article
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-enablesiem-abovefoldlink) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-enablesiem-abovefoldlink)
Enable security information and event management (SIEM) integration so you can pull detections from Microsoft Defender Security Center using your SIEM solution or by connecting directly to the detections REST API. Enable security information and event management (SIEM) integration so you can pull detections from Microsoft Defender Security Center. Pull detections using your SIEM solution or by connecting directly to the detections REST API.
>[!NOTE] >[!NOTE]
>- [Microsoft Defender ATP Alert](alerts.md) is composed from one or more detections. >- [Microsoft Defender ATP Alert](alerts.md) is composed from one or more detections.
@ -36,7 +36,14 @@ Enable security information and event management (SIEM) integration so you can p
>- The Microsoft Defender ATP Alert API is the latest API for alert consumption and contain a detailed list of related evidence for each alert. For more information, see [Alert methods and properties](alerts.md) and [List alerts](get-alerts.md). >- The Microsoft Defender ATP Alert API is the latest API for alert consumption and contain a detailed list of related evidence for each alert. For more information, see [Alert methods and properties](alerts.md) and [List alerts](get-alerts.md).
## Prerequisites ## Prerequisites
- The user who activates the setting must have permissions to create an app in Azure Active Directory (AAD). This is someone with the following roles: Security Administrator and either Global Administrator, Cloud Application Administrator, Application Administrator, or owner of the service principal.
- The user who activates the setting must have permissions to create an app in Azure Active Directory (AAD). This is someone with the following roles:
- Security Administrator and either Global Administrator
- Cloud Application Administrator
- Application Administrator
- Owner of the service principal
- During the initial activation, a pop-up screen is displayed for credentials to be entered. Make sure that you allow pop-ups for this site. - During the initial activation, a pop-up screen is displayed for credentials to be entered. Make sure that you allow pop-ups for this site.
## Enabling SIEM integration ## Enabling SIEM integration
@ -47,7 +54,7 @@ Enable security information and event management (SIEM) integration so you can p
>[!TIP] >[!TIP]
>If you encounter an error when trying to enable the SIEM connector application, check the pop-up blocker settings of your browser. It might be blocking the new window being opened when you enable the capability. >If you encounter an error when trying to enable the SIEM connector application, check the pop-up blocker settings of your browser. It might be blocking the new window being opened when you enable the capability.
2. Select **Enable SIEM integration**. This activates the **SIEM connector access details** section with pre-populated values and an application is created under you Azure Active Directory (AAD) tenant. 2. Select **Enable SIEM integration**. This activates the **SIEM connector access details** section with pre-populated values and an application is created under your Azure Active Directory (Azure AD) tenant.
> [!WARNING] > [!WARNING]
>The client secret is only displayed once. Make sure you keep a copy of it in a safe place.<br> >The client secret is only displayed once. Make sure you keep a copy of it in a safe place.<br>

24
windows/security/threat-protection/microsoft-defender-atp/exposed-apis-create-app-nativeapp.md
View File

@ -56,7 +56,7 @@ This page explains how to create an AAD application, get an access token to Micr
![Image of Microsoft Azure and navigation to application registration](images/atp-azure-new-app2.png) ![Image of Microsoft Azure and navigation to application registration](images/atp-azure-new-app2.png)
3. In the registration from, enter the following information then click **Register**. 3. In the registration from, enter the following information then select **Register**.
![Image of Create application window](images/nativeapp-create2.png) ![Image of Create application window](images/nativeapp-create2.png)
@ -65,45 +65,45 @@ This page explains how to create an AAD application, get an access token to Micr
4. Allow your Application to access Microsoft Defender ATP and assign it 'Read alerts' permission: 4. Allow your Application to access Microsoft Defender ATP and assign it 'Read alerts' permission:
- On your application page, click **API Permissions** > **Add permission** > **APIs my organization uses** > type **WindowsDefenderATP** and click on **WindowsDefenderATP**. - On your application page, select **API Permissions** > **Add permission** > **APIs my organization uses** > type **WindowsDefenderATP** and select on **WindowsDefenderATP**.
- **Note**: WindowsDefenderATP does not appear in the original list. You need to start writing its name in the text box to see it appear. - **Note**: WindowsDefenderATP does not appear in the original list. You need to start writing its name in the text box to see it appear.
![Image of API access and API selection](images/add-permission.png) ![Image of API access and API selection](images/add-permission.png)
- Choose **Delegated permissions** > **Alert.Read** > Click on **Add permissions** - Choose **Delegated permissions** > **Alert.Read** > select **Add permissions**
![Image of API access and API selection](images/application-permissions-public-client.png) ![Image of API access and API selection](images/application-permissions-public-client.png)
- **Important note**: You need to select the relevant permissions. 'Read alerts' is only an example! - **Important note**: Select the relevant permissions. Read alerts is only an example.
For instance, For instance,
- To [run advanced queries](run-advanced-query-api.md), select 'Run advanced queries' permission - To [run advanced queries](run-advanced-query-api.md), select 'Run advanced queries' permission
- To [isolate a device](isolate-machine.md), select 'Isolate machine' permission - To [isolate a device](isolate-machine.md), select 'Isolate machine' permission
- To determine which permission you need, please look at the **Permissions** section in the API you are interested to call. - To determine which permission you need, view the **Permissions** section in the API you are interested to call.
- Click **Grant consent** - Select **Grant consent**
**Note**: Every time you add permission you must click on **Grant consent** for the new permission to take effect. **Note**: Every time you add permission you must select on **Grant consent** for the new permission to take effect.
![Image of Grant permissions](images/grant-consent.png) ![Image of Grant permissions](images/grant-consent.png)
6. Write down your application ID and your tenant ID: 6. Write down your application ID and your tenant ID:
- On your application page, go to **Overview** and copy the following: - On your application page, go to **Overview** and copy the following information:
![Image of created app id](images/app-and-tenant-ids.png) ![Image of created app id](images/app-and-tenant-ids.png)
## Get an access token ## Get an access token
For more details on AAD token, refer to [AAD tutorial](https://docs.microsoft.com/azure/active-directory/develop/active-directory-v2-protocols-oauth-client-creds) For more information on AAD token, see [Azure AD tutorial](https://docs.microsoft.com/azure/active-directory/develop/active-directory-v2-protocols-oauth-client-creds)
### Using C# ### Using C#
- Copy/Paste the below class in your application. - Copy/Paste the below class in your application.
- Use **AcquireUserTokenAsync** method with the your application ID, tenant ID, user name and password to acquire a token. - Use **AcquireUserTokenAsync** method with your application ID, tenant ID, user name, and password to acquire a token.
```csharp ```csharp
namespace WindowsDefenderATP namespace WindowsDefenderATP
@ -145,7 +145,7 @@ For more details on AAD token, refer to [AAD tutorial](https://docs.microsoft.co
## Validate the token ## Validate the token
Sanity check to make sure you got a correct token: Verify to make sure you got a correct token:
- Copy/paste into [JWT](https://jwt.ms) the token you got in the previous step in order to decode it - Copy/paste into [JWT](https://jwt.ms) the token you got in the previous step in order to decode it
- Validate you get a 'scp' claim with the desired app permissions - Validate you get a 'scp' claim with the desired app permissions
- In the screenshot below you can see a decoded token acquired from the app in the tutorial: - In the screenshot below you can see a decoded token acquired from the app in the tutorial:
@ -156,7 +156,7 @@ Sanity check to make sure you got a correct token:
- Choose the API you want to use - [Supported Microsoft Defender ATP APIs](exposed-apis-list.md) - Choose the API you want to use - [Supported Microsoft Defender ATP APIs](exposed-apis-list.md)
- Set the Authorization header in the HTTP request you send to "Bearer {token}" (Bearer is the Authorization scheme) - Set the Authorization header in the HTTP request you send to "Bearer {token}" (Bearer is the Authorization scheme)
- The Expiration time of the token is 1 hour (you can send more then one request with the same token) - The Expiration time of the token is 1 hour (you can send more than one request with the same token)
- Example of sending a request to get a list of alerts **using C#** - Example of sending a request to get a list of alerts **using C#**

22
windows/security/threat-protection/microsoft-defender-atp/supported-response-apis.md
View File

@ -1,6 +1,6 @@
--- ---
title: Supported Microsoft Defender Advanced Threat Protection response APIs title: Supported Microsoft Defender Advanced Threat Protection response APIs
description: Learn about the specific response related Microsoft Defender Advanced Threat Protection API calls. description: Learn about the specific response-related Microsoft Defender Advanced Threat Protection API calls.
keywords: response apis, graph api, supported apis, actor, alerts, device, user, domain, ip, file keywords: response apis, graph api, supported apis, actor, alerts, device, user, domain, ip, file
search.product: eADQiWindows 10XVcnh search.product: eADQiWindows 10XVcnh
search.appverid: met150 search.appverid: met150
@ -28,24 +28,24 @@ ms.topic: conceptual
> [!TIP] > [!TIP]
> Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-supported-response-apis-abovefoldlink) > Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-supported-response-apis-abovefoldlink)
Learn about the supported response related API calls you can run and details such as the required request headers, and expected response from the calls. Learn about the supported response-related API calls you can run and details such as the required request headers, and expected response from the calls.
## In this section ## In this section
Topic | Description Topic | Description
:---|:--- :---|:---
Collect investigation package | Run this to collect an investigation package from a device. Collect investigation package | Run this API to collect an investigation package from a device.
Isolate device | Run this to isolate a device from the network. Isolate device | Run this API to isolate a device from the network.
Unisolate device | Remove a device from isolation. Unisolate device | Remove a device from isolation.
Restrict code execution | Run this to contain an attack by stopping malicious processes. You can also lock down a device and prevent subsequent attempts of potentially malicious programs from running. Restrict code execution | Run this API to contain an attack by stopping malicious processes. You can also lock down a device and prevent subsequent attempts of potentially malicious programs from running.
Unrestrict code execution | Run this to reverse the restriction of applications policy after you have verified that the compromised device has been remediated. Unrestrict code execution | Run this to reverse the restriction of applications policy after you have verified that the compromised device has been remediated.
Run antivirus scan | Remotely initiate an antivirus scan to help identify and remediate malware that might be present on a compromised device. Run antivirus scan | Remotely initiate an antivirus scan to help identify and remediate malware that might be present on a compromised device.
Stop and quarantine file | Run this call to stop running processes, quarantine files, and delete persistency such as registry keys. Stop and quarantine file | Run this call to stop running processes, quarantine files, and delete persistency such as registry keys.
Request sample | Run this call to request a sample of a file from a specific device. The file will be collected from the device and uploaded to a secure storage. Request sample | Run this call to request a sample of a file from a specific device. The file will be collected from the device and uploaded to a secure storage.
Block file | Run this to prevent further propagation of an attack in your organization by banning potentially malicious files or suspected malware. Block file | Run this API to prevent further propagation of an attack in your organization by banning potentially malicious files or suspected malware.
Unblock file | Allow a file run in the organization using Microsoft Defender Antivirus. Unblock file | Allow a file run in the organization using Microsoft Defender Antivirus.
Get package SAS URI | Run this to get a URI that allows downloading an investigation package. Get package SAS URI | Run this API to get a URI that allows downloading an investigation package.
Get MachineAction object | Run this to get MachineAction object. Get MachineAction object | Run this API to get MachineAction object.
Get MachineActions collection | Run this to get MachineAction collection. Get MachineActions collection | Run this to get MachineAction collection.
Get FileActions collection | Run this to get FileActions collection. Get FileActions collection | Run this API to get FileActions collection.
Get FileMachineAction object | Run this to get FileMachineAction object. Get FileMachineAction object | Run this API to get FileMachineAction object.
Get FileMachineActions collection | Run this to get FileMachineAction collection. Get FileMachineActions collection | Run this API to get FileMachineAction collection.