For more info about creating the OpenSearch XML file, see the [Understanding OpenSearch Standards](https://msdn.microsoft.com/en-us/library/dd163546.aspx) topic. | Disable setting (default) | Any added search engines are removed from the employee’s device. |
-| Do not configure | The search engine list is set to what is specified in App settings. |
+## Always Enable book library
+>*Supporteded versions: Windows 10, version 1709 or later*
-### Configure Autofill
+This policy settings specifies whether to always show the Books Library in Microsoft Edge. By default, this setting is disabled, which means the library is only visible in countries or regions where available. if enabled, the Books Library is always shown regardless of countries or region of activation.
+
+**Microsoft Intune to manage your MDM settings**
+| | |
+|---|---|
+|MDM name |[AlwaysEnableBooksLibrary](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-browser#browser-alwaysenablebookslibrary) |
+|Supported devices |Desktop
Mobile |
+|URI full path | ./Vendor/MSFT/Policy/Config/Browser/AlwaysEnableBooksLibrary |
+|Data type | Integer |
+|Allowed values |
- **0 (default)** - Disable. Use default visibility of the Books Library. The Library will be only visible in countries or regions where it’s available.
- **1** - Enable. Always show the Books Library, regardless of countries or region of activation.
Mobile | +|URI full path |./Vendor/MSFT/Policy/Config/Browser/ConfigureAdditionalSearchEngines | +|Data type | Integer | +|Allowed values |
- **0 (default)** - Additional search engines are not allowed.
- **1** - Additional search engines are allowed.
- **0** - Employees cannot use Autofill to complete form fields.
- **1 (default)** - Employees can use Autofill to complete form fields.
- **Allow all cookies (default)** from all websites.
- **Block all cookies** from all websites.
- **Block only 3rd-party cookies** from 3rd-party websites.
Mobile | +|URI full path |./Vendor/MSFT/Policy/Config/Browser/AllowCookies | +|Data type | Integer | +|Allowed values |
- **0 (default)** - Allows all cookies from all sites.
- **1** - Blocks only cookies from 3rd party websites.
- **2** - Blocks all cookies from all sites.
Mobile | +|URI full path |./Vendor/MSFT/Policy/Config/Browser/AllowDoNotTrack | +|Data type | Integer | +|Allowed values |
- **0 (default)** - Stops you from sending Do Not Track headers to websites requesting tracking info.
- **1** - Employees can send Do Not Track headers to websites requesting tracking info.
Mobile | +|URI full path |./Vendor/MSFT/Policy/Config/Browser/ProvisionFavorites | +|Data type | String | + + +## Configure Password Manager +>*Supported versions: Windows 10* + +This policy setting specifies whether saving and managing passwords locally on the device is allowed. By default, this setting is enabled allowing you to save their passwords locally. If not configured, you can choose whether or not to save and manage passwords locally. If disabled, saving and managing passwords locally is turned off. + +**Microsoft Intune to manage your MDM settings** +| | | +|---|---| +|MDM name |[AllowPasswordManager](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-browser#browser-allowpasswordmanager) | +|Supported devices |Desktop
Mobile | +|URI full path |./Vendor/MSFT/Policy/Config/Browser/AllowPasswordManager | +|Data type | Integer | +|Allowed values |
- **0 (default)** - Employees cannot use Password Manager to save passwords locally.
- **1** - Employees can use Password Manager to save passwords locally.
- **0 (default)** - Turns off Pop-up Blocker, allowing pop-up windows.
- **1** - Turns on Pop-up Blocker, stopping pop-up windows.
Mobile | +|URI full path |./Vendor/MSFT/Policy/Config/Browser/AllowSearchSuggestionsinAddressBar | +|Data type | Integer | +|Allowed values |
- **0 (default)** - Employees cannot see search suggestions in the Address bar of Microsoft Edge.
- **1** - Employees can see search suggestions in the Address bar of Microsoft Edge.
- **0** - Adobe Flash content is automatically loaded and run by Microsoft Edge.
- **1 (default)** - An employee must click the content, click a Click-to-Run button, or have the site appear on an auto-allow list before Microsoft Edge loads and runs Adobe Flash content.
`
>If you already use a site list, enterprise mode continues to work during the 65-second wait; it just uses the existing site list instead of the new one. -### Configure Windows Defender SmartScreen +**Microsoft Intune to manage your MDM settings** +| | | +|---|---| +|MDM name |[EnterpriseModeSiteList](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-browser#browser-enterprisemodesitelist) | +|Supported devices |Desktop | +|URI full path |./Vendor/MSFT/Policy/Config/Browser/EnterpriseModeSiteList | +|Data type | String | +|Allowed values |
- Not configured.
- **1 (default)** - Use the Enterprise Mode Site List, if configured.
- **2** - Specify the location to the site list.
Mobile | +|URI full path |./Vendor/MSFT/Policy/Config/Browser/AllowSmartScreen | +|Data type | Integer | +|Allowed values |
- **0 (default)** - Turns off Windows Defender SmartScreen.
- **1** - Turns on Windows Defender SmartScreen, providing warning messages to your you about potential phishing scams and malicious software.
- **0 (default)** - Enable lockdown of the Start pages according to the settings specified in the Browser/HomePages policy. Users cannot change the Start pages.
- **1** - Disable lockdown of the Start pages and allow users to modify them.
Enabling this setting stops Microsoft Edge favorites from syncing between connected Windows 10 devices. | -| Disable or do not configure | Employees cannot sync their favorites between Internet Explorer and Microsoft Edge. | +**Microsoft Intune to manage your MDM settings** +| | | +|---|---| +|MDM name |[AllowSyncMySettings](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-experience#experience-allowsyncmysettings) | +|Supported devices |Desktop | +|URI full path |./Vendor/MSFT/Policy/Config/Experience/AllowSyncMySettings | +|Location |Computer Configuration\Administrative Templates\Windows Components\sync your settings\Do not sync | +|Data type | Integer | +|Allowed values |
- **0** - Employees cannot sync settings between PCs.
- **1 (default)** - Employees can sync between PCs.
- **0 (default)** - Synchronization is turned off.
- **1** - Synchronization is turned on.
- **0 (default)** - Employees can access the about:flags page in Microsoft Edge.
- **1** - Employees cannot access the about:flags page in Microsoft Edge.
Mobile | +|URI full path | ./Vendor/MSFT/Policy/Config/Browser/PreventSmartScreenPromptOverrideForFiles | +|Data type | Integer | +|Allowed values |
- **0 (default)** - Lets you ignore the Windows Defender SmartScreen warnings about unverified files and lets them continue the download process.
- **1** - Stops you from ignoring the Windows Defender SmartScreen warnings about unverified files.
Mobile | +|URI full path |./Vendor/MSFT/Policy/Config/Browser/PreventSmartscreenPromptOverride | +|Data type | Integer | +|Allowed values |
- **0 (default)** - Turns off Windows Defender SmartScreen.
- **1** - Turns on Windows Defender SmartScreen.
`https://fabrikam.com/opensearch.xml` | -| Disable | The policy-set default search engine is removed. If this is also the current in-use default, the search engine changes to the Microsoft Edge specified engine for the market . | -| Do not configure | The default search engine is set to the one specified in App settings. | +This policy setting specifies whether you can add, import, sort, or edit the Favorites list in Microsoft Edge. By default, this setting is disabled or not configured (turned on), which means the Favorites list is not locked down and you can make changes to the Favorites list. If enabled, you cannot make changes to the Favorites list. Also, the Save a Favorite, Import settings, and the context menu items, such as Create a new folder, are turned off. >[!Important] ->If you'd like your employees to use the default Microsoft Edge settings for each market , you can set the string to EDGEDEFAULT. If you'd like your employees to use Microsoft Bing as the default search engine, you can set the string to EDGEBING. +>Don't enable both this setting and the Keep favorites in sync between Internet Explorer and Microsoft Edge setting. Enabling both settings stops you from syncing their favorites between Internet Explorer and Microsoft Edge. -### Show message when opening sites in Internet Explorer +**Microsoft Intune to manage your MDM settings** +| | | +|---|---| +|MDM name |[LockdownFavorites](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-browser#browser-lockdownfavorites) | +|Supported devices |Desktop
Mobile | +|URI full path |./Vendor/MSFT/Policy/Config/Browser/LockdownFavorites | +|Data type | Integer | +|Allowed values |
- **0 (default)** - Disabled. Do not lockdown Favorites.
- **1** - Enabled. Lockdown Favorites.
Mobile | +|URI full path |./Vendor/MSFT/Policy/Config/Browser/PreventLiveTileDataCollection | +|Data type | Integer | +|Allowed values |
- **0 (default)** - Microsoft servers will be contacted if a site is pinned to Start from Microsoft Edge.
- **1** - Microsoft servers will not be contacted if a site is pinned to Start from Microsoft Edge.
Mobile | +|URI full path | ./Vendor/MSFT/Policy/Config/Browser/PreventFirstRunPage | +|Data type | Integer | +|Allowed values |
- **0 (default)** - Employees see the First Run webpage.
- **1** - Employees do not see the First Run webpage.
- **0 (default)** - Shows an employee's LocalHost IP address while using the WebRTC protocol.
- **1** - Does not show an employee's LocalHost IP address while using the WebRTC protocol.
- **0 (default)** - Automatically opens all websites, including intranet sites, using Microsoft Edge.
- **1** - Automatically opens all intranet sites using Internet Explorer 11.
Mobile | +|URI full path |./Vendor/MSFT/Policy/Config/Browser/SetDefaultSearchEngine | +|Data type | Integer | +|Allowed values |
- **0 (default)** - The default search engine is set to the one specified in App settings.
- **1** - Allows you to configure the default search engine for your you.
- **0 (default)** - Doesn’t show an additional page in Microsoft Edge, stating that a site has been opened using Internet Explorer 11.
- **1** - Shows an additional page in Microsoft Edge, stating that a site has been opened using Internet Explorer 11.
If you’re already using a site list, enterprise mode continues to work during the 65 second wait; it just uses your existing site list instead of your new one.
-
-### Favorites
-- **Supported versions:** Windows 10, version 1511 or later
-
-- **Supported devices:** Both
-
-- **Details:**
-
- - **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/Favorites
-
- - **Data type:** String
-
- - **Allowed values:**
-
- - Configure the **Favorite** URLs for your employees.
-
- **Example:**
-
- [Windows 10 editions for education customers](windows-editions-for-education-customers.md) [Compare each Windows edition](https://www.microsoft.com/en-us/WindowsForBusiness/Compare) [Get Windows 10 Education or Windows 10 Pro Education](https://www.microsoft.com/en-us/education/buy-license/overview-of-how-to-buy/default.aspx?tabshow=schools) How-to videos
**-OR-**
-Open the Local Group Policy Editor and go to `Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Security Features\Add-on Management`.
+Open the Local Group Policy Editor and go to: User Configuration\Administrative Templates\Windows Components\Internet Explorer\Security Features\Add-on Management.
-4. Open the **Add-on List** Group Policy Object, pick **Enabled**, and then click **Show**.
-**Show Contents** box appears.
+4. Open the **Add-on List** Group Policy Object, select **Enabled**, and then click **Show**.
The Show Contents dialog appears.
-5. In **Value Name**, put your copied Class ID.
+6. In **Value Name**, paste the Class ID for your add-on, for example, **{47833539-D0C5-4125-9FA8-0819E2EAAC93}**.
-6. In **Value**, put:
+6. In **Value**, enter one of the following:
- **0**. The add-on is disabled and your employees can’t change it.
@@ -88,11 +97,12 @@ Open the Local Group Policy Editor and go to `Computer Configuration\Administrat
- **2**. The add-on is enabled and your employees can change it.
-7. Click **OK** and close the Group Policy editor.
-
-
-
-
+7. Close the Show Contents dialog.
+7. In the Group Policy editor, go to: Computer Configuration\Administrative Templates\Windows Components\Internet Explorer.
+8. Double-click **Automatically activate/enable newly installed add-ons** and select **Enabled**.
Enabling turns off the message prompting you to Enable or Don't enable the add-on.
+7. Click **OK** twice to close the Group Policy editor.
+
+
\ No newline at end of file
diff --git a/browsers/internet-explorer/ie11-ieak/licensing-version-and-features-ieak11.md b/browsers/internet-explorer/ie11-ieak/licensing-version-and-features-ieak11.md
index 6a0c89fda8..8e6a48df9f 100644
--- a/browsers/internet-explorer/ie11-ieak/licensing-version-and-features-ieak11.md
+++ b/browsers/internet-explorer/ie11-ieak/licensing-version-and-features-ieak11.md
@@ -2,12 +2,14 @@
ms.localizationpriority: low
ms.mktglfcycl: plan
description: Learn about which version of the IEAK 11 you should run, based on your license agreement.
-author: eross-msft
-ms.prod: ie11
+author: pashort
+ms.author: shortpatti
+ms.manager: elizapo
+ms.prod: ie11, ieak11
ms.assetid: 69d25451-08af-4db0-9daa-44ab272acc15
title: Determine the licensing version and features to use in IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros)
ms.sitesec: library
-ms.date: 07/27/2017
+ms.date: 05/02/2018
---
@@ -45,7 +47,7 @@ You must pick a version of IEAK 11 to run during installation, either **Externa
|Automatic configuration |Not available |
|Proxy settings |Proxy settings |
|Security and privacy settings |Not available |
-|Not available |Add a root certificate |
+|Add a root certificate |Not available |
|Programs |Programs |
|Additional settings |Not available |
|Wizard complete |Wizard complete |
diff --git a/devices/hololens/TOC.md b/devices/hololens/TOC.md
index 87ef48bb20..d494af7e30 100644
--- a/devices/hololens/TOC.md
+++ b/devices/hololens/TOC.md
@@ -1,9 +1,12 @@
# [Microsoft HoloLens](index.md)
+## [What's new in Microsoft HoloLens](hololens-whats-new.md)
## [HoloLens in the enterprise: requirements and FAQ](hololens-requirements.md)
## [Set up HoloLens](hololens-setup.md)
## [Unlock Windows Holographic for Business features](hololens-upgrade-enterprise.md)
## [Enroll HoloLens in MDM](hololens-enroll-mdm.md)
+## [Manage updates to HoloLens](hololens-updates.md)
## [Set up HoloLens in kiosk mode](hololens-kiosk.md)
+## [Share HoloLens with multiple people](hololens-multiple-users.md)
## [Configure HoloLens using a provisioning package](hololens-provisioning.md)
## [Install apps on HoloLens](hololens-install-apps.md)
## [Enable Bitlocker device encryption for HoloLens](hololens-encryption.md)
diff --git a/devices/hololens/change-history-hololens.md b/devices/hololens/change-history-hololens.md
index 20d0866be8..6b277cfa47 100644
--- a/devices/hololens/change-history-hololens.md
+++ b/devices/hololens/change-history-hololens.md
@@ -8,13 +8,22 @@ ms.sitesec: library
ms.pagetype: surfacehub
author: jdeckerms
ms.localizationpriority: medium
-ms.date: 02/02/2018
+ms.date: 04/30/2018
---
# Change history for Microsoft HoloLens documentation
This topic lists new and updated topics in the [Microsoft HoloLens documentation](index.md).
+## Windows 10 Holographic for Business, version 1803
+
+The topics in this library have been updated for Windows 10 Holographic for Business, version 1803. The following new topics have been added:
+
+- [What's new in Microsoft HoloLens](hololens-whats-new.md)
+- [Manage updates to HoloLens](hololens-updates.md)
+- [Share HoloLens with multiple people](hololens-multiple-users.md)
+
+
## February 2018
New or changed topic | Description
diff --git a/devices/hololens/hololens-encryption.md b/devices/hololens/hololens-encryption.md
index aef7ea7f69..a673506578 100644
--- a/devices/hololens/hololens-encryption.md
+++ b/devices/hololens/hololens-encryption.md
@@ -55,7 +55,7 @@ Provisioning packages are files created by the Windows Configuration Designer to
### Create a provisioning package that upgrades the Windows Holographic edition
-1. [Create a provisioning package for HoloLens.](hololens-provisioning.md#create-a-provisioning-package-for-hololens)
+1. [Create a provisioning package for HoloLens.](hololens-provisioning.md)
2. Go to **Runtime settings** > **Policies** > **Security**, and select **RequireDeviceEncryption**.
diff --git a/devices/hololens/hololens-enroll-mdm.md b/devices/hololens/hololens-enroll-mdm.md
index 1412357e31..db28187680 100644
--- a/devices/hololens/hololens-enroll-mdm.md
+++ b/devices/hololens/hololens-enroll-mdm.md
@@ -12,7 +12,7 @@ ms.date: 07/27/2017
# Enroll HoloLens in MDM
-You can manage multiple Microsoft HoloLens devices simultaneously using solutions like Microsoft Intune. You will be able to manage settings, select apps to install and set security configurations tailored to your organization's need. See [Manage devices running Windows Holographic with Microsoft Intune](https://docs.microsoft.com/intune/windows-holographic-for-business), the [configuration service providers (CSPs) that are supported in Windows Holographic](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/configuration-service-provider-reference#hololens), and the [policies supported by Windows Holographic for Business](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#hololenspolicies).
+You can manage multiple Microsoft HoloLens devices simultaneously using solutions like [Microsoft Intune](https://docs.microsoft.com/intune/windows-holographic-for-business). You will be able to manage settings, select apps to install and set security configurations tailored to your organization's need. See [Manage devices running Windows Holographic with Microsoft Intune](https://docs.microsoft.com/intune/windows-holographic-for-business), the [configuration service providers (CSPs) that are supported in Windows Holographic](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/configuration-service-provider-reference#hololens), and the [policies supported by Windows Holographic for Business](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#hololenspolicies).
>[!NOTE]
>Mobile device management (MDM), including the VPN, Bitlocker, and kiosk mode features, is only available when you [upgrade to Windows Holographic for Business](hololens-upgrade-enterprise.md).
diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md
index 14ede04e4d..d17932da87 100644
--- a/devices/hololens/hololens-kiosk.md
+++ b/devices/hololens/hololens-kiosk.md
@@ -1,20 +1,170 @@
---
title: Set up HoloLens in kiosk mode (HoloLens)
-description: Kiosk mode limits the user's ability to launch new apps or change the running app.
+description: Use a kiosk configuration to lock down the apps on HoloLens.
ms.prod: w10
ms.mktglfcycl: manage
ms.pagetype: hololens, devices
ms.sitesec: library
author: jdeckerms
ms.localizationpriority: medium
-ms.date: 07/27/2017
+ms.date: 04/30/2018
---
# Set up HoloLens in kiosk mode
+>[!WARNING]
+>Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
+
+In Windows 10, version 1803, you can configure your HoloLens devices to run as multi-app or single-app kiosks.
+
+When HoloLens is configured as a multi-app kiosk, only the allowed apps are available to the user. The benefit of a multi-app kiosk, or fixed-purpose device, is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don’t need to access.
+
+Single-app kiosk mode starts the specified app when the user signs in, and restricts the user's ability to launch new apps or change the running app. When single-app kiosk mode is enabled for HoloLens, the bloom gesture and Cortana are disabled, and placed apps aren't shown in the user's surroundings.
+
+The [AssignedAccess Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) enables kiosk configuration.
+
+>[!WARNING]
+>The assigned access feature which enables kiosk mode is intended for corporate-owned fixed-purpose devices. When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide, and will impact other users on the device. Deleting the multi-app configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all [the enforced policies](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#policies-set-by-multi-app-kiosk-configuration). A factory reset is needed to clear all the policies enforced via assigned access.
+>
+>Be aware that voice commands are enabled for kiosk mode configured in Microsoft Intune or provisioning packages, even if the Cortana app is not selected as a kiosk app.
+
+For HoloLens devices running Windows 10, version 1803, there are three methods that you can use to configure the device as a kiosk:
+- You can use [Microsoft Intune or other mobile device management (MDM) service](#intune-kiosk) to configure single-app and multi-app kiosks.
+- You can [use a provisioning package](#ppkg-kiosk) to configure single-app and multi-app kiosks.
+- You can [use the Windows Device Portal](#portal-kiosk) to configure single-app kiosks. This method is recommended only for demonstrations, as it requires that developer mode be enabled on the device.
+
+For HoloLens devices running Windows 10, version 1607, you can [use the Windows Device Portal](#portal-kiosk) to configure single-app kiosks.
+
+
+## Start layout for HoloLens
+
+If you use [MDM, Microsoft Intune](#intune-kiosk), or a [provisioning package](#ppkg-kiosk) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Holographic for Business, so you'll need to use a placeholder Start layout.
+
+>[!NOTE]
+>Because a single-app kiosk launches the kiosk app when a user signs in, there is no Start screen displayed.
+
+### Start layout file for Intune
+
+Save the following sample as an XML file. You will select this file when you configure the kiosk in Microsoft Intune (or in another MDM service that provides a kiosk profile).
+
+>[!NOTE]
+>If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, use the [Start layout instructions for a provisioning package](#start-layout-for-a-provisioning-package).
+
+```xml
+
**IMPORTANT**
If you create a local account in the provisioning package, you must change the password using the **Settings** app every 42 days. If the password is not changed during that period, the account might be locked out and unable to sign in. If the user account is locked out, you must [perform a full device recovery](https://developer.microsoft.com/windows/mixed-reality/reset_or_recover_your_hololens#perform_a_full_device_recovery). |
| **Certificates** | Deploy a certificate to HoloLens. |
| **ConnectivityProfiles** | Deploy a Wi-Fi profile to HoloLens. |
| **EditionUpgrade** | [Upgrade to Windows Holographic for Business.](hololens-upgrade-enterprise.md) |
diff --git a/devices/hololens/hololens-requirements.md b/devices/hololens/hololens-requirements.md
index 77ad68eb9e..c6061e863f 100644
--- a/devices/hololens/hololens-requirements.md
+++ b/devices/hololens/hololens-requirements.md
@@ -54,8 +54,8 @@ Hello for Business (using a PIN to sign in) is supported for HoloLens. It must b
Yes, the behavior for the type of account impacts the sign-in behavior. If you apply policies for sign-in, the policy is always respected. If no policy for sign-in is applied, these are the default behaviors for each account type.
- Microsoft account: signs in automatically
-- Local account: always asks for password, not configurable by Settings
-- Azure AD: asks for password by default; configurable by Settings to no longer ask for password.
+- Local account: always asks for password, not configurable in **Settings**
+- Azure AD: asks for password by default; configurable by **Settings** to no longer ask for password.
>[!NOTE]
>Inactivity timers are currently not supported, which means that the **AllowIdleReturnWithoutPassword** policy is respected only when the device goes into StandBy.
diff --git a/devices/hololens/hololens-updates.md b/devices/hololens/hololens-updates.md
new file mode 100644
index 0000000000..e7e0c89ac7
--- /dev/null
+++ b/devices/hololens/hololens-updates.md
@@ -0,0 +1,50 @@
+---
+title: Manage updates to HoloLens (HoloLens)
+description: Administrators can use mobile device management to manage updates to HoloLens devices.
+ms.prod: w10
+ms.mktglfcycl: manage
+ms.pagetype: hololens, devices
+ms.sitesec: library
+author: jdeckerms
+ms.localizationpriority: medium
+ms.date: 04/30/2018
+---
+
+# Manage updates to HoloLens
+
+>[!WARNING]
+>Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
+
+Windows 10, version 1803, is the first feature update to Windows Holographic for Business since its release in Windows 10, version 1607. As with desktop devices, administrators can manage updates to the HoloLens operating system using [Windows Update for Business](https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-wufb).
+
+>[!NOTE]
+>HoloLens devices must be [upgraded to Windows Holographic for Business](hololens-upgrade-enterprise.md) to manage updates.
+
+
+Mobile device management (MDM) providers use the [Policy Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider) to enable update management.
+
+The Update policies supported for HoloLens are:
+
+- [Update/AllowAutoUpdate](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-allowautoupdate)
+- [Update/AllowUpdateService](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-allowupdateservice)
+- [Update/RequireDeferUpgrade](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-requiredeferupgrade)
+- [Update/RequireUpdateApproval](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-requireupdateapproval)
+- [Update/UpdateServiceUrl](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-updateserviceurl)
+
+
+
+Typically, devices access Windows Update directly for updates. You can use the following update policies to configure devices to get updates from Windows Server Update Service (WSUS) instead:
+
+- [Update/AllowUpdateService](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-allowupdateservice)
+- [Update/RequireUpdateApproval](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-requireupdateapproval)
+- [Update/UpdateServiceUrl](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-updateserviceurl)
+
+In Microsoft Intune, use [a custom profile](https://docs.microsoft.com/intune/custom-settings-windows-holographic) to configure devices to get updates from WSUS.
+
+
+
+
+
+## Related topics
+
+- [Manage software updates in Microsoft Intune](https://docs.microsoft.com/intune/windows-update-for-business-configure)
\ No newline at end of file
diff --git a/devices/hololens/hololens-upgrade-enterprise.md b/devices/hololens/hololens-upgrade-enterprise.md
index 1ac6bbeed2..3beed8592e 100644
--- a/devices/hololens/hololens-upgrade-enterprise.md
+++ b/devices/hololens/hololens-upgrade-enterprise.md
@@ -7,17 +7,20 @@ ms.pagetype: hololens, devices
ms.sitesec: library
author: jdeckerms
ms.localizationpriority: medium
-ms.date: 02/02/2018
+ms.date: 04/30/2018
---
# Unlock Windows Holographic for Business features
+>[!WARNING]
+>Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
+
Microsoft HoloLens is available in the *Development Edition*, which runs Windows Holographic (an edition of Windows 10 designed for HoloLens), and in the [Commercial Suite](https://docs.microsoft.com/windows/mixed-reality/commercial-features), which provides extra features designed for business.
When you purchase the Commercial Suite, you receive a license that upgrades Windows Holographic to Windows Holographic for Business. This license can be applied to the device either through the organization's [mobile device management (MDM) provider](#edition-upgrade-using-mdm) or a [provisioning package](#edition-upgrade-using-a-provisioning-package).
>[!TIP]
->You can tell that the HoloLens has been upgraded to the business edition in **Settings** > **Network & Internet**. The **VPN** option is only available in Windows Holographic for Business.
+>In Windows 10, version 1803, you can tell that the HoloLens has been upgraded to the business edition in **Settings** > **System**.
@@ -37,7 +40,7 @@ Provisioning packages are files created by the Windows Configuration Designer to
### Create a provisioning package that upgrades the Windows Holographic edition
-1. [Create a provisioning package for HoloLens.](hololens-provisioning.md#create-a-provisioning-package-for-hololens)
+1. [Create a provisioning package for HoloLens.](hololens-provisioning.md)
2. Go to **Runtime settings** > **EditionUpgrade**, and select **EditionUpgradeWithLicense**.
diff --git a/devices/hololens/hololens-whats-new.md b/devices/hololens/hololens-whats-new.md
new file mode 100644
index 0000000000..00e18e5b12
--- /dev/null
+++ b/devices/hololens/hololens-whats-new.md
@@ -0,0 +1,55 @@
+---
+title: What's new in Microsoft HoloLens (HoloLens)
+description: Windows Holographic for Business gets new features in Windows 10, version 1803.
+ms.prod: w10
+ms.mktglfcycl: manage
+ms.pagetype: hololens, devices
+ms.sitesec: library
+author: jdeckerms
+ms.localizationpriority: medium
+ms.date: 04/30/2018
+---
+
+# What's new in Microsoft HoloLens
+
+>[!WARNING]
+>Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
+
+Windows 10, version 1803, is the first feature update to Windows Holographic for Business since its release in Windows 10, version 1607. This update introduces the following changes:
+
+- Previously, you could only verify that upgrade license for Commercial Suite had been applied to your HoloLens device by checking to see if VPN was an available option on the device. Now, **Settings** > **System** will display **Windows Holographic for Business** after the upgrade license is applied. [Learn how to unlock Windows Holographic for Business features](hololens-upgrade-enterprise.md).
+
+- You can view the operating system build number in device properties in the File Explorer app and in the [Windows Device Recovery Tool (WDRT)](https://support.microsoft.com/help/12379/windows-10-mobile-device-recovery-tool-faq).
+
+- Provisioning a HoloLens device is now easier with the new **Provision HoloLens devices** wizard in the Windows Configuration Designer tool. In the wizard, you can configure the setup experience and network connections, set developer mode, and obtain bulk Azure AD tokens. [Learn how to use the simple provisioning wizard for HoloLens](hololens-provisioning.md#wizard).
+
+ 
+
+- When you create a local account in a provisioning package, the password no longer expires every 42 days.
+
+- You can [configure HoloLens as a single-app or multi-app kiosk](hololens-kiosk.md). Multi-app kiosk mode lets you set up a HoloLens to only run the apps that you specify, and prevents users from making changes.
+
+- Media Transfer Protocol (MTP) is enabled so that you can connect the HoloLens device to a PC by USB and transfer files between HoloLens and the PC. You can also use the File Explorer app to move and delete files from within HoloLens.
+
+- Previously, after you signed in to the device with an Azure Active Directory (Azure AD) account, you then had to **Add work access** in **Settings** to get access to corporate resources. Now, you sign in with an Azure AD account and enrollment happens automatically.
+
+- Before you sign in, you can choose the network icon below the password field to choose a different Wi-Fi network to connect to. You can also connect to a guest network, such as at a hotel, conference center, or business.
+
+- You can now easily [share HoloLens with multiple people](hololens-multiple-users.md) using Azure AD accounts.
+
+- When setup or sign-in fails, choose the new **Collect info** option to get diagnostic logs for troubleshooting.
+
+- Individual users can sync their corporate email without enrolling their device in mobile device management (MDM). You can use the device with a Microsoft Account, download and install the Mail app, and add an email account directly.
+
+- You can check the MDM sync status for a device in **Settings** > **Accounts** > **Access Work or School** > **Info**. In the **Device sync status** section, you can start a sync, see areas managed by MDM, and create and export an advanced diagnostics report.
+
+
+
+
+
+## Additional resources
+
+- [Reset or recover your HoloLens](https://developer.microsoft.com/windows/mixed-reality/reset_or_recover_your_hololens)
+- [Restart, rest, or recover HoloLens](https://support.microsoft.com/help/13452/hololens-restart-reset-or-recover-hololens)
+- [Manage devices running Windows Holographic with Microsoft Intune](https://docs.microsoft.com/intune/windows-holographic-for-business)
+
diff --git a/devices/hololens/images/account-management-details.png b/devices/hololens/images/account-management-details.png
new file mode 100644
index 0000000000..4094dabd85
Binary files /dev/null and b/devices/hololens/images/account-management-details.png differ
diff --git a/devices/hololens/images/account-management.PNG b/devices/hololens/images/account-management.PNG
new file mode 100644
index 0000000000..34165dfcd6
Binary files /dev/null and b/devices/hololens/images/account-management.PNG differ
diff --git a/devices/hololens/images/add-certificates-details.PNG b/devices/hololens/images/add-certificates-details.PNG
new file mode 100644
index 0000000000..966a826a46
Binary files /dev/null and b/devices/hololens/images/add-certificates-details.PNG differ
diff --git a/devices/hololens/images/add-certificates.PNG b/devices/hololens/images/add-certificates.PNG
new file mode 100644
index 0000000000..24cb605d1c
Binary files /dev/null and b/devices/hololens/images/add-certificates.PNG differ
diff --git a/devices/hololens/images/backicon.png b/devices/hololens/images/backicon.png
new file mode 100644
index 0000000000..3007e448b1
Binary files /dev/null and b/devices/hololens/images/backicon.png differ
diff --git a/devices/hololens/images/check_blu.png b/devices/hololens/images/check_blu.png
new file mode 100644
index 0000000000..d5c703760f
Binary files /dev/null and b/devices/hololens/images/check_blu.png differ
diff --git a/devices/hololens/images/check_grn.png b/devices/hololens/images/check_grn.png
new file mode 100644
index 0000000000..f9f04cd6bd
Binary files /dev/null and b/devices/hololens/images/check_grn.png differ
diff --git a/devices/hololens/images/checklistbox.gif b/devices/hololens/images/checklistbox.gif
new file mode 100644
index 0000000000..cbcf4a4f11
Binary files /dev/null and b/devices/hololens/images/checklistbox.gif differ
diff --git a/devices/hololens/images/checklistdone.png b/devices/hololens/images/checklistdone.png
new file mode 100644
index 0000000000..7e53f74d0e
Binary files /dev/null and b/devices/hololens/images/checklistdone.png differ
diff --git a/devices/hololens/images/checkmark.png b/devices/hololens/images/checkmark.png
new file mode 100644
index 0000000000..f9f04cd6bd
Binary files /dev/null and b/devices/hololens/images/checkmark.png differ
diff --git a/devices/hololens/images/crossmark.png b/devices/hololens/images/crossmark.png
new file mode 100644
index 0000000000..69432ff71c
Binary files /dev/null and b/devices/hololens/images/crossmark.png differ
diff --git a/devices/hololens/images/developer-setup-details.png b/devices/hololens/images/developer-setup-details.png
new file mode 100644
index 0000000000..0a32af7ba7
Binary files /dev/null and b/devices/hololens/images/developer-setup-details.png differ
diff --git a/devices/hololens/images/developer-setup.png b/devices/hololens/images/developer-setup.png
new file mode 100644
index 0000000000..826fda5f25
Binary files /dev/null and b/devices/hololens/images/developer-setup.png differ
diff --git a/devices/hololens/images/doneicon.png b/devices/hololens/images/doneicon.png
new file mode 100644
index 0000000000..d80389f35b
Binary files /dev/null and b/devices/hololens/images/doneicon.png differ
diff --git a/devices/hololens/images/finish-details.png b/devices/hololens/images/finish-details.png
new file mode 100644
index 0000000000..ff3f53e5c8
Binary files /dev/null and b/devices/hololens/images/finish-details.png differ
diff --git a/devices/hololens/images/finish.PNG b/devices/hololens/images/finish.PNG
new file mode 100644
index 0000000000..7c65da1799
Binary files /dev/null and b/devices/hololens/images/finish.PNG differ
diff --git a/devices/hololens/images/five.png b/devices/hololens/images/five.png
new file mode 100644
index 0000000000..961f0e15b7
Binary files /dev/null and b/devices/hololens/images/five.png differ
diff --git a/devices/hololens/images/four.png b/devices/hololens/images/four.png
new file mode 100644
index 0000000000..0fef213b37
Binary files /dev/null and b/devices/hololens/images/four.png differ
diff --git a/devices/hololens/images/icd-create-options-1703.PNG b/devices/hololens/images/icd-create-options-1703.PNG
new file mode 100644
index 0000000000..007e740683
Binary files /dev/null and b/devices/hololens/images/icd-create-options-1703.PNG differ
diff --git a/devices/hololens/images/icd-export-menu.png b/devices/hololens/images/icd-export-menu.png
new file mode 100644
index 0000000000..20bd5258eb
Binary files /dev/null and b/devices/hololens/images/icd-export-menu.png differ
diff --git a/devices/hololens/images/icd-install.PNG b/devices/hololens/images/icd-install.PNG
new file mode 100644
index 0000000000..a0c80683ff
Binary files /dev/null and b/devices/hololens/images/icd-install.PNG differ
diff --git a/devices/hololens/images/icd-simple-edit.png b/devices/hololens/images/icd-simple-edit.png
new file mode 100644
index 0000000000..421159ac17
Binary files /dev/null and b/devices/hololens/images/icd-simple-edit.png differ
diff --git a/devices/hololens/images/launchicon.png b/devices/hololens/images/launchicon.png
new file mode 100644
index 0000000000..d469c68a2c
Binary files /dev/null and b/devices/hololens/images/launchicon.png differ
diff --git a/devices/hololens/images/multiappassignedaccesssettings.png b/devices/hololens/images/multiappassignedaccesssettings.png
new file mode 100644
index 0000000000..86e2e0a451
Binary files /dev/null and b/devices/hololens/images/multiappassignedaccesssettings.png differ
diff --git a/devices/hololens/images/one.png b/devices/hololens/images/one.png
new file mode 100644
index 0000000000..7766e7d470
Binary files /dev/null and b/devices/hololens/images/one.png differ
diff --git a/devices/hololens/images/provision-hololens-devices.png b/devices/hololens/images/provision-hololens-devices.png
new file mode 100644
index 0000000000..c5ece7102f
Binary files /dev/null and b/devices/hololens/images/provision-hololens-devices.png differ
diff --git a/devices/hololens/images/set-up-device-details.PNG b/devices/hololens/images/set-up-device-details.PNG
new file mode 100644
index 0000000000..85b7dd382e
Binary files /dev/null and b/devices/hololens/images/set-up-device-details.PNG differ
diff --git a/devices/hololens/images/set-up-device.PNG b/devices/hololens/images/set-up-device.PNG
new file mode 100644
index 0000000000..0c9eb0e3ff
Binary files /dev/null and b/devices/hololens/images/set-up-device.PNG differ
diff --git a/devices/hololens/images/set-up-network-details-desktop.PNG b/devices/hololens/images/set-up-network-details-desktop.PNG
new file mode 100644
index 0000000000..83911ccbd0
Binary files /dev/null and b/devices/hololens/images/set-up-network-details-desktop.PNG differ
diff --git a/devices/hololens/images/set-up-network.PNG b/devices/hololens/images/set-up-network.PNG
new file mode 100644
index 0000000000..a0e856c103
Binary files /dev/null and b/devices/hololens/images/set-up-network.PNG differ
diff --git a/devices/hololens/images/seven.png b/devices/hololens/images/seven.png
new file mode 100644
index 0000000000..285a92df0b
Binary files /dev/null and b/devices/hololens/images/seven.png differ
diff --git a/devices/hololens/images/six.png b/devices/hololens/images/six.png
new file mode 100644
index 0000000000..e8906332ec
Binary files /dev/null and b/devices/hololens/images/six.png differ
diff --git a/devices/hololens/images/three.png b/devices/hololens/images/three.png
new file mode 100644
index 0000000000..887fa270d7
Binary files /dev/null and b/devices/hololens/images/three.png differ
diff --git a/devices/hololens/images/two.png b/devices/hololens/images/two.png
new file mode 100644
index 0000000000..b8c2d52eaf
Binary files /dev/null and b/devices/hololens/images/two.png differ
diff --git a/devices/hololens/images/wizard-steps.png b/devices/hololens/images/wizard-steps.png
new file mode 100644
index 0000000000..d97bae9a05
Binary files /dev/null and b/devices/hololens/images/wizard-steps.png differ
diff --git a/devices/hololens/index.md b/devices/hololens/index.md
index ddb5c29aea..98ceb942a3 100644
--- a/devices/hololens/index.md
+++ b/devices/hololens/index.md
@@ -7,7 +7,7 @@ ms.pagetype: hololens, devices
ms.sitesec: library
author: jdeckerms
ms.localizationpriority: medium
-ms.date: 11/29/2017
+ms.date: 04/30/2018
---
# Microsoft HoloLens
@@ -21,14 +21,18 @@ ms.date: 11/29/2017
| Topic | Description |
| --- | --- |
+[What's new in Microsoft HoloLens](hololens-whats-new.md) | Discover the new features in the latest update.
| [HoloLens in the enterprise: requirements](hololens-requirements.md) | Lists requirements for general use, Wi-Fi, and device management |
| [Set up HoloLens](hololens-setup.md) | How to set up HoloLens for the first time |
| [Unlock Windows Holographic for Business features](hololens-upgrade-enterprise.md) | How to upgrade your Development Edition HoloLens to Windows Holographic for Business|
| [Enroll HoloLens in MDM](hololens-enroll-mdm.md) | Manage multiple HoloLens devices simultaneously using solutions like Microsoft Intune |
+[Manage updates to HoloLens](hololens-updates.md) | Use mobile device management (MDM) policies to configure settings for updates.
| [Set up HoloLens in kiosk mode](hololens-kiosk.md) | Enable kiosk mode for HoloLens, which limits the user's ability to launch new apps or change the running app |
+[Share HoloLens with multiple people](hololens-multiple-users.md) | Multiple users can shared a HoloLens device by using their Azure Active Directory accounts.
| [Configure HoloLens using a provisioning package](hololens-provisioning.md) | Provisioning packages make it easy for IT administrators to configure HoloLens devices without imaging |
| [Install apps on HoloLens](hololens-install-apps.md) | Use Microsoft Store for Business, mobile device management (MDM), or the Windows Device Portal to install apps on HoloLens|
-
+[Enable Bitlocker device encryption for HoloLens](hololens-encryption.md) | Learn how to use Bitlocker device encryption to protect files and information stored on the HoloLens.
+[Change history for Microsoft HoloLens documentation](change-history-hololens.md) | See new and updated topics in the HoloLens documentation library.
## Related resources
diff --git a/devices/surface-hub/change-history-surface-hub.md b/devices/surface-hub/change-history-surface-hub.md
index d0cb5eb932..c3ab437724 100644
--- a/devices/surface-hub/change-history-surface-hub.md
+++ b/devices/surface-hub/change-history-surface-hub.md
@@ -16,6 +16,12 @@ ms.localizationpriority: medium
This topic lists new and updated topics in the [Surface Hub Admin Guide]( surface-hub-administrators-guide.md).
+## April 2018
+
+New or changed topic | Description
+--- | ---
+[Hybrid deployment](hybrid-deployment-surface-hub-device-accounts.md) | Updated instructions for Skype for Business Hybrid.
+
## March 2018
New or changed topic | Description
diff --git a/devices/surface-hub/connect-and-display-with-surface-hub.md b/devices/surface-hub/connect-and-display-with-surface-hub.md
index 44cc9145f9..dd8d127472 100644
--- a/devices/surface-hub/connect-and-display-with-surface-hub.md
+++ b/devices/surface-hub/connect-and-display-with-surface-hub.md
@@ -17,6 +17,9 @@ ms.localizationpriority: medium
You can connect other devices to your Microsoft Surface Hub to display content. This topic describes the Guest Mode, Replacement PC Mode, and Video Out functionality available through wired connections, and also lists accessories that you can connect to Surface Hub using [Bluetooth](#bluetooth-accessories).
+>[!NOTE]
+>Surface Hub will use the video input that you select until a new connection is made, the existing connection is disrupted, or the Connect App is closed.
+
## Which method should I choose?
When connecting external devices and displays to a Surface Hub, there are several available options. The method you use will depend upon your scenario and needs.
diff --git a/devices/surface-hub/create-a-device-account-using-office-365.md b/devices/surface-hub/create-a-device-account-using-office-365.md
index f6f48f6401..5f69165c08 100644
--- a/devices/surface-hub/create-a-device-account-using-office-365.md
+++ b/devices/surface-hub/create-a-device-account-using-office-365.md
@@ -177,8 +177,8 @@ Now that you're connected to the online services, you can finish setting up the
4. Various Exchange properties can be set on the device account to improve the meeting experience. You can see which properties need to be set in the [Exchange properties](exchange-properties-for-surface-hub-device-accounts.md) section.
``` syntax
- Set-CalendarProcessing -Identity $acctUpn -AutomateProcessing AutoAccept -AddOrganizerToSubject $false –AllowConflicts $false –DeleteComments $false -DeleteSubject $false -RemovePrivateProperty $false
- Set-CalendarProcessing -Identity $acctUpn -AddAdditionalResponse $true -AdditionalResponse "This is a Surface Hub room!"
+ Set-CalendarProcessing -Identity $strEmail -AutomateProcessing AutoAccept -AddOrganizerToSubject $false –AllowConflicts $false –DeleteComments $false -DeleteSubject $false -RemovePrivateProperty $false
+ Set-CalendarProcessing -Identity $strEmail -AddAdditionalResponse $true -AdditionalResponse "This is a Surface Hub room!"
```
@@ -211,7 +211,7 @@ In order to enable Skype for Business, your environment will need to meet the fo
2. To enable your Surface Hub account for Skype for Business Server, run this cmdlet:
```PowerShell
- Enable-CsMeetingRoom -Identity $rm -RegistrarPool
+ Enable-CsMeetingRoom -Identity $strEmail -RegistrarPool
"sippoolbl20a04.infra.lync.com" -SipAddressType EmailAddress
```
@@ -325,8 +325,8 @@ Now that you're connected to the online services, you can finish setting up the
4. Various Exchange properties can be set on the device account to improve the meeting experience. You can see which properties need to be set in the [Exchange properties](exchange-properties-for-surface-hub-device-accounts.md) section.
``` syntax
- Set-CalendarProcessing -Identity $acctUpn -AutomateProcessing AutoAccept -AddOrganizerToSubject $false –AllowConflicts $false –DeleteComments $false -DeleteSubject $false -RemovePrivateProperty $false
- Set-CalendarProcessing -Identity $acctUpn -AddAdditionalResponse $true -AdditionalResponse "This is a Surface Hub room!"
+ Set-CalendarProcessing -Identity $strEmail -AutomateProcessing AutoAccept -AddOrganizerToSubject $false –AllowConflicts $false –DeleteComments $false -DeleteSubject $false -RemovePrivateProperty $false
+ Set-CalendarProcessing -Identity $strEmail -AddAdditionalResponse $true -AdditionalResponse "This is a Surface Hub room!"
```
5. Now we have to set some properties in AD. To do that, you need the alias of the account (this is the part of the UPN that becomes before the “@”).
@@ -369,7 +369,7 @@ In order to enable Skype for Business, your environment will need to meet the fo
2. To enable your Surface Hub account for Skype for Business Server, run this cmdlet:
```PowerShell
- Enable-CsMeetingRoom -Identity $rm -RegistrarPool
+ Enable-CsMeetingRoom -Identity $strEmail -RegistrarPool
"sippoolbl20a04.infra.lync.com" -SipAddressType EmailAddress
```
diff --git a/devices/surface-hub/device-reset-surface-hub.md b/devices/surface-hub/device-reset-surface-hub.md
index d5d8bbf104..a595ea198c 100644
--- a/devices/surface-hub/device-reset-surface-hub.md
+++ b/devices/surface-hub/device-reset-surface-hub.md
@@ -60,6 +60,9 @@ If you see a blank screen for long periods of time during the **Reset device** p
In the Windows Recovery Environment (Windows RE), you can recover your device by downloading a factory build from the cloud and installing it on the Surface Hub. This allows devices in an unusable state to recover without requiring assistance from Microsoft Support.
+>[!NOTE]
+>The **Recover from the cloud** process requires an open internet connection (no proxy, or other authentications). An ethernet connection is recommended.
+
### Recover a Surface Hub in a bad state
If the device account gets into an unstable state or the Admin account is running into issues, you can use cloud recovery in **Settings**. You should only use cloud recovery when [reset](#reset-a-surface-hub-from-settings) doesn't fix the problem.
@@ -77,8 +80,6 @@ On rare occasions, a Surface Hub may encounter an error while cleaning up user a
1. From the welcome screen, toggle the Surface Hub's power switch 3 times. Wait a few seconds between each toggle. See the [Surface Hub Site Readiness Guide](https://www.microsoft.com/surface/support/surface-hub/surface-hub-site-readiness-guide) for help with locating the power switch.
2. The device should automatically boot into Windows RE.
3. After the Surface Hub enters Windows RE, select **Recover from the cloud**. (Optionally, you can choose **Reset**, however **Recover from the cloud** is the recommended approach.)
- >[!NOTE]
- >When using **Recover from the cloud**, an ethernet connection is recommended.
diff --git a/devices/surface-hub/hybrid-deployment-surface-hub-device-accounts.md b/devices/surface-hub/hybrid-deployment-surface-hub-device-accounts.md
index de3ffd59ee..b464e456dc 100644
--- a/devices/surface-hub/hybrid-deployment-surface-hub-device-accounts.md
+++ b/devices/surface-hub/hybrid-deployment-surface-hub-device-accounts.md
@@ -9,13 +9,17 @@ ms.sitesec: library
ms.pagetype: surfacehub
author: jdeckerms
ms.author: jdecker
-ms.date: 02/21/2018
+ms.date: 04/12/2018
ms.localizationpriority: medium
---
# Hybrid deployment (Surface Hub)
A hybrid deployment requires special processing to set up a device account for your Microsoft Surface Hub. If you’re using a hybrid deployment, in which your organization has a mix of services, with some hosted on-premises and some hosted online, then your configuration will depend on where each service is hosted. This topic covers hybrid deployments for [Exchange hosted on-premises](#exchange-on-prem), [Exchange hosted online](#exchange-online), Skype for Business on-premises, Skype for Business online, and Skype for Business hybrid. Because there are so many different variations in this type of deployment, it's not possible to provide detailed instructions for all of them. The following process will work for many configurations. If the process isn't right for your setup, we recommend that you use PowerShell (see [Appendix: PowerShell](appendix-a-powershell-scripts-for-surface-hub.md)) to achieve the same end result as documented here, and for other deployment options. You should then use the provided Powershell script to verify your Surface Hub setup. (See [Account Verification Script](appendix-a-powershell-scripts-for-surface-hub.md#acct-verification-ps-scripts).)
+>[!NOTE]
+>In an Exchange hybrid environment, follow the steps for [Exchange on-premises](#exchange-on-prem). To move Exchange objects to Office 365, use the [New-MoveRequest](https://docs.microsoft.com/powershell/module/exchange/move-and-migration/new-moverequest?view=exchange-ps) cmdlet.
+
+
## Exchange on-premises
Use this procedure if you use Exchange on-premises.
@@ -210,15 +214,10 @@ If your organization has set up [hybrid connectivity between Skype for Business
The Surface Hub requires a Skype account of the type `meetingroom`, while a normal user would use a user type account in Skype. If your Skype server is set up for hybrid where you might have users on the local Skype server as well as users hosted in Office 365, you might run into a few issues when trying to create a Surface Hub account.
-In a hybrid Skype environment, you have to create the user on-premises first, then move the user to the cloud. This means that your user is present in both environments (which makes SIP routing possible). The move from on-premises to online is done via the [Move-CsUser](https://technet.microsoft.com/library/gg398528.aspx) cmdlet which can only be used against user type accounts, not meetingroom type accounts. Because of this, you will not be able to move a Surface Hub account that has a meetingroom type of account. You might think of using the [Move-CsMeetingRoom](https://technet.microsoft.com/library/jj204889.aspx?f=255&mspperror=-2147217396) cmdlet, unfortunately this will not work between the on-preisesm Skype server and Office 365 - it only works across on-premises Skype pools.
+In Skype for Business Server 2015 hybrid environment, any user that you want in Skype for Business Online must first be created in the on-premises deployment, so that the user account is created in Active Directory Domain Services. You can then move the user to Skype for Business Online. The move of a user account from on-premises to online is done via the [Move-CsUser](https://technet.microsoft.com/library/gg398528.aspx) cmdlet. To move a Csmeetingroom object, use the [Move-CsMeetingRoom](https://technet.microsoft.com/library/jj204889.aspx?f=255&mspperror=-2147217396) cmdlet.
-To have a functional Surface Hub account in a Skype hybrid configuration, create the Skype account as a normal user type account, instead of creating the account as a meetingroom. Enable the account on the on-premises Skype server first:
-
-```
-Enable-CsUser -Identity 'HUB01@contoso.com' -RegistrarPool "registrarpoolfqdn" -SipAddressType UserPrincipalName
-```
-
-After the Surface Hub account is enabled for Skype for Business on-premises, you can keep the account on-premises or you can move the Surface Hub account to Office 365, using the Move-CsUser cmdlet. [Learn more about moving a Skype user to Office 365.](https://technet.microsoft.com/library/jj204969.aspx)
+>[!NOTE]
+>To use the Move-CsMeetingRoom cmdlet, you must have installed [the May 2017 cumulative update 6.0.9319.281 for Skype for Business Server 2015](https://support.microsoft.com/help/4020991/enables-the-move-csmeetingroom-cmdlet-to-move-a-meeting-room-from-on-p) or [the July 2017 cumulative update 5.0.8308.992 for Lync Server 2013](https://support.microsoft.com/help/4034279/enables-the-move-csmeetingroom-cmdlet-to-move-a-meeting-room-from-on-p).
## Exchange online
@@ -406,13 +405,8 @@ If your organization has set up [hybrid connectivity between Skype for Business
The Surface Hub requires a Skype account of the type *meetingroom*, while a normal user would use a *user* type account in Skype. If your Skype server is set up for hybrid where you might have users on the local Skype server as well as users hosted in Office 365, you might run into a few issues when trying to create a Surface Hub account.
-In a hybrid Skype environment, you have to create the user on-premises first, then move the user to the cloud. This means that your user is present in both environments (which makes SIP routing possible). The move from on-premises to online is done via the [Move-CsUser](https://technet.microsoft.com/library/gg398528.aspx) cmdlet which can only be used against user type accounts, not meetingroom type accounts. Because of this, you will not be able to move a Surface Hub account that has a meetingroom type of account. You might think of using the [Move-CsMeetingRoom](https://technet.microsoft.com/library/jj204889.aspx?f=255&MSPPError=-2147217396) cmdlet, unfortunately this will not work between the on-premises Skype server and Office 365 - it only works across on-premises Skype pools.
-
-In order to have a functional Surface Hub account in a Skype hybrid configuration, create the Skype account as a normal user type account, instead of creating the account as a meetingroom. First follow the Exchange steps - either [online](#exchange-online) or [on-premises](#exchange-on-premises) - and, instead of enabling the user for Skype for Business Online as described, [enable the account](https://technet.microsoft.com/library/gg398711.aspx) on the on-premises Skype server:
+In Skype for Business Server 2015 hybrid environment, any user that you want in Skype for Business Online must first be created in the on-premises deployment, so that the user account is created in Active Directory Domain Services. You can then move the user to Skype for Business Online. The move of a user account from on-premises to online is done via the [Move-CsUser](https://technet.microsoft.com/library/gg398528.aspx) cmdlet. To move a Csmeetingroom object, use the [Move-CsMeetingRoom](https://technet.microsoft.com/library/jj204889.aspx?f=255&mspperror=-2147217396) cmdlet.
-```PowerShell
-Enable-CsUser -Identity 'HUB01@contoso.com' -RegistrarPool "registrarpoolfqdn" -SipAddressType UserPrincipalName
-```
-
-After the Surface Hub account is enabled for Skype for Business on-premises, you can keep the account on-premises or you can move the Surface Hub account to Office 365, using the Move-CsUser cmdlet. [Learn more about moving a Skype user to Office 365](https://technet.microsoft.com/library/jj204969.aspx).
+>[!NOTE]
+>To use the Move-CsMeetingRoom cmdlet, you must have installed [the May 2017 cumulative update 6.0.9319.281 for Skype for Business Server 2015](https://support.microsoft.com/help/4020991/enables-the-move-csmeetingroom-cmdlet-to-move-a-meeting-room-from-on-p) or [the July 2017 cumulative update 5.0.8308.992 for Lync Server 2013](https://support.microsoft.com/help/4034279/enables-the-move-csmeetingroom-cmdlet-to-move-a-meeting-room-from-on-p).
diff --git a/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md b/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md
index 238158def7..d81d9cfc72 100644
--- a/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md
+++ b/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md
@@ -25,17 +25,7 @@ Surface Hub has been validated with Microsoft’s first-party MDM providers:
You can also manage Surface Hubs using any third-party MDM provider that can communicate with Windows 10 using the MDM protocol.
## Enroll a Surface Hub into MDM
-You can enroll your Surface Hubs using bulk or manual enrollment.
-
-> [!NOTE]
-> You can join your Surface Hub to Azure Active Directory (Azure AD) to manage admin groups on the device. However, Surface Hub does not currently support automatic enrollment to Microsoft Intune through Azure AD join. If your organization automatically enrolls Azure AD-joined devices into Intune, you must disable this policy for Surface Hub before joining the device to Azure AD.
->
-> **To enable automatic enrollment for Microsoft Intune**
-> 1. In the [Azure classic portal](https://manage.windowsazure.com/), navigate to the **Active Directory** node and select your directory.
-> 2. Click the **Applications** tab, then click **Microsoft Intune**.
-> 3. Under **Manage devices for these users**, click **Groups**.
-> 4. Click **Select Groups**, then select the groups of users you want to automatically enroll into Intune. **Do not include accounts that are used to enroll Surface Hubs into Intune.**
-> 5. Click the checkmark button, then click **Save**.
+You can enroll your Surface Hubs using bulk, manual, or automatic enrollment.
### Bulk enrollment
**To configure bulk enrollment**
@@ -51,6 +41,13 @@ You can enroll your Surface Hubs using bulk or manual enrollment.
4. Under **Device management**, select **+ Device management**.
5. Follow the instructions in the dialog to connect to your MDM provider.
+### Automatic enrollment via Azure Active Directory join
+
+Surface Hub now supports the ability to automatically enroll in Intune by joining the device to Azure Active Directory.
+
+For more information, see [Enable Windows 10 automatic enrollment](https://docs.microsoft.com/intune/windows-enroll#enable-windows-10-automatic-enrollment).
+
+
## Manage Surface Hub settings with MDM
You can use MDM to manage some [Surface Hub CSP settings](#supported-surface-hub-csp-settings), and some [Windows 10 settings](#supported-windows-10-settings). Depending on the MDM provider that you use, you may set these settings using a built-in user interface, or by deploying custom SyncML. Microsoft Intune and System Center Configuration Manager provide built-in experiences to help create policy templates for Surface Hub. Refer to documentation from your MDM provider to learn how to create and deploy SyncML.
diff --git a/devices/surface-hub/on-premises-deployment-surface-hub-device-accounts.md b/devices/surface-hub/on-premises-deployment-surface-hub-device-accounts.md
index 7ef2ae24a6..7c6a90015d 100644
--- a/devices/surface-hub/on-premises-deployment-surface-hub-device-accounts.md
+++ b/devices/surface-hub/on-premises-deployment-surface-hub-device-accounts.md
@@ -9,7 +9,7 @@ ms.sitesec: library
ms.pagetype: surfacehub
author: jdeckerms
ms.author: jdecker
-ms.date: 07/27/2017
+ms.date: 04/13/2018
ms.localizationpriority: medium
---
@@ -100,13 +100,12 @@ If you have a single-forest on-premises deployment with Microsoft Exchange 2013
8. OPTIONAL: You can also allow your Surface Hub to make and receive public switched telephone network (PSTN) phone calls by enabling Enterprise Voice for your account. Enterprise Voice isn't a requirement for Surface Hub, but if you want PSTN dialing functionality for the Surface Hub client, here's how to enable it:
- ```PowerShell
- Set-CsMeetingRoom HUB01 -DomainController DC-ND-001.contoso.com
- -LineURItel: +14255550555;ext=50555" Set-CsMeetingRoom -DomainController DC-ND-001.contoso.com
- -Identity HUB01 -EnterpriseVoiceEnabled $true
+ ```PowerShell
+ Set-CsMeetingRoom -Identity HUB01 -DomainController DC-ND-001.contoso.com -LineURI “tel:+14255550555;ext=50555" -EnterpriseVoiceEnabled $true
```
Again, you'll need to replace the provided domain controller and phone number examples with your own information. The parameter value `$true` stays the same.
+
diff --git a/devices/surface-hub/prepare-your-environment-for-surface-hub.md b/devices/surface-hub/prepare-your-environment-for-surface-hub.md
index 077e16a6a5..cef7042de1 100644
--- a/devices/surface-hub/prepare-your-environment-for-surface-hub.md
+++ b/devices/surface-hub/prepare-your-environment-for-surface-hub.md
@@ -36,9 +36,10 @@ Additionally, note that Surface Hub requires the following open ports:
- HTTP: 80
- NTP: 123
-Depending on your environment, access to additional ports may be needed:
-- For online environments, see [Office 365 IP URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US).
-- For on-premises installations, see [Skype for Business Server: Ports and protocols for internal servers](https://technet.microsoft.com/library/gg398833.aspx).
+If you are using Surface Hub with Skype for Business, you will need to open additional ports. Please follow the guidance below:
+- If you use Skype for Business Online, see [Office 365 IP URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US).
+- If you use Skype for Business Server, see [Skype for Business Server: Ports and protocols for internal servers](https://technet.microsoft.com/library/gg398833.aspx).
+- If you use a hybrid of Skype for Business Online and Skype for Business Server, you need to open all documented ports from [Office 365 IP URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US) and [Skype for Business Server: Ports and protocols for internal servers](https://technet.microsoft.com/library/gg398833.aspx).
Microsoft collects diagnostic data to help improve your Surface Hub experience. Add these sites to your allow list:
- Diagnostic data client endpoint: `https://vortex.data.microsoft.com/`
diff --git a/devices/surface-hub/surface-hub-authenticator-app.md b/devices/surface-hub/surface-hub-authenticator-app.md
index b303d0354c..4e76e525e0 100644
--- a/devices/surface-hub/surface-hub-authenticator-app.md
+++ b/devices/surface-hub/surface-hub-authenticator-app.md
@@ -24,7 +24,7 @@ To let people in your organization sign in to Surface Hub with their phones and
- Make sure you have at minimum an Office 365 E3 subscription.
-- [Configure Multi-Factor Authentication](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication). Make sure **Notification through mobile app** is selected.
+- [Configure Multi-Factor Authentication](https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-mfasettings). Make sure **Notification through mobile app** is selected.
diff --git a/devices/surface-hub/surface-hub-downloads.md b/devices/surface-hub/surface-hub-downloads.md
index 33ef0f983f..71706b04fe 100644
--- a/devices/surface-hub/surface-hub-downloads.md
+++ b/devices/surface-hub/surface-hub-downloads.md
@@ -31,7 +31,7 @@ This topic provides links to useful Surface Hub documents, such as product datas
| [Rolling Stand Mounting and Assembly Guide (PDF)](http://download.microsoft.com/download/7/0/2/702485E3-B55E-4DE8-B5DD-3B56F90DCF5D/SH-Guide_WACG_Rolling_Stands_EN-FR-ES-NL-DE-IT-AR-DA-FI-NO-SV.pdf) | Detailed instructions on how to safely and securely assemble the rolling stand, and how to mount your Surface Hub onto it. [Watch the video (opens in a pop-up media player)](http://compass.xbox.com/assets/1f/94/1f949613-3e4a-41e3-ad60-fe8aa7134115.mov?n=04.07.16_installation_video_04_rolling_stand_mount.mov) |
| [Mounts and Stands Datasheet (PDF)](http://download.microsoft.com/download/5/0/1/501F98D9-1BCC-4448-A1DB-47056CEE33B6/20160711_Surface_Hub_Mounts_and_Stands_Datasheet.pdf) | Specifications and prices for all Surface Hub add-on stands and mounts that turn your workspace into a Surface Hub workspace. |
| [Surface Hub Stand and Wall Mount Specifications (PDF)](http://download.microsoft.com/download/7/A/7/7A75BD0F-5A46-4BCE-B313-A80E47AEB581/20160720_Combined_Stand_Wall_Mount_Drawings.pdf) | Illustrated specifications for the 55” and 84” Surface Hub rolling stands, wall mounts, and floor-supported wall mounts. |
-| [Surface Hub Onsite Installation and Onsite Repair/Exchange Services FAQ (PDF)](http://download.microsoft.com/download/B/D/1/BD16D7C5-2662-4B7D-9C98-272CEB11A6F3/20160816%20SurfaceHub_Onsite%20Services%20FAQs%20FINAL.PDF) | Get answers to the most common questions about Surface Hub onsite service offerings and delivery. |
+
diff --git a/devices/surface-hub/whiteboard-collaboration.md b/devices/surface-hub/whiteboard-collaboration.md
index e7013de28c..7ad560c77e 100644
--- a/devices/surface-hub/whiteboard-collaboration.md
+++ b/devices/surface-hub/whiteboard-collaboration.md
@@ -15,7 +15,7 @@ ms.localizationpriority: medium
Microsoft Whiteboard’s latest update (17.8302.5275X or greater) includes the capability for two Surface Hubs to collaborate in real time on the same board.
-By ensuring that your organization meets the prerequisites, users can then ink, collaborate, and ideate together. Mobile device management (MDM) allows you to control default settings and provides access to these capabilities. For more information about mobile device management for Surface Hub, see [Manage settings with an MDM provider (Surface Hub)](manage-settings-with-mdm-for-surface-hub.md).
+By ensuring that your organization meets the prerequisites, users can then ink, collaborate, and ideate together.
diff --git a/devices/surface/TOC.md b/devices/surface/TOC.md
index 778c88fa47..6bb7a33e57 100644
--- a/devices/surface/TOC.md
+++ b/devices/surface/TOC.md
@@ -1,6 +1,6 @@
# [Surface](index.md)
## [Deploy Surface devices](deploy.md)
-### [Windows AutoPilot and Surface devices](windows-autopilot-and-surface-devices.md)
+### [Windows Autopilot and Surface devices](windows-autopilot-and-surface-devices.md)
### [Surface device compatibility with Windows 10 Long-Term Servicing Branch](surface-device-compatibility-with-windows-10-ltsc.md)
#### [Long-Term Servicing Branch for Surface devices](ltsb-for-surface.md)
### [Deploy Windows 10 to Surface devices with MDT](deploy-windows-10-to-surface-devices-with-mdt.md)
diff --git a/devices/surface/change-history-for-surface.md b/devices/surface/change-history-for-surface.md
index a374627e4d..443f787ea4 100644
--- a/devices/surface/change-history-for-surface.md
+++ b/devices/surface/change-history-for-surface.md
@@ -23,7 +23,7 @@ This topic lists new and updated topics in the Surface documentation library.
|New or changed topic | Description |
| --- | --- |
-|[Windows AutoPilot and Surface devices](windows-autopilot-and-surface-devices.md) | New article |
+|[Windows Autopilot and Surface devices](windows-autopilot-and-surface-devices.md) | New article |
|[Microsoft Surface Data Eraser](microsoft-surface-data-eraser.md) | Added version 3.2.45.0 information |
|[Surface device compatibility with Windows 10 Long-Term Servicing Channel (LTSC)](surface-device-compatibility-with-windows-10-ltsc.md) | Updated Current Branch (CB) or Current Branch for Business (CBB) servicing options with Semi-Annual Channel (SAC) information |
|[Wake On LAN for Surface devices](wake-on-lan-for-surface-devices.md) | Added Surface Book 2, Surface Laptop, Surface Pro, Surface Pro with LTE Advanced, and Surface Pro information |
diff --git a/devices/surface/deploy.md b/devices/surface/deploy.md
index a52eef5395..70879513fa 100644
--- a/devices/surface/deploy.md
+++ b/devices/surface/deploy.md
@@ -18,7 +18,7 @@ Get deployment guidance for your Surface devices including information about MDT
| Topic | Description |
| --- | --- |
-| [Windows AutoPilot and Surface devices](windows-autopilot-and-surface-devices.md) | Find out how to remotely deploy and configure devices with Windows AutoPilot. |
+| [Windows Autopilot and Surface devices](windows-autopilot-and-surface-devices.md) | Find out how to remotely deploy and configure devices with Windows Autopilot. |
| [Surface device compatibility with Windows 10 Long-Term Servicing Channel](surface-device-compatibility-with-windows-10-ltsc.md) | Find out about compatibility and limitations of Surface devices running Windows 10 Enterprise LTSC edition. |
| [Deploy Windows 10 to Surface devices with MDT](deploy-windows-10-to-surface-devices-with-mdt.md) | Walk through the recommended process of how to deploy Windows 10 to your Surface devices with the Microsoft Deployment Toolkit.|
| [Upgrade Surface devices to Windows 10 with MDT](upgrade-surface-devices-to-windows-10-with-mdt.md)| Find out how to perform a Windows 10 upgrade deployment to your Surface devices. |
diff --git a/devices/surface/windows-autopilot-and-surface-devices.md b/devices/surface/windows-autopilot-and-surface-devices.md
index d4599d8ffd..bc678a28bd 100644
--- a/devices/surface/windows-autopilot-and-surface-devices.md
+++ b/devices/surface/windows-autopilot-and-surface-devices.md
@@ -1,6 +1,6 @@
---
-title: Windows AutoPilot and Surface Devices (Surface)
-description: Find out about Windows AutoPilot deployment options for Surface devices.
+title: Windows Autopilot and Surface Devices (Surface)
+description: Find out about Windows Autopilot deployment options for Surface devices.
keywords: autopilot, windows 10, surface, deployment
ms.prod: w10
ms.mktglfcycl: deploy
@@ -11,16 +11,16 @@ ms.date: 01/31/2018
ms.author: jdecker
---
-# Windows AutoPilot and Surface devices
+# Windows Autopilot and Surface devices
-Windows AutoPilot is a cloud-based deployment technology available in Windows 10. Using Windows AutoPilot, you can remotely deploy and configure devices in a truly zero-touch process right out of the box. Windows AutoPilot registered devices are identified over the internet at first boot using a unique device signature, known as the hardware hash, and automatically enrolled and configured using modern management solutions such as Azure Active Directory (AAD) and Mobile Device Management (MDM).
+Windows Autopilot is a cloud-based deployment technology available in Windows 10. Using Windows Autopilot, you can remotely deploy and configure devices in a truly zero-touch process right out of the box. Windows Autopilot registered devices are identified over the internet at first boot using a unique device signature, known as the hardware hash, and automatically enrolled and configured using modern management solutions such as Azure Active Directory (AAD) and Mobile Device Management (MDM).
-With Surface devices, you can choose to register your devices at the time of purchase when purchasing from a Surface partner enabled for Windows AutoPilot. New devices can be shipped directly to your end-users and will be automatically enrolled and configured when the units are unboxed and turned on for the first time. This process can eliminate need to reimage your devices as part of your deployment process, reducing the work required of your deployment staff and opening up new, agile methods for device management and distribution.
+With Surface devices, you can choose to register your devices at the time of purchase when purchasing from a Surface partner enabled for Windows Autopilot. New devices can be shipped directly to your end-users and will be automatically enrolled and configured when the units are unboxed and turned on for the first time. This process can eliminate need to reimage your devices as part of your deployment process, reducing the work required of your deployment staff and opening up new, agile methods for device management and distribution.
-In this article learn how to enroll your Surface devices in Windows AutoPilot with a Surface partner and the options and considerations you will need to know along the way. This article focuses specifically on Surface devices, for more information about using Windows AutoPilot with other devices, or to read more about Windows AutoPilot and its capabilities, see [Overview of Windows AutoPilot](https://docs.microsoft.com/en-us/windows/deployment/windows-autopilot/windows-10-autopilot) in the Windows Docs Library.
+In this article learn how to enroll your Surface devices in Windows Autopilot with a Surface partner and the options and considerations you will need to know along the way. This article focuses specifically on Surface devices, for more information about using Windows Autopilot with other devices, or to read more about Windows Autopilot and its capabilities, see [Overview of Windows Autopilot](https://docs.microsoft.com/en-us/windows/deployment/windows-autopilot/windows-10-autopilot) in the Windows Docs Library.
## Prerequisites
-Enrollment of Surface devices in Windows AutoPilot with a Surface partner enabled for Windows AutoPilot has the following licensing requirements for each enrolled Surface device:
+Enrollment of Surface devices in Windows Autopilot with a Surface partner enabled for Windows Autopilot has the following licensing requirements for each enrolled Surface device:
* **Azure Active Directory Premium** – Required to enroll your devices in your organization and to automatically enroll devices in your organization’s mobile management solution.
* **Mobile Device Management (such as Microsoft Intune)** – Required to remotely deploy applications, configure, and manage your enrolled devices.
* **Office 365 ProPlus** – Required to deploy Microsoft Office to your enrolled devices.
@@ -33,19 +33,19 @@ Or
* Office 365 ProPlus, E3, or E5 (includes Office 365 ProPlus)
>[!NOTE]
->Deployment of devices using Windows AutoPilot to complete the Out-of-Box Experience (OOBE) is supported without these prerequisites, however will yield deployed devices without applications, configuration, or enrollment in a management solution and is highly discouraged.
+>Deployment of devices using Windows Autopilot to complete the Out-of-Box Experience (OOBE) is supported without these prerequisites, however will yield deployed devices without applications, configuration, or enrollment in a management solution and is highly discouraged.
### Windows version considerations
-Support for broad deployments of Surface devices using Windows AutoPilot, including enrollment performed by Surface partners at the time of purchase, requires devices manufactured with or otherwise installed with Windows 10 Version 1709 (Fall Creators Update). Windows 10 Version 1709 uses a secure 4096-bit (4k) hash value to uniquely identify devices for Windows AutoPilot that is necessary for deployments at scale.
+Support for broad deployments of Surface devices using Windows Autopilot, including enrollment performed by Surface partners at the time of purchase, requires devices manufactured with or otherwise installed with Windows 10 Version 1709 (Fall Creators Update). Windows 10 Version 1709 uses a secure 4096-bit (4k) hash value to uniquely identify devices for Windows Autopilot that is necessary for deployments at scale.
### Surface device support
-Surface devices with support for out-of-box deployment with Windows AutoPilot, enrolled during the purchase process with a Surface partner, include the following devices, where the devices ship from the factory with Windows 10 Version 1709:
+Surface devices with support for out-of-box deployment with Windows Autopilot, enrolled during the purchase process with a Surface partner, include the following devices, where the devices ship from the factory with Windows 10 Version 1709:
* Surface Pro (Model 1796)
* Surface Book 2
* Surface Laptop
* Surface Studio
-## Surface partners enabled for Windows AutoPilot
-Enrolling Surface devices in Windows AutoPilot at the time of purchase is a capability provided by select Surface partners that are enabled with the capability to identify individual Surface devices during the purchase process and perform enrollment on an organization’s behalf. Devices enrolled by a Surface partner at time of purchase can be shipped directly to users and configured entirely through the zero-touch process of Windows AutoPilot, Azure Active Directory, and Mobile Device Management.
+## Surface partners enabled for Windows Autopilot
+Enrolling Surface devices in Windows Autopilot at the time of purchase is a capability provided by select Surface partners that are enabled with the capability to identify individual Surface devices during the purchase process and perform enrollment on an organization’s behalf. Devices enrolled by a Surface partner at time of purchase can be shipped directly to users and configured entirely through the zero-touch process of Windows Autopilot, Azure Active Directory, and Mobile Device Management.
-You can find a list of Surface partners enabled for Windows AutoPilot at the [Windows AutoPilot for Surface portal](https://www.microsoft.com/en-us/itpro/surface/windows-autopilot-for-surface).
\ No newline at end of file
+You can find a list of Surface partners enabled for Windows Autopilot at the [Windows Autopilot for Surface portal](https://www.microsoft.com/en-us/itpro/surface/windows-autopilot-for-surface).
\ No newline at end of file
diff --git a/education/trial-in-a-box/educator-tib-get-started.md b/education/trial-in-a-box/educator-tib-get-started.md
index c827683002..1995443537 100644
--- a/education/trial-in-a-box/educator-tib-get-started.md
+++ b/education/trial-in-a-box/educator-tib-get-started.md
@@ -34,6 +34,7 @@ ms.date: 03/18/2018
> [!VIDEO https://www.youtube.com/embed/3nqooY9Iqq4]
+
@@ -41,9 +42,13 @@ ms.date: 03/18/2018
To try out the educator tasks, start by logging in as a teacher.
1. Turn on **Device A** and ensure you plug in the PC to an electrical outlet.
-2. Log in to **Device A** using the **Teacher Username** and **Teacher Password** included in the **Credentials Sheet** located in your kit.
-3. Connect to your school's Wi-Fi network or connect with a local Ethernet connection.
+2. Connect to your school's Wi-Fi network or connect with a local Ethernet connection.
+ >**Note**: If your Wi-Fi network requires a web browser login page to connect to the Internet you should connect using the Ethernet port. If your Wi-Fi network has additional restrictions that will prevent the device from connecting to the internet without registration you should consider using Device A from a different network.
+
+3. Log in to **Device A** using the **Teacher Username** and **Teacher Password** included in the **Credentials Sheet** located in your kit.
+
+
@@ -76,6 +81,9 @@ Learning Tools and the Immersive Reader can be used in the Microsoft Edge browse
|  |  |  |  |
+
+
+
## 3. Spark communication, critical thinking, and creativity in the classroom
@@ -94,6 +102,7 @@ Take a guided tour of Microsoft Teams and test drive this digital hub.
1. Take a guided tour of Microsoft Teams and test drive some teaching tasks. Open the Microsoft Edge browser and navigate to https://msteamsdemo.azurewebsites.net.
2. Use your school credentials provided in the **Credentials Sheet**.
+
@@ -127,6 +136,53 @@ When you're not using the pen, just use the magnet to stick it to the left side
+
+
+
## 5. Get kids to further collaborate and problem solve
diff --git a/education/trial-in-a-box/images/Bug.png b/education/trial-in-a-box/images/Bug.png
new file mode 100644
index 0000000000..3199821631
Binary files /dev/null and b/education/trial-in-a-box/images/Bug.png differ
diff --git a/education/trial-in-a-box/images/edu-tib-setp-5-jump2.png b/education/trial-in-a-box/images/edu-tib-setp-5-jump2.png
new file mode 100644
index 0000000000..684bc59a50
Binary files /dev/null and b/education/trial-in-a-box/images/edu-tib-setp-5-jump2.png differ
diff --git a/education/trial-in-a-box/images/edu-tib-setp-5-v4.png b/education/trial-in-a-box/images/edu-tib-setp-5-v4.png
new file mode 100644
index 0000000000..d1d3f51fb8
Binary files /dev/null and b/education/trial-in-a-box/images/edu-tib-setp-5-v4.png differ
diff --git a/education/trial-in-a-box/images/edu-tib-setp-6-v4.png b/education/trial-in-a-box/images/edu-tib-setp-6-v4.png
new file mode 100644
index 0000000000..c46d7861af
Binary files /dev/null and b/education/trial-in-a-box/images/edu-tib-setp-6-v4.png differ
diff --git a/education/trial-in-a-box/images/photo_app_1.png b/education/trial-in-a-box/images/photo_app_1.png
new file mode 100644
index 0000000000..b5e6a59f63
Binary files /dev/null and b/education/trial-in-a-box/images/photo_app_1.png differ
diff --git a/education/trial-in-a-box/images/photo_app_2.png b/education/trial-in-a-box/images/photo_app_2.png
new file mode 100644
index 0000000000..69ec9b01dd
Binary files /dev/null and b/education/trial-in-a-box/images/photo_app_2.png differ
diff --git a/education/trial-in-a-box/images/screenshot-bug.png b/education/trial-in-a-box/images/screenshot-bug.png
new file mode 100644
index 0000000000..3199821631
Binary files /dev/null and b/education/trial-in-a-box/images/screenshot-bug.png differ
diff --git a/education/trial-in-a-box/index.md b/education/trial-in-a-box/index.md
index 62510022e6..486c9358c7 100644
--- a/education/trial-in-a-box/index.md
+++ b/education/trial-in-a-box/index.md
@@ -28,7 +28,7 @@ Welcome to Microsoft Education Trial in a Box. We built this trial to make it ea
-|  |  |
+| [](educator-tib-get-started.md) | [](itadmin-tib-get-started.md) |
| :---: | :---: |
| **Educator**Enhance students of all abilities by unleashing their creativity, collaboration, and improving problem-solving skills. [Get started](educator-tib-get-started.md) | **IT Admin**Quickly implement and deploy a full cloud infrastructure that's secure and easy to manage. [Get started](itadmin-tib-get-started.md) |
diff --git a/education/trial-in-a-box/itadmin-tib-get-started.md b/education/trial-in-a-box/itadmin-tib-get-started.md
index 97a8d7964f..d450bc8dea 100644
--- a/education/trial-in-a-box/itadmin-tib-get-started.md
+++ b/education/trial-in-a-box/itadmin-tib-get-started.md
@@ -45,8 +45,10 @@ If you run into any problems while following the steps in this guide, or you hav
To try out the IT admin tasks, start by logging in as an IT admin.
1. Turn on **Device A** and ensure you plug in the PC to an electrical outlet.
-2. Log in to **Device A** using the **Administrator Username** and **Administrator Password** included in the **Credentials Sheet** located in your kit.
-3. Connect to your school's Wi-Fi network or connect with a local Ethernet connection.
+2. Connect to your school's Wi-Fi network or connect with a local Ethernet connection.
+ >**Note**: If your Wi-Fi network requires a web browser login page to connect to the Internet you should connect using the Ethernet port. If your Wi-Fi network has additional restrictions that will prevent the device from connecting to the internet without registration you should consider using Device A from a different network.
+
+3. Log in to **Device A** using the **Administrator Username** and **Administrator Password** included in the **Credentials Sheet** located in your kit.
4. Note the serial numbers on the Trial in a Box devices and register both devices with the hardware manufacturer to activate the manufacturer's warranty.
@@ -98,7 +100,7 @@ If you've previously used Set up School PCs to provision student devices, you ca
- Set up School PCs will change some account management logic so that it sets the expiration time for an account to 180 days (without requiring sign-in).
- This setting also increases the maximum storage to 100% of the available disk space. This prevents the student's account from being erased if the student stores a lot of files or data or if the student doesn't use the PC over a prolonged period.
- **Let guests sign-in to these PCs** allows guests to use student PCs without a school account. If you select this option, a **Guest** account button will be added in the PC's sign-in screen to allow anyone to use the PC.
- - **Enable Windows 10 Automatic Redeployment** enables IT admins to quickly remove personal files, apps, and settings, and reset Windows 10 devices from the lock screen any time and apply original settings and management enrollment the student PC is returned to a fully configured or known approved state. For more info, see [Windows Automatic Redeployment](https://docs.microsoft.com/en-us/education/windows/windows-automatic-redeployment).
+ - **Enable Windows 10 Autopilot Reset** enables IT admins to quickly remove personal files, apps, and settings, and reset Windows 10 devices from the lock screen any time and apply original settings and management enrollment the student PC is returned to a fully configured or known approved state. For more info, see [Autopilot Reset](https://docs.microsoft.com/en-us/education/windows/autopilot-reset).
- **Lock screen background** shows the default backgroudn used for student PCs provisioned by Set up School PCs. Select **Browse** to change the default.
7. **Set up the Take a Test app** configures the device for taking quizzes and high-stakes assessments by some providers like Smarter Balanced. Windows will lock down the student PC so that students can't access anything else while taking the test.
@@ -150,7 +152,7 @@ A provisioning package is a method for applying settings to Windows 10 without n
- If the PC is past the account setup screen, reset the PC to start over. To reset the PC, go to **Settings > Update & security > Recovery > Reset this PC**.
+ If you go past the region selection screen, select **Ctrl + Shift + F3** which will prompt the "System Preparation Tool." Select **Okay** in the tool to return to the region selection screen. If this doesn't work, reset the PC by going to **Settings > Update & Security > Recovery > Reset this PC.**
2. Insert the USB drive into **Device B**. Windows will recognize the drive and automatically install the provisioning package.
3. When prompted, remove the USB drive. You can then use the USB drive to start provisioning another student PC.
@@ -231,10 +233,10 @@ The Microsoft Store for Education is where you can shop for more apps for your s
Update settings for all devices in your tenant by adding the **Documents** and **Downloads** folders to all devices managed in Intune for Education.
1. Go to the Intune for Education console.
-2. Select **Group > All Devices > Settings** and expand **Windows interface customizations**.
+2. Select **Group > All Devices > Settings** and expand **Windows interface settings**.
3. In **Choose folders that appear in the Start menu**, select **Documents** and **Downloads**.
- 
+ 
4. **Save** your changes.
diff --git a/education/windows/TOC.md b/education/windows/TOC.md
index a5adbaef71..3c2caa9f9a 100644
--- a/education/windows/TOC.md
+++ b/education/windows/TOC.md
@@ -11,15 +11,16 @@
### [Set up Take a Test on a single PC](take-a-test-single-pc.md)
### [Set up Take a Test on multiple PCs](take-a-test-multiple-pcs.md)
### [Take a Test app technical reference](take-a-test-app-technical.md)
-## [Reset devices with Windows Automatic Redeployment](windows-automatic-redeployment.md)
+## [Reset devices with Autopilot Reset](autopilot-reset.md)
## [Working with Microsoft Store for Education](education-scenarios-store-for-business.md)
## [Get Minecraft: Education Edition](get-minecraft-for-education.md)
### [For teachers: get Minecraft Education Edition](teacher-get-minecraft.md)
### [For IT administrators: get Minecraft Education Edition](school-get-minecraft.md)
### [Get Minecraft: Education Edition with Windows 10 device promotion](get-minecraft-device-promotion.md)
-## [Test Windows 10 S on existing Windows 10 education devices](test-windows10s-for-edu.md)
+## [Test Windows 10 in S mode on existing Windows 10 education devices](test-windows10s-for-edu.md)
## [Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md)
## [Deploy Windows 10 in a school district](deploy-windows-10-in-a-school-district.md)
-## [Switch to Windows 10 Pro Education from Windows 10 Pro or Windows 10 S](switch-to-pro-education.md)
+## [Switch to Windows 10 Pro Education in S mode from Windows 10 Pro in S mode](s-mode-switch-to-edu.md)
+## [Switch to Windows 10 Pro Education from Windows 10 Pro](switch-to-pro-education.md)
## [Chromebook migration guide](chromebook-migration-guide.md)
## [Change history for Windows 10 for Education](change-history-edu.md)
diff --git a/education/windows/autopilot-reset.md b/education/windows/autopilot-reset.md
new file mode 100644
index 0000000000..caf4a7f2c0
--- /dev/null
+++ b/education/windows/autopilot-reset.md
@@ -0,0 +1,113 @@
+---
+title: Reset devices with Autopilot Reset
+description: Gives an overview of Autopilot Reset and how you can enable and use it in your schools.
+keywords: Autopilot Reset, Windows 10, education
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: edu
+ms.localizationpriority: high
+author: CelesteDG
+ms.author: celested
+ms.date: 03/08/2018
+---
+
+# Reset devices with Autopilot Reset
+**Applies to:**
+
+- Windows 10, version 1709
+
+IT admins or technical teachers can use Autopilot Reset to quickly remove personal files, apps, and settings, and reset Windows 10 devices from the lock screen any time and apply original settings and management enrollment (Azure Active Directory and device management) so the devices are ready to use. With Autopilot Reset, devices are returned to a fully configured or known IT-approved state.
+
+To enable Autopilot Reset in Windows 10, version 1709 (Fall Creators Update), you must:
+
+1. [Enable the policy for the feature](#enable-autopilot-reset)
+2. [Trigger a reset for each device](#trigger-autopilot-reset)
+
+## Enable Autopilot Reset
+
+To use Autopilot Reset, [Windows Recovery Environment (WinRE) must be enabled on the device](#winre).
+
+**DisableAutomaticReDeploymentCredentials** is a policy that enables or disables the visibility of the credentials for Autopilot Reset. It is a policy node in the [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-credentialproviders), **CredentialProviders/DisableAutomaticReDeploymentCredentials**. By default, this policy is set to 1 (Disable). This ensures that Autopilot Reset isn't triggered by accident.
+
+You can set the policy using one of these methods:
+
+- MDM provider
+
+ - Autopilot Reset in Intune for Education is coming soon. In a future update of Intune for Education, new tenants will automatically have the Autopilot Reset setting enabled by default on the **All devices** group as part of initial tenant configuration. You will also be able to manage this setting to target different groups in the admin console.
+ - If you're using an MDM provider other than Intune for Education, check your MDM provider documentation on how to set this policy. If your MDM provider doesn't explicitly support this policy, you can manually set this policy if your MDM provider allows specific OMA-URIs to be manually set.
+
+ For example, in Intune, create a new configuration policy and add an OMA-URI.
+ - OMA-URI: ./Vendor/MSFT/Policy/Config/CredentialProviders/DisableAutomaticReDeploymentCredentials
+ - Data type: Integer
+ - Value: 0
+
+- Windows Configuration Designer
+
+ You can [use Windows Configuration Designer](https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-create-package) to set the **Runtime settings > Policies > CredentialProviders > DisableAutomaticReDeploymentCredentials** setting and create a provisioning package.
+
+- Set up School PCs app
+
+ Autopilot Reset in the Set up School PCs app is available in the latest release of the app. Make sure you are running Windows 10, version 1709 on the student PCs if you want to use Autopilot Reset through the Set up School PCs app. You can check the version several ways:
+ - Reach out to your device manufacturer.
+ - If you manage your PCs using Intune or Intune for Education, you can check the OS version by checking the **OS version** info for the device. If you are using another MDM provider, check the documentation for the MDM provider to confirm the OS version.
+ - Log into the PCs, go to the **Settings > System > About** page, look in the **Windows specifications** section and confirm **Version** is set to 1709.
+
+ To use the Autopilot Reset setting in the Set up School PCs app:
+ * When using [Set up School PCs](use-set-up-school-pcs-app.md), in the **Configure student PC settings** screen, select **Enable Windows 10 Autopilot Reset** among the list of settings for the student PC as shown in the following example:
+
+ 
+
+## Trigger Autopilot Reset
+Autopilot Reset is a two-step process: trigger it and then authenticate. Once you've done these two steps, you can let the process execute and once it's done, the device is again ready for use.
+
+**To trigger Autopilot Reset**
+
+1. From the Windows device lock screen, enter the keystroke: **CTRL +  + R**.
+
+ 
+
+ This will open up a custom login screen for Autopilot Reset. The screen serves two purposes:
+ 1. Confirm/verify that the end user has the right to trigger Autopilot Reset
+ 2. Notify the user in case a provisioning package, created using Windows Configuration Designer or Set up School PCs, will be used as part of the process.
+
+ 
+
+2. Sign in with the admin account credentials. If you created a provisioning package, plug in the USB drive and trigger Autopilot Reset.
+
+>[!IMPORTANT]
+>To reestablish Wi-Fi connectivity after reset, make sure the **Connect automatically** box is checked for the device's wireless network connection.
+
+ Once Autopilot Reset is triggered, the reset process starts.
+
+ After reset, the device:
+ - Sets the region, language, and keyboard.
+ - Connects to Wi-Fi.
+ - If you provided a provisioning package when Autopilot Reset is triggered, the system will apply this new provisioning package. Otherwise, the system will re-apply the original provisioning package on the device.
+ - Is returned to a known good managed state, connected to Azure AD and MDM.
+
+ 
+
+ Once provisioning is complete, the device is again ready for use.
+
+
+## Troubleshoot Autopilot Reset
+
+Autopilot Reset will fail when the [Windows Recovery Environment (WinRE)](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-recovery-environment--windows-re--technical-reference) is not enabled on the device. You will see `Error code: ERROR_NOT_SUPPORTED (0x80070032)`.
+
+To make sure WinRE is enabled, use the [REAgentC.exe tool](https://docs.microsoft.com/windows-hardware/manufacture/desktop/reagentc-command-line-options) to run the following command:
+
+```
+reagentc /enable
+```
+
+If Windows Automatic Reployment fails after enabling WinRE, or if you are unable to enable WinRE, please contact [Microsoft Support](https://support.microsoft.com) for assistance.
+
+## Related topics
+
+[Set up Windows devices for education](set-up-windows-10.md)
+
+
+
+
+
diff --git a/education/windows/change-history-edu.md b/education/windows/change-history-edu.md
index 0775c1d4c7..71c9bbf87c 100644
--- a/education/windows/change-history-edu.md
+++ b/education/windows/change-history-edu.md
@@ -19,7 +19,7 @@ This topic lists new and updated topics in the [Windows 10 for Education](index.
New or changed topic | Description
--- | ---
-[Reset devices with Windows Automatic Redeployment](windows-automatic-redeployment.md) | Added section for troubleshooting Windows Automatic Redeployment.
+[Reset devices with Autopilot Reset](autopilot-reset.md) | Added section for troubleshooting Autopilot Reset.
## November 2017
@@ -34,7 +34,7 @@ New or changed topic | Description
| New or changed topic | Description |
| --- | ---- |
-| [Reset devices with Windows Automatic Redeployment](windows-automatic-redeployment.md) | New. Learn how you can use this new feature to quickly reset student PCs from the lock screen and apply original settings and management enrollment (Azure Active Directory and device management) so the devices are ready to use and returned to a fully configured or known IT-approved state. |
+| [Reset devices with Autopilot Reset](autopilot-reset.md) | New. Learn how you can use this new feature to quickly reset student PCs from the lock screen and apply original settings and management enrollment (Azure Active Directory and device management) so the devices are ready to use and returned to a fully configured or known IT-approved state. |
| [Test Windows 10 S on existing Windows 10 education devices](test-windows10s-for-edu.md) | Updated the *Go back to your previous edition of Windows 10* section with new information on how to work around cases where Win32 apps are blocked after switching from Windows 10 S back to your previous Windows edition. |
| [Take a Test app technical reference](take-a-test-app-technical.md) | Updated. Starting with Windows 10, version 1709 (Fall Creators Update), assessments can now run in permissive mode. This mode enables students who need access to other apps, like accessibility tools, to use the apps. |
@@ -103,7 +103,7 @@ New or changed topic | Description
| New or changed topic | Description|
| --- | --- |
-| [Working with Microsoft Store for Business – education scenarios](education-scenarios-store-for-business.md) | New. Learn about education scenarios for Microsoft Store for Business. |
+| [Working with Microsoft Store for Business – education scenarios](education-scenarios-store-for-business.md) | New. Learn about education scenarios for Microsoft Store for Business. |
| [For teachers - get Minecraft: Education Edition](teacher-get-minecraft.md) | Updates. Subscription support for Minecraft: Education Edition. |
| [For IT administrators - get Minecraft: Education Edition](school-get-minecraft.md) | Updates. Subscription support for Minecraft: Education Edition. |
diff --git a/education/windows/education-scenarios-store-for-business.md b/education/windows/education-scenarios-store-for-business.md
index 5659364a47..fad685b3d2 100644
--- a/education/windows/education-scenarios-store-for-business.md
+++ b/education/windows/education-scenarios-store-for-business.md
@@ -10,7 +10,7 @@ searchScope:
- Store
author: trudyha
ms.author: trudyha
-ms.date: 11/01/2017
+ms.date: 3/30/2018
---
# Working with Microsoft Store for Education
diff --git a/education/windows/images/windows-automatic-redeployment-customlogin.png b/education/windows/images/autopilot-reset-customlogin.png
similarity index 100%
rename from education/windows/images/windows-automatic-redeployment-customlogin.png
rename to education/windows/images/autopilot-reset-customlogin.png
diff --git a/education/windows/images/windows-automatic-redeployment-lockscreen.png b/education/windows/images/autopilot-reset-lockscreen.png
similarity index 100%
rename from education/windows/images/windows-automatic-redeployment-lockscreen.png
rename to education/windows/images/autopilot-reset-lockscreen.png
diff --git a/education/windows/images/windows-automatic-redeployment-provisioningcomplete.png b/education/windows/images/autopilot-reset-provisioningcomplete.png
similarity index 100%
rename from education/windows/images/windows-automatic-redeployment-provisioningcomplete.png
rename to education/windows/images/autopilot-reset-provisioningcomplete.png
diff --git a/education/windows/images/sfe-roles.png b/education/windows/images/sfe-roles.png
index d208fb29b7..63a9290371 100644
Binary files a/education/windows/images/sfe-roles.png and b/education/windows/images/sfe-roles.png differ
diff --git a/education/windows/index.md b/education/windows/index.md
index 80955b020d..3b3fda8446 100644
--- a/education/windows/index.md
+++ b/education/windows/index.md
@@ -21,15 +21,6 @@ ms.date: 10/13/2017
Windows 10, version 1607 introduces two editions designed for the unique needs of K-12 institutions: Windows 10 Pro Education and Windows 10 Education. These editions provide education-specific default settings for the evolving landscape in K-12 education IT environments.
Find out more about the features and functionality we support in each edition of Windows.
When you've made your decision, find out how to buy Windows for your school.
-
Windows Ink/Microsoft Edge | X | X | X | X | +|Store apps (including Windows
desktop bridge apps) | X | X | X | X | +|Windows Update | X | X | X | X | +|Device Encryption | X | X | X | X | +|BitLocker | | X | X | X | +|Windows Update for Business | | X | X | X | +|Microsoft Store for Education | | X | X | X | +|Mobile Device Management
and Azure AD join | | X | X | X | +|Group Policy management and
Active Directory Domain Services | | | X | X | +|Desktop (Windows 32) Apps | X | | X | X | +|Change App Defaults
Search/Browser/Photos/etc. | X | | X | X | +|Credential Guard | | | | X | +|Device Guard | | | | X | + +### Windows 10 in S mode is safe, secure, and fast. +However, in some limited scenarios, you might need to switch to Windows 10 Education. You can switch devices running Windows 10, version 1709 or later. Use the following information to switch to Windows 10 Pro through the Microsoft Store. + +> [!IMPORTANT] +> While it’s free to switch to Windows 10 Pro, it’s not reversible. The only way to rollback this kind of switch is through a BMR factory reset. + +## How to switch + +### Devices running Windows 10, version 1803 + +**Switch using the Microsoft Store for Education**
+There are two switch options available using the Microsoft Store for Education: + +Tenant-wide Windows 10 Pro in S mode > Pro EDU in S mode
+Tenant-wide Windows 10 Pro > Pro EDU + +> [!NOTE] +> To rollback to Windows 10 Pro in S mode, a BMR factory reset must be performed. + +### Devices running Windows 10, version 1709 + +1. **Bulk switch through Microsoft Store for Education** - In this scenario, the global admin for the Azure AD education tenant can use Microsoft Store to switch all Windows 10 Pro in S mode devices on the tenant to Windows 10 Pro Education. (Devices running Windows 10, version 1803 will switch to Windows 10 Pro EDU in S mode.) + +2. **Key acquisition options** - For schools with **active Microsoft Volume Licensing** agreements, global admins can obtain free MAK keys for Windows 10 Pro Education. For schools without an active Microsoft Volume Licensing agreement, the global admin can contact CSS, fill out a form and provide a proof of purchase to receive MAK keys for Windows 10 Pro Education. + +> [!NOTE] +> There is currently no "bulk-switch" option for devices running Windows 10, version 1803. + +## Related Topics +[Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md)
+[Deploy Windows 10 in a school district](deploy-windows-10-in-a-school-district.md)
+[Compare Windows 10 editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare) \ No newline at end of file diff --git a/education/windows/set-up-school-pcs-technical.md b/education/windows/set-up-school-pcs-technical.md index c4c3cbd233..8164b32aca 100644 --- a/education/windows/set-up-school-pcs-technical.md +++ b/education/windows/set-up-school-pcs-technical.md @@ -9,7 +9,7 @@ ms.pagetype: edu ms.localizationpriority: high author: CelesteDG ms.author: celested -ms.date: 03/12/2018 +ms.date: 04/04/2018 --- # Technical reference for the Set up School PCs app @@ -290,7 +290,8 @@ The Set up School PCs app produces a specialized provisioning package that makes
Accounts: Block Microsoft accounts
**Note** Microsoft accounts can still be used in apps.
Enabled
Interactive logon: Do not display last user name
Enabled
Interactive logon: Sign-in last interactive user automatically after a system-initiated restart
Disabled
Interactive logon: Sign-in last interactive user automatically after a system-initiated restart
Disabled
User Account Control: Behavior of the elevation prompt for standard users
Auto deny
-**Figure 14** - Illustrates a device on which the existing operating system is not activated, but the Windows 10 Pro Education switch is active.
+**Figure 14** - Illustrates a device on which the existing operating system is not activated, but the Windows 10 Pro Education change is active.
### Review requirements on devices
-Devices must be running Windows 10 Pro, version 1607 or higher, or Windows 10 S, version 1703 and be Azure AD joined, or domain joined with Azure AD Connect. Customers who are federated with Azure AD are also eligible. You can use the following procedures to review whether a particular device meets requirements.
+Devices must be running Windows 10 Pro, version 1607 or higher, or domain joined with Azure AD Connect. Customers who are federated with Azure AD are also eligible. You can use the following procedures to review whether a particular device meets requirements.
**To determine if a device is Azure AD joined**
@@ -329,23 +260,23 @@ Devices must be running Windows 10 Pro, version 1607 or higher, or Windows 10 S,
A popup window will display the Windows 10 version number and detailed OS build information.
> [!NOTE]
- > If a device is running a previous version of Windows 10 Pro (for example, version 1511), it will not be switched to Windows 10 Pro Education when a user signs in, even if the user has been assigned a license.
+ > If a device is running a previous version of Windows 10 Pro (for example, version 1511), it will not be changeed to Windows 10 Pro Education when a user signs in, even if the user has been assigned a license.
### Roll back Windows 10 Pro Education to Windows 10 Pro
-If your organization has the Windows 10 Pro to Windows 10 Pro Education switch enabled, and you decide to roll back to Windows 10 Pro or to cancel the switch, you can do this by:
+If your organization has the Windows 10 Pro to Windows 10 Pro Education change enabled, and you decide to roll back to Windows 10 Pro or to cancel the change, you can do this by:
-- Logging into Microsoft Store for Education page and turning off the automatic switch.
-- Selecting the link to turn off the automatic switch from the notification email sent to all global administrators.
+- Logging into Microsoft Store for Education page and turning off the automatic change.
+- Selecting the link to turn off the automatic change from the notification email sent to all global administrators.
-Once the automatic switch to Windows 10 Pro Education is turned off, the change is effective immediately. Devices that were switched will revert to Windows 10 Pro only after the license has been refreshed (every 30 days) and the next time the user signs in. This means that a user whose device was switched may not immediately see Windows 10 Pro Education rolled back to Windows 10 Pro for up to 30 days. However, users who haven't signed in during the time that a switch was enabled and then turned off will never see their device change from Windows 10 Pro.
+Once the automatic change to Windows 10 Pro Education is turned off, the change is effective immediately. Devices that were changeed will revert to Windows 10 Pro only after the license has been refreshed (every 30 days) and the next time the user signs in. This means that a user whose device was changeed may not immediately see Windows 10 Pro Education rolled back to Windows 10 Pro for up to 30 days. However, users who haven't signed in during the time that a change was enabled and then turned off will never see their device change from Windows 10 Pro.
> [!NOTE]
-> Devices that were switched from Windows 10 S to Windows 10 Pro Education cannot roll back to Windows 10 S.
+> Devices that were changeed from mode to Windows 10 Pro Education cannot roll back to Windows 10 Pro Education S mode.
**To roll back Windows 10 Pro Education to Windows 10 Pro**
-1. Log in to [Microsoft Store for Education](https://educationstore.microsoft.com/) with your school or work account, or follow the link from the notification email to turn off the automatic switch.
+1. Log in to [Microsoft Store for Education](https://educationstore.microsoft.com/) with your school or work account, or follow the link from the notification email to turn off the automatic change.
2. Select **Manage > Benefits** and locate the section **Windows 10 Pro Education** and follow the link.
3. In the **Revert to Windows 10 Pro** page, click **Revert to Windows 10 Pro**.
@@ -353,10 +284,10 @@ Once the automatic switch to Windows 10 Pro Education is turned off, the change
-4. You will be asked if you're sure that you want to turn off automatic switches to Windows 10 Pro Education. Click **Yes**.
+4. You will be asked if you're sure that you want to turn off automatic changees to Windows 10 Pro Education. Click **Yes**.
5. Click **Close** in the **Success** page.
- All global admins get a confirmation email that a request was made to roll back your organization to Windows 10 Pro. If you, or another global admin, decide later that you want to turn on automatic switches again, you can do this by selecting **Switch to Windows 10 Pro Education for free** from the **Manage > Benefits** in the Microsoft Store for Education.
+ All global admins get a confirmation email that a request was made to roll back your organization to Windows 10 Pro. If you, or another global admin, decide later that you want to turn on automatic changees again, you can do this by selecting **change to Windows 10 Pro Education for free** from the **Manage > Benefits** in the Microsoft Store for Education.
## Preparing for deployment of Windows 10 Pro Education licenses
diff --git a/education/windows/test-windows10s-for-edu.md b/education/windows/test-windows10s-for-edu.md
index 17e228afb1..35d22062b3 100644
--- a/education/windows/test-windows10s-for-edu.md
+++ b/education/windows/test-windows10s-for-edu.md
@@ -1,52 +1,52 @@
---
-title: Test Windows 10 S on existing Windows 10 education devices
-description: Provides guidance on downloading and testing Windows 10 S for existing Windows 10 education devices.
-keywords: Windows 10 S, try, download, school, education, Windows 10 S installer, existing Windows 10 education devices
+title: Test Windows 10 in S mode on existing Windows 10 education devices
+description: Provides guidance on downloading and testing Windows 10 in S mode for existing Windows 10 education devices.
+keywords: Windows 10 in S mode, try, download, school, education, Windows 10 in S mode installer, existing Windows 10 education devices
ms.mktglfcycl: deploy
ms.prod: w10
ms.pagetype: edu
ms.sitesec: library
ms.localizationpriority: high
-author: CelesteDG
-ms.author: celested
-ms.date: 11/03/2017
+author: MikeBlodge
+ms.author: MikeBlodge
+ms.date: 04/30/2018
---
-# Test Windows 10 S on existing Windows 10 education devices
+# Test Windows 10 in S mode on existing Windows 10 education devices
**Applies to:**
-- Windows 10 Pro, Windows 10 Pro Education, Windows 10 Education, Windows 10 Enterprise
+- Devices running Windows 10, version 1709: Windows 10 Pro, Windows 10 Pro Education, Windows 10 Education, Windows 10 Enterprise
-The Windows 10 S self-installer will allow you to test Windows 10 S on a variety of individual Windows 10 devices (except Windows 10 Home) with a genuine, activated license[1](#footnote1). Please test Windows 10 S on a variety of devices in your school and share your feedback with us.
+The Windows 10 in S mode self-installer will allow you to test Windows 10 in S mode on a variety of individual Windows 10 devices (except Windows 10 Home) with a genuine, activated license[1](#footnote1). Please test Windows 10 in S mode on a variety of devices in your school and share your feedback with us.
-Windows 10 S is built to give schools the familiar, robust, and productive experiences you count on from Windows in an experience that's been streamlined for security and performance in the classroom, and built to work with Microsoft Education[2](#footnote2).
+Windows 10 in S mode is built to give schools the familiar, robust, and productive experiences you count on from Windows in an experience that's been streamlined for security and performance in the classroom, and built to work with Microsoft Education[2](#footnote2).
-Windows 10 S is different from other editions of Windows 10 as everything that runs on the device is verfied by Microsoft for security and performance. Therefore, Windows 10 S works exclusively with apps from the Microsoft Store. Some accessories and apps compatible with Windows 10 may not work and performance may vary. Certain default settings, features, and apps cannot be changed. When you install Windows 10 S, your existing applications and settings will be deleted and you will only be able to install apps from the Microsoft Store.
+Windows 10 in S mode is different from other editions of Windows 10 as everything that runs on the device is verfied by Microsoft for security and performance. Therefore, Windows 10 in S mode works exclusively with apps from the Microsoft Store. Some accessories and apps compatible with Windows 10 may not work and performance may vary. Certain default settings, features, and apps cannot be changed. When you install Windows 10 in S mode, your existing applications and settings will be deleted and you will only be able to install apps from the Microsoft Store.
-**Configuring Windows 10 S for school use is easy:** Education customers must configure **SetEduPolicies** for use in K-12 schools. For more information on how to do these, see [Use the Set up School PCs app](use-set-up-school-pcs-app.md) and [Windows 10 configuration recommendations for education customers](configure-windows-for-education.md).
+**Configuring Windows 10 in S mode for school use is easy:** Education customers must configure **SetEduPolicies** for use in K-12 schools. For more information on how to do these, see [Use the Set up School PCs app](use-set-up-school-pcs-app.md) and [Windows 10 configuration recommendations for education customers](configure-windows-for-education.md).
-**Installing Office 365 for Windows 10 S (Education preview)**: To install the Office applications in a school environment, you must use the free Set up School PCs app, which is available on the Microsoft Store for Education and from the Microsoft Store.
+**Installing Office 365 for Windows 10 in S mode (Education preview)**: To install the Office applications in a school environment, you must use the free Set up School PCs app, which is available on the Microsoft Store for Education and from the Microsoft Store.
-As we finalize development of Office 365 for Windows 10 S (Education preview), the applications will be updated automatically. You must have an Office license to activate the applications once they are installed.To learn more about Office 365 for Education plans, see [FAQ: Office on Windows 10 S](https://support.office.com/article/717193b5-ff9f-4388-84c0-277ddf07fe3f).
+As we finalize development of Office 365 for Windows 10 in S mode (Education preview), the applications will be updated automatically. You must have an Office license to activate the applications once they are installed.To learn more about Office 365 for Education plans, see [FAQ: Office on Windows 10 in S mode](https://support.office.com/article/717193b5-ff9f-4388-84c0-277ddf07fe3f).
-## Before you install Windows 10 S
+## Before you install Windows 10 in S mode
### Important information
-Before you install Windows 10 S, be aware that non-Microsoft Store apps will not work, peripherals that require custom drivers may not work, and other errors may occur. In particular, this release of Windows 10 S:
+Before you install Windows 10 in S mode, be aware that non-Microsoft Store apps will not work, peripherals that require custom drivers may not work, and other errors may occur. In particular, this release of Windows 10 in S mode:
* Is intended for education customers to test compatibility with existing hardware
-* May not work with some device drivers, which may not yet be ready for Windows 10 S and may cause some loss in functionality
+* May not work with some device drivers, which may not yet be ready for Windows 10 in S mode and may cause some loss in functionality
* May not be compatible with all peripherals that require custom drivers and, even if compatible, may cause aspects of the peripheral to not function
-* Has software and feature limitations compared to other Windows 10 editions, primarily that Windows 10 S is limited to Store apps only
+* Has software and feature limitations compared to other Windows 10 editions, primarily that Windows 10 in S mode is limited to Store apps only
> [!WARNING]
- > You can install Windows 10 S on devices running other editions of Windows 10. For more information, see [Supported devices](#supported-devices). However, we don't recommend installing Windows 10 S on Windows 10 Home devices as you won't be able to activate it.
+ > You can install Windows 10 in S mode on devices running other editions of Windows 10. For more information, see [Supported devices](#supported-devices). However, we don't recommend installing Windows 10 in S mode on Windows 10 Home devices as you won't be able to activate it.
* Will not run current Win32 software and might result in the loss of any data associated with that software, which might include software already purchased
Due to these reasons, we recommend that you use the installation tool and avoid doing a clean install from an ISO media.
-Before you install Windows 10 S on your existing Windows 10 Pro, Windows 10 Pro Education, Windows 10 Education, or Windows 10 Enterprise device:
+Before you install Windows 10 in S mode on your existing Windows 10 Pro, Windows 10 Pro Education, Windows 10 Education, or Windows 10 Enterprise device:
* Make sure that you updated your existing device to Windows 10, version 1703 (Creators Update).
See [Download Windows 10](https://www.microsoft.com/en-us/software-download/windows10) and follow the instructions to update your device to Windows 10, version 1703. You can verify your current version in **Settings > System > About**.
@@ -55,27 +55,27 @@ Before you install Windows 10 S on your existing Windows 10 Pro, Windows 10 Pro
To do this, go to **Settings > Update & security > Windows Update**.
-* Create a system backup in case you would like to return to your previously installed version of Windows 10 after trying Windows 10 S.
+* Create a system backup in case you would like to return to your previously installed version of Windows 10 after trying Windows 10 in S mode.
See [Create a recovery drive](#create-a-recovery-drive) for information on how to do this.
## Supported devices
-The Windows 10 S install will install and activate on the following editions of Windows 10 in use by schools:
+The Windows 10 in S mode install will install and activate on the following editions of Windows 10 in use by schools:
* Windows 10 Pro
* Windows 10 Pro Education
* Windows 10 Education
* Windows 10 Enterprise
-Other Windows 10 editions cannot be activated and are not supported. If your device is not running one of these supported Windows 10 editions, do not proceed with using the Windows 10 S installer. Windows 10 N editions and running in virtual machines are not supported by the Windows 10 S installer.
+Other Windows 10 editions cannot be activated and are not supported. If your device is not running one of these supported Windows 10 editions, do not proceed with using the Windows 10 in S mode installer. Windows 10 N editions and running in virtual machines are not supported by the Windows 10 in S mode installer.
### Preparing your device to install drivers
-Make sure all drivers are installed and working properly on your device running Windows 10 Pro, Windows 10 Pro Education, Windows 10 Education, or Windows 10 Enterprise before installing Windows 10 S.
+Make sure all drivers are installed and working properly on your device running Windows 10 Pro, Windows 10 Pro Education, Windows 10 Education, or Windows 10 Enterprise before installing Windows 10 in S mode.
### Supported devices and drivers
-Check with your device manufacturer before trying Windows 10 S on your device to see if the drivers are available and supported by the device manufacturer.
+Check with your device manufacturer before trying Windows 10 in S mode on your device to see if the drivers are available and supported by the device manufacturer.
| | | |
| - | - | - |
@@ -95,44 +95,41 @@ Check with your device manufacturer before trying Windows 10 S on your device to
| Trekstor | Trigem | Vaio |
| Wortmann | Yifang | |
-
> [!NOTE]
> If you don't see any device listed on the manufacturer's web site, check back again later as more devices get added in the future.
-
## Kept files
-Back up all your data before installing Windows 10 S. Only personal files may be kept during installation. Your settings and apps will be deleted.
+Back up all your data before installing Windows 10 in S mode. Only personal files may be kept during installation. Your settings and apps will be deleted.
> [!NOTE]
> All existing Win32 applications and data will be deleted. Save any data or installation files in case you may need to access that data again or need to reinstall these applications later.
## Domain join
-Windows 10 S does not support non-Azure Active Directory domain accounts. Before installing Windows 10 S, you must have at least one of these administrator accounts:
+Windows 10 in S mode does not support non-Azure Active Directory domain accounts. Before installing Windows 10 in S mode, you must have at least one of these administrator accounts:
- Local administrator
- Microsoft Account (MSA) administrator
- Azure Active Directory administrator
> [!WARNING]
-> If you don't have one of these administrator accounts accessible before migration, you will not be able to log in to your device after migrating to Windows 10 S.
+> If you don't have one of these administrator accounts accessible before migration, you will not be able to log in to your device after migrating to Windows 10 in S mode.
-We recommend [creating a recovery drive](#create-a-recovery-drive) before migrating to Windows 10 S in case you run into this issue.
+We recommend [creating a recovery drive](#create-a-recovery-drive) before migrating to Windows 10 in S mode in case you run into this issue.
## Installing Office applications
-After installing Windows 10 S, use the free [Set up School PCs app](use-set-up-school-pcs-app.md) to install Office 365 for Windows 10 S (Education preview). You must have an Office license to activate the applications once they are installed.
-
+After installing Windows 10 in S mode, use the free [Set up School PCs app](use-set-up-school-pcs-app.md) to install Office 365 for Windows 10 in S mode (Education preview). You must have an Office license to activate the applications once they are installed.
## Switch to previously installed Windows 10 editions
-If Windows 10 S is not right for you, you can switch to the Windows 10 edition previously installed on your device(s).
-* Education customers can switch devices to Windows 10 Pro Education using the Microsoft Store for Education. For more information, see [Switch to Windows 10 Pro Education from Windows 10 Pro or Windows 10 S](switch-to-pro-education.md).
-* If you try Windows 10 S and decide to switch back to the previously installed edition within 10 days, you can go back to the previously installed edition using the Windows Recovery option in Settings. For more info, see [Go back to your previous edition of Windows 10](#go-back-to-your-previous-edition-of-windows-10).
+If Windows 10 in S mode is not right for you, you can switch to the Windows 10 edition previously installed on your device(s).
+* Education customers can switch devices to Windows 10 Pro Education using the Microsoft Store for Education. For more information, see [Switch to Windows 10 Pro Education from Windows 10 Pro or Windows 10 in S mode](switch-to-pro-education.md).
+* If you try Windows 10 in S mode and decide to switch back to the previously installed edition within 10 days, you can go back to the previously installed edition using the Windows Recovery option in Settings. For more info, see [Go back to your previous edition of Windows 10](#go-back-to-your-previous-edition-of-windows-10).
## Device recovery
-Before installing Windows 10 S, we recommend that you create a system backup in case you would like to return to Windows 10 Pro or Windows 10 Pro Education after trying Windows 10 S.
+Before installing Windows 10 in S mode, we recommend that you create a system backup in case you would like to return to Windows 10 Pro or Windows 10 Pro Education after trying Windows 10 in S mode.
### Create a recovery drive
To create a recovery drive, follow these steps.
@@ -147,7 +144,7 @@ To create a recovery drive, follow these steps.
### Go back to your previous edition of Windows 10
-Alternatively, for a period of 10 days after you install Windows 10 S, you have the option to go back to your previous edition of Windows 10 from **Settings > Update & security > Recovery**. This will keep your personal files, but it will remove installed apps as well as any changes you made to **Settings**.
+Alternatively, for a period of 10 days after you install Windows 10 in S mode, you have the option to go back to your previous edition of Windows 10 from **Settings > Update & security > Recovery**. This will keep your personal files, but it will remove installed apps as well as any changes you made to **Settings**.
To go back, you need to:
* Keep everything in the windows.old and $windows.~bt folders after the upgrade.
@@ -203,48 +200,49 @@ To use an installation media to reinstall Windows 10, follow these steps.
13. When you're done formatting, select **Next**.
14. Follow the rest of the setup instructions to finish installing Windows 10.
-## Download Windows 10 S
-Ready to test Windows 10 S on your existing Windows 10 Pro or Windows 10 Pro Education device? Make sure you read the [important pre-installation information](#important-information) and all the above information.
+## Download Windows 10 in S mode
+Ready to test Windows 10 in S mode on your existing Windows 10 Pro or Windows 10 Pro Education device? Make sure you read the [important pre-installation information](#important-information) and all the above information.
-When you're ready, you can download the Windows 10 S installer by clicking the **Download installer** button below:
+When you're ready, you can download the Windows 10 in S mode installer by clicking the **Download installer** button below:
> [!div class="nextstepaction" style="center"]
> [Download installer](https://go.microsoft.com/fwlink/?linkid=853240)
-After you install Windows 10 S, the OS defaults to the English version. To change the UI and show the localized UI, go to **Settings > Time & language > Region & language >** in **Languages** select **Add a language** to add a new language or select an existing language and set it as the default.
+After you install Windows 10 in S mode, the OS defaults to the English version. To change the UI and show the localized UI, go to **Settings > Time & language > Region & language >** in **Languages** select **Add a language** to add a new language or select an existing language and set it as the default.
## Terms and Conditions
-Because you’re installing Windows 10 S on a running version of Windows 10, you have already accepted the Windows 10 Terms and Conditions. You are not required to accept it again and the Windows 10 installer doesn’t show a Terms and Conditions page during installation.
+Because you’re installing Windows 10 in S mode on a running version of Windows 10, you have already accepted the Windows 10 Terms and Conditions. You are not required to accept it again and the Windows 10 installer doesn’t show a Terms and Conditions page during installation.
## Support
-Thank you for testing Windows 10 S. Your best experience will be running on a supported device as mentioned above. However, we invite you to try Windows 10 S on existing devices with an eligible operating system. If you are having difficulty installing or running Windows 10 S, use the Windows **Feedback Hub** to report your experience to Microsoft. This is the best way to help improve Windows 10 S with your feedback.
+Thank you for testing Windows 10 in S mode. Your best experience will be running on a supported device as mentioned above. However, we invite you to try Windows 10 in S mode on existing devices with an eligible operating system. If you are having difficulty installing or running Windows 10 in S mode, use the Windows **Feedback Hub** to report your experience to Microsoft. This is the best way to help improve Windows 10 in S mode with your feedback.
-Common support questions for the Windows 10 S test program:
+Common support questions for the Windows 10 in S mode test program:
-* **How do I activate if I don't have a Windows 10 S product key?**
+* **How do I activate if I don't have a Windows 10 in S mode product key?**
- As stated above, devices running Windows 10 Pro, Windows 10 Pro Education, Windows 10 Education, or Windows 10 Enterprise can install and run Windows 10 S and it will automatically activate. Testing Windows 10 S on a device running Windows 10 Home is not recommended and supported at this time.
+ As stated above, devices running Windows 10 Pro, Windows 10 Pro Education, Windows 10 Education, or Windows 10 Enterprise can install and run Windows 10 in S mode and it will automatically activate. Testing Windows 10 in S mode on a device running Windows 10 Home is not recommended and supported at this time.
-* **Will my OEM help me run Windows 10 S?**
+* **Will my OEM help me run Windows 10 in S mode?**
- OEMs typically only support their devices with the operating system that was pre-installed. See [Supported devices](#supported-devices) for OEM devices that are best suited for testing Windows 10 S. When testing Windows 10 S, be ready to restore your own PC back to factory settings without assistance. Steps to return to your previous installation of Windows 10 are covered above.
+ OEMs typically only support their devices with the operating system that was pre-installed. See [Supported devices](#supported-devices) for OEM devices that are best suited for testing Windows 10 in S mode. When testing Windows 10 in S mode, be ready to restore your own PC back to factory settings without assistance. Steps to return to your previous installation of Windows 10 are covered above.
-* **What happens when I run Reset or Fresh Start on Windows 10 S?**
+* **What happens when I run Reset or Fresh Start on Windows 10 in S mode?**
- **Reset** or **Fresh Start** will operate correctly and keep you on Windows 10 S. They also remove the 10-day go back ability. See [Switch to previously installed Windows 10 editions](#switch-to-previously-installed-windows-10-editions) to return to your previous installation of Windows 10 if you wish to discontinue using Windows 10 S.
+ **Reset** or **Fresh Start** will operate correctly and keep you on Windows 10 in S mode. They also remove the 10-day go back ability. See [Switch to previously installed Windows 10 editions](#switch-to-previously-installed-windows-10-editions) to return to your previous installation of Windows 10 if you wish to discontinue using Windows 10 in S mode.
-* **What if I want to move from Windows 10 S to Windows 10 Pro?**
+* **What if I want to move from Windows 10 in S mode to Windows 10 Pro?**
- If you want to discontinue using Windows 10 S, follow the instructions to return to your previous installation of Windows 10. If you already had Windows 10 Pro or Windows 10 Pro Education on the device you are testing on, you should be able to move to Windows 10 Pro or Windows 10 Pro Education at no charge with the instructions in this document. Otherwise, there may be a cost to acquire a Windows 10 Pro license in the Store.
+ If you want to discontinue using Windows 10 in S mode, follow the instructions to return to your previous installation of Windows 10. If you already had Windows 10 Pro or Windows 10 Pro Education on the device you are testing on, you should be able to move to Windows 10 Pro or Windows 10 Pro Education at no charge with the instructions in this document. Otherwise, there may be a cost to acquire a Windows 10 Pro license in the Store.
For help with activation issues, click on the appropriate link below for support options.
* For Volume Licensing Agreement or Shape the Future program customers, go to the [Microsoft Commercial Support](https://support.microsoft.com/gp/commercialsupport) website and select the country/region in which you are seeking commercial support to contact our commercial support team.
* If you do not have a Volume Licensing Agreement, go to the [Microsoft Support](https://support.microsoft.com/en-us/contactus/) website and choose a support option.
-
1 Internet access fees may apply.
2 Devices must be configured for educational use by applying **[SetEduPolicies](https://docs.microsoft.com/en-us/education/windows/configure-windows-for-education#setedupolicies)** using the Set up School PCs app.
ASP.NET MVC 4.0
[ASP.NET MVC 4 download](https://go.microsoft.com/fwlink/?LinkId=392271)
Service Principal Name (SPN)
The web applications require an SPN for the virtual host name under the domain account that you use for the web application pools.
If your administrative rights permit you to create SPNs in Active Directory Domain Services, MBAM creates the SPN for you. See [Setspn](http://technet.microsoft.com/library/cc731241.aspx) for information about the rights required to create SPNs.
@@ -403,11 +407,8 @@ Setspn -s http/mbamvirtual.contoso.com contoso\mbamapppooluser -## Got a suggestion for MBAM? -Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - ## Related topics @@ -420,7 +421,9 @@ Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-micros - +## Got a suggestion for MBAM? +- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). +- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). diff --git a/mdop/mbam-v25/mbam-25-server-prerequisites-that-apply-only-to-the-configuration-manager-integration-topology.md b/mdop/mbam-v25/mbam-25-server-prerequisites-that-apply-only-to-the-configuration-manager-integration-topology.md index b29f39406b..93707f9f9d 100644 --- a/mdop/mbam-v25/mbam-25-server-prerequisites-that-apply-only-to-the-configuration-manager-integration-topology.md +++ b/mdop/mbam-v25/mbam-25-server-prerequisites-that-apply-only-to-the-configuration-manager-integration-topology.md @@ -37,10 +37,6 @@ To enable the client computers to report BitLocker compliance details in the MBA [Create or Edit the Sms\_def.mof File](create-or-edit-the-sms-defmof-file-mbam-25.md) -## Got a suggestion for MBAM? - - -Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). ## Related topics @@ -54,7 +50,9 @@ Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-micros - +## Got a suggestion for MBAM? +- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). +- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). diff --git a/mdop/mbam-v25/mbam-25-supported-configurations.md b/mdop/mbam-v25/mbam-25-supported-configurations.md index 195d6fcf64..1c9cdc239c 100644 --- a/mdop/mbam-v25/mbam-25-supported-configurations.md +++ b/mdop/mbam-v25/mbam-25-supported-configurations.md @@ -561,11 +561,8 @@ The MBAM server can be deployed in Azure Infrastructure as a Service (IaaS) on a The MBAM client is not supported on virtual machines and is also not supported on Azure IaaS. -## Got a suggestion for MBAM? -Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - ## Related topics @@ -576,7 +573,9 @@ Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-micros - +## Got a suggestion for MBAM? +- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). +- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). diff --git a/mdop/mbam-v25/monitoring-and-reporting-bitlocker-compliance-with-mbam-25.md b/mdop/mbam-v25/monitoring-and-reporting-bitlocker-compliance-with-mbam-25.md index 86650a1bfd..e7f1395a8b 100644 --- a/mdop/mbam-v25/monitoring-and-reporting-bitlocker-compliance-with-mbam-25.md +++ b/mdop/mbam-v25/monitoring-and-reporting-bitlocker-compliance-with-mbam-25.md @@ -44,9 +44,8 @@ The topic in this section describes the reports for the Configuration Manager In [Operations for MBAM 2.5](operations-for-mbam-25.md) ## Got a suggestion for MBAM? - - -Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). +- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). +- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). diff --git a/mdop/mbam-v25/monitoring-web-service-request-performance-counters.md b/mdop/mbam-v25/monitoring-web-service-request-performance-counters.md index 113fa272b8..6376939620 100644 --- a/mdop/mbam-v25/monitoring-web-service-request-performance-counters.md +++ b/mdop/mbam-v25/monitoring-web-service-request-performance-counters.md @@ -81,11 +81,8 @@ The recommended tool for viewing MBAM performance counters is Windows Performanc For detailed instructions on how to view performance counters, see [How to View MBAM Performance Counters](https://go.microsoft.com/fwlink/?LinkId=393457). -## Got a suggestion for MBAM? -Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - ## Related topics @@ -96,6 +93,8 @@ Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-micros - +## Got a suggestion for MBAM? +- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). +- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). diff --git a/mdop/mbam-v25/moving-mbam-25-features-to-another-server.md b/mdop/mbam-v25/moving-mbam-25-features-to-another-server.md index 557110bbd6..00fdddca93 100644 --- a/mdop/mbam-v25/moving-mbam-25-features-to-another-server.md +++ b/mdop/mbam-v25/moving-mbam-25-features-to-another-server.md @@ -41,9 +41,8 @@ Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 enables you to move - [Configuring the MBAM 2.5 Server Features](configuring-the-mbam-25-server-features.md) ## Got a suggestion for MBAM? - - -Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). +- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). +- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). diff --git a/mdop/mbam-v25/operations-for-mbam-25.md b/mdop/mbam-v25/operations-for-mbam-25.md index 0be326e434..5a895028c3 100644 --- a/mdop/mbam-v25/operations-for-mbam-25.md +++ b/mdop/mbam-v25/operations-for-mbam-25.md @@ -55,9 +55,8 @@ This topic describes the types of administrative tasks that you can perform with [Technical Reference for MBAM 2.5](technical-reference-for-mbam-25.md) ## Got a suggestion for MBAM? - - -Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). +- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). +- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). diff --git a/mdop/mbam-v25/performing-bitlocker-management-with-mbam-25.md b/mdop/mbam-v25/performing-bitlocker-management-with-mbam-25.md index a6765849f0..37802d9fc1 100644 --- a/mdop/mbam-v25/performing-bitlocker-management-with-mbam-25.md +++ b/mdop/mbam-v25/performing-bitlocker-management-with-mbam-25.md @@ -52,11 +52,8 @@ If end users get locked out of Windows by BitLocker, they can use the instructio [How to Use the Self-Service Portal to Regain Access to a Computer](how-to-use-the-self-service-portal-to-regain-access-to-a-computer-mbam-25.md) -## Got a suggestion for MBAM? -Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - ## Related topics @@ -64,7 +61,9 @@ Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-micros - +## Got a suggestion for MBAM? +- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). +- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). diff --git a/mdop/mbam-v25/planning-for-mbam-25-client-deployment.md b/mdop/mbam-v25/planning-for-mbam-25-client-deployment.md index 105ec5910e..54bddfa55e 100644 --- a/mdop/mbam-v25/planning-for-mbam-25-client-deployment.md +++ b/mdop/mbam-v25/planning-for-mbam-25-client-deployment.md @@ -59,10 +59,6 @@ The TPM protector option requires the administrator to accept the BIOS prompt to MBAM supports BitLocker on Encrypted Hard Drives that meet TCG specification requirements for Opal as well as IEEE 1667 standards. When BitLocker is enabled on these devices, it will generate keys and perform management functions on the encrypted drive. See [Encrypted Hard Drive](https://technet.microsoft.com/library/hh831627.aspx) for more information. -## Got a suggestion for MBAM? - - -Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). ## Related topics @@ -74,7 +70,9 @@ Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-micros - +## Got a suggestion for MBAM? +- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). +- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). diff --git a/mdop/mbam-v25/planning-for-mbam-25-group-policy-requirements.md b/mdop/mbam-v25/planning-for-mbam-25-group-policy-requirements.md index 96c6732f3b..c016d3779d 100644 --- a/mdop/mbam-v25/planning-for-mbam-25-group-policy-requirements.md +++ b/mdop/mbam-v25/planning-for-mbam-25-group-policy-requirements.md @@ -512,10 +512,6 @@ This section describes Removable Drive Group Policy definitions for Microsoft Bi -## Got a suggestion for MBAM? - - -Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopmbam). ## Related topics @@ -525,7 +521,9 @@ Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-micros [MBAM 2.5 Deployment Prerequisites](mbam-25-deployment-prerequisites.md) - +## Got a suggestion for MBAM? +- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). +- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). diff --git a/mdop/mbam-v25/planning-for-mbam-25-groups-and-accounts.md b/mdop/mbam-v25/planning-for-mbam-25-groups-and-accounts.md index 3271b950b3..541ece0a38 100644 --- a/mdop/mbam-v25/planning-for-mbam-25-groups-and-accounts.md +++ b/mdop/mbam-v25/planning-for-mbam-25-groups-and-accounts.md @@ -172,10 +172,6 @@ Create the following accounts for the Administration and Monitoring Website. -## Got a suggestion for MBAM? - - -Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). ## Related topics @@ -186,7 +182,9 @@ Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-micros - +## Got a suggestion for MBAM? +- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). +- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). diff --git a/mdop/mbam-v25/planning-for-mbam-25-high-availability.md b/mdop/mbam-v25/planning-for-mbam-25-high-availability.md index 29829ab49e..fcf168b878 100644 --- a/mdop/mbam-v25/planning-for-mbam-25-high-availability.md +++ b/mdop/mbam-v25/planning-for-mbam-25-high-availability.md @@ -123,11 +123,8 @@ MBAM provides a Volume Shadow Copy Service (VSS) writer, called the Microsoft Bi The VSS writer is registered on every server where you enable an MBAM web application. The MBAM VSS writer depends on the SQL Server VSS Writer, which is registered as part of the Microsoft SQL Server installation. Any backup technology that uses VSS writers to perform backup can discover the MBAM VSS writer. -## Got a suggestion for MBAM? -Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - ## Related topics @@ -136,7 +133,9 @@ Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-micros - +## Got a suggestion for MBAM? +- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). +- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). diff --git a/mdop/mbam-v25/planning-for-mbam-25-server-deployment.md b/mdop/mbam-v25/planning-for-mbam-25-server-deployment.md index cb91068cf3..6fc0c1b5d5 100644 --- a/mdop/mbam-v25/planning-for-mbam-25-server-deployment.md +++ b/mdop/mbam-v25/planning-for-mbam-25-server-deployment.md @@ -96,11 +96,8 @@ The Server infrastructure for the MBAM Configuration Manager topology contains t For a description of these features, see [High-Level Architecture of MBAM 2.5 with Configuration Manager Integration Topology](high-level-architecture-of-mbam-25-with-configuration-manager-integration-topology.md). -## Got a suggestion for MBAM? -Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - ## Related topics @@ -110,7 +107,9 @@ Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-micros - +## Got a suggestion for MBAM? +- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). +- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). diff --git a/mdop/mbam-v25/planning-for-mbam-25.md b/mdop/mbam-v25/planning-for-mbam-25.md index d6dbd8c240..bbf4e631bb 100644 --- a/mdop/mbam-v25/planning-for-mbam-25.md +++ b/mdop/mbam-v25/planning-for-mbam-25.md @@ -46,15 +46,14 @@ This topic lists the tasks, prerequisites, and requirements that you need to com [Technical Reference for MBAM 2.5](technical-reference-for-mbam-25.md) + + + + + ## Got a suggestion for MBAM? - - -Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - +- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). +- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). diff --git a/mdop/mbam-v25/planning-how-to-secure-the-mbam-websites.md b/mdop/mbam-v25/planning-how-to-secure-the-mbam-websites.md index f6b5891298..b59cdf6226 100644 --- a/mdop/mbam-v25/planning-how-to-secure-the-mbam-websites.md +++ b/mdop/mbam-v25/planning-how-to-secure-the-mbam-websites.md @@ -313,10 +313,6 @@ If you already registered SPNs on the machine account rather than in an applicat -## Got a suggestion for MBAM? - - -Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopmbam). ## Related topics @@ -329,7 +325,9 @@ Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-micros - +## Got a suggestion for MBAM? +- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). +- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). diff --git a/mdop/mbam-v25/planning-to-deploy-mbam-25.md b/mdop/mbam-v25/planning-to-deploy-mbam-25.md index d40d55d6cb..4d0379428b 100644 --- a/mdop/mbam-v25/planning-to-deploy-mbam-25.md +++ b/mdop/mbam-v25/planning-to-deploy-mbam-25.md @@ -47,9 +47,8 @@ With MBAM, you can encrypt a computer in your organization either before the end [Planning for MBAM 2.5](planning-for-mbam-25.md) ## Got a suggestion for MBAM? - - -Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). +- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). +- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). diff --git a/mdop/mbam-v25/preparing-your-environment-for-mbam-25.md b/mdop/mbam-v25/preparing-your-environment-for-mbam-25.md index 3bff735f43..cccc386d97 100644 --- a/mdop/mbam-v25/preparing-your-environment-for-mbam-25.md +++ b/mdop/mbam-v25/preparing-your-environment-for-mbam-25.md @@ -47,9 +47,8 @@ As part of the prerequisites, you must define certain roles and accounts, which [MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md) ## Got a suggestion for MBAM? - - -Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). +- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). +- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). diff --git a/mdop/mbam-v25/prerequisites-for-mbam-25-clients.md b/mdop/mbam-v25/prerequisites-for-mbam-25-clients.md index f4920073c1..f151a12f21 100644 --- a/mdop/mbam-v25/prerequisites-for-mbam-25-clients.md +++ b/mdop/mbam-v25/prerequisites-for-mbam-25-clients.md @@ -83,11 +83,8 @@ Before you install the MBAM Client software on end users' computers, ensure that If BitLocker was used without MBAM, MBAM can be installed and utilize the existing TPM information. -## Got a suggestion for MBAM? -Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - ## Related topics @@ -96,7 +93,9 @@ Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-micros [Planning to Deploy MBAM 2.5](planning-to-deploy-mbam-25.md) - +## Got a suggestion for MBAM? +- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). +- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). diff --git a/mdop/mbam-v25/prerequisites-for-the-configuration-manager-integration-feature.md b/mdop/mbam-v25/prerequisites-for-the-configuration-manager-integration-feature.md index 248bb620bf..f00c62f502 100644 --- a/mdop/mbam-v25/prerequisites-for-the-configuration-manager-integration-feature.md +++ b/mdop/mbam-v25/prerequisites-for-the-configuration-manager-integration-feature.md @@ -176,11 +176,8 @@ To install MBAM with Configuration Manager, you must have an administrative user To enable the client computers to report BitLocker compliance details through the MBAM Configuration Manager reports, you have to edit the Configuration.mof file and Sms\_def.mof file for System Center 2012 Configuration Manager and Microsoft System Center Configuration Manager 2007. For instructions, see [MBAM 2.5 Server Prerequisites that Apply Only to the Configuration Manager Integration Topology](mbam-25-server-prerequisites-that-apply-only-to-the-configuration-manager-integration-topology.md). -## Got a suggestion for MBAM? -Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - ## Related topics @@ -190,7 +187,9 @@ Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-micros - +## Got a suggestion for MBAM? +- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). +- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). diff --git a/mdop/mbam-v25/release-notes-for-mbam-25-sp1.md b/mdop/mbam-v25/release-notes-for-mbam-25-sp1.md index ed0dcd0fb5..6fb8a41a78 100644 --- a/mdop/mbam-v25/release-notes-for-mbam-25-sp1.md +++ b/mdop/mbam-v25/release-notes-for-mbam-25-sp1.md @@ -143,11 +143,8 @@ Original setting is: This is the reason why the issue was not seen with other browsers like Chrome, Firefox etc. -## Got a suggestion for MBAM? -Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopmbam). - ## Related topics @@ -155,7 +152,9 @@ Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-micros - +## Got a suggestion for MBAM? +- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). +- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). diff --git a/mdop/mbam-v25/release-notes-for-mbam-25.md b/mdop/mbam-v25/release-notes-for-mbam-25.md index bf6d611a02..91c710e6ee 100644 --- a/mdop/mbam-v25/release-notes-for-mbam-25.md +++ b/mdop/mbam-v25/release-notes-for-mbam-25.md @@ -165,10 +165,6 @@ This table lists the hotfixes and KB articles for MBAM 2.5. -## Got a suggestion for MBAM? - - -Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). ## Related topics @@ -177,7 +173,9 @@ Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-micros - +## Got a suggestion for MBAM? +- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). +- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). diff --git a/mdop/mbam-v25/removing-mbam-server-features-or-software.md b/mdop/mbam-v25/removing-mbam-server-features-or-software.md index 142c6e121f..bf66d191ab 100644 --- a/mdop/mbam-v25/removing-mbam-server-features-or-software.md +++ b/mdop/mbam-v25/removing-mbam-server-features-or-software.md @@ -71,11 +71,8 @@ Use the following steps to remove the MBAM Server software and any MBAM Server f 2. Select **Uninstall**, and follow the remaining prompts to complete the process of uninstalling the MBAM Server software. -## Got a suggestion for MBAM? -Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - ## Related topics @@ -85,7 +82,9 @@ Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-micros - +## Got a suggestion for MBAM? +- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). +- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). diff --git a/mdop/mbam-v25/server-event-logs.md b/mdop/mbam-v25/server-event-logs.md index 4b8067be48..637ae371f3 100644 --- a/mdop/mbam-v25/server-event-logs.md +++ b/mdop/mbam-v25/server-event-logs.md @@ -660,10 +660,6 @@ The following table contains messages and troubleshooting information for event -## Got a suggestion for MBAM? - - -Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). ## Related topics @@ -673,7 +669,9 @@ Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-micros [Client Event Logs](client-event-logs.md) - +## Got a suggestion for MBAM? +- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). +- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). diff --git a/mdop/mbam-v25/technical-reference-for-mbam-25.md b/mdop/mbam-v25/technical-reference-for-mbam-25.md index f0411f3292..d09d2963c8 100644 --- a/mdop/mbam-v25/technical-reference-for-mbam-25.md +++ b/mdop/mbam-v25/technical-reference-for-mbam-25.md @@ -43,9 +43,8 @@ This section includes technical information about features in Microsoft BitLocke [Troubleshooting MBAM 2.5](troubleshooting-mbam-25.md) ## Got a suggestion for MBAM? - - -Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). +- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). +- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). diff --git a/mdop/mbam-v25/troubleshooting-mbam-25.md b/mdop/mbam-v25/troubleshooting-mbam-25.md index bc2671930f..cb05acd2bf 100644 --- a/mdop/mbam-v25/troubleshooting-mbam-25.md +++ b/mdop/mbam-v25/troubleshooting-mbam-25.md @@ -84,9 +84,8 @@ If you have a troubleshooting tip or a best practice to share that is not alread [Troubleshooting MBAM 2.5 installation problems](https://support.microsoft.com/kb/3049652) ## Got a suggestion for MBAM? - - -Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). +- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). +- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). diff --git a/mdop/mbam-v25/understanding-mbam-25-stand-alone-reports.md b/mdop/mbam-v25/understanding-mbam-25-stand-alone-reports.md index 6d37f02d47..508b82dd72 100644 --- a/mdop/mbam-v25/understanding-mbam-25-stand-alone-reports.md +++ b/mdop/mbam-v25/understanding-mbam-25-stand-alone-reports.md @@ -366,10 +366,6 @@ Report results can be saved to a file by clicking the **Export** button on the * -## Got a suggestion for MBAM? - - -Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). ## Related topics @@ -380,7 +376,9 @@ Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-micros - +## Got a suggestion for MBAM? +- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). +- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). diff --git a/mdop/mbam-v25/understanding-the-bitlocker-encryption-options-and-bitlocker-drive-encryption-items-in-control-panel.md b/mdop/mbam-v25/understanding-the-bitlocker-encryption-options-and-bitlocker-drive-encryption-items-in-control-panel.md index 9acb5a40e8..6a9f2918f6 100644 --- a/mdop/mbam-v25/understanding-the-bitlocker-encryption-options-and-bitlocker-drive-encryption-items-in-control-panel.md +++ b/mdop/mbam-v25/understanding-the-bitlocker-encryption-options-and-bitlocker-drive-encryption-items-in-control-panel.md @@ -113,10 +113,6 @@ The following table describes how the **Manage BitLocker** shortcut menu differs -## Got a suggestion for MBAM? - - -Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). ## Related topics @@ -125,7 +121,9 @@ Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-micros - +## Got a suggestion for MBAM? +- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). +- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). diff --git a/mdop/mbam-v25/upgrading-to-mbam-25-or-mbam-25-sp1-from-previous-versions.md b/mdop/mbam-v25/upgrading-to-mbam-25-or-mbam-25-sp1-from-previous-versions.md index 7bb09bf7a9..3d7c288953 100644 --- a/mdop/mbam-v25/upgrading-to-mbam-25-or-mbam-25-sp1-from-previous-versions.md +++ b/mdop/mbam-v25/upgrading-to-mbam-25-or-mbam-25-sp1-from-previous-versions.md @@ -130,7 +130,7 @@ Use the steps in the following sections to upgrade MBAM for the Stand-alone topo 6. Install and configure the MBAM 2.5 or 2.5 SP1 databases, reports, web applications, and Configuration Manager integration, in that order. The databases and Configuration Manager objects are upgraded in place. -7. Optionally, update the Group Policy Objects (GPOs), and edit the settings if you want to implement new features in MBAM, such as enforced encryption. If you do not update the GPOs, MBAM will continue to report against your current GPOs. See [How to Get MDOP Group Policy (.admx) Templates](http://www.microsoft.com/download/details.aspx?id=41183) to download the latest ADMX templates. +7. Optionally, update the Group Policy Objects (GPOs), and edit the settings if you want to implement new features in MBAM, such as enforced encryption. If you do not update the GPOs, MBAM will continue to report against your current GPOs. See [How to Get MDOP Group Policy (.admx) Templates](https://docs.microsoft.com/en-us/microsoft-desktop-optimization-pack/solutions/how-to-download-and-deploy-mdop-group-policy--admx--templates) to download the latest ADMX templates. After you upgrade the MBAM Server infrastructure, the existing client computers continue to successfully report to the MBAM 2.5 or 2.5 SP1 Server, and recovery data continues to be stored. @@ -147,11 +147,8 @@ MBAM supports upgrades to the MBAM 2.5 Client from any earlier version of the M - Install the MBAM Client through an electronic software distribution system or through tools such as Active Directory Domain Services or System Center Configuration Manager. -## Got a suggestion for MBAM? -Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - ## Related topics @@ -163,7 +160,9 @@ Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-micros - +## Got a suggestion for MBAM? +- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). +- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). diff --git a/mdop/mbam-v25/using-windows-powershell-to-administer-mbam-25.md b/mdop/mbam-v25/using-windows-powershell-to-administer-mbam-25.md index b7ac31ef9d..56da96c821 100644 --- a/mdop/mbam-v25/using-windows-powershell-to-administer-mbam-25.md +++ b/mdop/mbam-v25/using-windows-powershell-to-administer-mbam-25.md @@ -86,11 +86,8 @@ Windows PowerShell Help for MBAM cmdlets is available in the following formats: -## Got a suggestion for MBAM? -Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - ## Related topics @@ -100,7 +97,9 @@ Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-micros - +## Got a suggestion for MBAM? +- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). +- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). diff --git a/mdop/mbam-v25/validating-the-mbam-25-server-feature-configuration.md b/mdop/mbam-v25/validating-the-mbam-25-server-feature-configuration.md index d0e3b1685a..c7b9098597 100644 --- a/mdop/mbam-v25/validating-the-mbam-25-server-feature-configuration.md +++ b/mdop/mbam-v25/validating-the-mbam-25-server-feature-configuration.md @@ -168,18 +168,17 @@ Use these steps to validate your MBAM Server deployment when you are using MBAM - BitLocker Operating System Drive Protection -## Got a suggestion for MBAM? -Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - ## Related topics [Configuring the MBAM 2.5 Server Features](configuring-the-mbam-25-server-features.md) - +## Got a suggestion for MBAM? +- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). +- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). diff --git a/mdop/mbam-v25/viewing-mbam-25-reports-for-the-configuration-manager-integration-topology.md b/mdop/mbam-v25/viewing-mbam-25-reports-for-the-configuration-manager-integration-topology.md index db55e575ba..b8c9ce465b 100644 --- a/mdop/mbam-v25/viewing-mbam-25-reports-for-the-configuration-manager-integration-topology.md +++ b/mdop/mbam-v25/viewing-mbam-25-reports-for-the-configuration-manager-integration-topology.md @@ -473,11 +473,6 @@ The Removable Data Volume encryption status is not shown in this report. -## Got a suggestion for MBAM? - - -Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - ## Related topics @@ -485,7 +480,9 @@ Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-micros - +## Got a suggestion for MBAM? +- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). +- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). diff --git a/mdop/mbam-v25/viewing-mbam-25-reports-for-the-stand-alone-topology.md b/mdop/mbam-v25/viewing-mbam-25-reports-for-the-stand-alone-topology.md index e1a671b6e8..98fca5e3d3 100644 --- a/mdop/mbam-v25/viewing-mbam-25-reports-for-the-stand-alone-topology.md +++ b/mdop/mbam-v25/viewing-mbam-25-reports-for-the-stand-alone-topology.md @@ -48,10 +48,6 @@ If you are using the Configuration Manager Integration topology, most reports ar -## Got a suggestion for MBAM? - - -Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). ## Related topics @@ -62,7 +58,9 @@ Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-micros - +## Got a suggestion for MBAM? +- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). +- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). diff --git a/mdop/uev-v2/manage-administrative-backup-and-restore-in-ue-v-2x-new-topic-for-21.md b/mdop/uev-v2/manage-administrative-backup-and-restore-in-ue-v-2x-new-topic-for-21.md index 18be63b57f..b0d0ef4e43 100644 --- a/mdop/uev-v2/manage-administrative-backup-and-restore-in-ue-v-2x-new-topic-for-21.md +++ b/mdop/uev-v2/manage-administrative-backup-and-restore-in-ue-v-2x-new-topic-for-21.md @@ -94,7 +94,7 @@ Restoring a user’s device restores the currently registered Template’s setti - **Manual Restore** - If you want to assist users by restoring a device during a refresh, you can choose to use the Restore-UevBackup cmdlet. This command ensures that the user’s current settings become the current state on the Settings Storage Location. + If you want to assist users by restoring a device during a refresh, you can choose to use the Restore-UevBackup cmdlet. This command causes the user’s settings to be downloaded from the Settings Storage Location. ## Restore Application and Windows Settings to Original State diff --git a/store-for-business/TOC.md b/store-for-business/TOC.md index 5bd846269f..9709bdc21e 100644 --- a/store-for-business/TOC.md +++ b/store-for-business/TOC.md @@ -21,7 +21,7 @@ ### [Manage access to private store](manage-access-to-private-store.md) ### [Manage private store settings](manage-private-store-settings.md) ### [Configure MDM provider](configure-mdm-provider-microsoft-store-for-business.md) -### [Manage Windows device deployment with Windows AutoPilot Deployment](add-profile-to-devices.md) +### [Manage Windows device deployment with Windows Autopilot Deployment](add-profile-to-devices.md) ### [Microsoft Store for Business and Education PowerShell module - preview](microsoft-store-for-business-education-powershell-module.md) ### [Manage software purchased with Microsoft Products and Services agreement in Microsoft Store for Business](manage-mpsa-software-microsoft-store-for-business.md) ## [Device Guard signing portal](device-guard-signing-portal.md) diff --git a/store-for-business/add-profile-to-devices.md b/store-for-business/add-profile-to-devices.md index 20536b0115..411a0ae2cd 100644 --- a/store-for-business/add-profile-to-devices.md +++ b/store-for-business/add-profile-to-devices.md @@ -1,6 +1,6 @@ --- -title: Manage Windows device deployment with Windows AutoPilot Deployment -description: Add an AutoPilot profile to devices. AutoPilot profiles control what is included in Windows set up experience for your employees. +title: Manage Windows device deployment with Windows Autopilot Deployment +description: Add an Autopilot profile to devices. Autopilot profiles control what is included in Windows set up experience for your employees. ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library @@ -11,68 +11,68 @@ ms.date: 2/9/2018 ms.localizationpriority: high --- -# Manage Windows device deployment with Windows AutoPilot Deployment +# Manage Windows device deployment with Windows Autopilot Deployment **Applies to** - Windows 10 -Windows AutoPilot Deployment Program simplifies device set up for IT Admins. For an overview of benefits, scenarios, and prerequisites, see [Overview of Windows AutoPilot](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-10-autopilot). +Windows Autopilot simplifies device set up for IT Admins. For an overview of benefits, scenarios, and prerequisites, see [Overview of Windows Autopilot](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-10-autopilot). -Watch this video to learn more about Windows AutoPilot in Micrsoft Store for Business. +Watch this video to learn more about Windows Autopilot in Micrsoft Store for Business. > [!video https://www.microsoft.com/en-us/videoplayer/embed/3b30f2c2-a3e2-4778-aa92-f65dbc3ecf54?autoplay=false] -## What is Windows AutoPilot Deployment Program? -In Microsoft Store for Business, you can manage devices for your organization and apply an *AutoPilot deployment profile* to your devices. When people in your organization run the out-of-box experience on the device, the profile configures Windows based on the AutoPilot deployment profile you applied to the device. +## What is Windows Autopilot? +In Microsoft Store for Business, you can manage devices for your organization and apply an *Autopilot deployment profile* to your devices. When people in your organization run the out-of-box experience on the device, the profile configures Windows based on the Autopilot deployment profile you applied to the device. -You can create and apply AutoPilot deployment profiles to these devices. The overall process looks like this. +You can create and apply Autopilot deployment profiles to these devices. The overall process looks like this. - + -Figure 1 - Windows AutoPilot Deployment Program process +Figure 1 - Windows Autopilot Deployment Program process -AutoPilot deployment profiles have two main parts: default settings that can't be changed, and optional settings that you can include. +Autopilot deployment profiles have two main parts: default settings that can't be changed, and optional settings that you can include. -### AutoPilot deployment profiles - default settings -These settings are configured with all AutoPilot deployment profiles: +### Autopilot deployment profiles - default settings +These settings are configured with all Autopilot deployment profiles: - Skip Cortana, OneDrive, and OEM registration setup pages - Automatically setup for work or school - Sign in experience with company or school brand -### AutoPilot deployment profiles - optional settings -These settings are off by default. You can turn them on for your AutoPilot deployment profiles: +### Autopilot deployment profiles - optional settings +These settings are off by default. You can turn them on for your Autopilot deployment profiles: - Skip privacy settings -### Support for AutoPilot profile settings -AutoPilot profile settings are supported beginning with the version of Windows they were introduced in. This table summarizes the settings and what they are supported on. +### Support for Autopilot profile settings +Autopilot profile settings are supported beginning with the version of Windows they were introduced in. This table summarizes the settings and what they are supported on. | Setting | Supported on | | ------- | ------------- | | Deployment default features| Windows 10, version 1703 or later | | Skip privacy settings | Windows 10, version 1703 or later | | Disable local admin account creation on the device | Windows 10, version 1703 or later | -| Skip End User License Agreement (EULA) | Windows 10, version 1709 or later. [Learn about Windows AutoPilot EULA dismissal](https://docs.microsoft.com/windows/deployment/Windows-AutoPilot-EULA-note) | +| Skip End User License Agreement (EULA) | Windows 10, version 1709 or later. [Learn about Windows Autopilot EULA dismissal](https://docs.microsoft.com/windows/deployment/Windows-Autopilot-EULA-note) | -## Windows AutoPilot deployment profiles in Microsoft Store for Business and Education +## Windows Autopilot deployment profiles in Microsoft Store for Business and Education You can manage new devices in Microsoft Store for Business or Microsoft Store for Education. Devices need to meet these requirements: - Windows 10, version 1703 or later - New devices that have not been through Windows out-of-box experience. -## Add devices and apply AutoPilot deployment profile +## Add devices and apply Autopilot deployment profile To manage devices through Microsoft Store for Business and Education, you'll need a .csv file that contains specific information about the devices. You should be able to get this from your Microsoft account contact, or the store where you purchased the devices. Upload the .csv file to Microsoft Store to add the devices. ### Device information file format Columns in the device information file need to use this naming and be in this order: - Column A: Device Serial Number -- Column B: Windows Product ID +- Column B: Windows Product ID (optional, typically blank) - Column C: Hardware Hash Here's a sample device information file:  -When you add devices, you need to add them to an *AutoPilot deployment group*. Use these groups to apply AutoPilot deployment profiles to a group of devices. The first time you add devices to a group, you'll need to create an AutoPilot deployment group. +When you add devices, you need to add them to an *Autopilot deployment group*. Use these groups to apply Autopilot deployment profiles to a group of devices. The first time you add devices to a group, you'll need to create an Autopilot deployment group. > [!NOTE] > You can only add devices to a group when you add devices to **Microsoft Store for Business and Education**. If you decide to reorganize devices into different groups, you'll need to delete them from **Devices** in **Microsoft Store**, and add them again. @@ -81,50 +81,50 @@ When you add devices, you need to add them to an *AutoPilot deployment group*. U 1. Sign in to [Microsoft Store for Business](http://businessstore.microsoft.com) or [Microsoft Store for Education](https://educationstore.microsoft.com). 2. Click **Manage**, and then click **Devices**. 3. Click **Add devices**, navigate to the *.csv file and select it. -4. Type a name for a new AutoPilot deployment group, or choose one from the list, and then click **Add**. +4. Type a name for a new Autopilot deployment group, or choose one from the list, and then click **Add**. If you don't add devices to a group, you can select the individual devices to apply a profile to. -5. Click the devices or AutoPilot deployment group that you want to manage. You need to select devices before you can apply an AutoPilot deployment profile. You can switch between seeing groups or devices by clicking **View groups** or **View devices**. +5. Click the devices or Autopilot deployment group that you want to manage. You need to select devices before you can apply an Autopilot deployment profile. You can switch between seeing groups or devices by clicking **View groups** or **View devices**. -**Apply AutoPilot deployment profile** -1. When you have devices selected, click **AutoPilot deployment**. -2. Choose the AutoPilot deployment profile to apply to the selected devices. +**Apply Autopilot deployment profile** +1. When you have devices selected, click **Autopilot deployment**. +2. Choose the Autopilot deployment profile to apply to the selected devices. > [!NOTE] - > The first time you use AutoPilot deployment profiles, you'll need to create one. See [Create AutoPilot profile](#create-autopilot-profile). + > The first time you use Autopilot deployment profiles, you'll need to create one. See [Create Autopilot profile](#create-autopilot-profile). 3. Microsoft Store for Business applies the profile to your selected devices, and shows the profile name on **Devices**. -## Manage AutoPilot deployment profiles -You can manage the AutoPilot deployment profiles created in Microsoft Store. You can create a new profile, edit, or delete a profile. +## Manage Autopilot deployment profiles +You can manage the Autopilot deployment profiles created in Microsoft Store. You can create a new profile, edit, or delete a profile. -### Create AutoPilot profile +### Create Autopilot profile 1. Sign in to [Microsoft Store for Business](http://businessstore.microsoft.com) or [Microsoft Store for Education](https://educationstore.microsoft.com). 2. Click **Manage**, and then click **Devices**. -3. Click **AutoPilot deployment**, and then click **Create new profile**. +3. Click **Autopilot deployment**, and then click **Create new profile**. 4. Name the profile, choose the settings to include, and then click **Create**. -The new profile is added to the **AutoPilot deployment** list. +The new profile is added to the **Autopilot deployment** list. -### Edit or delete AutoPilot profile +### Edit or delete Autopilot profile 1. Sign in to [Microsoft Store for Business](http://businessstore.microsoft.com) or [Microsoft Store for Education](https://educationstore.microsoft.com). 2. Click **Manage**, and then click **Devices**. -3. Click **AutoPilot deployment**, click **Edit your profiles**, and then choose the profile to edit. +3. Click **Autopilot deployment**, click **Edit your profiles**, and then choose the profile to edit. TBD: art 4. Change settings for the profile, and then click **Save**. -or- Click **Delete profile** to delete the profile. -## Apply a different AutoPilot deployment profile to devices -After you've applied an AutoPilot deployment profile to a device, if you decide to apply a different profile, you can remove the profile and apply a new profile. +## Apply a different Autopilot deployment profile to devices +After you've applied an Autopilot deployment profile to a device, if you decide to apply a different profile, you can remove the profile and apply a new profile. > [!NOTE] > The new profile will only be applied if the device has not been started, and gone through the out-of-box experience. Settings from a different profile can't be applied when another profile has been applied. Windows would need to be reinstalled on the device for the second profile to be applied to the device. -## AutoPilot device information file error messages -Here's info on some of the errors you might see while working with AutoPilot deployment profiles in **Microsoft Store for Business and Education**. +## Autopilot device information file error messages +Here's info on some of the errors you might see while working with Autopilot deployment profiles in **Microsoft Store for Business and Education**. | Message Id | Message explanation | | ---------- | ------------------- | @@ -135,6 +135,6 @@ Here's info on some of the errors you might see while working with AutoPilot dep | wadp005 | Check your .csv file with your device provider. One of the devices on your list has been claimed by another organization. | | wadp006 | Try that again. Something happened on our end. Waiting a bit might help. | | wadp007 | Check the info for this device in your .csv file. The device is already registered in your organization. | -| wadp008 | The device does not meet AutoPilot Deployment requirements. | +| wadp008 | The device does not meet Autopilot Deployment requirements. | | wadp009 | Check with your device provider for an update .csv file. The current file doesn’t work | | wadp010 | Try that again. Something happened on our end. Waiting a bit might help. | diff --git a/store-for-business/education/TOC.md b/store-for-business/education/TOC.md index 4de95964bc..b97c30604a 100644 --- a/store-for-business/education/TOC.md +++ b/store-for-business/education/TOC.md @@ -26,7 +26,7 @@ ### [Manage access to private store](/microsoft-store/manage-access-to-private-store?toc=/microsoft-store/education/toc.json) ### [Manage private store settings](/microsoft-store/manage-private-store-settings?toc=/microsoft-store/education/toc.json) ### [Configure MDM provider](/microsoft-store/configure-mdm-provider-microsoft-store-for-business?toc=/microsoft-store/education/toc.json) -### [Manage Windows device deployment with Windows AutoPilot Deployment](/microsoft-store/add-profile-to-devices?toc=/microsoft-store/education/toc.json) +### [Manage Windows device deployment with Windows Autopilot Deployment](/microsoft-store/add-profile-to-devices?toc=/microsoft-store/education/toc.json) ### [Microsoft Store for Business and Education PowerShell module - preview](/microsoft-store/microsoft-store-for-business-education-powershell-module?toc=/microsoft-store/education/toc.json) ### [Manage software purchased with Microsoft Products and Services agreement in Microsoft Store for Business](/microsoft-store/manage-mpsa-software-microsoft-store-for-business?toc=/microsoft-store/education/toc.json) ## [Device Guard signing portal](/microsoft-store/device-guard-signing-portal?toc=/microsoft-store/education/toc.json) diff --git a/store-for-business/images/bank-account-icon.png b/store-for-business/images/bank-account-icon.png new file mode 100644 index 0000000000..664f8c7a6f Binary files /dev/null and b/store-for-business/images/bank-account-icon.png differ diff --git a/store-for-business/images/license-assign-icon.png b/store-for-business/images/license-assign-icon.png new file mode 100644 index 0000000000..4a5daa933c Binary files /dev/null and b/store-for-business/images/license-assign-icon.png differ diff --git a/store-for-business/images/skype-icon-wn.png b/store-for-business/images/skype-icon-wn.png new file mode 100644 index 0000000000..d9819ae0ae Binary files /dev/null and b/store-for-business/images/skype-icon-wn.png differ diff --git a/store-for-business/manage-apps-microsoft-store-for-business-overview.md b/store-for-business/manage-apps-microsoft-store-for-business-overview.md index 5f765d2f3c..85fb5deed0 100644 --- a/store-for-business/manage-apps-microsoft-store-for-business-overview.md +++ b/store-for-business/manage-apps-microsoft-store-for-business-overview.md @@ -28,6 +28,6 @@ Manage products and services in Microsoft Store for Business and Microsoft Store | [App inventory managemement for Microsoft Store for Business and Education](app-inventory-management-microsoft-store-for-business.md) | You can manage all apps that you've acquired on your **Apps & software** page. | | [Manage private store settings](manage-private-store-settings.md) | The private store is a feature in Microsoft Store for Business and Education that organizations receive during the sign up process. When admins add apps to the private store, all employees in the organization can view and download the apps. Only online-licensed apps can be distributed from your private store. | | [Configure MDM provider](configure-mdm-provider-microsoft-store-for-business.md) | For companies or organizations using mobile device management (MDM) tools, those tools can synchronize with Microsoft Store for Business inventory to manage apps with offline licenses. Microsoft Store management tool services work with your third-party management tool to manage content. | -| [Manage Windows device deployment with Windows AutoPilot Deployment](add-profile-to-devices.md) | In Microsoft Store for Business, you can manage devices for your organization and apply an AutoPilot deployment profile to your devices. When people in your organization run the out-of-box experience on the device, the profile configures Windows based on the AutoPilot deployment profile you applied to the device. | +| [Manage Windows device deployment with Windows Autopilot Deployment](add-profile-to-devices.md) | In Microsoft Store for Business, you can manage devices for your organization and apply an Autopilot deployment profile to your devices. When people in your organization run the out-of-box experience on the device, the profile configures Windows based on the Autopilot deployment profile you applied to the device. | | [Microsoft Store for Business and Education PowerShell module - preview](microsoft-store-for-business-education-powershell-module.md) | Use PowerShell cmdlets to automate basic app license assignment. | | [Manage software purchased with Microsoft Products and Services agreement in Microsoft Store for Business](manage-mpsa-software-microsoft-store-for-business.md) | Software purchased with the Microsoft Products and Services Agreement (MPSA) can be managed in Microsoft Store for Business and Education. This allows customers to manage online software purchases in one location. | \ No newline at end of file diff --git a/store-for-business/manage-private-store-settings.md b/store-for-business/manage-private-store-settings.md index 93d1f09234..e851331cdb 100644 --- a/store-for-business/manage-private-store-settings.md +++ b/store-for-business/manage-private-store-settings.md @@ -7,7 +7,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store author: TrudyHa -ms.date: 2/15/2018 +ms.date: 3/29/2018 ms.localizationpriority: high --- @@ -30,8 +30,8 @@ You can change the name of your private store in Microsoft Store. **To change the name of your private store** 1. Sign in to the [Microsoft Store for Business](http://businessstore.microsoft.com) or [Microsoft Store for Education](https://educationstore.microsoft.com). -2. Click **Manage**, click **Permissions**. -3. On the **Private store** tab, click **Change**. +2. Click **Settings**, click **Distribute**. +3. In the **Private store** section, click **Change**. 4. Type a new display name for your private store, and click **Save**.  @@ -53,7 +53,7 @@ You can add a collection to your private store from the private store, or from t  4. Type a name for your collection, and then click **Next**. -5. Add at least one product to your collection, and then click **Done**. +5. Add at least one product to your collection, and then click **Done**. You can search for apps and refine results based on the source of the app, or the supported devices. > [!NOTE] > New collections require at least one app, or they will not be created. @@ -64,7 +64,7 @@ You can add a collection to your private store from the private store, or from t 3. Under **Apps & software**, choose an app you want to include in a new collection. 4. Under **Private Store Collections**, click **Add a collection**. - +  5. Type a name for your collection, and then click **Next**. 6. Add at least one product to your collection, and then click **Done**. @@ -78,7 +78,7 @@ If you've already added a Collection to your private store, you can easily add a 1. Sign in to [Microsoft Store for Business](http://businessstore.microsoft.com) or [Microsoft Store for Education](https://educationstore.microsoft.com). 2. Click your private store. - +  3. Click the ellipses next to the collection name, and click **Edit collection**. 4. Add or remove products from the collection, and then click **Done**. @@ -89,9 +89,8 @@ You can also add an app to a collection from the app details page. 3. Under **Apps & software**, choose an app you want to include in a new collection. 4. Under **Private Store Collections**, turn on the collection you want to add the app to. - +  - \ No newline at end of file +| Rename private store tab | 4-6 hours | diff --git a/store-for-business/release-history-microsoft-store-business-education.md b/store-for-business/release-history-microsoft-store-business-education.md index 705b6a6199..bb8c98ae04 100644 --- a/store-for-business/release-history-microsoft-store-business-education.md +++ b/store-for-business/release-history-microsoft-store-business-education.md @@ -6,7 +6,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store author: TrudyHa -ms.date: 2/8/2018 +ms.date: 4/26/2018 --- # Microsoft Store for Business and Education release history @@ -15,6 +15,20 @@ Microsoft Store for Business and Education regularly releases new and improved f Looking for info on the latest release? Check out [What's new in Microsoft Store for Business and Education](whats-new-microsoft-store-business-education.md) +## March 2018 +- **Performance improvements in private store** - We've made it significantly faster for you to udpate the private store. Many changes to the private store are available immediately after you make them. [Get more info](https://docs.microsoft.com/microsoft-store/manage-private-store-settings#private-store-performance) +- **Private store collection updates** - We’ve made it easier to find apps when creating private store collections – now you can search and filter results. + [Get more info](https://docs.microsoft.com/microsoft-store/manage-private-store-settings#private-store-collections) +- **Manage Skype Communication credits** - Office 365 customers that own Skype Communication Credits can now see and manage them in Microsoft Store for Business. You can view your account, add funds to your account, and manage auto-recharge settings. +- **Upgrade Office 365 trial subscription** - Customers with Office 365 can upgrade their subscription and automatically re-assign their user licenses over to a new target subscription. For example, you could upgrade your Office 365 Business to Office 365 Business Premium. + +## January and February 2018 +- **One place for apps, software, and subscriptions** - The new **Products & services** page in Microsoft Store for Business and Education gives customers a single place to manage all products and services. +- **Create collections of apps in your private store** - Use **collections** to customize your private store. Collections allow you to create groups of apps that are commonly used in your organization or school -- you might create a collection for a Finance department, or a 6th-grade class. [Get more info](https://docs.microsoft.com/microsoft-store/manage-private-store-settings#private-store-collections) +- **Upgrade Office 365 trial subscription** - Customers with Office 365 trials can now transition their trial to a paid subscription in Microsoft Store for Business. This works for trials you acquired from Microsoft Store for Business, or Office Admin Portal. +- **Supporting Microsoft Product and Services Agreement customers** - If you are purchasing under the Microsoft Products and Services Agreement (MPSA), you can use Microsoft Store for Business. Here you will find access to Products & Services purchased, Downloads & Keys, Software Assurance benefits, Order history, and Agreement details. +- **Microsoft Product and Services Agreement customers can invite people to take roles** - MPSA admins can invite people to take Microsoft Store for Business roles even if the person is not in their tenant. You provide an email address when you assign the role, and we'll add the account to your tenant and assign the role. + ## December 2017 - Bug fixes and permformance improvements. @@ -29,7 +43,7 @@ Looking for info on the latest release? Check out [What's new in Microsoft Store ## September 2017 -- **Manage Windows device deployment with Windows AutoPilot Deployment** - In Microsoft Store for Business, you can manage devices for your organization and apply an AutoPilot deployment profile to your devices. When people in your organization run the out-of-box experience on the device, the profile configures Windows, based on the AutoPilot deployment profile you applied to the device. [Get more info](add-profile-to-devices.md) +- **Manage Windows device deployment with Windows Autopilot Deployment** - In Microsoft Store for Business, you can manage devices for your organization and apply an Autopilot deployment profile to your devices. When people in your organization run the out-of-box experience on the device, the profile configures Windows, based on the Autopilot deployment profile you applied to the device. [Get more info](add-profile-to-devices.md) - **Request an app** - People in your organization can reqest additional licenses for apps in your private store, and then Admins or Purchasers can make the purchases. [Get more info](https://docs.microsoft.com/microsoft-store/acquire-apps-microsoft-store-for-business#request-apps) - **My organization** - **My organization** shows you all Agreements that apply to your organization. You can also update profile info for you org, such as mailing address and email associated with your account. - **Manage prepaid Office 365 subscriptions** - Office 365 prepaid subscriptions can be redeemed using a prepaid token. Tokens are available through 3rd-party businesses, outside of Microsoft Store for Business or the Office 365 Admin portal. After redemming prepaid subscriptions, Admins can add more licenses or extend the subscription's expiration date. diff --git a/store-for-business/roles-and-permissions-microsoft-store-for-business.md b/store-for-business/roles-and-permissions-microsoft-store-for-business.md index 1d42371897..e5c032895c 100644 --- a/store-for-business/roles-and-permissions-microsoft-store-for-business.md +++ b/store-for-business/roles-and-permissions-microsoft-store-for-business.md @@ -8,7 +8,7 @@ ms.sitesec: library ms.pagetype: store author: TrudyHa ms.localizationpriority: high -ms.date: 10/17/2017 +ms.date: 3/30/2018 --- # Roles and permissions in Microsoft Store for Business and Education @@ -48,7 +48,7 @@ This table lists the roles and their permissions. | | Admin | Purchaser | Device Guard signer | | ------------------------------ | ------ | -------- | ------------------- | | Assign roles | X | | | -| Manage Microsoft Store for business and education settings | X | | | +| Manage Microsoft Store for Business and Education settings | X | | | | Acquire apps | X | X | | | Distribute apps | X | X | | | Sign policies and catalogs | X | | | @@ -69,7 +69,9 @@ These permissions allow people to: - **Acquire apps** - Acquire apps from Microsoft Store and add them to your inventory. -- **Distribute apps** - Distribute apps that are in your inventory. You can distribute from inventory, private store, or use a management tool. +- **Distribute apps** - Distribute apps that are in your inventory. + - Admins can assign apps to people, add apps to the private store, or use a management tool. + - Purchasers can assign apps to people. **To assign roles to people** diff --git a/store-for-business/sfb-change-history.md b/store-for-business/sfb-change-history.md index 3ce51504ba..0d80d2e32a 100644 --- a/store-for-business/sfb-change-history.md +++ b/store-for-business/sfb-change-history.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: store author: TrudyHa ms.author: TrudyHa -ms.date: 10/31/2017 +ms.date: 4/26/2018 ms.localizationpriority: high --- @@ -18,10 +18,19 @@ ms.localizationpriority: high - Windows 10 - Windows 10 Mobile +## April 2018 +| New or changed topic | Description | +| --- | --- | +| [Configure access to Microsoft Store](https://docs.microsoft.com/en-us/windows/configuration/stop-employees-from-using-microsoft-store#a-href-idblock-store-group-policyablock-microsoft-store-using-group-policy) | Update on app updates when Microsoft Store is blocked. | +| [What's New in Microsoft Store for Business and Education](whats-new-microsoft-store-business-education.md) | Update | + ## March 2018 | New or changed topic | Description | | --- | --- | | [Manage software purchased with Microsoft Products and Services agreement in Microsoft Store for Business](manage-mpsa-software-microsoft-store-for-business.md) | New | +| [Manage private store settings](manage-private-store-settings.md) | Update for adding private store performance improvements. | +| [What's New in Microsoft Store for Business and Education](whats-new-microsoft-store-business-education.md) | Update | +| [Roles and permissions in Microsoft Store for Business](roles-and-permissions-microsoft-store-for-business.md) | Update | ## February 2018 @@ -40,7 +49,7 @@ ms.localizationpriority: high | New or changed topic | Description | | --- | --- | -| [Manage Windows device deployment with Windows AutoPilot Deployment](add-profile-to-devices.md) | Update. Add profile settings with supported build info. | +| [Manage Windows device deployment with Windows Autopilot Deployment](add-profile-to-devices.md) | Update. Add profile settings with supported build info. | | [What's New in Microsoft Store for Business and Education](whats-new-microsoft-store-business-education.md) | Update | ## September 2017 @@ -69,7 +78,7 @@ ms.localizationpriority: high | New or changed topic | Description | | -------------------- | ----------- | -| [Manage Windows device deployment with Windows AutoPilot Deployment](add-profile-to-devices.md) | New. Information about Windows AutoPilot Deployment Program and how it is used in Microsoft Store for Business and Education. | +| [Manage Windows device deployment with Windows Autopilot Deployment](add-profile-to-devices.md) | New. Information about Windows Autopilot Deployment Program and how it is used in Microsoft Store for Business and Education. | | [Microsoft Store for Business and Education overview - supported markets](https://docs.microsoft.com/en-us/microsoft-store/windows-store-for-business-overview#supported-markets) | Updates for added market support. | diff --git a/store-for-business/whats-new-microsoft-store-business-education.md b/store-for-business/whats-new-microsoft-store-business-education.md index fd595f2771..92debb23e2 100644 --- a/store-for-business/whats-new-microsoft-store-business-education.md +++ b/store-for-business/whats-new-microsoft-store-business-education.md @@ -6,7 +6,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store author: TrudyHa -ms.date: 2/16/2018 +ms.date: 4/26/2018 --- # What's new in Microsoft Store for Business and Education @@ -15,16 +15,13 @@ Microsoft Store for Business and Education regularly releases new and improved f ## Latest updates for Store for Business and Education -**January & February, 2018** +**April 2018** | | | |--------------------------------------|---------------------------------| -|  |**One place for apps, software, and subscriptions**
The new **Products & services** page in Microsoft Store for Business and Education gives customers a single place to manage all products and services. This includes Apps, Software, and Subscriptions that your organization acquired or manages through Microsoft Store for Business. This change centralizes these products, but the platform changes also improve overall performance.
**Applies to**:
Microsoft Store for Business
Microsoft Store for Education | -|  |**Create collections of apps in your private store**
Use **collections** to customize your private store. Collections allow you to create groups of apps that are commonly used in your organization or school -- you might create a collection for a Finance department, or a 6th-grade class.
[Get more info](https://docs.microsoft.com/microsoft-store/manage-private-store-settings#private-store-collections)
**Applies to**:
Microsoft Store for Business
Microsoft Store for Education | -|  |**Upgrade Office 365 trial subscription**
Customers with Office 365 trials can now transition their trial to a paid subscription in Microsoft Store for Business. This works for trials you acquired from Microsoft Store for Business, or Office Admin Portal.
**Applies to**:
Microsoft Store for Business
Microsoft Store for Education | -|  |**Supporting Microsoft Product and Services Agreement customers**
If you are purchasing under the Microsoft Products and Services Agreement (MPSA), you can use Microsoft Store for Business. Here you will find access to Products & Services purchased, Downloads & Keys, Software Assurance benefits, Order history, and Agreement details. Also, we added the ability to associate your purchasing account to your tenant.
**Applies to**:
Microsoft Store for Business
Microsoft Store for Education | -|  |**Microsoft Product and Services Agreement customers can invite people to take roles**
MPSA admins can invite people to take Microsoft Store for Business roles even if the person is not in their tenant. You provide an email address when you assign the role, and we'll add the account to your tenant and assign the role.
**Applies to**:
Microsoft Store for Business
Microsoft Store for Education | - +|  |**Assign apps to larger groups**
We're making it easier for admins to assign apps to groups of people. Admins can assign licenses to groups of any size, and include subgroups within those groups. We’ll figure out who’s in those groups, and assign licenses to people in the groups (skipping people who already have licenses). Along the way, we’ll let you know how many licenses are needed, and provide an estimate on the time required to assign licenses.
**Applies to**:
Microsoft Store for Business
Microsoft Store for Education | +|  |**Change collection order in private store**
Private store collections make it easy for groups of people to find the apps that they need. Now, you can customize the order of your private store collections.
**Applies to**:
Microsoft Store for Business
Microsoft Store for Education | +|  |**Office 365 subscription management**
We know that sometimes customers need to cancel subscription. While we don't want to lose a customer, we want the process for managing subscriptions to be easy. Now, you can delete your Office 365 subscription without calling Support. From Microsoft Store for Business and Education, you can request to delete an Office 365 subscription. We'll wait three days before permanently deleting the subscription. In case of a mistake, customers are welcome to reactivate subscriptions during the three-day period.
**Applies to**:
Microsoft Store for Business
Microsoft Store for Education | ## Previous releases and updates +[March 2018](release-history-microsoft-store-business-education.md#march-2018) +- Performance improvements in private store +- Private store collection updates +- Manage Skype communication credits +- Upgrade Office 365 trial subscription + +[January & February, 2018](release-history-microsoft-store-business-education.md#january-and-february-2018) +- One place for apps, software, and subscriptions +- Create collections of apps in your private store +- Upgrade Office 365 trial subscription +- Supporting Microsoft Product and Services Agreement customers +- Microsoft Product and Services Agreement customers can invite people to take roles + [December 2017](release-history-microsoft-store-business-education.md#december-2017) - Bug fixes and permformance improvements @@ -50,7 +60,7 @@ We’ve been working on bug fixes and performance improvements to provide you a - Bug fixes and permformance improvements [September 2017](release-history-microsoft-store-business-education.md#september-2017) -- Manage Windows device deployment with Windows AutoPilot Deployment +- Manage Windows device deployment with Windows Autopilot Deployment - Request an app - My organization - Manage prepaid Office 365 subscriptions diff --git a/windows/application-management/TOC.md b/windows/application-management/TOC.md index 5adf6e1def..310d18137e 100644 --- a/windows/application-management/TOC.md +++ b/windows/application-management/TOC.md @@ -2,6 +2,8 @@ ## [Sideload apps](sideload-apps-in-windows-10.md) ## [Remove background task resource restrictions](enterprise-background-activity-controls.md) ## [Enable or block Windows Mixed Reality apps in the enterprise](manage-windows-mixed-reality.md) +## [Understand apps in Windows 10](apps-in-windows-10.md) +## [Add apps and features in Windows 10](add-apps-and-features.md) ## [Application Virtualization (App-V) for Windows](app-v/appv-for-windows.md) ### [Getting Started with App-V](app-v/appv-getting-started.md) #### [What's new in App-V for Windows 10, version 1703 and earlier](app-v/appv-about-appv.md) @@ -104,6 +106,5 @@ ## [Service Host process refactoring](svchost-service-refactoring.md) ## [Per-user services in Windows](per-user-services-in-windows.md) ## [Disabling System Services in Windows Server](https://docs.microsoft.com/windows-server/security/windows-services/security-guidelines-for-disabling-system-services-in-windows-server) -## [Understand apps in Windows 10](apps-in-windows-10.md) ## [Deploy app upgrades on Windows 10 Mobile](deploy-app-upgrades-windows-10-mobile.md) ## [Change history for Application management](change-history-for-application-management.md) diff --git a/windows/application-management/add-apps-and-features.md b/windows/application-management/add-apps-and-features.md new file mode 100644 index 0000000000..d7320eab03 --- /dev/null +++ b/windows/application-management/add-apps-and-features.md @@ -0,0 +1,27 @@ +--- +title: Windows 10 - How to add apps from Apps & features +description: Learn how to add apps, like XPS Viewer, to your Windows 10 device with the Apps & features page in Settings +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: article +ms.author: elizapo +author: lizap +ms.localizationpriority: low +ms.date: 04/26/2018 +--- +# How to add apps and features to Windows 10 +> Applies to: Windows 10 + +Windows 10 includes a range of [applications](apps-in-windows-10.md), from [system apps](apps-in-windows-10.md#system-apps) that support the operating system (like Settings) to ["provisioned" apps](apps-in-windows-10.md#provisioned-windows-apps) (like Feedback Hub) that are installed the first time you run Windows. We also provide additional apps and features, called Features on Demand (like language packs or handwriting recognition), that you can install at any time. If you're working in a managed environment (like at work, where you have an administrator who manages your systems and resources), your admin can use [Windows Update to install Features on Demand](https://docs.microsoft.com/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities). If you're working on your own device, you can add apps and features from the Settings app. + +Here's how you do that: + +1. In the Search bar, search for "apps." +2. Select **Apps and features** in the results. +3. Select **Manage optional features**, and then select **Add a feature**. +4. Select the feature you want to add, like **XPS Viewer**, and then select **Install.** + +And that's it. You can see the apps you have installed on the **Apps & features** page and the features on **Manage optional features**. + +You can manage and uninstall apps and features from the same Settings page. Just select the app or feature, and then select **Uninstall**. \ No newline at end of file diff --git a/windows/application-management/app-v/appv-about-appv.md b/windows/application-management/app-v/appv-about-appv.md index c18bb989b4..c2421f0918 100644 --- a/windows/application-management/app-v/appv-about-appv.md +++ b/windows/application-management/app-v/appv-about-appv.md @@ -6,66 +6,64 @@ ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 04/19/2017 +ms.date: 04/18/2018 --- - # What's new in App-V for Windows 10, version 1703 and earlier -**Applies to** -- Windows 10, version 1703 and earlier +>Applies to: Windows 10, version 1703 and earlier -Microsoft Application Virtualization (App-V) helps organizations to deliver Win32 applications to employees as virtual apps. Virtual apps are installed on centrally managed servers and delivered to employees as a service – in real time and on an as-needed basis. Employees start virtual apps from familiar access points and interact with them as if they were installed locally. +Microsoft Application Virtualization (App-V) for Windows 10 delivers Win32 applications to users as virtual applications. Virtual applications are installed on centrally managed servers and delivered to users as a service in real time and on an as-needed basis. Users launch virtual applications from familiar access points and interact with them as if they were installed locally. ## What's new in App-V Windows 10, version 1703 -The following are new features in App-V for Windows 10, version 1703. -### Auto sequence and update your App-V packages singly or as a batch -Previous versions of the App-V Sequencer have required you to manually sequence and update your app packages. This was time-consuming and required extensive interaction, causing many companies to deploy brand-new packages rather than update an existing one. Windows 10, version 1703 introduces the App-V Auto-Sequencer, which automatically sequences your app packages, improving your overall experience by streamlining the provisioning of the prerequisite environment, automating app installation, and expediting the package updating setup. +### Auto-sequence and update your App-V packages singly or as a batch -Using the automatic sequencer to package your apps provides: -- Automatic virtual machine (VM) provisioning of the sequencing environment. For info about this, see [Automatically provision your sequencing environment using Microsoft Application Virtualization Sequencer (App-V Sequencer)](appv-auto-provision-a-vm.md). +Previous versions of the App-V Sequencer required manual sequencing and updating of app packages. This was time-consuming and required extensive interaction, causing many companies to deploy brand-new packages rather than update an existing one. Windows 10, version 1703 introduces the App-V Auto-Sequencer, which automatically sequences your app packages, improving your overall experience by streamlining prerequisite environment provisioning, automating app installation, and expediting package updating setup. -- Batch-sequencing of packages. This means that multiple apps can be sequenced at the same time, in a single group. For info about this, see [Automatically sequence multiple apps at the same time using Microsoft Application Virtualization Sequencer (App-V Sequencer)](appv-auto-batch-sequencing.md). +Using the automatic sequencer to package your apps gives you the following benefits: -- Batch-updating of packages. This means that multiple apps can be updated at the same time, in a single group. For info about this, see [Automatically update multiple apps at the same time using Microsoft Application Virtualization Sequencer (App-V Sequencer)](appv-auto-batch-updating.md). +* **Automatic virtual machine (VM) sequencing environment provisioning**. To learn more, see [Automatically provision your sequencing environment using Microsoft Application Virtualization Sequencer (App-V Sequencer)](appv-auto-provision-a-vm.md). +* **Package batch-sequencing**. This means that multiple apps can be sequenced at the same time, in a single group. To learn more, see [Automatically sequence multiple apps at the same time using Microsoft Application Virtualization Sequencer (App-V Sequencer)](appv-auto-batch-sequencing.md). +* **Package batch-updating**. This means that multiple apps can be updated at the same time, in a single group. To learn more, see [Automatically update multiple apps at the same time using Microsoft Application Virtualization Sequencer (App-V Sequencer)](appv-auto-batch-updating.md). ### Updates to the App-V project template -Starting with Windows 10, version 1703, you can save an App-V project template (.appvt) file as part of a sequenced App-V package, so it's automatically loaded every time the package opens for editing or updates. Your template can include general option settings, file exclusion list settings, and target operating system settings. For more info about this, see [Create and apply an App-V project template to a sequenced App-V package](appv-create-and-use-a-project-template.md) -### Automatically cleanup unpublished App-V packages from the App-V client -Previous versions of App-V have required you to manually remove your unpublished packages from your client devices, to free up additional storage space. Windows 10, version 1703 introduces the ability to use PowerShell or Group Policy settings to automatically cleanup your unpublished packages after a device restart. For more info about this, see [Automatically cleanup unpublished packages on the App-V client](appv-auto-clean-unpublished-packages.md) +Starting with Windows 10, version 1703, you can now save an App-V project template (.appvt) file as part of a sequenced App-V package. This file will automatically load every time you open the package for edits or updates. Your template can include general option settings, file exclusion list settings, and target operating system settings. To learn more, see [Create and apply an App-V project template to a sequenced App-V package](../app-v/appv-create-and-use-a-project-template.md). + +### Automatically clean up unpublished App-V packages from the App-V client + +Previous versions of App-V have required you to manually remove your unpublished packages from your client devices, to free up additional storage space. Windows 10, version 1703 introduces the ability to use PowerShell or Group Policy settings to automatically clean up your unpublished packages after a device restart. To learn more, see [Automatically clean up unpublished packages on the App-V client](../app-v/appv-auto-clean-unpublished-packages.md). ## What's new in App-V in Windows 10, version 1607 -The following are new features in App-V for Windows 10, version 1607. -## App-V is now a feature in Windows 10 -With Windows 10, version 1607 and later releases, Application Virtualization (App-V) is included with [Windows 10 for Enterprise and Windows 10 for Education](https://www.microsoft.com/en-us/WindowsForBusiness/windows-product-home) and is no longer part of the Microsoft Desktop Optimization Pack. +### App-V is now a feature in Windows 10 -For information about earlier versions of App-V, see [MDOP Information Experience](https://technet.microsoft.com/itpro/mdop/index). +With Windows 10, version 1607 and later releases, App-V is now included with [Windows 10 for Enterprise and Windows 10 for Education](https://www.microsoft.com/en-us/WindowsForBusiness/windows-product-home) and is no longer part of the Microsoft Desktop Optimization Pack. -The changes in App-V for Windows 10, version 1607 impact already existing implementations of App-V in the following ways: +To learn more about earlier versions of App-V, see [MDOP Information Experience](https://docs.microsoft.com/en-us/microsoft-desktop-optimization-pack/index). -- The App-V client is installed on user devices automatically with Windows 10, version 1607, and no longer has to be deployed separately. Performing an in-place upgrade to Windows 10, version 1607, on user devices automatically installs the App-V client. +The changes in App-V for Windows 10, version 1607 impact existing implementations of App-V in the following ways: -- The App-V application sequencer is available from the [Windows 10 Assessment and Deployment Kit (ADK)](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit). In previous releases of App-V, the application sequencer was included in the Microsoft Desktop Optimization Pack. Although you’ll need to use the new application sequencer to create new virtualized applications, existing virtualized applications will continue to work. +* The App-V client is installed on user devices automatically with Windows 10, version 1607, and no longer has to be deployed separately. Performing an in-place upgrade to Windows 10, version 1607, on user devices automatically installs the App-V client. +* In previous releases of App-V, the application sequencer was included in the Microsoft Desktop Optimization Pack. Although you’ll need to use the new application sequencer to create new virtualized applications, existing virtualized applications will continue to work. The App-V application sequencer is available from the [Windows 10 Assessment and Deployment Kit (ADK)](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit). - >[!NOTE] - >If you're already using App-V 5.x, you don't need to re-deploy the App-V server components as they haven't changed since App-V 5.0 was released. + >[!NOTE] + >If you're already using App-V 5.x, you don't need to redeploy the App-V server components, as they haven't changed since App-V 5.0's release. -For more information about how to configure an existing App-V installation after upgrading user devices to Windows 10, see [Upgrading to App-V for Windows 10 from an existing installation](appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md) and [Migrating to App-V for Windows 10 from a previous version](appv-migrating-to-appv-from-a-previous-version.md). +For more information about how to configure an existing App-V installation after upgrading user devices to Windows 10, see [Upgrading to App-V for Windows 10 from an existing installation](../app-v/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md) and [Migrating to App-V for Windows 10 from a previous version](../app-v/appv-migrating-to-appv-from-a-previous-version.md). >[!IMPORTANT] ->You can upgrade your existing App-V installation to Windows 10, version 1607 from App-V versions 5.0 SP2 and higher only. If you are using a previous version of App-V, you’ll need to upgrade from that version to App-V 5.0 SP2 before you upgrade to Windows 10, version 1607. - -## Support for System Center -App-V supports System Center 2016 and System Center 2012 R2 Configuration Manager SP1. See [Planning for App-V Integration with Configuration Manager](https://technet.microsoft.com/library/jj822982.aspx) for information about integrating your App-V environment with Configuration Manager. +>You can only upgrade your existing App-V installation to Windows 10, version 1607 if it's version 5.0 SP2 or higher. If you're using an older version of App-V, you’ll need to upgrade from that version to App-V 5.0 SP2 before you can upgrade to Windows 10, version 1607. -## Related topics -- [Release Notes for App-V for Windows 10, version 1607](appv-release-notes-for-appv-for-windows.md) +## Support for System Center -- [Release Notes for App-V for Windows 10, version 1703](appv-release-notes-for-appv-for-windows-1703.md) +App-V supports System Center 2016 and System Center 2012 R2 Configuration Manager SP1. See [Planning for App-V Integration with Configuration Manager](https://technet.microsoft.com/library/jj822982.aspx) to learn more about how to integrate your App-V environment with Configuration Manager. ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization). +## Related topics + +* [Release Notes for App-V for Windows 10, version 1607](../app-v/appv-release-notes-for-appv-for-windows.md) +* [Release Notes for App-V for Windows 10, version 1703](../app-v/appv-release-notes-for-appv-for-windows-1703.md) \ No newline at end of file diff --git a/windows/application-management/app-v/appv-add-or-remove-an-administrator-with-the-management-console.md b/windows/application-management/app-v/appv-add-or-remove-an-administrator-with-the-management-console.md index 0bd1f363b2..7a031ea941 100644 --- a/windows/application-management/app-v/appv-add-or-remove-an-administrator-with-the-management-console.md +++ b/windows/application-management/app-v/appv-add-or-remove-an-administrator-with-the-management-console.md @@ -33,7 +33,7 @@ Use the following procedures to add or remove an administrator on the Microsoft ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/application-management/app-v/appv-add-or-upgrade-packages-with-the-management-console.md b/windows/application-management/app-v/appv-add-or-upgrade-packages-with-the-management-console.md index 89c7a533fb..19131f8521 100644 --- a/windows/application-management/app-v/appv-add-or-upgrade-packages-with-the-management-console.md +++ b/windows/application-management/app-v/appv-add-or-upgrade-packages-with-the-management-console.md @@ -27,7 +27,7 @@ You can the following procedure to add or upgrade a package to the App-V Managem 2. To specify the package you want to add, click **Add or Upgrade Packages**. -3. Type the full path to the package that you want to add. Use the UNC or HTTP path format, for example **\\\\servername\\sharename\\foldername\\packagename.appv** or **http://server.1234/file.appv**, and then click **Add**. +3. Type the full path to the package that you want to add. Use the UNC or HTTP path format, for example **\\\\servername\\sharename\\foldername\\packagename.appv** or **https://server.1234/file.appv**, and then click **Add**. **Important** You must select a package with the **.appv** file name extension. @@ -42,7 +42,7 @@ You can the following procedure to add or upgrade a package to the App-V Managem ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/application-management/app-v/appv-administering-appv-with-powershell.md b/windows/application-management/app-v/appv-administering-appv-with-powershell.md index f234f60e45..a27ad2dd60 100644 --- a/windows/application-management/app-v/appv-administering-appv-with-powershell.md +++ b/windows/application-management/app-v/appv-administering-appv-with-powershell.md @@ -129,7 +129,7 @@ Use the following table for information about Windows PowerShell error handling ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/application-management/app-v/appv-administering-virtual-applications-with-the-management-console.md b/windows/application-management/app-v/appv-administering-virtual-applications-with-the-management-console.md index f7ba1d2116..ff218061cc 100644 --- a/windows/application-management/app-v/appv-administering-virtual-applications-with-the-management-console.md +++ b/windows/application-management/app-v/appv-administering-virtual-applications-with-the-management-console.md @@ -97,7 +97,7 @@ JavaScript must be enabled on the browser that opens the Web Management Console. ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Other resources for this App-V deployment diff --git a/windows/application-management/app-v/appv-allow-administrators-to-enable-connection-groups.md b/windows/application-management/app-v/appv-allow-administrators-to-enable-connection-groups.md index 25c6cf10a9..f97ca1f36d 100644 --- a/windows/application-management/app-v/appv-allow-administrators-to-enable-connection-groups.md +++ b/windows/application-management/app-v/appv-allow-administrators-to-enable-connection-groups.md @@ -54,7 +54,7 @@ Use one of the following methods to allow only administrators to enable or disab ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md index 2c094afa66..4674fddc02 100644 --- a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md +++ b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md @@ -1285,4 +1285,4 @@ There are three specific categories of events recorded described below. ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). diff --git a/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md b/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md index d88487a0f0..ce1b3601b9 100644 --- a/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md +++ b/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md @@ -35,7 +35,7 @@ The dynamic deployment configuration file is applied when a package is added or ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/application-management/app-v/appv-apply-the-user-configuration-file-with-powershell.md b/windows/application-management/app-v/appv-apply-the-user-configuration-file-with-powershell.md index 206bc30bea..a59c999681 100644 --- a/windows/application-management/app-v/appv-apply-the-user-configuration-file-with-powershell.md +++ b/windows/application-management/app-v/appv-apply-the-user-configuration-file-with-powershell.md @@ -34,7 +34,7 @@ Use the following procedure to specify a user-specific configuration file. The f ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/application-management/app-v/appv-auto-batch-sequencing.md b/windows/application-management/app-v/appv-auto-batch-sequencing.md index c8521bc7d2..508ae9f351 100644 --- a/windows/application-management/app-v/appv-auto-batch-sequencing.md +++ b/windows/application-management/app-v/appv-auto-batch-sequencing.md @@ -6,49 +6,40 @@ ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 06/26/2017 +ms.date: 04/18/2018 --- - # Automatically sequence multiple apps at the same time using Microsoft Application Virtualization Sequencer (App-V Sequencer) -**Applies to** -- Windows 10, version 1703 +>Applies to: Windows 10, version 1703 Sequencing multiple apps at the same time requires you to install and start Microsoft Application Virtualization Sequencer (App-V Sequencer), and to install the necessary apps to collect any changes made to the operating system during the installation and building of the App-V package. In Windows 10, version 1703, running the App-V Sequencer automatically captures and stores your customizations as an App-V project template (.appvt) file. If you want to make changes to this package later, your customizations will be automatically loaded from this template file. This is applicable to all of the sequencing scenarios: -- Using the New-BatchAppVSequencerPackages cmdlet - +- Using the **New-BatchAppVSequencerPackages** cmdlet - Using the App-V Sequencer interface - -- Using the new-AppVSequencerPackage cmdlet +- Using the **New-AppVSequencerPackage** cmdlet >[!NOTE] ->If you're trying to update multiple apps at the same time, see the [Automatically update multiple apps at the same time using Microsoft Application Virtualization Sequencer (App-V Sequencer)](appv-auto-batch-updating.md) topic. +>If you're trying to update multiple apps at the same time, see [Automatically update multiple apps at the same time using Microsoft Application Virtualization Sequencer (App-V Sequencer)](appv-auto-batch-updating.md). + +### Sequence multiple apps with a PowerShell cmdlet -### Sequence multiple apps by using a PowerShell cmdlet Sequencing multiple apps at the same time requires that you create a **ConfigFile** with info related to each round of sequencing. This file is then used by the cmdlet to start the VM at a "clean" checkpoint, to copy the installer from the Host device to the VM, and then to start the App-V Sequencer to monitor your specified app installations. -**To create your ConfigFile for use by the PowerShell cmdlet** +#### Create your ConfigFile for use by the PowerShell cmdlet 1. Determine the apps that need to be included in your App-V sequencing package, and then open a text editor, such as Notepad. 2. Add the following required XML info for each app: - - **<AppName>.** The name of the app you're adding to the package. - - - **<InstallerFolder>.** The file path to the folder with the app installer. - - - **<Installer>.** The file name for the app executable. This will typically be an .exe or .msi file. - - - **<InstallerOptions>.** The command-line options required for the app installation. - - - **<TimeoutInMinutes>.** The maximum amount of time, in minutes, that the cmdlet should wait for sequencing to complete. You can enter a different value for each app, based on the size and complexity of the app itself. - - - **<Cmdlet>.** Determines whether the sequencer uses the cmdlet or the App-V Sequencer interface. **True** tells the sequencer to use cmdlet-based sequencing, while **False** tells the sequencer to use the App-V Sequencer interface. You can use both the cmdlet and the interface together in the same ConfigFile, for different apps. - - - **<Enabled>.** Indicates whether the app should be sequenced. **True** includes the app, while **False** ignores it. You can include as many apps as you want in the batch file, but optionally enable only a few of them. + - ```
-Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
-Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
-Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
-Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). Determine Application Scope Depending on the applications to be virtualized, the App-V infrastructure can be set up in different ways. The first task is to define what applications you want to virtualize. Determine Location Scope Location scope refers to the physical locations (for example, enterprise-wide or a specific geographic location) where you plan to run the virtualized applications. It can also refer to the user population (for example, a single department) who will run the virtual applications. You should obtain a network map that includes the connection paths as well as available bandwidth to each location and the number of users using virtualized applications and the WAN link speed. The number of publishing servers simultaneously requesting package metadata refreshes. A single management server can respond to up to 320 publishing servers requesting publishing metadata simultaneously. Round trip response time for 320 pub servers is ~40 seconds. For <50 publishing servers requesting metadata simultaneously, the round trip response time is <5 seconds. From 50 to 320 publishing servers, the response time increases linearly (approximately 2x). The number of connection groups configured on the management server. For up to 100 connection groups, there is no significant change in the round trip response time on the publishing server. For 100 - 400 connection groups, there is a minor linear increase in the round trip response time. The number of access groups configured on the management server. For up to 40 access groups, there is a linear (approximately 3x) increase in the round trip response time on the publishing server. Publishing servers simultaneously contacting management server for publishing metadata. Number of publishing servers 0 0 0 0 0 0 1 1 1 1 1 1 50 100 200 300 315 320 LAN LAN LAN LAN LAN LAN 5 10 19 32 30 37 17 17 17 15 17 15 Publishing metadata contains connection groups Number of connection groups 10 50 100 150 300 400 1 1 1 1 1 1 100 100 100 100 100 100 LAN LAN LAN LAN LAN LAN 10 11 11 16 22 25 17 19 22 19 20 20 Publishing metadata contains access groups Number of access groups 0 0 0 0 1 10 20 40 100 100 100 100 LAN LAN LAN LAN 10 43 153 535 17 26 24 24 Network connection between the publishing server and management server 1.5 Mbps Slow link Network 0 0 1 1 50 100 1.5Mbps Cable DSL 1.5Mbps Cable DSL 4 5 1 2 Network connection between the publishing server and management server LAN / WIFI Network 0 0 1 1 100 200 Wifi Wifi 11 20 15 17 Multiple App-V clients send reporting information to the reporting server simultaneously. Round trip response time from the reporting server is 2.6 seconds for 500 clients. Round trip response time from the reporting server is 5.65 seconds for 1000 clients. Round trip response time increases linearly depending on number of clients. Requests per second processed by the reporting server. A single reporting server and a single database, can process a maximum of 139 requests per second. The average is 121 requests/second. Using two reporting servers reporting to the same Microsoft SQL Server database, the average requests/second is similar to a single reporting server = ~127, with a max of 278 requests/second. A single reporting server can process 500 concurrent/active connections. A single reporting server can process a maximum 1500 concurrent connections. Reporting Database. Lock contention on the computer running Microsoft SQL Server is the limiting factor for requests/second. Throughput and response time are independent of database size. Multiple App-V clients connect to a single publishing server simultaneously. A publishing server running dual core processors can respond to at most 5000 clients requesting a refresh simultaneously. For 5000-10000 clients, the publishing server requires a minimum quad core. For 10000-20000 clients, the publishing server should have dual quad cores for more efficient response times. A publishing server with a quad core can refresh up to 10000 packages within 3 seconds. (Supporting 10000 simultaneous clients) Number of packages in each refresh. Increasing number of packages will increase response time by ~40% (up to 1000 packages). Network between the App-V client and the publishing server. Across a slow network (1.5 Mbps bandwidth), there is a 97% increase in response time compared to LAN (up to 1000 users). App-V client sends publishing refresh request & receives response, each request containing 120 packages Number of clients 100 1000 5000 10000 120 120 120 120 Dual Core Dual Core Quad Core Quad Core LAN LAN LAN LAN 1 2 2 3 100 99 89 77 Multiple packages in each refresh Number of packages 1000 1000 500 1000 Quad Core Quad Core LAN LAN 2 3 92 91 Network between client and publishing server 1.5 Mbps Slow link network 100 500 1000 120 120 120 Quad Core Quad Core Quad Core 1.5 Mbps Intra-Continental Network 3 10 (with 0.2% failure rate) 17 (with 1% failure rate) Multiple App-V clients stream applications from a single streaming server simultaneously. If the number of clients simultaneously streaming from the same server increases, there is a linear relationship with the package download/streaming time. Size of the package being streamed. The package size has a significant impact on the streaming/download time only for larger packages with a size ~ 1GB. For package sizes ranging from 3 MB to 100 MB, the streaming time ranges from 20 seconds to 100 seconds, with 100 simultaneous clients. Network between the App-V client and the streaming server. Across a slow network (1.5 Mbps bandwidth), there is a 70-80% increase in response time compared to LAN (up to 100 users). Multiple App-V clients streaming virtual application packages from a streaming server. Number of clients. 100 200 1000 100 200 1000 3.5 MB 3.5 MB 3.5 MB 5 MB 5 MB 5 MB LAN LAN LAN LAN LAN LAN 29 39 391 35 68 461 Size of each package being streamed. Size of each package. 100 200 100 200 21 MB 21 MB 109 109 LAN LAN LAN LAN 33 83 100 160 Network connection between client and App-V streaming server. 1.5 Mbps Slow link network. 100 100 3.5 MB 5 MB 1.5 Mbps Intra-Continental Network 102 121 Schema name Name of the schema. If you want to use the “optional packages” and “use any version” features that are described in this table, you must specify the following schema in the XML file:
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv).
\ No newline at end of file
+Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
\ No newline at end of file
diff --git a/windows/application-management/app-v/appv-auto-batch-updating.md b/windows/application-management/app-v/appv-auto-batch-updating.md
index 09911137f3..1d96b18fb8 100644
--- a/windows/application-management/app-v/appv-auto-batch-updating.md
+++ b/windows/application-management/app-v/appv-auto-batch-updating.md
@@ -6,45 +6,37 @@ ms.pagetype: mdop, appcompat, virtualization
ms.mktglfcycl: deploy
ms.sitesec: library
ms.prod: w10
-ms.date: 06/26/2017
+ms.date: 04/18/2018
---
-
# Automatically update multiple apps at the same time using Microsoft Application Virtualization Sequencer (App-V Sequencer)
-**Applies to**
-- Windows 10, version 1703
+>Applies to: Windows 10, version 1703
-Updating multiple apps at the same time follows the same process as [automatically sequencing multiple apps at the same time](appv-auto-batch-sequencing.md). However for updating, you'll pass your previously created app package files to the App-V Sequencer cmdlet for updating.
+Updating multiple apps at the same time follows a similar process to the one used for [automatically sequencing multiple apps at the same time](appv-auto-batch-sequencing.md). However, when updating, you'll also have to pass your previously created app package files to the App-V Sequencer cmdlet.
Starting with Windows 10, version 1703, running the New-BatchAppVSequencerPackages cmdlet or the App-V Sequencer interface captures and stores all of your customizations as an App-V project template. If you want to make changes to this package later, your customizations are automatically loaded from this template file.
>[!NOTE]
->If you're trying to sequence multiple apps at the same time, see the [Automatically sequence multiple apps at the same time using Microsoft Application Virtualization Sequencer (App-V Sequencer)](appv-auto-batch-sequencing.md) topic.
+>If you're trying to sequence multiple apps at the same time, see [Automatically sequence multiple apps at the same time using Microsoft Application Virtualization Sequencer (App-V Sequencer)](appv-auto-batch-sequencing.md).
+
+## Update multiple apps with a PowerShell cmdlet
-### Update multiple apps by using a PowerShell cmdlet
Updating multiple apps at the same time requires that you create a **ConfigFile** with info related to each round of updating. This file is then used by the cmdlet to start the VM at a "clean" checkpoint, to copy the installer from the Host device to the VM, and then to start the App-V Sequencer to monitor your specified app installations.
-**To create your ConfigFile for use by the PowerShell cmdlet**
+### Create your ConfigFile for use by the PowerShell cmdlet
1. Determine the apps that need to be included in your app package, and then open a text editor, such as Notepad.
2. Add the following XML info for each app:
- - **<AppName>.** The name of the app you're adding to the package.
-
- - **<InstallerFolder>.** The file path to the folder with the app installer.
-
- - **<Installer>.** The file name for the app executable. This will typically be an .exe or .msi file.
-
- - **<InstallerOptions>.** The command-line options required for the app installation.
-
- - **<Package>.** The file path to the location of your App-V packages. These packages were created when you sequenced your apps.
-
- - **<TimeoutInMinutes>.** The maximum amount of time, in minutes, that the cmdlet should wait for updating to complete. You can enter a different value for each app, based on the size and complexity of the app itself.
-
- - **<Cmdlet>.** Determines whether the sequencer uses the cmdlet or the App-V Sequencer interface. **True** tells the sequencer to use cmdlet-based updating, while **False** tells the sequencer to use the App-V Sequencer interface. You can use both the cmdlet and the interface together in the same ConfigFile, for different apps.
-
- - **<Enabled>.** Indicates whether the app should be sequenced. **True** includes the app, while **False** ignores it. You can include as many apps as you want in the batch file, but optionally enable only a few of them.
+ - ```
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv).
\ No newline at end of file
+Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
\ No newline at end of file
diff --git a/windows/application-management/app-v/appv-auto-clean-unpublished-packages.md b/windows/application-management/app-v/appv-auto-clean-unpublished-packages.md
index 9632883b04..23a9fe37c6 100644
--- a/windows/application-management/app-v/appv-auto-clean-unpublished-packages.md
+++ b/windows/application-management/app-v/appv-auto-clean-unpublished-packages.md
@@ -74,4 +74,4 @@ Using Group Policy, you can turn on the **Enable automatic cleanup of unused app
**Have a suggestion for App-V?**
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv).
\ No newline at end of file
+Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv).
\ No newline at end of file
diff --git a/windows/application-management/app-v/appv-auto-provision-a-vm.md b/windows/application-management/app-v/appv-auto-provision-a-vm.md
index 29943d7b0b..73c3fb6cdf 100644
--- a/windows/application-management/app-v/appv-auto-provision-a-vm.md
+++ b/windows/application-management/app-v/appv-auto-provision-a-vm.md
@@ -6,88 +6,89 @@ ms.pagetype: mdop, appcompat, virtualization
ms.mktglfcycl: deploy
ms.sitesec: library
ms.prod: w10
-ms.date: 04/19/2017
+ms.date: 04/18/2018
---
-
-
# Automatically provision your sequencing environment using Microsoft Application Virtualization Sequencer (App-V Sequencer)
-**Applies to**
-- Windows 10, version 1703
+>Applies to: Windows 10, version 1703
Previous versions of the App-V Sequencer have required you to manually create your sequencing environment. Windows 10, version 1703 introduces two new PowerShell cmdlets, New-AppVSequencerVM and Connect-AppvSequencerVM, which automatically create your sequencing environment for you, including provisioning your virtual machine.
## Automatic VM provisioning of the sequencing environment
-You have 2 options for provisioning an VM for auto-sequencing:
-- Using a Virtual Hard Disk (VHD)
- -OR-
+You have two options for provisioning an VM for auto-sequencing:
-- Updating an existing VM
+1. Using a Virtual Hard Disk (VHD)
+2. Updating an existing VM
- >[!NOTE]
- >We have reduced the number of environmental checks performed by the App-V Sequencer, narrowing down the list of apps that need to be disabled or turned off for a clean sequencing experience. We've also suppressed antivirus and other similar app warnings.
+You can only choose one option.
+
+>[!NOTE]
+>We have reduced the number of environmental checks performed by the App-V Sequencer, narrowing down the list of apps that need to be disabled or turned off for a clean sequencing experience. We've also suppressed antivirus and other similar app warnings.
+
+### Provision a new VM with a VHD file
-### Provision a new VM by using a VHD file
Provisioning your new VM includes creating a VHD file, setting up a user account, turning on remote PowerShell scripting, and installing the App-V Sequencer.
#### Create a VHD file
+
For this process to work, you must have a base operating system available as a VHD image file, we recommend using the [Convert-WindowsImage.ps1](https://gallery.technet.microsoft.com/scriptcenter/Convert-WindowsImageps1-0fe23a8f) command-line tool.
-**To create a VHD file by using the Convert-WindowsImage command-line tool**
-1. Open PowerShell as an admin and run the Convert-WindowsImage tool, using the following commands:
+#### Create a VHD file with the Convert-WindowsImage command-line tool
+
+1. Open PowerShell as an admin and run the **Convert-WindowsImage** tool, using the following commands:
```ps1
Convert-WindowsImage -SourcePath "
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv).
\ No newline at end of file
+Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
\ No newline at end of file
diff --git a/windows/application-management/app-v/appv-capacity-planning.md b/windows/application-management/app-v/appv-capacity-planning.md
index f37904bd63..4eb8944558 100644
--- a/windows/application-management/app-v/appv-capacity-planning.md
+++ b/windows/application-management/app-v/appv-capacity-planning.md
@@ -6,948 +6,190 @@ ms.pagetype: mdop, appcompat, virtualization
ms.mktglfcycl: deploy
ms.sitesec: library
ms.prod: w10
-ms.date: 04/19/2017
+ms.date: 04/18/2018
---
-
-
# App-V Capacity Planning
-**Applies to**
-- Windows Server 2016
+>Applies to: Windows Server 2016
The following recommendations can be used as a baseline to help determine capacity planning information that is appropriate to your organization’s App-V infrastructure.
->**Important**
-Use the information in this section only as a general guide for planning your App-V deployment. Your system capacity requirements will depend on the specific details of your hardware and application environment. Additionally, the performance numbers displayed in this document are examples and your results may vary.
+>[!IMPORTANT]
+>Use the information in this section only as a general guide for planning your App-V deployment. Your system capacity requirements will depend on the specific details of your hardware and application environment. Additionally, the performance numbers displayed in this document are examples and your results may vary.
-
+## Determine the project scope
-## Determine the Project Scope
+Before you design the App-V infrastructure, determining which applications will be available virtually, and also identify the target users and their locations. This information will determine what type of App-V infrastructure your project should implement. Your should base your decisions about your project's scope on your organization's specific needs.
+|Task|More information|
+|----|----------------|
+|Determine application scope|The App-V infrastructure can be set up in different ways depending on which applications you want to virtualize. This means your first task is to define which applications you want to virtualize.|
+|Determine location scope|"Location scope" refers to the physical locations where you plan to run the virtualized applications (for example, enterprise-wide or a specific geographic location). It can also refer to the user population that will run the virtual applications (for example, a single department). You should obtain a network map that includes the connection paths, the available bandwidth for each location, the number of users using virtualized applications, and the WAN link speed.|
-Before you design the App-V infrastructure, determine the project’s scope. The scope consists of determining which applications will be available virtually and to also identify the target users, and their locations. This information will help determine what type of App-V infrastructure should be implemented. Decisions about the scope of the project must be based on the specific needs of your organization.
+## Determine which App-V infrastructure is required
-
-
+You can also manage your App-V environment using an electronic software distribution (ESD) solution such as Microsoft Systems Center Configuration Manager. For more information see [How to deploy App-V packages using electronic software distribution](appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md).
-## Determine Which App-V Infrastructure is Required
+* **Standalone model**—The standalone model allows virtual applications to be Windows Installer-enabled for distribution without streaming. App-V in Standalone mode only needs the sequencer and the client; no additional components are required. Applications are prepared for virtualization using a process called sequencing. For more information, see [Planning for the App-V Sequencer and Client deployment](appv-planning-for-sequencer-and-client-deployment.md). The standalone model is recommended for the following scenarios:
-You can also manage your App-V environment using an Electronic Software Distribution (ESD) solution such as Microsoft Systems Center Configuration Manager. For more information see [How to deploy App-V Packages Using Electronic Software Distribution](appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md).
+ * When there are disconnected remote users who can't connect to the App-V infrastructure.
+ * When you're running a software management system, such as System Center 2012 Configuration Manager.
+ * When network bandwidth limitations inhibit electronic software distribution.
+* **Full infrastructure model**—The full infrastructure model provides for software distribution, management, and reporting capabilities; it also includes the streaming of applications across the network. The App-V full infrastructure model consists of one or more App-V management servers that can be used to publish applications to all clients. Publishing places the virtual application icons and shortcuts on the target computer. It can also stream applications to local users. For more information about how to install the management server, see [Planning for App-V Server deployment](appv-planning-for-appv-server-deployment.md). The full infrastructure model is recommended for the following scenarios:
-- **Standalone Model** - The standalone model allows virtual applications to be Windows Installer-enabled for distribution without streaming. App-V in Standalone Mode consists of the sequencer and the client; no additional components are required. Applications are prepared for virtualization using a process called sequencing. For more information see, [Planning for the App-V Sequencer and Client Deployment](appv-planning-for-sequencer-and-client-deployment.md). The stand-alone model is recommended for the following scenarios:
+ * When you want to use the Management Server to publish the application to target computers.
+ * For rapid provisioning of applications to target computers.
+ * When you want to use App-V reporting.
- - With disconnected remote users who cannot connect to the App-V infrastructure.
+>[!IMPORTANT]
+>The App-V full infrastructure model requires Microsoft SQL Server to store configuration data. For more information, see [App-V supported configurations](appv-supported-configurations.md).
- - When you are running a software management system, such as System Center 2012 Configuration Manager.
+## End-to-end server sizing guidance
- - When network bandwidth limitations inhibit electronic software distribution.
+The following section describes end-to-end App-V sizing and planning. For more specific information, refer to the subsequent sections.
-- **Full Infrastructure Model** - The full infrastructure model provides for software distribution, management, and reporting capabilities; it also includes the streaming of applications across the network. The App-V Full Infrastructure Model consists of one or more App-V management servers. The Management Server can be used to publish applications to all clients. The publishing process places the virtual application icons and shortcuts on the target computer. It can also stream applications to local users. For more information about installing the management server see, [Planning for App-V Server Deployment](appv-planning-for-appv-server-deployment.md). The full infrastructure model is recommended for the following scenarios:
+>[!NOTE]
+>Round trip response time on the client is the time taken by the computer running the App-V client to receive a successful notification from the publishing server. Round trip response time on the publishing server is the time taken by the computer running the publishing server to receive a successful package metadata update from the management server.
- >**Important**
- The App-V full infrastructure model requires Microsoft SQL Server to store configuration data. For more information see [App-V Supported Configurations](appv-supported-configurations.md).
+* 20,000 clients can target a single publishing server to obtain the package refreshes in an acceptable round trip time (<3 seconds).
+* A single management server can support up to 50 publishing servers for package metadata refreshes in an acceptable round trip time (<5 seconds).
-
+## App-V Management Server capacity planning recommendations
- - When you want to use the Management Server to publish the application to target computers.
+The App-V publishing servers require the management server for package refresh requests and package refresh responses. The management server then sends the information to the management database to retrieve information. For more information about App-V management server supported configurations, see [App-V supported configurations](appv-supported-configurations.md).
- - For rapid provisioning of applications to target computers.
+>[!NOTE]
+>The default refresh time on the App-V publishing server is ten minutes.
- - When you want to use App-V reporting.
+When multiple simultaneous publishing servers contact a single management server for package metadata refreshes, the following three factors will influence the publishing server's round-trip response time:
-## End-to-end Server Sizing Guidance
+1. The number of publishing servers making simultaneous requests.
+2. The number of connection groups configured on the management server.
+3. The number of access groups configured on the management server.
+The following table describes each factor that impacts round-trip time in more detail.
-The following section provides information about end-to-end App-V sizing and planning. For more specific information, refer to the subsequent sections.
+>[!NOTE]
+>Round trip response time is the time taken by the computer running the App-V publishing server to receive a successful package metadata update from the management server.
-**Note**
-Round trip response time on the client is the time taken by the computer running the App-V client to receive a successful notification from the publishing server. Round trip response time on the publishing server is the time taken by the computer running the publishing server to receive a successful package metadata update from the management server.
+|Factors impacting round-trip response time|Description|
+|------------------------------------------|-----------|
+|The number of publishing servers simultaneously requesting package metadata refreshes.|A single management server can respond to up to 320 publishing servers simultaneously requesting publishing metadata. For example, in a case with 30 publishing servers simultaneously requesting publishing metadata, the round-trip response time is about 40 seconds, while for less than 50 servers it's less than 5 seconds. From 50 to 320 publishing servers, response team increases linearly (approximately 2×).|
+|The number of connection groups configured on the management server.|For up to 100 connection groups, there is no significant change in the round-trip response time on the publishing server. For 100–400 connection groups, there is a minor linear increase in the round-trip response time.|
+|The number of access groups configured on the management server.|For up to 40 access groups, there is a linear (approximately 3×) increase in the round-trip response time on the publishing server.|
-
+The following table displays sample values for each of the previous factors. In each variation, 120 packages are refreshed from the App-V management server.
-- 20,000 clients can target a single publishing server to obtain the package refreshes in an acceptable round trip time. (<3 seconds)
+|Scenario|Variation|Number of connection groups|Number of access groups|Number of publishing servers|Network connection type|Round-trip response time (seconds)|Management server CPU utilization|
+|---|---|---|---|---|---|---|---|
+|Publishing servers contact management server for publishing metadata at same time|Number of publishing servers.|0
-
-
-
-Task
-More Information
-
-
-
-
-
-
0
0
0
0
0|1
1
1
1
1
1|50
100
200
300
315
320|LAN|5
10
19
32
30
37|17
17
17
15
17
15|
+|Publishing metadata contains connection groups|Number of connection groups|10
20
100
150
300
400|1
1
1
1
1
1|100
100
100
100
100
100|LAN|10
11
11
16
22
25|17
19
22
19
20
20|
+|Publishing metadata contains access groups|Number of access groups|0
0
0
0|1
10
20
40|100
100
100
100|LAN|10
43
153
535|17
26
24
24|
-- A single management server can support up to 50 publishing servers for package metadata refreshes in an acceptable round trip time. (<5 seconds)
+The CPU utilization of the computer running the management server is around 25% irrespective of the number of publishing servers targeting it. The Microsoft SQL Server database transactions/sec, batch requests/sec and user connections are identical irrespective of the number of publishing servers. For example, transactions/sec is approximately 30, batch requests approximately 200, and user connects approximately six.
-## App-V Management Server Capacity Planning Recommendations
+Using a geographically distributed deployment, where the management server and publishing servers utilize a slow link network between them, the round-trip response time on the publishing servers is within acceptable time limits (<5 seconds), even for 100 simultaneous requests on a single management server.
-
-The App-V publishing servers require the management server for package refresh requests and package refresh responses. The management server then sends the information to the management database to retrieve information. For more information about App-V management server supported configurations see [App-V Supported Configurations](appv-supported-configurations.md).
-
-**Note**
-The default refresh time on the App-V publishing server is ten minutes.
-
-
-
-When multiple simultaneous publishing servers contact a single management server for package metadata refreshes, the following three factors influence the round trip response time on the publishing server:
-
-1. Number of publishing servers making simultaneous requests.
-
-2. Number of connection groups configured on the management server.
-
-3. Number of access groups configured on the management server.
-
-The following table displays more information about each factor that impacts round trip time.
-
-**Note**
-Round trip response time is the time taken by the computer running the App-V publishing server to receive a successful package metadata update from the management server.
-
-
-
-
-
-
-
-
-The following table displays sample values for each of the previous factors. In each variation, 120 packages are refreshed from the App-Vmanagement server.
-
-
-
-
-
-Factors impacting round trip response time
-More Information
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-The CPU utilization of the computer running the management server is around 25% irrespective of the number of publishing servers targeting it. The Microsoft SQL Server database transactions/sec, batch requests/sec and user connections are identical irrespective of the number of publishing servers. For example: Transactions/sec is ~30, batch requests ~200, and user connects ~6.
-
-Using a geographically distributed deployment, where the management server & publishing servers utilize a slow link network between them, the round trip response time on the publishing servers is within acceptable time limits (<5 seconds), even for 100 simultaneous requests on a single management server.
-
-
-
-
-
-Scenario
-Variation
-Number of connection groups
-Number of access groups
-Number of publishing servers
-Network connection type publishing server / management server
-Round trip response time on the publishing server (in seconds)
-CPU utilization on management server
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+|Scenario|Variation|Number of connection groups|Number of access groups|Number of publishing servers|Network connection type|Round-trip response time (seconds)|Management server CPU utilization (in %)|
+|---|---|---|---|---|---|---|---|
+|Network connection between the publishing server and management server|1.5 Mbps Slow link Network|0
-
-
-
-Scenario
-Variation
-Number of connection groups
-Number of access groups
-Number of publishing servers
-Network connection type publishing server / management server
-Round trip response time on the publishing server (in seconds)
-CPU utilization on management server
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
0|1
1|50
100|1.5 Mbps Cable DSL|4
5|1
2|
+|Network connection between the publishing server and management server|LAN/WiFi Network|0
0|1
1|100
200|WiFi|11
20|15
17|
Whether the management server and publishing servers are connected over a slow link network, or a high speed network, the management server can handle approximately 15,000 package refresh requests in 30 minutes.
-## App-V Reporting Server Capacity Planning Recommendations
+## App-V Reporting Server capacity planning recommendations
+App-V clients send reporting data to the reporting server. The reporting server then records the information in the Microsoft SQL Server database and returns a successful notification back to the computer running App-V client. For more information about the App-V Reporting Server's supported configurations see [App-V supported configurations](appv-supported-configurations.md).
-App-V clients send reporting data to the reporting server. The reporting server then records the information in the Microsoft SQL Server database and returns a successful notification back to the computer running App-V client. For more information about App-V Reporting Server supported configurations see [App-V Supported Configurations](appv-supported-configurations.md).
+>[!NOTE]
+>Round-trip response time is the time taken by the computer running the App-V client to send the reporting information to the reporting server and receive a successful notification from the reporting server.
-**Note**
-Round trip response time is the time taken by the computer running the App-V client to send the reporting information to the reporting server and receive a successful notification from the reporting server.
+|Scenario|Summary|
+|---|---|
+|Multiple App-V clients send reporting information to the reporting server simultaneously.|Round-trip response time from the reporting server is 2.6 seconds for 500 clients. Round-trip response time from the reporting server is 5.65 seconds for 1000 clients. Round-trip response time increases linearly depending on number of clients.|
+|Requests per second processed by the reporting server.|A single reporting server and a single database, can process a maximum of 139 requests per second. The average is 121 requests/second. Using two reporting servers reporting to the same Microsoft SQL Server database, the average requests/second, like a single reporting server, is about 127, with a max of 278 requests/second. A single reporting server can process 500 concurrent/active connections. A single reporting server can process a maximum 1,500 concurrent connections.|
+|Reporting database.|Lock contention on the computer running Microsoft SQL Server is the limiting factor for requests/second. Throughput and response time are independent of database size.|
-
-
-
-
-
-
-
-**Calculating random delay**:
+### Calculating random delay
The random delay specifies the maximum delay (in minutes) for data to be sent to the reporting server. When the scheduled task is started, the client generates a random delay between **0** and **ReportingRandomDelay** and will wait the specified duration before sending data.
-Random delay = 4 \* number of clients / average requests per second.
+*Random delay = 4 × number of clients/average requests per second*.
-Example: For 500 clients, with 120 requests per second, the Random delay is, 4 \* 500 / 120 = ~17 minutes.
+Example: Random delay for 500 clients with 120 requests per second is *4 × 500/120 = about 17 minutes*.
-## App-V Publishing Server Capacity Planning Recommendations
+## App-V publishing server capacity planning recommendations
+Computers running the App-V client connect to the App-V publishing server to send a publishing refresh request and receive a response. Round trip response time is measured on the computer running the App-V client, while processor time is measured on the publishing server. For more information about App-V Publishing Server supported configurations, see [App-V supported configurations](appv-supported-configurations.md).
-Computers running the App-V client connect to the App-V publishing server to send a publishing refresh request and to receive a response. Round trip response time is measured on the computer running the App-V client. Processor time is measured on the publishing server. For more information about App-V Publishing Server supported configurations see [App-V Supported Configurations](appv-supported-configurations.md).
+>[!IMPORTANT]
+>The following list displays the main factors to consider when setting up the App-V publishing server:
+ * The number of clients connecting simultaneously to a single publishing server.
+ * The number of packages in each refresh.
+ * The available network bandwidth in your environment between the client and the App-V publishing server.
-**Important**
-The following list displays the main factors to consider when setting up the App-V publishing server:
+|Scenario|Summary|
+|---|---|
+|Multiple App-V clients connect to a single publishing server simultaneously.|A publishing server running dual core processors can respond to at most 5000 clients requesting a refresh simultaneously. For 5,000–10,000 clients, the publishing server requires a minimum quad core. For 10,000–20,000 clients, the publishing server should have dual quad cores for more efficient response times. A publishing server with a quad core can refresh up to 10,000 packages within three seconds. (Supports 10,000 simultaneous clients.)|
+|Number of packages in each refresh.|Increasing number of packages will increase response time by about 40% (up to 1,000 packages).|
+|Network between the App-V client and the publishing server.|Across a slow network (1.5 Mbps bandwidth), there is a 97% increase in response time compared to LAN (up to 1,000 users).|
-- The number of clients connecting simultaneously to a single publishing server.
+>[!NOTE]
+>The publishing server CPU usage is always high during the time interval when it must process simultaneous requests (>90% in most cases). The publishing server can handle about 1,500 client requests in one second.
-- The number of packages in each refresh.
-
-- The available network bandwidth in your environment between the client and the App-V publishing server.
-
-
-
-
-
-
-
-Scenario
-Summary
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-**Note**
-The publishing server CPU usage is always high during the time interval when it has to process simultaneous requests (>90% in most cases). The publishing server can handle ~1500 client requests in 1 second.
-
-
-
-
-
-
-
-Scenario
-Summary
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-## App-V Streaming Capacity Planning Recommendations
+|Scenario|Variation|Number of App-V clients|Number of packages|Processor configuration on publishing server|Network connection type|App-V client round-trip time (in seconds)|Publishing server CPU utilization (in %)|
+|---|---|---|---|---|---|---|---|
+|App-V client sends publishing refresh request and receives response, each request containing 120 packages|Number of clients|100
-
-
-
-Scenario
-Variation
-Number of App-V clients
-Number of packages
-Processor configuration on the publishing server
-Network connection type publishing server / App-V client
-Round trip time on the App-V client (in seconds)
-CPU utilization on publishing server (in %)
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
1,000
5,000
10,000|120
120
120
120|Dual Core
Dual Core
Quad Core
Quad Core|LAN|1
2
2
3|100
99
89
77|
+|Multiple packages in each refresh.|Number of packages|1,000
1,000|500
1,000|Quad Core|LAN|2
3|92
91|
+|Network between client and publishing server.|1.5 Mbps Slow link network|100
500
1,000|120
120
120|Quad Core|1.5 Mbps intra-continental network|3
10 (0.2% failure rate)
7 (1% failure rate)||
+## App-V streaming capacity planning recommendations
Computers running the App-V client stream the virtual application package from the streaming server. Round trip response time is measured on the computer running the App-V client, and is the time taken to stream the entire package.
-**Important**
-The following list identifies the main factors to consider when setting up the App-V streaming server:
+>[!IMPORTANT]
+>The following list identifies the main factors to consider when setting up the App-V streaming server:
+ * The number of clients streaming application packages simultaneously from a single streaming server.
+ * The size of the package being streamed.
+ * The available network bandwidth in your environment between the client and the streaming server.
-- The number of clients streaming application packages simultaneously from a single streaming server.
-
-- The size of the package being streamed.
-
-- The available network bandwidth in your environment between the client and the streaming server.
-
-
-
-
-
-
-
+|Scenario|Summary|
+|---|---|
+|Multiple App-V clients stream applications from a single streaming server simultaneously.|If the number of clients simultaneously streaming from the same server increases, there is a linear relationship with the package download/streaming time.|
+|Size of the package being streamed.|The package size has a significant impact on the streaming/download time only for larger packages with a size of about 1 GB. For package sizes ranging from 3 MB to 100 MB, the streaming time ranges from 20 seconds to 100 seconds, with 100 simultaneous clients.|
+|Network between the App-V client and the streaming server.|Across a slow network (1.5 Mbps bandwidth), there is a 70–80% increase in response time compared to LAN (up to 100 users).|
The following table displays sample values for each of the factors in the previous list:
-
-
-
-
-Scenario
-Summary
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+|Scenario|Variation|Number of App-V clients|Size of each package|Network connection type|Round-trip time on the App-V client (in seconds)|
+|---|---|---|---|---|---|
+|Multiple App-V clients streaming virtual application packages from a streaming server.|Number of clients.|100
-
-
-
-Scenario
-Variation
-Number of App-V clients
-Size of each package
-Network connection type streaming server / App-V client
-Round trip time on the App-V client (in seconds)
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
200
1,000
100
200
1,000|3.5 MB
3.5 MB
3.5 MB
5 MB
5 MB
5 MB|LAN|29
39
391
35
68
461|
+|Size of each package being streamed.|Size of each package.|100
200
100
200|21 MB
21 MB
109 MB
109 MB|LAN|33
83
100
160|
+|Network connection between client and App-V streaming server.|1.5 Mbps Slow link network.|100
100|3.5 MB
5 MB|1.5 Mbps intra-continental network|102
121|
Each App-V streaming server should be able to handle a minimum of 200 clients concurrently streaming virtualized applications.
-**Note**
-The actual time to it will take to stream is determined primarily by the number of clients streaming simultaneously, number of packages, package size, the server’s network activity, and network conditions.
+>[!NOTE]
+>The actual time to it will take to stream is determined primarily by the number of clients streaming simultaneously, number of packages, package size, the server’s network activity, and network conditions.
-
-
-For example, an average user can stream a 100 MB package in less than 2 minutes, when 100 simultaneous clients are streaming from the server. However, a package of size 1 GB could take up to 30 minutes. In most real world environments streaming demand is not uniformly distributed, you will need to understand the approximate peak streaming requirements present in your environment in order to properly size the number of required streaming servers.
+For example, an average user can stream a 100 MB package in less than 2 minutes, when 100 simultaneous clients are streaming from the server. However, a package of size 1 GB could take up to 30 minutes. In most real-world environments, streaming demand is not uniformly distributed, you will need to understand the approximate peak streaming requirements present in your environment to properly size the number of required streaming servers.
The number of clients a streaming server can support can be significantly increased and the peak streaming requirements reduced if you pre-cache your applications. You can also increase the number of clients a streaming server can support by using on-demand streaming delivery and stream optimized packages.
-## Combining App-V Server Roles
+## Combining App-V server roles
+Discounting scaling and fault-tolerance requirements, the minimum number of servers that a location with Active Directory connectivity needs to function is one. This server will host the management server, management server service, and Microsoft SQL Server roles. This means that you can arrange server roles in any combination you like, as they don't conflict with one another.
-Discounting scaling and fault-tolerance requirements, the minimum number of servers needed for a location with connectivity to Active Directory is one. This server will host the management server, management server service, and Microsoft SQL Server roles. Server roles, therefore, can be arranged in any desired combination since they do not conflict with one another.
+Ignoring scaling requirements, the minimum number of servers that a fault-tolerant implementation needs to function is four. The management server and Microsoft SQL Server roles support placement in fault-tolerant configurations. The management server service can be combined with any of the roles, but remains a single point of failure.
-Ignoring scaling requirements, the minimum number of servers necessary to provide a fault-tolerant implementation is four. The management server, and Microsoft SQL Server roles support being placed in fault-tolerant configurations. The management server service can be combined with any of the roles, but remains a single point of failure.
-
-Although there are a number of fault-tolerance strategies and technologies available, not all are applicable to a given service. Additionally, if App-V roles are combined, certain fault-tolerance options may no longer apply due to incompatibilities.
+Although there are many fault-tolerance strategies and technologies you can use, not all are applicable to a given service. Additionally, if App-V roles are combined, the resulting incompatabilities could cause certain fault-tolerance options to stop working.
## Have a suggestion for App-V?
-
-Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv).
+Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
## Related topics
-
-[App-V Supported Configurations](appv-supported-configurations.md)
-
-[Planning for High Availability with App-V](appv-planning-for-high-availability-with-appv.md)
-
-[Planning to Deploy App-V](appv-planning-to-deploy-appv.md)
-
-
-
-
-
-
-
-
-
+* [App-V supported configurations](appv-supported-configurations.md)
+* [Planning for high availability with App-V](appv-planning-for-high-availability-with-appv.md)
+* [Planning to deploy App-V](appv-planning-to-deploy-appv.md)
\ No newline at end of file
diff --git a/windows/application-management/app-v/appv-client-configuration-settings.md b/windows/application-management/app-v/appv-client-configuration-settings.md
index 5608dafd61..8ecf438180 100644
--- a/windows/application-management/app-v/appv-client-configuration-settings.md
+++ b/windows/application-management/app-v/appv-client-configuration-settings.md
@@ -6,99 +6,97 @@ ms.pagetype: mdop, appcompat, virtualization
ms.mktglfcycl: deploy
ms.sitesec: library
ms.prod: w10
-ms.date: 04/19/2017
+ms.date: 04/18/2018
---
-
# About Client Configuration Settings
-**Applies to**
-- Windows 10, version 1607
+>Applies to: Windows 10, version 1607
-The Microsoft Application Virtualization (App-V) client stores its configuration in the registry. You can gather some useful information about the client if you understand the format of data in the registry. You can also configure many client actions by changing registry entries. This topic lists the App-V Client configuration settings and explains their uses. You can use Windows PowerShell to modify the client configuration settings. For more information about using Windows PowerShell and App-V see [Administering App-V by Using Windows PowerShell](appv-administering-appv-with-powershell.md).
+The Microsoft Application Virtualization (App-V) client stores its configuration in the registry. Understanding how the register's format for data works can help you better understand the client, as you can configure many client actions by changing registry entries. This topic lists the App-V client configuration settings and explains their uses. You can use Windows PowerShell to modify the client configuration settings. For more information about using Windows PowerShell and App-V see [Administering App-V by using Windows PowerShell](appv-administering-appv-with-powershell.md).
-You can use Group Policy to configure App-V client settings by using the Group Policy Management Console under **Computer Configuration** > **Administrative Templates** > **System** > **App-V**.
+You can use Group Policy to configure App-V client settings by navigating to the **Group Policy managment console** at **Computer Configuration** > **Administrative Templates** > **System** > **App-V**.
## App-V Client Configuration Settings: Windows PowerShell
The following table provides information about App-V client configuration settings that can be configured through Windows PowerShell cmdlets:
-| Windows PowerShell cmdlet or cmdlets,
**Option**
Type | Description | Disabled Policy State Keys and Values |
+| Windows PowerShell cmdlet or cmdlets,
**Option**
Type | Description | Disabled policy state keys and values |
|------------|------------|------------|------------|
| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-PackageInstallationRoot**
String | Specifies directory where all new applications and updates will be installed. | Policy value not written (same as Not Configured) |
| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-PackageSourceRoot**
String | Overrides source location for downloading package content. | Policy value not written (same as Not Configured) |
-| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-AllowHighCostLaunch**
True (enabled); False (Disabled state) | This setting controls whether virtualized applications are launched on Windows 10 machines connected via a metered network connection (For example, 4G). | 0 |
-| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-ReestablishmentRetries**
Integer (0-99) | Specifies the number of times to retry a dropped session. | Policy value not written (same as Not Configured) |
-| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-ReestablishmentInterval**
Integer (0-3600) | Specifies the number of seconds between attempts to reestablish a dropped session. | Policy value not written (same as Not Configured) |
+| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-AllowHighCostLaunch**
True (enabled); False (Disabled state) | This setting controls whether virtualized applications are launched on Windows 10 machines connected by a metered network connection (for example, 4G). | 0 |
+| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-ReestablishmentRetries**
Integer (0–99) | Specifies the number of times to retry a dropped session. | Policy value not written (same as Not Configured) |
+| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-ReestablishmentInterval**
Integer (0–3600) | Specifies the number of seconds between attempts to reestablish a dropped session. | Policy value not written (same as Not Configured) |
| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-LocationProvider**
String | Specifies the CLSID for a compatible implementation of the IAppvPackageLocationProvider interface. | Policy value not written (same as Not Configured) |
| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-CertFilterForClientSsl**
String | Specifies the path to a valid certificate in the certificate store. | Policy value not written (same as Not Configured) |
-| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-VerifyCertificateRevocationList**
True(enabled); False(Disabled state) | Verifies Server certificate revocation status before steaming using HTTPS. | 0 |
-| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-SharedContentStoreMode**
True(enabled); False(Disabled state) | Specifies that streamed package contents will be not be saved to the local hard disk. | 0 |
+| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-VerifyCertificateRevocationList**
True (enabled); False (Disabled state) | Verifies Server certificate revocation status before streaming with HTTPS. | 0 |
+| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-SharedContentStoreMode**
True (enabled); False (Disabled state) | Specifies that streamed package contents will be not be saved to the local hard disk. | 0 |
| Set-AppvPublishingServer
**-Name**
String | Displays the name of publishing server. | Policy value not written (same as Not Configured) |
| Set-AppvPublishingServer
**-URL**
String | Displays the URL of publishing server. | Policy value not written (same as Not Configured) |
-| Set-AppvPublishingServer
**-GlobalRefreshEnabled**
True(enabled); False(Disabled state) | Enables global publishing refresh (Boolean) | False |
-| Set-AppvPublishingServer
**-GlobalRefreshOnLogon**
True(enabled); False(Disabled state) | Triggers a global publishing refresh on logon. ( Boolean) | False |
-| Set-AppvPublishingServer
**-GlobalRefreshInterval**
Integer (0-744) | Specifies the publishing refresh interval using the GlobalRefreshIntervalUnit. To disable package refresh, select 0. | 0 |
-| Set-AppvPublishingServer
**-GlobalRefreshIntervalUnit**
0 for hour, 1 for day | Specifies the interval unit (Hour 0-23, Day 0-31). | 1 |
-| Set-AppvPublishingServer
**-UserRefreshEnabled**
True(enabled); False(Disabled state) | Enables user publishing refresh (Boolean) | False |
-| Set-AppvPublishingServer
**-UserRefreshOnLogon**
True(enabled); False(Disabled state) | Triggers a user publishing refresh onlogon. ( Boolean)Word count (with spaces): 60 | False |
-| Set-AppvPublishingServer
**-UserRefreshInterval**
Word count (with spaces): 85Integer (0-744 Hours) | Specifies the publishing refresh interval using the UserRefreshIntervalUnit. To disable package refresh, select 0. | 0 |
-| Set-AppvPublishingServer
**-UserRefreshIntervalUnit**
0 for hour, 1 for day | Specifies the interval unit (Hour 0-23, Day 0-31). | 1 |
-| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-MigrationMode**
True(enabled state); False (disabled state) | Migration mode allows the App-V client to modify shortcuts and FTA’s for packages created using a previous version of App-V. | |
-| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-EnablePackageScripts**
True(enabled); False(Disabled state) | Enables scripts defined in the package manifest of configuration files that should run. | |
-| Set-AppvClientConfiguration
**-RoamingFileExclusions**
String | Specifies the file paths relative to %userprofile% that do not roam with a user's profile. Example usage: /ROAMINGFILEEXCLUSIONS='desktop;my pictures' | |
-| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-RoamingRegistryExclusions**
String | Specifies the registry paths that do not roam with a user profile. Example usage: /ROAMINGREGISTRYEXCLUSIONS=software\\classes;software\\clients | Policy value not written (same as Not Configured) |
-| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-IntegrationRootUser**
String | Specifies the location to create symbolic links associated with the current version of a per-user published package. all virtual application extensions, for example shortcuts and file type associations, will point to this path. If you do not specify a path, symbolic links will not be used when you publish the package. For example: %localappdata%\\Microsoft\\AppV\\Client\\Integration. | Policy value not written (same as Not Configured) |
-| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-IntegrationRootGlobal**
String | Specifies the location to create symbolic links associated with the current version of a globally published package. all virtual application extensions, for example shortcuts and file type associations, will point to this path. If you do not specify a path, symbolic links will not be used when you publish the package. For example: %allusersprofile%\\Microsoft\\AppV\\Client\\Integration | Policy value not written (same as Not Configured) |
-| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-VirtualizableExtensions**
String | A comma -delineated list of file name extensions that can be used to determine if a locally installed application can be run in the virtual environment. When shortcuts, FTAs, and other extension points are created during publishing, App-V will compare the file name extension to the list if the application that is associated with the extension point is locally installed. If the extension is located, the **RunVirtual** command line parameter will be added, and the application will run virtually. For more information about the **RunVirtual** parameter, see [Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications](appv-running-locally-installed-applications-inside-a-virtual-environment.md). | Policy value not written |
-| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-ReportingEnabled**
True (enabled); False (Disabled state) | Enables the client to return information to a reporting server. | False |
+| Set-AppvPublishingServer
**-GlobalRefreshEnabled**
True (enabled); False (Disabled state) | Enables global publishing refresh (Boolean) | False |
+| Set-AppvPublishingServer
**-GlobalRefreshOnLogon**
True (enabled); False (Disabled state) | Triggers a global publishing refresh on sign in. (Boolean) | False |
+| Set-AppvPublishingServer
**-GlobalRefreshInterval**
Integer (0–744) | Specifies the publishing refresh interval using the GlobalRefreshIntervalUnit. To disable package refresh, specify 0. | 0 |
+| Set-AppvPublishingServer
**-GlobalRefreshIntervalUnit**
0 for hour, 1 for day | Specifies the interval unit (Hour 0–23, Day 0–31). | 1 |
+| Set-AppvPublishingServer
**-UserRefreshEnabled**
True (enabled); False (Disabled state) | Enables user publishing refresh (Boolean) | False |
+| Set-AppvPublishingServer
**-UserRefreshOnLogon**
True (enabled); False (Disabled state) | Triggers a user publishing refresh on sign in. (Boolean) Word count (with spaces): 60 | False |
+| Set-AppvPublishingServer
**-UserRefreshInterval**
Word count (with spaces): 85
Integer (0–744 Hours) | Specifies the publishing refresh interval using the UserRefreshIntervalUnit. To disable package refresh, select 0. | 0 |
+| Set-AppvPublishingServer
**-UserRefreshIntervalUnit**
0 for hour, 1 for day | Specifies the interval unit (Hour 0–23, Day 0–31). | 1 |
+| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-MigrationMode**
True (enabled state); False (Disabled state) | Migration mode allows the App-V client to modify shortcuts and FTA’s for packages created by a previous version of App-V. | |
+| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-EnablePackageScripts**
True (enabled); False (Disabled state) | Enables scripts defined in the package manifest of configuration files that should run. | |
+| Set-AppvClientConfiguration
**-RoamingFileExclusions**
String | Specifies the file paths relative to %userprofile% that do not roam with a user's profile. For example, ```/ROAMINGFILEEXCLUSIONS='desktop;my pictures'``` | |
+| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-RoamingRegistryExclusions**
String | Specifies the registry paths that do not roam with a user profile. For example, ```/ROAMINGREGISTRYEXCLUSIONS=software\\classes;software\\clients``` | Policy value not written (same as Not Configured) |
+| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-IntegrationRootUser**
String | Specifies the location to create symbolic links associated with the current version of a per-user published package. All virtual application extensions, such as shortcuts and file type associations, will point to this path. If you don't specify a path, symbolic links will not be used when you publish the package. For example, ```%localappdata%\\Microsoft\\AppV\\Client\\Integration```. | Policy value not written (same as Not Configured) |
+| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-IntegrationRootGlobal**
String | Specifies the location to create symbolic links associated with the current version of a globally published package. All virtual application extensions, such as shortcuts and file type associations, will point to this path. If you don't specify a path, symbolic links will not be used when you publish the package. For example, ```%allusersprofile%\\Microsoft\\AppV\\Client\\Integration```. | Policy value not written (same as Not Configured) |
+| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-VirtualizableExtensions**
String | A comma-delineated list of file name extensions that can be used to determine if a locally installed application can be run in the virtual environment. When shortcuts, FTAs, and other extension points are created during publishing, App-V will compare the file name extension to the list if the application associated with the extension point is locally installed. If the extension is located, the **RunVirtual** command-line parameter will be added, and the application will run virtually. For more information about the **RunVirtual** parameter, see [Running a locally installed application inside a virtual environment with virtualized applications](appv-running-locally-installed-applications-inside-a-virtual-environment.md). | Policy value not written |
+| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-ReportingEnabled**
True (enabled); False (Disabled state) | Returns information to a reporting server. | False |
| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-ReportingServerURL**
String | Specifies the location on the reporting server where client information is saved. | Policy value not written (same as Not Configured) |
-| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-ReportingDataCacheLimit**
Integer \[0-1024\] | Specifies the maximum size in megabytes (MB) of the XML cache for storing reporting information. The size applies to the cache in memory. When the limit is reached, the log file will roll over. Set between 0 and 1024. | Policy value not written (same as Not Configured) |
+| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-ReportingDataCacheLimit**
Integer \[0–1024\] | Specifies the maximum size in megabytes (MB) of the XML cache for storing reporting information. The size applies to the cache in memory. When the limit is reached, the log file will roll over. Set between 0 and 1024. | Policy value not written (same as Not Configured) |
| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-ReportingDataBlockSize**
Integer \[1024 - Unlimited\] | Specifies the maximum size in bytes to transmit to the server for reporting upload requests. This can help avoid permanent transmission failures when the log has reached a significant size. Set between 1024 and unlimited. | Policy value not written (same as Not Configured) |
-| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-ReportingStartTime**
Integer (0 – 23) | Specifies the time to initiate the client to send data to the reporting server. You must specify a valid integer between 0-23 corresponding to the hour of the day. By default the **ReportingStartTime** will start on the current day at 10 P.M.or 22.
**Note** You should configure this setting to a time when computers running the App-V client are least likely to be offline. | Policy value not written (same as Not Configured) |
+| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-ReportingStartTime**
Integer (0–23) | Specifies the time to initiate the client to send data to the reporting server. You must specify a valid integer between 0–23 corresponding to the hour of the day. By default the **ReportingStartTime** will start on the current day at 10 P.M.or 22.
**Note** You should configure this setting to a time when computers running the App-V client are least likely to be offline. | Policy value not written (same as Not Configured) |
| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-ReportingInterval**
Integer | Specifies the retry interval that the client will use to resend data to the reporting server. | Policy value not written (same as Not Configured) |
| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-ReportingRandomDelay**
Integer \[0 - ReportingRandomDelay\] | Specifies the maximum delay (in minutes) for data to be sent to the reporting server. When the scheduled task is started, the client generates a random delay between 0 and **ReportingRandomDelay** and will wait the specified duration before sending data. This can help to prevent collisions on the server. | Policy value not written (same as Not Configured) |
| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-EnableDynamicVirtualization
**1 (Enabled), 0 (Disabled) | Enables supported Shell Extensions, Browser Helper Objects, and Active X controls to be virtualized and run with virtual applications. | |
| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-EnablePublishingRefreshUI**
1 (Enabled), 0 (Disabled) | Enables the publishing refresh progress bar for the computer running the App-V Client. | |
| Sync-AppvPublishingServer
**-HidePublishingRefreshUI**
1 (Enabled), 0 (Disabled) | Hides the publishing refresh progress bar. | |
-| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-ProcessesUsingVirtualComponents**
String | Specifies a list of process paths (that may contain wildcards), which are candidates for using dynamic virtualization (supported shell extensions, browser helper objects, and ActiveX controls). Only processes whose full path matches one of these items can use dynamic virtualization. | Empty string. |
+| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-ProcessesUsingVirtualComponents**
String | Specifies a list of process paths (that may contain wildcards) that are candidates for using dynamic virtualization (such as supported shell extensions, browser helper objects, and ActiveX controls). Only processes whose full path matches one of these items can use dynamic virtualization. | Empty string. |
-## App-V Client Configuration Settings: Registry Keys
+## App-V client configuration settings: registry keys
The following table provides information about App-V client configuration settings that can be configured through the registry:
-| **Setting name**
Type | Registry Key Value | Disabled Policy State Keys and Values |
+| **Setting name**
Type | Registry key value | Disabled policy state keys and values |
|---------------------------|---------------------|---------------------------------------|
| **PackageInstallationRoot**
String | Streaming\\PackageInstallationRoot | Policy value not written (same as Not Configured) |
| **PackageSourceRoot**
String | Streaming\\PackageSourceRoot | Policy value not written (same as Not Configured) |
-| **AllowHighCostLaunch**
True (enabled); False (Disabled state) | Streaming\\AllowHighCostLaunch | 0 |
-| **ReestablishmentRetries**
Integer (0-99) | Streaming\\ReestablishmentRetries | Policy value not written (same as Not Configured) |
-| **ReestablishmentInterval**
Integer (0-3600) | Streaming\\ReestablishmentInterval | Policy value not written (same as Not Configured) |
+| **AllowHighCostLaunch**
True (Enabled); False (Disabled state) | Streaming\\AllowHighCostLaunch | 0 |
+| **ReestablishmentRetries**
Integer (0–99) | Streaming\\ReestablishmentRetries | Policy value not written (same as Not Configured) |
+| **ReestablishmentInterval**
Integer (0–3600) | Streaming\\ReestablishmentInterval | Policy value not written (same as Not Configured) |
| **LocationProvider**
String | Streaming\\LocationProvider | Policy value not written (same as Not Configured) |
| **CertFilterForClientSsl**
String | Streaming\\CertFilterForClientSsl | Policy value not written (same as Not Configured) |
-| **VerifyCertificateRevocationList**
True(enabled); False(Disabled state) | Streaming\\VerifyCertificateRevocationList | 0 |
-| **SharedContentStoreMode**
True(enabled); False(Disabled state) | Streaming\\SharedContentStoreMode | 0 |
+| **VerifyCertificateRevocationList**
True (Enabled); False (Disabled state) | Streaming\\VerifyCertificateRevocationList | 0 |
+| **SharedContentStoreMode**
True (Enabled); False (Disabled state) | Streaming\\SharedContentStoreMode | 0 |
| **Name**
String | Publishing\\Servers{serverId}\\FriendlyName | Policy value not written (same as Not Configured) |
| **URL**
String | Publishing\\Servers{serverId}\\URL | Policy value not written (same as Not Configured) |
-| **GlobalRefreshEnabled**
True(enabled); False(Disabled state) | Publishing\\Servers{serverId}\\GlobalEnabled | False |
-| **GlobalRefreshOnLogon**
True(enabled); False(Disabled state) | Publishing\\Servers{serverId}\\GlobalLogonRefresh | False |
-| **GlobalRefreshInterval**
Integer (0-744) | Publishing\\Servers{serverId}\\GlobalPeriodicRefreshInterval | 0 |
+| **GlobalRefreshEnabled**
True (Enabled); False (Disabled state) | Publishing\\Servers{serverId}\\GlobalEnabled | False |
+| **GlobalRefreshOnLogon**
True (Enabled); False (Disabled state) | Publishing\\Servers{serverId}\\GlobalLogonRefresh | False |
+| **GlobalRefreshInterval**
Integer (0–744) | Publishing\\Servers{serverId}\\GlobalPeriodicRefreshInterval | 0 |
| **GlobalRefreshIntervalUnit**
0 for hour, 1 for day | Publishing\\Servers{serverId}\\GlobalPeriodicRefreshIntervalUnit | 1 |
-| **UserRefreshEnabled**
True(enabled); False(Disabled state) | Publishing\\Servers{serverId}\\UserEnabled | False |
-| **UserRefreshOnLogon**
True(enabled); False(Disabled state) | Publishing\\Servers{serverId}\\UserLogonRefresh | False |
-| **UserRefreshInterval**
Word count (with spaces): 85Integer (0-744 Hours) | Publishing\\Servers{serverId}\\UserPeriodicRefreshInterval | 0 |
+| **UserRefreshEnabled**
True (Enabled); False (Disabled state) | Publishing\\Servers{serverId}\\UserEnabled | False |
+| **UserRefreshOnLogon**
True (Enabled); False (Disabled state) | Publishing\\Servers{serverId}\\UserLogonRefresh | False |
+| **UserRefreshInterval**
Word count (with spaces): 85; Integer (0–744 Hours) | Publishing\\Servers{serverId}\\UserPeriodicRefreshInterval | 0 |
| **UserRefreshIntervalUnit**
0 for hour, 1 for day | Publishing\\Servers{serverId}\\UserPeriodicRefreshIntervalUnit | 1 |
-| **MigrationMode**
True(enabled state); False (disabled state) | Coexistence\\MigrationMode | |
-| **EnablePackageScripts**
True(enabled); False(Disabled state) | \\Scripting\\EnablePackageScripts | |
+| **MigrationMode**
True(Enabled state); False (Disabled state) | Coexistence\\MigrationMode | |
+| **EnablePackageScripts**
True (Enabled); False (Disabled state) | \\Scripting\\EnablePackageScripts | |
| **RoamingFileExclusions**
String | | |
| **RoamingRegistryExclusions**
String | Integration\\RoamingReglstryExclusions | Policy value not written (same as Not Configured) |
| **IntegrationRootUser**
String | Integration\\IntegrationRootUser | Policy value not written (same as Not Configured) |
| **IntegrationRootGlobal**
String | Integration\\IntegrationRootGlobal | Policy value not written (same as Not Configured) |
| **VirtualizableExtensions**
String | Integration\\VirtualizableExtensions | Policy value not written |
-| **ReportingEnabled**
True (enabled); False (Disabled state) | Reporting\\EnableReporting | False |
+| **ReportingEnabled**
True (Enabled); False (Disabled state) | Reporting\\EnableReporting | False |
| **ReportingServerURL**
String | Reporting\\ReportingServer | Policy value not written (same as Not Configured) |
-| **ReportingDataCacheLimit**
Integer \[0-1024\] | Reporting\\DataCacheLimit | Policy value not written (same as Not Configured) |
-| **ReportingDataBlockSize**
Integer \[1024 - Unlimited\] | Reporting\\DataBlockSize | Policy value not written (same as Not Configured) |
-| **ReportingStartTime**
Integer (0 – 23) | Reporting\\ StartTime | Policy value not written (same as Not Configured) |
+| **ReportingDataCacheLimit**
Integer \[0–1024\] | Reporting\\DataCacheLimit | Policy value not written (same as Not Configured) |
+| **ReportingDataBlockSize**
Integer \[1024–Unlimited\] | Reporting\\DataBlockSize | Policy value not written (same as Not Configured) |
+| **ReportingStartTime**
Integer (0–23) | Reporting\\ StartTime | Policy value not written (same as Not Configured) |
| **ReportingInterval**
Integer | Reporting\\RetryInterval | Policy value not written (same as Not Configured) |
| **ReportingRandomDelay**
Integer \[0 - ReportingRandomDelay\] | Reporting\\RandomDelay | Policy value not written (same as Not Configured) |
| **EnableDynamicVirtualization
**1 (Enabled), 0 (Disabled) | HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\AppV\\Client\\Virtualization | |
@@ -108,9 +106,8 @@ The following table provides information about App-V client configuration settin
## Have a suggestion for App-V?
-Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv).
+Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
## Related topics
-[Deploying the App-V Sequencer and Configuring the Client](appv-deploying-the-appv-sequencer-and-client.md)
-
+* [Deploying the App-V Sequencer and Configuring the Client](appv-deploying-the-appv-sequencer-and-client.md)
\ No newline at end of file
diff --git a/windows/application-management/app-v/appv-configure-access-to-packages-with-the-management-console.md b/windows/application-management/app-v/appv-configure-access-to-packages-with-the-management-console.md
index a36a845027..58b23dd73f 100644
--- a/windows/application-management/app-v/appv-configure-access-to-packages-with-the-management-console.md
+++ b/windows/application-management/app-v/appv-configure-access-to-packages-with-the-management-console.md
@@ -60,7 +60,7 @@ Use the following procedure to configure access to virtualized packages.
## Have a suggestion for App-V?
-Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv).
+Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv).
## Related topics
diff --git a/windows/application-management/app-v/appv-configure-connection-groups-to-ignore-the-package-version.md b/windows/application-management/app-v/appv-configure-connection-groups-to-ignore-the-package-version.md
index 8fca1c8678..06b310e729 100644
--- a/windows/application-management/app-v/appv-configure-connection-groups-to-ignore-the-package-version.md
+++ b/windows/application-management/app-v/appv-configure-connection-groups-to-ignore-the-package-version.md
@@ -57,7 +57,7 @@ For more information, see [How to Manage App-V Packages Running on a Stand-Alone
## Have a suggestion for App-V?
-Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv).
+Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv).
## Related topics
diff --git a/windows/application-management/app-v/appv-configure-the-client-to-receive-updates-from-the-publishing-server.md b/windows/application-management/app-v/appv-configure-the-client-to-receive-updates-from-the-publishing-server.md
index 8d682c7235..dca7131dbf 100644
--- a/windows/application-management/app-v/appv-configure-the-client-to-receive-updates-from-the-publishing-server.md
+++ b/windows/application-management/app-v/appv-configure-the-client-to-receive-updates-from-the-publishing-server.md
@@ -59,7 +59,7 @@ For the following procedures the management server was installed on a computer n
## Have a suggestion for App-V?
-Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv).
+Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv).
## Related topics
diff --git a/windows/application-management/app-v/appv-connect-to-the-management-console.md b/windows/application-management/app-v/appv-connect-to-the-management-console.md
index b4c4203b8f..4da1633e90 100644
--- a/windows/application-management/app-v/appv-connect-to-the-management-console.md
+++ b/windows/application-management/app-v/appv-connect-to-the-management-console.md
@@ -18,13 +18,13 @@ Use the following procedure to connect to the App-V Management Console.
**To connect to the App-V Management Console**
-1. Open Internet Explorer browser and type the address for the App-V Management server. For example, **http://\<_management server name_\>:\<_management service port number_\>/console.html**.
+1. Open Internet Explorer browser and type the address for the App-V Management server. For example, **https://\<_management server name_\>:\<_management service port number_\>/console.html**.
2. To view different sections of the console, click the desired section in the navigation pane.
## Have a suggestion for App-V?
-Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv).
+Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv).
## Related topics
diff --git a/windows/application-management/app-v/appv-connection-group-file.md b/windows/application-management/app-v/appv-connection-group-file.md
index 89b2c9530c..2c0d1e7208 100644
--- a/windows/application-management/app-v/appv-connection-group-file.md
+++ b/windows/application-management/app-v/appv-connection-group-file.md
@@ -83,7 +83,7 @@ The following table describes the parameters in the XML file that define the con
xmlns="http://schemas.microsoft.com/appv/2014/virtualapplicationconnectiongroup"xmlns="https://schemas.microsoft.com/appv/2014/virtualapplicationconnectiongroup"
AppConnectionGroupId
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/application-management/app-v/appv-connection-group-virtual-environment.md b/windows/application-management/app-v/appv-connection-group-virtual-environment.md index 6bd7e8257a..6ba91b41f8 100644 --- a/windows/application-management/app-v/appv-connection-group-virtual-environment.md +++ b/windows/application-management/app-v/appv-connection-group-virtual-environment.md @@ -95,7 +95,7 @@ In the example above, when a virtualized application tries to find a specific fi ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/application-management/app-v/appv-convert-a-package-created-in-a-previous-version-of-appv.md b/windows/application-management/app-v/appv-convert-a-package-created-in-a-previous-version-of-appv.md index c7589228fa..83cff76b90 100644 --- a/windows/application-management/app-v/appv-convert-a-package-created-in-a-previous-version-of-appv.md +++ b/windows/application-management/app-v/appv-convert-a-package-created-in-a-previous-version-of-appv.md @@ -58,7 +58,7 @@ When you convert packages from App-V 4.6 to App-V for Windows 10, the App-V for ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/application-management/app-v/appv-create-a-connection-group-with-user-published-and-globally-published-packages.md b/windows/application-management/app-v/appv-create-a-connection-group-with-user-published-and-globally-published-packages.md index 418919b1b2..5a13170e82 100644 --- a/windows/application-management/app-v/appv-create-a-connection-group-with-user-published-and-globally-published-packages.md +++ b/windows/application-management/app-v/appv-create-a-connection-group-with-user-published-and-globally-published-packages.md @@ -79,7 +79,7 @@ You can create user-entitled connection groups that contain both user-published ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/application-management/app-v/appv-create-a-connection-group.md b/windows/application-management/app-v/appv-create-a-connection-group.md index 321421cdcd..144900c14b 100644 --- a/windows/application-management/app-v/appv-create-a-connection-group.md +++ b/windows/application-management/app-v/appv-create-a-connection-group.md @@ -42,7 +42,7 @@ When you place packages in a connection group, their package root paths are merg ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/application-management/app-v/appv-create-a-custom-configuration-file-with-the-management-console.md b/windows/application-management/app-v/appv-create-a-custom-configuration-file-with-the-management-console.md index afc4033cc9..3aea6099e5 100644 --- a/windows/application-management/app-v/appv-create-a-custom-configuration-file-with-the-management-console.md +++ b/windows/application-management/app-v/appv-create-a-custom-configuration-file-with-the-management-console.md @@ -34,7 +34,7 @@ Use the following procedure to create a Dynamic User Configuration file by using ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/application-management/app-v/appv-create-a-package-accelerator-with-powershell.md b/windows/application-management/app-v/appv-create-a-package-accelerator-with-powershell.md index 8c79e0bc1a..5d001bf498 100644 --- a/windows/application-management/app-v/appv-create-a-package-accelerator-with-powershell.md +++ b/windows/application-management/app-v/appv-create-a-package-accelerator-with-powershell.md @@ -43,7 +43,7 @@ App-V package accelerators automatically sequence large, complex applications. A ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/application-management/app-v/appv-create-a-package-accelerator.md b/windows/application-management/app-v/appv-create-a-package-accelerator.md index b6b8930c2d..b62f27281a 100644 --- a/windows/application-management/app-v/appv-create-a-package-accelerator.md +++ b/windows/application-management/app-v/appv-create-a-package-accelerator.md @@ -70,7 +70,7 @@ Use the following procedure to create a package accelerator. ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/application-management/app-v/appv-create-a-virtual-application-package-package-accelerator.md b/windows/application-management/app-v/appv-create-a-virtual-application-package-package-accelerator.md index eb25257a00..d816a91315 100644 --- a/windows/application-management/app-v/appv-create-a-virtual-application-package-package-accelerator.md +++ b/windows/application-management/app-v/appv-create-a-virtual-application-package-package-accelerator.md @@ -72,7 +72,7 @@ Use the following procedure to create a virtual application package with the App ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/application-management/app-v/appv-create-and-use-a-project-template.md b/windows/application-management/app-v/appv-create-and-use-a-project-template.md index 26367d8ffd..383572f210 100644 --- a/windows/application-management/app-v/appv-create-and-use-a-project-template.md +++ b/windows/application-management/app-v/appv-create-and-use-a-project-template.md @@ -62,4 +62,4 @@ After creating the template, you can apply it to all of your new virtual app pac - [Manually sequence a new app using Microsoft Application Virtualization Sequencer (App-V Sequencer)](appv-sequence-a-new-application.md) **Have a suggestion for App-V?**
-Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). Context menu handler Adds menu items to the context menu. It is called before the context menu is displayed. Drag-and-drop handler Controls the action where right-click, drag and drop and modifies the context menu that appears. Drop target handler Controls the action after a data object is dragged and dropped over a drop target such as a file. Data object handler Controls the action after a file is copied to the clipboard or dragged and dropped over a drop target. It can provide additional clipboard formats to the drop target. Property sheet handler Replaces or adds pages to the property sheet dialog box of an object. Infotip handler Allows retrieving flags and infotip information for an item and displaying it inside a pop-up tooltip upon mouse hover. Column handler Allows creating and displaying custom columns in Windows Explorer Details view. It can be used to extend sorting and grouping. Preview handler Enables a preview of a file to be displayed in the Windows Explorer Preview pane. Package creation Sequencing Package Accelerator Office Deployment Kit Supported licensing Volume Licensing Supported deployments Desktop Personal VDI RDS Lync meeting Join Plug-in for Firefox and Chrome User can join Lync meetings from Firefox and Chrome Sent to OneNote Print Driver User can print to OneNote Yes OneNote Linked Notes OneNote Linked Notes Send to OneNote Internet Explorer Add-In User can send to OneNote from IE Firewall Exception for Lync and Outlook Firewall Exception for Lync and Outlook MAPI Client Native apps and add-ins can interact with virtual Outlook through MAPI SharePoint Plugin for Firefox User can use SharePoint features in Firefox Mail Control Panel Applet User gets the mail control panel applet in Outlook Yes Primary Interop Assemblies Support managed add-ins Office Document Cache Handler Allows Document Cache for Office applications Outlook Protocol Search handler User can search in outlook Yes Active X Controls: For more information on ActiveX controls, refer to [ActiveX Control API Reference](https://msdn.microsoft.com/library/office/ms440037(v=office.14).aspx). Groove.SiteClient Active X Control PortalConnect.PersonalSite Active X Control SharePoint.openDocuments Active X Control SharePoint.ExportDatabase Active X Control SharePoint.SpreadSheetLauncher Active X Control SharePoint.StssyncHander Active X Control SharePoint.DragUploadCtl Active X Control SharePoint.DragDownloadCtl Active X Control Sharpoint.OpenXMLDocuments Active X Control Sharepoint.ClipboardCtl Active X control WinProj.Activator Active X Control Name.NameCtrl Active X Control STSUPld.CopyCtl Active X Control CommunicatorMeetingJoinAx.JoinManager Active X Control LISTNET.Listnet Active X Control OneDrive Pro Browser Helper Active X Control] OneDrive Pro Icon Overlays Windows explorer shell icon overlays when users look at folders OneDrive Pro folders [Supported versions of Microsoft Office](appv-planning-for-using-appv-with-office.md#bkmk-office-vers-supp-appv) Supported versions of Office Supported deployment types (for example, desktop, personal Virtual Desktop Infrastructure (VDI), pooled VDI) Office licensing options [Planning for using App-V with coexisting versions of Office](appv-planning-for-using-appv-with-office.md#bkmk-plan-coexisting) Considerations for installing different versions of Office on the same computer Packaging All of the Office applications that you want to deploy to users must be in a single package. In App-V and later, you must use the Office Deployment Tool to create packages. You cannot use the Sequencer. If you are deploying Microsoft Visio 2013 and Microsoft Project 2013 along with Office, you must include them in the same package with Office. For more information, see [Deploying Visio 2013 and Project 2013 with Office](#bkmk-deploy-visio-project). Publishing You can publish only one Office package to each client computer. You must publish the Office package globally. You cannot publish to the user. Deploying any of the following products to a shared computer, for example, by using Remote Desktop Services: Office 365 ProPlus Visio Pro for Office 365 Project Pro for Office 365 You must enable [shared computer activation](http://technet.microsoft.com/library/dn782860.aspx). You don’t use shared computer activation if you’re deploying a volume licensed product, such as: Office Professional Plus 2013 Visio Professional 2013 Project Professional 2013 Use the ExcludeApp setting when you create the package by using the Office Deployment Tool. Enables you to exclude specific Office applications from the package when the Office Deployment Tool creates the package. For example, you can use this setting to create a package that contains only Microsoft Word. For more information, see [ExcludeApp element](https://technet.microsoft.com/library/jj219426.aspx#BKMK_ExcludeAppElement). Modify the DeploymentConfig.xml file Modify the DeploymentConfig.xml file after the package has been created. This file contains the default package settings for all users on a computer that is running the App-V Client. For more information, see [Disabling Office 2013 applications](#bkmk-disable-office-apps). Prerequisite software .Net Framework 4 Supported operating systems 64-bit version of Windows 8 or later 64-bit version of Windows 7 is the network share location that contains the Office Deployment Tool and the custom Configuration.xml file, Customconfig.xml. is the Office Deployment Tool. downloads the Office 2013 applications that you specify in the customConfig.xml file. These bits can be later converted in an Office 2013 App-V package with Volume Licensing. passes the XML configuration file required to complete the download process, in this example, customconfig.xml. After using the download command, Office applications should be found in the location specified in the configuration xml file, in this example \\Server\Office2013. Add element: N/A OfficeClientEdition (attribute of Add element): Product element: Language element: Version (attribute of Add element): SourcePath (attribute of Add element): Office 2013 ProPlusVolume O365ProPlusRetail Office 2013 with Visio 2013 ProPlusVolume VisioProVolume O365ProPlusRetail VisioProRetail Office 2013 with Visio 2013 and Project 2013 ProPlusVolume VisioProVolume ProjectProVolume O365ProPlusRetail VisioProRetail ProjectProRetail is the network share location that contains the Office Deployment Tool and the custom Configuration.xml file, Customconfig.xml. is the Office Deployment Tool. creates the Office 2013 App-V package with Volume Licensing as specified in the customConfig.xml file. passes the configuration XML file (in this case customConfig) that has been prepared for the packaging stage. specifies the location of the newly created Office App-V package. Enable Windows PowerShell scripting on the App-V clients To publish Office 2013 packages, you must run a script. Package scripts are disabled by default on App-V clients. To enable scripting, run the following Windows PowerShell command: Publish the Office 2013 package globally Extension points in the Office App-V package require installation at the computer level. When you publish at the computer level, no prerequisite actions or redistributables are needed, and the Office 2013 package globally enables its applications to work like natively installed Office, eliminating the need for administrators to customize packages. Create two different packages and deploy each one to a different group of users Create and deploy the following packages: A package that contains only Office - deploy to computers whose users need only Office. A package that contains Office, Visio, and Project - deploy to computers whose users need all three applications. If you want only one package for the whole organization, or if you have users who share computers: Follows these steps: Create a package that contains Office, Visio, and Project. Deploy the package to all users. Use [AppLocker](https://technet.microsoft.com/itpro/windows/keep-secure/applocker-overview) to prevent specific users from using Visio and Project. is the network share location that contains the Office Deployment Tool and the custom Configuration.xml file, Customconfig.xml. is the Office Deployment Tool. creates the Office 2016 App-V package with the type of licensing specified in the customConfig.xml file. passes the configuration XML file (in this case customConfig) that has been prepared for the packaging stage. specifies the location of the newly created Office App-V package. Complete the planning phase to prepare the computing environment for App-V deployment. [App-V Planning Checklist](appv-planning-checklist.md) Review the App-V supported configurations information. [App-V Supported Configurations](appv-supported-configurations.md) Run App-V Setup to deploy the required App-V features for your environment. Keep track of the names of the servers and associated URLs created during installation. This information will be used throughout the installation process. [How to Install the Sequencer](appv-install-the-sequencer.md) [Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md) [How to Deploy the App-V Server](appv-deploy-the-appv-server.md)
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv).
+Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv).
diff --git a/windows/application-management/app-v/appv-creating-and-managing-virtualized-applications.md b/windows/application-management/app-v/appv-creating-and-managing-virtualized-applications.md
index d076323495..92958f3b25 100644
--- a/windows/application-management/app-v/appv-creating-and-managing-virtualized-applications.md
+++ b/windows/application-management/app-v/appv-creating-and-managing-virtualized-applications.md
@@ -6,140 +6,87 @@ ms.pagetype: mdop, appcompat, virtualization
ms.mktglfcycl: deploy
ms.sitesec: library
ms.prod: w10
-ms.date: 04/19/2017
+ms.date: 04/18/2018
---
-
-
# Creating and Managing App-V Virtualized Applications
-**Applies to**
-- Windows 10, version 1607
+>Applies to: Windows 10, version 1607
After you have properly deployed the Microsoft Application Virtualization (App-V) sequencer, you can use it to monitor and record the installation and setup process for an application to be run as a virtualized application.
-**Note**
-For more information about configuring the App-V sequencer, sequencing best practices, and an example of creating and updating a virtual application, see the [Microsoft Application Virtualization 5.0 Sequencing Guide](http://download.microsoft.com/download/F/7/8/F784A197-73BE-48FF-83DA-4102C05A6D44/App-V 5.0 Sequencing Guide.docx).
+For more information about configuring the App-V sequencer, sequencing best practices, and an example of creating and updating a virtual application, see the [Microsoft Application Virtualization 5.0 Sequencing Guide](
-
+|Handler|Description|
+|---|---|
+|Context menu handler|Adds menu items to the context menu. It's called before the context menu is displayed.|
+|Drag-and-drop handler|Controls the action where right-click, drag and drop, and modifies the context menu that appears.|
+|Drop target handler|Controls the action after a data object is dragged and dropped over a drop target such as a file.|
+|Data object handler|Controls the action after a file is copied to the clipboard or dragged and dropped over a drop target. It can provide additional clipboard formats to the drop target.|
+|Property sheet handler|Replaces or adds pages to the property sheet dialog box of an object.|
+|Infotip handler|Allows retrieving flags and infotip information for an item and displaying it inside a pop-up tooltip upon mouse hover.|
+|Column handler|Allows creating and displaying custom columns in **Windows Explorer Details view**. It can be used to extend sorting and grouping.|
+|Preview handler|Enables a preview of a file to be displayed in the Windows Explorer Preview pane.|
## Copy on Write (CoW) file extension support
@@ -147,50 +94,46 @@ Copy on write (CoW) file extensions allow App-V to dynamically write to specific
The following table displays the file types that can exist in a virtual package under the VFS directory, but cannot be updated on the computer running the App-V client. All other files and directories can be modified.
-| File Type | | | | | |
-|------------ |------------- |------------- |------------ |------------ |------------ |
-| .acm | .asa | .asp | .aspx | .ax | .bat |
-| .cer | .chm | .clb | .cmd | .cnt | .cnv |
-| .com | .cpl | .cpx | .crt | .dll | .drv |
-| .esc | .exe | .fon | .grp | .hlp | .hta |
-| .ime | .inf | .ins | .isp | .its | .js |
-| .jse | .lnk | .msc | .msi | .msp | .mst |
-| .mui | .nls | .ocx | .pal | .pcd | .pif |
-| .reg | .scf | .scr | .sct | .shb | .shs |
-| .sys | .tlb | .tsp | .url | .vb | .vbe |
-| .vbs | .vsmacros | .ws | .wsf | .wsh | |
-
+| File Type||||||
+|---|---|---|---|---|---|
+| .acm | .asa | .asp | .aspx | .ax | .bat |
+| .cer | .chm | .clb | .cmd | .cnt | .cnv |
+| .com | .cpl | .cpx | .crt | .dll | .drv |
+| .esc | .exe | .fon | .grp | .hlp | .hta |
+| .ime | .inf | .ins | .isp | .its | .js |
+| .jse | .lnk | .msc | .msi | .msp | .mst |
+| .mui | .nls | .ocx | .pal | .pcd | .pif |
+| .reg | .scf | .scr | .sct | .shb | .shs |
+| .sys | .tlb | .tsp | .url | .vb | .vbe |
+| .vbs | .vsmacros | .ws | .wsf | .wsh | |
## Modifying an existing virtual application package
-
You can use the sequencer to modify an existing package. The computer on which you do this should match the chip architecture of the computer you used to create the application. For example, if you initially sequenced a package using a computer running a 64-bit operating system, you should modify the package using a computer running a 64-bit operating system.
-[How to Modify an Existing Virtual Application Package](appv-modify-an-existing-virtual-application-package.md)
+For more information, see [How to Modify an Existing Virtual Application Package](appv-modify-an-existing-virtual-application-package.md).
## Creating a project template
+
An App-V project template (.appvt) file is a project template that can be used to save commonly applied, customized settings. You can then more easily use these settings for future sequencings. App-V project templates differ from App-V Application Accelerators because App-V Application Accelerators are application-specific, and App-V project templates can be applied to multiple applications. Additionally, you cannot use a project template when you use a Package Accelerator to create a virtual application package. The following general settings are saved with an App-V project template:
A template can specify and store multiple settings as follows:
-- **Advanced Monitoring Options**. Enables Microsoft Update to run during monitoring. Saves allow local interaction option settings
+- **Advanced Monitoring Options**. Enables Microsoft Update to run during monitoring. Saves allow local interaction option settings
+- **General Options**. Enables the use of **Windows Installer**, **Append Package Version to Filename**.
+- **Exclusion Items.** Contains the Exclusion pattern list.
-- **General Options**. Enables the use of **Windows Installer**, **Append Package Version to Filename**.
-
-- **Exclusion Items.** Contains the Exclusion pattern list.
-
-In Windows 10, version 1703, running the new-appvsequencerpackage or the update-appvsequencepackage cmdlets automatically captures and stores all of your customizations as an App-V project template. If you want to make changes to this package later, your customizations are automatically loaded from this template file.
+In Windows 10, version 1703, running the **new-appvsequencerpackage** or **update-appvsequencepackage** cmdlets automatically captures and stores all of your customizations as an App-V project template. If you want to make changes to this package later, your customizations are automatically loaded from this template file.
>[!IMPORTANT]
->If you have an auto-saved template and you attempt to load another template through the _TemplateFilePath_ parameter, the customization value from the parameter will override the auto-saved template.
-
-[How to Create and Use a Project Template](appv-create-and-use-a-project-template.md)
+>If you attempt to load another template through the *_TemplateFilePath_* parameter while already having an auto-saved template, the customization value from the parameter will override the auto-saved template.
+For more information, see [How to Create and Use a Project Template](appv-create-and-use-a-project-template.md).
## Creating a package accelerator
-**Note**
-Package accelerators created using a previous version of App-V must be recreated using App-V.
+>[!NOTE]
+>Package accelerators created using a previous version of App-V must be recreated using App-V.
You can use App-V package accelerators to automatically generate a new virtual application packages. After you have successfully created a package accelerator, you can reuse and share the package accelerator.
@@ -198,21 +141,21 @@ In some situations, to create the package accelerator, you might have to install
After you have successfully created a Package Accelerator, you can reuse and share the Package Accelerator. Creating App-V Package Accelerators is an advanced task. Package Accelerators can contain password and user-specific information. Therefore you must save Package Accelerators and the associated installation media in a secure location, and you should digitally sign the Package Accelerator after you create it so that the publisher can be verified when the App-V Package Accelerator is applied.
-[How to Create a Package Accelerator](appv-create-a-package-accelerator.md)
+For more information, see the following articles:
-[How to Create a Virtual Application Package Using an App-V Package Accelerator](appv-create-a-virtual-application-package-package-accelerator.md)
+- [How to Create a Package Accelerator](appv-create-a-package-accelerator.md)
+- [How to Create a Virtual Application Package Using an App-V Package Accelerator](appv-create-a-virtual-application-package-package-accelerator.md)
## Sequencer error reporting
-
The App-V Sequencer can detect common sequencing issues during sequencing. The **Installation Report** page at the end of the sequencing wizard displays diagnostic messages categorized into **Errors**, **Warnings**, and **Info** depending on the severity of the issue.
You can also find additional information about sequencing errors using the Windows Event Viewer.
## Have a suggestion for App-V?
-Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
-
-
-
-Handler
-Description
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv).
+Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
## Related topics
-- [Operations for App-V](appv-operations.md)
+- [Operations for App-V](appv-operations.md)
diff --git a/windows/application-management/app-v/appv-customize-virtual-application-extensions-with-the-management-console.md b/windows/application-management/app-v/appv-customize-virtual-application-extensions-with-the-management-console.md
index 77ec4edbc2..9a7fd827bf 100644
--- a/windows/application-management/app-v/appv-customize-virtual-application-extensions-with-the-management-console.md
+++ b/windows/application-management/app-v/appv-customize-virtual-application-extensions-with-the-management-console.md
@@ -33,7 +33,7 @@ Use the following procedure to customize the virtual application extensions for
## Have a suggestion for App-V?
-Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv).
+Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv).
## Related topics
diff --git a/windows/application-management/app-v/appv-delete-a-connection-group.md b/windows/application-management/app-v/appv-delete-a-connection-group.md
index 176253c332..b6e27aece2 100644
--- a/windows/application-management/app-v/appv-delete-a-connection-group.md
+++ b/windows/application-management/app-v/appv-delete-a-connection-group.md
@@ -25,7 +25,7 @@ Use the following procedure to delete an existing App-V connection group.
## Have a suggestion for App-V?
-Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv).
+Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv).
## Related topics
diff --git a/windows/application-management/app-v/appv-delete-a-package-with-the-management-console.md b/windows/application-management/app-v/appv-delete-a-package-with-the-management-console.md
index b96b43a1ad..0a3464836a 100644
--- a/windows/application-management/app-v/appv-delete-a-package-with-the-management-console.md
+++ b/windows/application-management/app-v/appv-delete-a-package-with-the-management-console.md
@@ -25,7 +25,7 @@ Use the following procedure to delete an App-V package.
## Have a suggestion for App-V?
-Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv).
+Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv).
## Related topics
diff --git a/windows/application-management/app-v/appv-deploy-appv-databases-with-sql-scripts.md b/windows/application-management/app-v/appv-deploy-appv-databases-with-sql-scripts.md
index eb3c088281..e719ae1710 100644
--- a/windows/application-management/app-v/appv-deploy-appv-databases-with-sql-scripts.md
+++ b/windows/application-management/app-v/appv-deploy-appv-databases-with-sql-scripts.md
@@ -6,51 +6,49 @@ ms.pagetype: mdop, appcompat, virtualization
ms.mktglfcycl: deploy
ms.sitesec: library
ms.prod: w10
-ms.date: 04/19/2017
+ms.date: 04/18/2018
---
+# How to deploy the App-V databases by using SQL scripts
-
-# How to Deploy the App-V Databases by Using SQL Scripts
-
-**Applies to**
-- Windows Server 2016
+>Applies to: Windows Server 2016
Use the following instructions to use SQL scripts, rather than the Windows Installer, to:
-- Install the App-V databases
+* Install the App-V databases
+* Upgrade the App-V databases to a later version
-- Upgrade the App-V databases to a later version
-
->**Note**
-> If you have already deployed an App-V 5.0 SP3 database or later, the SQL scripts are not required to upgrade to App-V for Windows.
+>[!NOTE]
+>If you have already deployed an App-V 5.0 SP3 database or later, the SQL scripts are not required to upgrade to App-V for Windows.
## How to install the App-V databases by using SQL scripts
-1. Before you install the database scripts, review and keep a copy of the App-V license terms. By running the database scripts, you are agreeing to the license terms. If you do not accept them, you should not use this software.
+1. Before you install the database scripts, review and keep a copy of the App-V license terms. By running the database scripts, you are agreeing to the license terms. If you do not accept them, you should not use this software.
-2. Copy the **appv\_server\_setup.exe** from the App-V release media to a temporary location.
+2. Copy **appv\_server\_setup.exe** from the App-V release media to a temporary location.
-3. From a command prompt, run **appv\_server\_setup.exe** and specify a temporary location for extracting the database scripts.
+3. From a command prompt, run **appv\_server\_setup.exe** and specify a temporary location for extracting the database scripts.
- Example: appv\_server\_setup.exe /layout c:\\_
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv).
+Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
## Related topics
-- [Deploying the App-V Server](appv-deploying-the-appv-server.md)
-- [How to Deploy the App-V Server](appv-deploy-the-appv-server.md)
+* [Deploying the App-V Server](appv-deploying-the-appv-server.md)
+* [How to deploy the App-V Server](appv-deploy-the-appv-server.md)
diff --git a/windows/application-management/app-v/appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md b/windows/application-management/app-v/appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md
index 0710d7ff57..439a1617b9 100644
--- a/windows/application-management/app-v/appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md
+++ b/windows/application-management/app-v/appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md
@@ -38,7 +38,7 @@ Use one of the following methods to publish packages to App-V client computers w
## Have a suggestion for App-V?
-Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv).
+Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv).
## Related topics
diff --git a/windows/application-management/app-v/appv-deploy-the-appv-server-with-a-script.md b/windows/application-management/app-v/appv-deploy-the-appv-server-with-a-script.md
index 1c7db8783f..7dbb8d0e48 100644
--- a/windows/application-management/app-v/appv-deploy-the-appv-server-with-a-script.md
+++ b/windows/application-management/app-v/appv-deploy-the-appv-server-with-a-script.md
@@ -6,335 +6,413 @@ ms.pagetype: mdop, appcompat, virtualization
ms.mktglfcycl: deploy
ms.sitesec: library
ms.prod: w10
-ms.date: 04/19/2017
+ms.date: 04/18/2018
---
+# How to deploy the App-V server using a script
+>Applies to: Windows Server 2016
-# How to Deploy the App-V Server Using a Script
+In order to complete the **appv_server_setup.exe** server setup successfully using the command line, you must specify and combine multiple parameters.
-**Applies to**
-- Windows Server 2016
-
-In order to complete the **appv\_server\_setup.exe** Server setup successfully using the command line, you must specify and combine multiple parameters.
-
-**To install the App-V server using a script**
+## To install the App-V server using a script
Use the following lists and tables for more information about installing the App-V server using the command line.
-> **Note** The information in the following lists and tables can also be accessed using the command line by typing the following command: **appv\_server\_setup.exe /?**.
+The information in the following lists and tables can also be accessed through the command line by entering the following command: ```appv\_server\_setup.exe /?```.
-## How to use common parameters
+## How to use common parameters to install the Management server and Management database on a local machine
-## To install the Management server and Management database on a local machine
+The following examples will show you how to install the Management server and database on a local machine.
-**Default instance of Microsoft SQL Server**: To use the default instance of Microsoft SQL Server, use the following parameters:
+### Parameters for a default instance of Microsoft SQL Server for a new installation on a local machine
-- /MANAGEMENT_SERVER
-- /MANAGEMENT_ADMINACCOUNT
-- /MANAGEMENT_WEBSITE_NAME
-- /MANAGEMENT_WEBSITE_PORT
-- /DB_PREDEPLOY_MANAGEMENT
-- /MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT
-- /MANAGEMENT_DB_NAME
+To use the default instance of Microsoft SQL Server, use the following parameters:
-**Custom instance of Microsoft SQL Server**: To use a custom instance of Microsoft SQL Server, use the following parameters:
+* */MANAGEMENT_SERVER*
+* */MANAGEMENT_ADMINACCOUNT*
+* */MANAGEMENT_WEBSITE_NAME*
+* */MANAGEMENT_WEBSITE_PORT*
+* */DB_PREDEPLOY_MANAGEMENT*
+* */MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT*
+* */MANAGEMENT_DB_NAME*
-- /MANAGEMENT_SERVER
-- /MANAGEMENT_ADMINACCOUNT
-- /MANAGEMENT_WEBSITE_NAME
-- /MANAGEMENT_WEBSITE_PORT
-- /DB_PREDEPLOY_MANAGEMENT
-- /MANAGEMENT_DB_CUSTOM_SQLINSTANCE
-- /MANAGEMENT_DB_NAME
+### Parameters for a custom instance of Microsoft SQL Server for a new installation on a local machine
-### Example for using a custom instance of Microsoft SQL Server:
+To use a custom instance of Microsoft SQL Server, use the following parameters:
-/appv_server_setup.exe /QUIET
-/MANAGEMENT_SERVER
-/MANAGEMENT_ADMINACCOUNT="Domain\AdminGroup"
-/MANAGEMENT_WEBSITE_NAME="Microsoft AppV Management Service"
-/MANAGEMENT_WEBSITE_PORT="8080"
-/DB_PREDEPLOY_MANAGEMENT
-/MANAGEMENT_DB_CUSTOM_SQLINSTANCE="SqlInstanceName"
+* */MANAGEMENT_SERVER*
+* */MANAGEMENT_ADMINACCOUNT*
+* */MANAGEMENT_WEBSITE_NAME*
+* */MANAGEMENT_WEBSITE_PORT*
+* */DB_PREDEPLOY_MANAGEMENT*
+* */MANAGEMENT_DB_CUSTOM_SQLINSTANCE*
+* */MANAGEMENT_DB_NAME*
+
+### Example parameters for using a custom instance of Microsoft SQL Server for a new installation on a local machine
+
+```SQL
+/appv_server_setup.exe /QUIET
+/MANAGEMENT_SERVER
+/MANAGEMENT_ADMINACCOUNT="Domain\AdminGroup"
+/MANAGEMENT_WEBSITE_NAME="Microsoft AppV Management Service"
+/MANAGEMENT_WEBSITE_PORT="8080"
+/DB_PREDEPLOY_MANAGEMENT
+/MANAGEMENT_DB_CUSTOM_SQLINSTANCE="SqlInstanceName"
/MANAGEMENT_DB_NAME="AppVManagement"
+```
-## To install the Management server using an existing Management database on a local machine
+## How to use common parameters to install the Management server using an existing Management database on a local machine
-**Default instance of Microsoft SQL Server**: To use the default instance of Microsoft SQL Server, use the following parameters:
+The following examples will show you how to install the Management server on a local machine with an existing Management database.
-- /MANAGEMENT_SERVER
-- /MANAGEMENT_ADMINACCOUNT
-- /MANAGEMENT_WEBSITE_NAME
-- /MANAGEMENT_WEBSITE_PORT
-- /EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL
-- /EXISTING_MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT
-- /EXISTING_MANAGEMENT_DB_NAME
+### Default instance of Microsoft SQL Server for installation with an existing Management database on a local machine
-**Custom instance of Microsoft SQL Server**: To use a custom instance of Microsoft SQL Server, use these parameters:
+To use the default instance of Microsoft SQL Server, use the following parameters:
-- /MANAGEMENT_SERVER
-- /MANAGEMENT_ADMINACCOUNT
-- /MANAGEMENT_WEBSITE_NAME
-- /MANAGEMENT_WEBSITE_PORT
-- /EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL
-- /EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE
-- /EXISTING_MANAGEMENT_DB_NAME
+* */MANAGEMENT_SERVER*
+* */MANAGEMENT_ADMINACCOUNT*
+* */MANAGEMENT_WEBSITE_NAME*
+* */MANAGEMENT_WEBSITE_PORT*
+* */EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL*
+* */EXISTING_MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT*
+* */EXISTING_MANAGEMENT_DB_NAME*
-### Example for using a custom instance of Microsoft SQL Server:
+### Custom instance of Microsoft SQL Server for installation with an existing Management database on a local machine
-/appv_server_setup.exe /QUIET
-/MANAGEMENT_SERVER
-/MANAGEMENT_ADMINACCOUNT="Domain\AdminGroup"
-/MANAGEMENT_WEBSITE_NAME="Microsoft AppV Management Service"
-/MANAGEMENT_WEBSITE_PORT="8080"
-/EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL
-/EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE ="SqlInstanceName"
+To use a custom instance of Microsoft SQL Server, use these parameters:
+
+* */MANAGEMENT_SERVER*
+* */MANAGEMENT_ADMINACCOUNT*
+* */MANAGEMENT_WEBSITE_NAME*
+* */MANAGEMENT_WEBSITE_PORT*
+* */EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL*
+* */EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE*
+* */EXISTING_MANAGEMENT_DB_NAME*
+
+### Example parameters for using a custom instance of Microsoft SQL Server for installation with an existing Management database on a local machine
+
+```SQL
+/appv_server_setup.exe /QUIET
+/MANAGEMENT_SERVER
+/MANAGEMENT_ADMINACCOUNT="Domain\AdminGroup"
+/MANAGEMENT_WEBSITE_NAME="Microsoft AppV Management Service"
+/MANAGEMENT_WEBSITE_PORT="8080"
+/EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL
+/EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE ="SqlInstanceName"
/EXISTING_MANAGEMENT_DB_NAME ="AppVManagement"
+```
-## To install the Management server using an existing Management database on a remote machine
+## How to install the Management server with an existing Management database on a remote machine
-**Default instance of Microsoft SQL Server**: To use the default instance of Microsoft SQL Server, use the following parameters:
+### Default instance of Microsoft SQL Server with an existing Management database on a remote machine
-- /MANAGEMENT_SERVER
-- /MANAGEMENT_ADMINACCOUNT
-- /MANAGEMENT_WEBSITE_NAME
-- /MANAGEMENT_WEBSITE_PORT
-- /EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME
-- /EXISTING_MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT
-- /EXISTING_MANAGEMENT_DB_NAME
+To use the default instance of Microsoft SQL Server, use the following parameters:
-**Custom instance of Microsoft SQL Server**: To use a custom instance of Microsoft SQL Server, use these parameters:
+* */MANAGEMENT_SERVER*
+* */MANAGEMENT_ADMINACCOUNT*
+* */MANAGEMENT_WEBSITE_NAME*
+* */MANAGEMENT_WEBSITE_PORT*
+* */EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME*
+* */EXISTING_MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT*
+* */EXISTING_MANAGEMENT_DB_NAME*
-- /MANAGEMENT_SERVER
-- /MANAGEMENT_ADMINACCOUNT
-- /MANAGEMENT_WEBSITE_NAME
-- /MANAGEMENT_WEBSITE_PORT
-- /EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME
-- /EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE
-- /EXISTING_MANAGEMENT_DB_NAME
+### Custom instance of Microsoft SQL Server with an existing Management database on a remote machine
-### Example for using a custom instance of Microsoft SQL Server:
+To use a custom instance of Microsoft SQL Server, use these parameters:
-/appv_server_setup.exe /QUIET
-/MANAGEMENT_SERVER
-/MANAGEMENT_ADMINACCOUNT="Domain\AdminGroup"
-/MANAGEMENT_WEBSITE_NAME="Microsoft AppV Management Service"
-/MANAGEMENT_WEBSITE_PORT="8080"
-/EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME="SqlServermachine.domainName"
-/EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE ="SqlInstanceName"
+* */MANAGEMENT_SERVER*
+* */MANAGEMENT_ADMINACCOUNT*
+* */MANAGEMENT_WEBSITE_NAME*
+* */MANAGEMENT_WEBSITE_PORT*
+* */EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME*
+* */EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE*
+* */EXISTING_MANAGEMENT_DB_NAME*
+
+### Example for using a custom instance of Microsoft SQL Server with an existing Management database on a remote machine
+
+```SQL
+/appv_server_setup.exe /QUIET
+/MANAGEMENT_SERVER
+/MANAGEMENT_ADMINACCOUNT="Domain\AdminGroup"
+/MANAGEMENT_WEBSITE_NAME="Microsoft AppV Management Service"
+/MANAGEMENT_WEBSITE_PORT="8080"
+/EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME="SqlServermachine.domainName"
+/EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE ="SqlInstanceName"
/EXISTING_MANAGEMENT_DB_NAME ="AppVManagement"
+```
-## To install the Management database and the Management Server on the same computer
+## Installing the Management database and the Management Server on the same computer
-**Default instance of Microsoft SQL Server**: To use the default instance of Microsoft SQL Server, use the following parameters:
+The following examples will show you how to install the Management server and database on the same computer.
-- /DB_PREDEPLOY_MANAGEMENT
-- /MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT
-- /MANAGEMENT_DB_NAME
-- /MANAGEMENT_SERVER_MACHINE_USE_LOCAL
-- /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT
+### Default instance of Microsoft SQL Server for installation on the same computer
-**Custom instance of Microsoft SQL Server**: To use a custom instance of Microsoft SQL Server, use these parameters:
+To use the default instance of Microsoft SQL Server, use these parameters:
-- /DB_PREDEPLOY_MANAGEMENT
-- /MANAGEMENT_DB_CUSTOM_SQLINSTANCE
-- /MANAGEMENT_DB_NAME
-- /MANAGEMENT_SERVER_MACHINE_USE_LOCAL
-- /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT
+* */DB_PREDEPLOY_MANAGEMENT*
+* */MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT*
+* */MANAGEMENT_DB_NAME*
+* */MANAGEMENT_SERVER_MACHINE_USE_LOCAL*
+* */MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT*
-### Example for using a custom instance of Microsoft SQL Server:
+### Custom instance of Microsoft SQL Server for installation on the same computer
-/appv_server_setup.exe /QUIET
-/DB_PREDEPLOY_MANAGEMENT
-/MANAGEMENT_DB_CUSTOM_SQLINSTANCE="SqlInstanceName"
-/MANAGEMENT_DB_NAME="AppVManagement"
-/MANAGEMENT_SERVER_MACHINE_USE_LOCAL
+To use a custom instance of Microsoft SQL Server, use these parameters:
+
+* */DB_PREDEPLOY_MANAGEMENT*
+* */MANAGEMENT_DB_CUSTOM_SQLINSTANCE*
+* */MANAGEMENT_DB_NAME*
+* */MANAGEMENT_SERVER_MACHINE_USE_LOCAL*
+* */MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT*
+
+### Example for using a custom instance of Microsoft SQL Server for installation on the same computer
+
+```SQL
+/appv_server_setup.exe /QUIET
+/DB_PREDEPLOY_MANAGEMENT
+/MANAGEMENT_DB_CUSTOM_SQLINSTANCE="SqlInstanceName"
+/MANAGEMENT_DB_NAME="AppVManagement"
+/MANAGEMENT_SERVER_MACHINE_USE_LOCAL
/MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT="Domain\InstallAdminAccount"
+```
-## To install the Management database on a different computer than the Management server
+## Installing the Management database on a different computer than the Management server
-**Default instance of Microsoft SQL Server**: To use the default instance of Microsoft SQL Server, use the following parameters:
+The following examples will show you how to install the Management database and server on different computers.
-- /DB_PREDEPLOY_MANAGEMENT
-- /MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT
-- /MANAGEMENT_DB_NAME
-- /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT
-- /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT
+### Default instance of Microsoft SQL Server for installing the Management database on a different computer than the Management server
-**Custom instance of Microsoft SQL Server**: To use a custom instance of Microsoft SQL Server, use these parameters:
+To use the default instance of Microsoft SQL Server, use the following parameters:
-- /DB_PREDEPLOY_MANAGEMENT
-- /MANAGEMENT_DB_CUSTOM_SQLINSTANCE
-- /MANAGEMENT_DB_NAME
-- /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT
-- /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT
+* */DB_PREDEPLOY_MANAGEMENT*
+* */MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT*
+* */MANAGEMENT_DB_NAME*
+* */MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT*
+* */MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT*
-### Example for using a custom instance of Microsoft SQL Server:
+### Custom instance of Microsoft SQL Server for installing the Management database on a different computer than the Management server
-/appv_server_setup.exe /QUIET
-/DB_PREDEPLOY_MANAGEMENT
-/MANAGEMENT_DB_CUSTOM_SQLINSTANCE="SqlInstanceName"
-/MANAGEMENT_DB_NAME="AppVManagement"
-/MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT="Domain\MachineAccount"
+To use a custom instance of Microsoft SQL Server, use these parameters:
+
+* */DB_PREDEPLOY_MANAGEMENT*
+* */MANAGEMENT_DB_CUSTOM_SQLINSTANCE*
+* */MANAGEMENT_DB_NAME*
+* */MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT*
+* */MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT*
+
+### Example for using a custom instance of Microsoft SQL Server for installing the Management database on a different computer than the Management server
+
+```SQL
+/appv_server_setup.exe /QUIET
+/DB_PREDEPLOY_MANAGEMENT
+/MANAGEMENT_DB_CUSTOM_SQLINSTANCE="SqlInstanceName"
+/MANAGEMENT_DB_NAME="AppVManagement"
+/MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT="Domain\MachineAccount"
/MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT="Domain\InstallAdminAccount"
+```
-## To install the Publishing server
+## Installing the Publishing server
-**Default instance of Microsoft SQL Server**: To use the default instance of Microsoft SQL Server, use the following parameters:
+The following examples will show you how to install the Publishing server.
-- /PUBLISHING_SERVER
-- /PUBLISHING_MGT_SERVER
-- /PUBLISHING_WEBSITE_NAME
-- /PUBLISHING_WEBSITE_PORT
+### Default instance of Microsoft SQL Server for installing the Publishing server
-### Example
+To use the default instance of Microsoft SQL Server, use the following parameters:
-/appv_server_setup.exe /QUIET
-/PUBLISHING_SERVER
-/PUBLISHING_MGT_SERVER="http://ManagementServerName:ManagementPort"
-/PUBLISHING_WEBSITE_NAME="Microsoft AppV Publishing Service"
+* */PUBLISHING_SERVER*
+* */PUBLISHING_MGT_SERVER*
+* */PUBLISHING_WEBSITE_NAME*
+* */PUBLISHING_WEBSITE_PORT*
+
+### Example for installing the Publishing server
+
+```SQL
+/appv_server_setup.exe /QUIET
+/PUBLISHING_SERVER
+/PUBLISHING_MGT_SERVER="http://ManagementServerName:ManagementPort"
+/PUBLISHING_WEBSITE_NAME="Microsoft AppV Publishing Service"
/PUBLISHING_WEBSITE_PORT="8081"
+```
-## To install the Reporting server and Reporting database on a local machine
+## Installing the Reporting server and Reporting database on a local machine
-**Default instance of Microsoft SQL Server**: To use the default instance of Microsoft SQL Server, use the following parameters:
+The following examples will show you how to install the Reporting server and database on a local machine.
-- /REPORTING _SERVER
-- /REPORTING _WEBSITE_NAME
-- /REPORTING _WEBSITE_PORT
-- /DB_PREDEPLOY_REPORTING
-- /REPORTING _DB_SQLINSTANCE_USE_DEFAULT
-- /REPORTING _DB_NAME
+### Default instance of Microsoft SQL Server for installing the Reporting server and Reporting database on a local machine
-**Custom instance of Microsoft SQL Server**: To use a custom instance of Microsoft SQL Server, use these parameters:
+To use the default instance of Microsoft SQL Server, use the following parameters:
-- /REPORTING _SERVER
-- /REPORTING _ADMINACCOUNT
-- /REPORTING _WEBSITE_NAME
-- /REPORTING _WEBSITE_PORT
-- /DB_PREDEPLOY_REPORTING
-- /REPORTING _DB_CUSTOM_SQLINSTANCE
-- /REPORTING _DB_NAME
+* */REPORTING_SERVER*
+* */REPORTING_WEBSITE_NAME*
+* */REPORTING_WEBSITE_PORT*
+* */DB_PREDEPLOY_REPORTING*
+* */REPORTING_DB_SQLINSTANCE_USE_DEFAULT*
+* */REPORTING_DB_NAME*
-### Example for using a custom instance of Microsoft SQL Server:
+### Custom instance of Microsoft SQL Server for installing the Reporting server and Reporting database on a local machine
-/appv_server_setup.exe /QUIET
-/REPORTING_SERVER
-/REPORTING_WEBSITE_NAME="Microsoft AppV Reporting Service"
-/REPORTING_WEBSITE_PORT="8082"
-/DB_PREDEPLOY_REPORTING
-/REPORTING_DB_CUSTOM_SQLINSTANCE="SqlInstanceName"
+To use a custom instance of Microsoft SQL Server, use these parameters:
+
+* */REPORTING_SERVER*
+* */REPORTING_ADMINACCOUNT*
+* */REPORTING_WEBSITE_NAME*
+* */REPORTING_WEBSITE_PORT*
+* */DB_PREDEPLOY_REPORTING*
+* */REPORTING_DB_CUSTOM_SQLINSTANCE*
+* */REPORTING_DB_NAME*
+
+### Example for using a custom instance of Microsoft SQL Server for installing the Reporting server and Reporting database on a local machine
+
+```SQL
+/appv_server_setup.exe /QUIET
+/REPORTING_SERVER
+/REPORTING_WEBSITE_NAME="Microsoft AppV Reporting Service"
+/REPORTING_WEBSITE_PORT="8082"
+/DB_PREDEPLOY_REPORTING
+/REPORTING_DB_CUSTOM_SQLINSTANCE="SqlInstanceName"
/REPORTING_DB_NAME="AppVReporting"
+```
-## To install the Reporting server using an existing Reporting database on a local machine
+## Installing the Reporting server using an existing Reporting database on a local machine
-**Default instance of Microsoft SQL Server**: To use the default instance of Microsoft SQL Server, use the following parameters:
+The following examples will show you how to install the reporting machine on a local machine with an existing Reporting database.
-- /REPORTING _SERVER
-- /REPORTING _WEBSITE_NAME
-- /REPORTING _WEBSITE_PORT
-- /EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL
-- /EXISTING_REPORTING_DB_SQLINSTANCE_USE_DEFAULT
-- /EXISTING_REPORTING_DB_NAME
+### Default instance of Microsoft SQL Server for installing the Reporting server using an existing Reporting database on a local machine
-**Custom instance of Microsoft SQL Server**: To use a custom instance of Microsoft SQL Server, use these parameters:
+To use the default instance of Microsoft SQL Server, use the following parameters:
-- /REPORTING _SERVER
-- /REPORTING _ADMINACCOUNT
-- /REPORTING _WEBSITE_NAME
-- /REPORTING _WEBSITE_PORT
-- /EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL
-- /EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE
-- /EXISTING_REPORTING _DB_NAME
+* */REPORTING_SERVER*
+* */REPORTING_WEBSITE_NAME*
+* */REPORTING_WEBSITE_PORT*
+* */EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL*
+* */EXISTING_REPORTING_DB_SQLINSTANCE_USE_DEFAULT*
+* */EXISTING_REPORTING_DB_NAME*
-### Example for using a custom instance of Microsoft SQL Server:
+### Custom instance of Microsoft SQL Server for installing the Reporting server using an existing Reporting database on a local machine
-/appv_server_setup.exe /QUIET
-/REPORTING_SERVER
-/REPORTING_WEBSITE_NAME="Microsoft AppV Reporting Service"
-/REPORTING_WEBSITE_PORT="8082"
-/EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL
-/EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE="SqlInstanceName"
+To use a custom instance of Microsoft SQL Server, use these parameters:
+
+* */REPORTING_SERVER*
+* */REPORTING_ADMINACCOUNT*
+* */REPORTING_WEBSITE_NAME*
+* */REPORTING_WEBSITE_PORT*
+* */EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL*
+* */EXISTING_REPORTING_DB_CUSTOM_SQLINSTANCE*
+* */EXISTING_REPORTING_DB_NAME*
+
+### Example for using a custom instance of Microsoft SQL Server for installing the Reporting server using an existing Reporting database on a local machine
+
+```SQL
+/appv_server_setup.exe /QUIET
+/REPORTING_SERVER
+/REPORTING_WEBSITE_NAME="Microsoft AppV Reporting Service"
+/REPORTING_WEBSITE_PORT="8082"
+/EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL
+/EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE="SqlInstanceName"
/EXITING_REPORTING_DB_NAME="AppVReporting"
+```
-## To install the Reporting server using an existing Reporting database on a remote machine
+## Installing the Reporting server using an existing Reporting database on a remote machine
-**Default instance of Microsoft SQL Server**: To use the default instance of Microsoft SQL Server, use the following parameters:
+The following examples will show you how to install the Reporting server and on a remote machine with an existing database.
-- /REPORTING _SERVER
-- /REPORTING _WEBSITE_NAME
-- /REPORTING _WEBSITE_PORT
-- /EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME
-- /EXISTING_REPORTING _DB_SQLINSTANCE_USE_DEFAULT
-- /EXISTING_REPORTING _DB_NAME
-
-**Custom instance of Microsoft SQL Server**: To use a custom instance of Microsoft SQL Server, use these parameters:
+### Default instance of Microsoft SQL Server for installing the Reporting server using an existing Reporting database on a remote machine
-- /REPORTING _SERVER
-- /REPORTING _ADMINACCOUNT
-- /REPORTING _WEBSITE_NAME
-- /REPORTING _WEBSITE_PORT
-- /EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME
-- /EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE
-- /EXISTING_REPORTING _DB_NAME
+To use the default instance of Microsoft SQL Server, use the following parameters:
-### Example for using a custom instance of Microsoft SQL Server:
+* */REPORTING_SERVER*
+* */REPORTING_WEBSITE_NAME*
+* */REPORTING_WEBSITE_PORT*
+* */EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME*
+* */EXISTING_REPORTING_DB_SQLINSTANCE_USE_DEFAULT*
+* */EXISTING_REPORTING_DB_NAME*
-/appv_server_setup.exe /QUIET
-/REPORTING_SERVER
-/REPORTING_WEBSITE_NAME="Microsoft AppV Reporting Service"
-/REPORTING_WEBSITE_PORT="8082"
-/EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME="SqlServerMachine.DomainName"
-/EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE="SqlInstanceName"
+### Custom instance of Microsoft SQL Server for installing the Reporting server using an existing Reporting database on a remote machine
+
+To use a custom instance of Microsoft SQL Server, use these parameters:
+
+* */REPORTING_SERVER*
+* */REPORTING_ADMINACCOUNT*
+* */REPORTING_WEBSITE_NAME*
+* */REPORTING_WEBSITE_PORT*
+* */EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME*
+* */EXISTING_REPORTING_DB_CUSTOM_SQLINSTANCE*
+* */EXISTING_REPORTING_DB_NAME*
+
+### Example using a custom instance of Microsoft SQL Server for installing the Reporting server using an existing Reporting database on a remote machine
+
+```SQL
+/appv_server_setup.exe /QUIET
+/REPORTING_SERVER
+/REPORTING_WEBSITE_NAME="Microsoft AppV Reporting Service"
+/REPORTING_WEBSITE_PORT="8082"
+/EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME="SqlServerMachine.DomainName"
+/EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE="SqlInstanceName"
/EXITING_REPORTING_DB_NAME="AppVReporting"
+```
-## To install the Reporting database on the same computer as the Reporting server
+## Installing the Reporting database on the same computer as the Reporting server
-**Default instance of Microsoft SQL Server**: To use the default instance of Microsoft SQL Server, use the following parameters:
+The following examples will show you how to install the Reporting database and server on the same computer.
-- /DB_PREDEPLOY_REPORTING
-- /REPORTING_DB_SQLINSTANCE_USE_DEFAULT
-- /REPORTING_DB_NAME
-- /REPORTING_SERVER_MACHINE_USE_LOCAL
-- /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT
+### Default instance of Microsoft SQL Server for installing the Reporting database on the same computer as the Reporting server
-**Custom instance of Microsoft SQL Server**: To use a custom instance of Microsoft SQL Server, use these parameters:
+To use the default instance of Microsoft SQL Server, use the following parameters:
-- /DB_PREDEPLOY_REPORTING
-- /REPORTING _DB_CUSTOM_SQLINSTANCE
-- /REPORTING _DB_NAME
-- /REPORTING_SERVER_MACHINE_USE_LOCAL
-- /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT
+* */DB_PREDEPLOY_REPORTING*
+* */REPORTING_DB_SQLINSTANCE_USE_DEFAULT*
+* */REPORTING_DB_NAME*
+* */REPORTING_SERVER_MACHINE_USE_LOCAL*
+* */REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT*
-### Example for using a custom instance of Microsoft SQL Server:
+### Custom instance of Microsoft SQL Server for installing the Reporting database on the same computer as the Reporting server
-/appv_server_setup.exe /QUIET
-/DB_PREDEPLOY_REPORTING
-/REPORTING_DB_CUSTOM_SQLINSTANCE="SqlInstanceName"
-/REPORTING_DB_NAME="AppVReporting"
-/REPORTING_SERVER_MACHINE_USE_LOCAL
+To use a custom instance of Microsoft SQL Server, use these parameters:
+
+* */DB_PREDEPLOY_REPORTING*
+* */REPORTING_DB_CUSTOM_SQLINSTANCE*
+* */REPORTING_DB_NAME*
+* */REPORTING_SERVER_MACHINE_USE_LOCAL*
+* */REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT*
+
+### Example for using a custom instance of Microsoft SQL Server for installing the Reporting database on the same computer as the Reporting server
+
+```SQL
+/appv_server_setup.exe /QUIET
+/DB_PREDEPLOY_REPORTING
+/REPORTING_DB_CUSTOM_SQLINSTANCE="SqlInstanceName"
+/REPORTING_DB_NAME="AppVReporting"
+/REPORTING_SERVER_MACHINE_USE_LOCAL
/REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT="Domain\InstallAdminAccount"
+```
-## To install the Reporting database on a different computer than the Reporting server
+## Installing the Reporting database on a different computer than the Reporting server
-**Default instance of Microsoft SQL Server**: To use the default instance of Microsoft SQL Server, use the following parameters:
+The following examples will show you how to install the Reporting database and server on different computers.
-- /DB_PREDEPLOY_REPORTING
-- /REPORTING _DB_SQLINSTANCE_USE_DEFAULT
-- /REPORTING _DB_NAME
-- /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT
-- /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT
+### Default instance of Microsoft SQL Server for installing the Reporting database on a different computer than the Reporting server
-**Custom instance of Microsoft SQL Server**: To use a custom instance of Microsoft SQL Server, use these parameters:
+To use the default instance of Microsoft SQL Server, use the following parameters:
-- /DB_PREDEPLOY_REPORTING
-- /REPORTING _DB_CUSTOM_SQLINSTANCE
-- /REPORTING _DB_NAME
-- /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT
-- /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT
+* */DB_PREDEPLOY_REPORTING*
+* */REPORTING_DB_SQLINSTANCE_USE_DEFAULT*
+* */REPORTING_DB_NAME*
+* */REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT*
+* */REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT*
-### Example for using a custom instance of Microsoft SQL Server:
+### Custom instance of Microsoft SQL Server for installing the Reporting database on a different computer than the Reporting server
+To use a custom instance of Microsoft SQL Server, use these parameters:
+
+* */DB_PREDEPLOY_REPORTING*
+* */REPORTING_DB_CUSTOM_SQLINSTANCE*
+* */REPORTING_DB_NAME*
+* */REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT*
+* */REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT*
+
+### Example for using a custom instance of Microsoft SQL Server for installing the Reporting database on a different computer than the Reporting server
+
+```SQL
Using a custom instance of Microsoft SQL Server example:
/appv_server_setup.exe /QUIET
/DB_PREDEPLOY_REPORTING
@@ -342,105 +420,104 @@ Using a custom instance of Microsoft SQL Server example:
/REPORTING_DB_NAME="AppVReporting"
/REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT="Domain\MachineAccount"
/REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT="Domain\InstallAdminAccount"
+```
## Parameter definitions
-- [General parameters](#parameter-definitions-for-general-parameters)
-- [Management Server installation parameters](#parameter-definitions-for-management-server-installation-parameters)
-- [Management Server Database parameters](#parameter-definitions-for-the-management-server-database)
-- [Publishing Server installation parameters](#parameter-definitions-for-publishing-server-installation-parameters)
-- [Reporting Server parameters](#parameter-definitions-for-reporting-server)
-- [Parameters for using an existing Reporting Server database](#parameters-for-using-an-existing-reporting-server-database)
-- [Reporting Server database installation parameters](#parameter-definitions-for-reporting-server-database-installation)
-- [Parameters for using an existing Management Server database](#parameters-for-using-an-existing-management-server-database)
+* [General parameters](#parameter-definitions-for-general-parameters)
+* [Management Server installation parameters](#parameter-definitions-for-management-server-installation-parameters)
+* [Management Server Database parameters](#parameter-definitions-for-the-management-server-database)
+* [Publishing Server installation parameters](#parameter-definitions-for-publishing-server-installation-parameters)
+* [Reporting Server parameters](#parameter-definitions-for-reporting-server)
+* [Parameters for using an existing Reporting Server database](#parameters-for-using-an-existing-reporting-server-database)
+* [Reporting Server database installation parameters](#parameter-definitions-for-reporting-server-database-installation)
+* [Parameters for using an existing Management Server database](#parameters-for-using-an-existing-management-server-database)
### Parameter definitions for general parameters
| Parameter | Description |
|-----------|-------------|
-| /QUIET | Specifies silent install. |
-| /UNINSTALL | Specifies an uninstall. |
-| /LAYOUT | Specifies layout action. This extracts the MSIs and script files to a folder without actually installing the product. No value is expected. |
-| /LAYOUTDIR | Specifies the layout directory. Takes a string. For example, /LAYOUTDIR="C:\Application Virtualization Server" |
-| /INSTALLDIR | Specifies the installation directory. Takes a string. E.g. /INSTALLDIR="C:\Program Files\Application Virtualization\Server" |
-| /MUOPTIN | Enables Microsoft Update. No value is expected |
-| /ACCEPTEULA | Accepts the license agreement. This is required for an unattended installation. Example usage: **/ACCEPTEULA** or **/ACCEPTEULA=1**. |
+| */QUIET* | Specifies silent install. |
+| */UNINSTALL* | Specifies an uninstall. |
+| */LAYOUT* | Specifies layout action. This extracts the MSIs and script files to a folder without installing the actual product. No value is expected. |
+| */LAYOUTDIR* | Specifies the layout directory with a string. For example, ```/LAYOUTDIR="C:\Application Virtualization Server"```. |
+| */INSTALLDIR* | Specifies the installation directory with a string. For example, ```/INSTALLDIR="C:\Program Files\Application Virtualization\Server"```. |
+| */MUOPTIN* | Enables Microsoft Update. No value is expected. |
+| */ACCEPTEULA* | Accepts the license agreement. This is required for an unattended installation. For example, ```/ACCEPTEULA``` or ```/ACCEPTEULA=1```. |
### Parameter definitions for Management Server installation parameters
| Parameter | Description |
|-----------|-------------|
-| /MANAGEMENT_SERVER | Specifies that the management server will be installed. No value is expected |
-| /MANAGEMENT_ADMINACCOUNT | Specifies the account that will be allowed to Administrator access to the management server This account can be an individual user account or a group. Example usage: **/MANAGEMENT_ADMINACCOUNT="mydomain\admin"**. If **/MANAGEMENT_SERVER** is not specified, this will be ignored. Specifies the account that will be allowed to Administrator access to the management server. This can be a user account or a group. For example, **/MANAGEMENT_ADMINACCOUNT="mydomain\admin"**. |
-| /MANAGEMENT_WEBSITE_NAME | Specifies name of the website that will be created for the management service. For example, /MANAGEMENT_WEBSITE_NAME="Microsoft App-V Management Service" |
-| /MANAGEMENT_WEBSITE_PORT | Specifies the port number that will be used by the management service will use. For example, /MANAGEMENT_WEBSITE_PORT=82. |
+| */MANAGEMENT_SERVER* | Specifies that the management server will be installed. No value is expected. |
+| */MANAGEMENT_ADMINACCOUNT* | Specifies the account that will be allowed administrator access to the management server. This account can be an individual user account or a group. For example, ```/MANAGEMENT_ADMINACCOUNT="mydomain\admin"```. If **/MANAGEMENT_SERVER** isn't specified, this parameter will be ignored.|
+| */MANAGEMENT_WEBSITE_NAME* | Specifies name of the website that will be created for the management service. For example, ```/MANAGEMENT_WEBSITE_NAME="Microsoft App-V Management Service"``` |
+| */MANAGEMENT_WEBSITE_PORT* | Specifies the port number that will be used by the management service will use. For example, ```/MANAGEMENT_WEBSITE_PORT=82```. |
### Parameter definitions for the Management Server Database
| Parameter | Description |
|-----------|-------------|
-| /DB\_PREDEPLOY\_MANAGEMENT | Specifies that the management database will be installed. You must have sufficient database permissions to complete this installation. No value is expected |
-| /MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT | Indicates that the default SQL instance should be used. No value is expected. |
-| /MANAGEMENT_DB_CUSTOM_SQLINSTANCE | Specifies the name of the custom SQL instance that should be used to create a new database. Example usage: **/MANAGEMENT_DB_CUSTOM_SQLINSTANCE="MYSQLSERVER"**. If /DB_PREDEPLOY_MANAGEMENT is not specified, this will be ignored. |
-| /MANAGEMENT_DB_NAME | Specifies the name of the new management database that should be created. Example usage: **/MANAGEMENT_DB_NAME="AppVMgmtDB"**. If /DB_PREDEPLOY_MANAGEMENT is not specified, this will be ignored. |
-| /MANAGEMENT_SERVER_MACHINE_USE_LOCAL | Indicates if the management server that will be accessing the database is installed on the local server. Switch parameter so no value is expected. |
-| /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT | Specifies the machine account of the remote machine that the management server will be installed on. Example usage: **/MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT="domain\computername"** |
-| /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT | Indicates the Administrator account that will be used to install the management server. Example usage: **/MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT ="domain\alias"** |
+| */DB\_PREDEPLOY\_MANAGEMENT* | Specifies that the management database will be installed. You must have sufficient database permissions to complete this installation. No value is expected. |
+| */MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT* | Indicates that the default SQL instance should be used. No value is expected. |
+| */MANAGEMENT_DB_CUSTOM_SQLINSTANCE* | Specifies the name of the custom SQL instance that should be used to create a new database. For example, ```/MANAGEMENT_DB_CUSTOM_SQLINSTANCE="MYSQLSERVER"```. If **/DB_PREDEPLOY_MANAGEMENT** isn't specified, this parameter will be ignored. |
+| */MANAGEMENT_DB_NAME* | Specifies the name of the new management database that should be created. For example, ```/MANAGEMENT_DB_NAME="AppVMgmtDB"```. If **/DB_PREDEPLOY_MANAGEMENT** isn't specified, this will be ignored. |
+| */MANAGEMENT_SERVER_MACHINE_USE_LOCAL* | Indicates if the management server that will be accessing the database is installed on the local server. This is a switch parameter, so no value is expected. |
+| */MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT* | Specifies the machine account of the remote machine that the management server will be installed on. For example, ```/MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT="domain\computername"```. |
+| */MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT* | Indicates the Administrator account that will be used to install the management server. For example, ```/MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT ="domain\alias"```. |
### Parameter definitions for Publishing Server installation parameters
| Parameter | Description |
|-----------|-------------|
-| /PUBLISHING_SERVER | Specifies that the Publishing Server will be installed. No value is expected |
-| /PUBLISHING_MGT_SERVER | Specifies the URL to Management Service the Publishing server will connect to. Example usage: **http://<management server name>:<Management server port number>**. If /PUBLISHING_SERVER is not used, this parameter will be ignored |
-| /PUBLISHING_WEBSITE_NAME | Specifies name of the website that will be created for the publishing service. For example, /PUBLISHING_WEBSITE_NAME="Microsoft App-V Publishing Service" |
-| /PUBLISHING_WEBSITE_PORT | Specifies the port number used by the publishing service. For example, /PUBLISHING_WEBSITE_PORT=83 |
+| */PUBLISHING_SERVER* | Specifies that the publishing server will be installed. No value is expected. |
+| */PUBLISHING_MGT_SERVER* | Specifies the URL to Management Service the Publishing server will connect to. For example, ```http://
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv).
+Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
## Related topics
-[Deploying the App-V Server](appv-deploying-the-appv-server.md)
+* [Deploying the App-V Server](appv-deploying-the-appv-server.md)
\ No newline at end of file
diff --git a/windows/application-management/app-v/appv-deploy-the-appv-server.md b/windows/application-management/app-v/appv-deploy-the-appv-server.md
index 70121311f4..4ffe1ba432 100644
--- a/windows/application-management/app-v/appv-deploy-the-appv-server.md
+++ b/windows/application-management/app-v/appv-deploy-the-appv-server.md
@@ -6,120 +6,92 @@ ms.pagetype: mdop, appcompat, virtualization
ms.mktglfcycl: deploy
ms.sitesec: library
ms.prod: w10
-ms.date: 04/19/2017
+ms.date: 04/18/2018
---
-
# How to Deploy the App-V Server (new installation)
-**Applies to**
-- Windows Server 2016
+>Applies to: Windows Server 2016
->**Important**
If you're already using App-V 5.x, you don't need to re-deploy the App-V server components as they haven't changed since App-V 5.0 was released.
+## Before you start
-**Before you start:**
+>[!IMPORTANT]
+>If you're already using App-V 5.x, you don't need to re-deploy the App-V server components as they haven't changed since App-V 5.0 was released.
-- Ensure that you’ve installed required software. See [App-V Prerequisites](appv-prerequisites.md).
+* Ensure that you’ve installed required software. See [App-V prerequisites](appv-prerequisites.md).
+* Review the server section of [App-V security considerations](appv-security-considerations.md).
+* Specify a port where each component will be hosted.
+* Add firewall rules to allow incoming requests to access the specified ports.
+* If you use SQL scripts instead of the Windows Installer to set up the Management database or Reporting database, you must run the required SQL scripts before installing the Management Server or Reporting Server. See [How to deploy the App-V databases by using SQL scripts](appv-deploy-appv-databases-with-sql-scripts.md).
-- Review the server section of [App-V security considerations](appv-security-considerations.md).
+## Installing the App-V server
-- Specify a port where each component will be hosted.
+1. Download the App-V server components. All five App-V server components are included in the Microsoft Desktop Optimization Pack (MDOP) 2015 ISO package, which can be downloaded from either of the following locations:
-- Add firewall rules to allow incoming requests to access the specified ports.
-
-- If you use SQL scripts, instead of the Windows Installer, to set up the Management database or Reporting database, you must run the SQL scripts before installing the Management Server or Reporting Server. See [How to Deploy the App-V Databases by Using SQL Scripts](appv-deploy-appv-databases-with-sql-scripts.md).
-
-**To install the App-V server**
-
-1. Download the App-V server components. All five App-V server components are included in the Microsoft Desktop Optimization Pack (MDOP) 2015 ISO package, which can be downloaded from:
-
- - The [MSDN (Microsoft Developer Network) subscriptions site](https://msdn.microsoft.com/en-us/subscriptions/downloads/default.aspx#FileId=65215) You must have a MSDN subscription to download the MDOP ISO package from the MSDN subscriptions site.
-
- - The [Volume Licensing Service Center](https://www.microsoft.com/en-us/licensing/default.aspx) if you're using [Windows 10 for Enterprise or Education](https://www.microsoft.com/en-us/WindowsForBusiness/windows-product-home).
-
-2. Copy the App-V server installation files to the computer on which you want to install it.
-
-3. Start the App-V server installation by right-clicking and running **appv\_server\_setup.exe** as an administrator, and then click **Install**.
-
-4. Review and accept the license terms, and choose whether to enable Microsoft updates.
-
-5. On the **Feature Selection** page, select all of the following components.
+ * The [MSDN (Microsoft Developer Network) subscriptions site](https://msdn.microsoft.com/en-us/subscriptions/downloads/default.aspx#FileId=65215). You must have a MSDN subscription to download the MDOP ISO package from this site.
+ * The [Volume Licensing Service Center](https://www.microsoft.com/en-us/licensing/default.aspx) if you're using [Windows 10 for Enterprise or Education](https://www.microsoft.com/en-us/WindowsForBusiness/windows-product-home).
+2. Copy the App-V server installation files to the computer on which you want to install it.
+3. Start the App-V server installation by right-clicking and running **appv\_server\_setup.exe** as an administrator, and then click **Install**.
+4. Review and accept the license terms, and choose whether to enable Microsoft updates.
+5. On the **Feature Selection** page, select all components listed in the following table.
| Component | Description |
- | - | - |
+ |---|---|
| Management server | Provides overall management functionality for the App-V infrastructure. |
| Management database | Facilitates database predeployments for App-V management. |
| Publishing server | Provides hosting and streaming functionality for virtual applications. |
| Reporting server | Provides App-V reporting services. |
| Reporting database | Facilitates database predeployments for App-V reporting. |
-
-6. On the **Installation Location** page, accept the default location where the selected components will be installed, or change the location by typing a new path on the **Installation Location** line.
-
-7. On the initial **Create New Management Database** page, configure the **Microsoft SQL Server instance** and **Management Server database** by selecting the appropriate option below.
+6. On the **Installation Location** page, accept the default location where the selected components will be installed, or change the location by typing a new path on the **Installation Location** line.
+7. On the initial **Create New Management Database** page, configure the **Microsoft SQL Server instance** and **Management Server database** by selecting the appropriate option below.
| Method | What you need to do |
- | - | - |
- | You are using a custom Microsoft SQL Server instance. | Select **Use the custom instance**, and type the name of the instance.
Use the format **INSTANCENAME**. The assumed installation location is the local computer.
Not supported: A server name using the format **ServerName**\\**INSTANCE**.|
+ |---|---|
+ | You are using a custom Microsoft SQL Server instance. | Select **Use the custom instance**, then specify the instance name.
Use the format **INSTANCENAME**. The assumed installation location is the local computer.
Not supported: A server name using the format **ServerName**\\**INSTANCE**.|
| You are using a custom database name. | Select **Custom configuration** and type the database name.
The database name must be unique, or the installation will fail.|
+8. On the **Configure** page, accept the default value, **Use this local computer**.
-8. On the **Configure** page, accept the default value **Use this local computer**.
-
- >**Note** If you are installing the Management server and Management database side by side, some options on this page are not available. In this case, the appropriate options are selected by default and cannot be changed.
-
-9. On the initial **Create New Reporting Database** page, configure the **Microsoft SQL Server instance** and **Reporting Server database** by selecting the appropriate option below.
+ >[!NOTE]
+ >If you're installing the Management server and Management database side-by-side, the appropriate options are selected by default and cannot be changed.
+9. On the initial **Create New Reporting Database** page, configure the **Microsoft SQL Server instance** and **Reporting Server database** by selecting the appropriate option below.
| Method | What you need to do |
- | - | - |
+ |---|---|
| You are using a custom Microsoft SQL Server instance. | Select **Use the custom instance**, and type the name of the instance.
Use the format **INSTANCENAME**. The assumed installation location is the local computer.
Not supported: A server name using the format **ServerName**\\**INSTANCE**.|
| You are using a custom database name. | Select **Custom configuration** and type the database name.
The database name must be unique, or the installation will fail.|
-
-
10. On the **Configure** page, accept the default value: **Use this local computer**.
- >**Note**
- > If you are installing the Management server and Management database side by side, some options on this page are not available. In this case, the appropriate options are selected by default and cannot be changed.
-
-
+ >[!NOTE]
+ >If you're installing the Management server and Management database side-by-side, the appropriate options are selected by default and cannot be changed.
11. On the **Configure** (Management Server Configuration) page, specify the following:
| Item to configure | Description and examples |
- | - | - |
- | Type the AD group with sufficient permissions to manage the App-V environment. | Example: MyDomain\MyUser
After installation, you can add users or groups on the management console. However, global security groups and Active Directory Domain Services (AD DS) distribution groups are not supported. You must use Domain local or Universal groups to perform this action.|
- | **Website name**: Specify the custom name that will be used to run the publishing service.
| If you do not have a custom name, do not make any changes.|
- |**Port binding**: Specify a unique port number that will be used by App-V. | Example: **12345**
Ensure that the port specified is not being used by another website. |
-
+ |---|---|
+ | Specify AD group | Specify the AD group with sufficient permissions to manage the App-V environment. Example: MyDomain\MyUser
After installation, you can add users or groups on the management console. However, global security groups and Active Directory Domain Services (AD DS) distribution groups are not supported. You must use Domain local or Universal groups to perform this action.|
+ |Website name | Specify the custom name that will be used to run the publishing service.
If you do not have a custom name, you don't have to change it.|
+ |Port binding | Specify a unique port number that will be used by App-V. Example: **12345**
Ensure that the port specified is not being used by another website. |
12. On the **Configure Publishing Server Configuration** page, specify the following:
| Item to configure | Description and examples |
- | - | - |
- | Specify the URL for the management service. | Example: http://localhost:12345 |
- | **Website name**: Specify the custom name that will be used to run the publishing service.| If you do not have a custom name, do not make any changes. |
- | **Port binding**: Specify a unique port number that will be used by App-V. | Example: 54321
Ensure that the port specified is not being used by another website. |
-
+ |---|---|
+ | Specify the management service URL | Example: http://localhost:12345 |
+ | Website name | Specify the custom website name that will be used to run the publishing service.
If you do not have a custom name, do not make any changes. |
+ | Port binding | Specify a unique port number that will be used by App-V. Example: 54321
Ensure that the port specified is not being used by another website. |
13. On the **Reporting Server** page, specify the following:
| Item to configure | Description and examples |
- | - | - |
- | **Website name**: Specify the custom name that will be used to run the Reporting Service. | If you do not have a custom name, do not make any changes. |
- | **Port binding**: Specify a unique port number that will be used by App-V. | Example: 55555
Ensure that the port specified is not being used by another website. |
-
+ |---|---|
+ | Website name | Specify the custom name that will be used to run the Reporting Service.
If you do not have a custom name, do not make any changes. |
+ | Port binding | Specify a unique port number that will be used by App-V. Example: 55555
Ensure that the port specified is not being used by another website.|
14. To start the installation, click **Install** on the **Ready** page, and then click **Close** on the **Finished** page.
+15. To verify that the setup completed successfully, open a web browser, and type the following URL with the bracketed variables adjusted according to your specifications in the earlier steps:
-15. To verify that the setup completed successfully, open a web browser, and type the following URL:
+ ```http://
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv).
+ Example: ```http://localhost:12345/console.html```. If the installation succeeded, the App-V Management console will display with no errors.
## Related topics
-- [Deploying App-V](appv-deploying-appv.md)
-
-- [How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services](appv-install-the-management-and-reporting-databases-on-separate-computers.md)
-
-- [How to Install the Publishing Server on a Remote Computer](appv-install-the-publishing-server-on-a-remote-computer.md)
-
-- [How to Deploy the App-V Server Using a Script](appv-deploy-the-appv-server-with-a-script.md)
+* [Deploying App-V](appv-deploying-appv.md)
+* [How to install the management and reporting databases on separate computers from the management and reporting services](appv-install-the-management-and-reporting-databases-on-separate-computers.md)
+* [How to install the publishing server on a remote computer](appv-install-the-publishing-server-on-a-remote-computer.md)
+* [How to deploy the App-V server using a script](appv-deploy-the-appv-server-with-a-script.md)
\ No newline at end of file
diff --git a/windows/application-management/app-v/appv-deploying-appv.md b/windows/application-management/app-v/appv-deploying-appv.md
index d6d019fcff..1d2034eb89 100644
--- a/windows/application-management/app-v/appv-deploying-appv.md
+++ b/windows/application-management/app-v/appv-deploying-appv.md
@@ -6,52 +6,41 @@ ms.pagetype: mdop, appcompat, virtualization
ms.mktglfcycl: deploy
ms.sitesec: library
ms.prod: w10
-ms.date: 04/19/2017
+ms.date: 04/18/2018
---
-
# Deploying App-V for Windows 10
-**Applies to**
-- Windows 10, version 1607
+>Applies to: Windows 10, version 1607
-App-V supports a number of different deployment options. Review this topic for information about the tasks that you must complete at different stages in your deployment.
+App-V supports several different deployment options. Review this topic for information about the tasks that you must complete at different stages in your deployment.
## App-V Deployment Information
+* [Deploying the App-V Sequencer and configuring the client](appv-deploying-the-appv-sequencer-and-client.md)
-- [Deploying the App-V Sequencer and Configuring the Client](appv-deploying-the-appv-sequencer-and-client.md)
+ This section describes how to install the App-V sequencer used to virtualize applications, and how to enable the App-V client that runs on target computers to facilitate virtualized packages.
+* [Deploying the App-V server](appv-deploying-the-appv-server.md)
- This section describes how to install the App-V sequencer, which is used to virtualize applications, and how to enable the App-V client, which runs on target computers to facilitate virtualized packages.
-
-- [Deploying the App-V Server](appv-deploying-the-appv-server.md)
-
- This section provides information about installing the App-V management, publishing, database and reporting severs.
-
-- [App-V Deployment Checklist](appv-deployment-checklist.md)
+ This section provides information about installing the App-V management, publishing, database, and reporting severs.
+* [App-V deployment checklist](appv-deployment-checklist.md)
This section provides a deployment checklist that can be used to assist with installing App-V.
-- [Deploying Microsoft Office 2016 by Using App-V](appv-deploying-microsoft-office-2016-with-appv.md)
-[Deploying Microsoft Office 2013 by Using App-V](appv-deploying-microsoft-office-2013-with-appv.md)
-[Deploying Microsoft Office 2010 by Using App-V](appv-deploying-microsoft-office-2010-wth-appv.md)
+The following sections describe how to use App-V to deliver Microsoft Office as a virtualized application to computers in your organization.
- These sections describe how to use App-V to deliver Microsoft Office as a virtualized application to computers in your organization.
+* [Deploying Microsoft Office 2016 by using App-V](appv-deploying-microsoft-office-2016-with-appv.md)
+* [Deploying Microsoft Office 2013 by using App-V](appv-deploying-microsoft-office-2013-with-appv.md)
+* [Deploying Microsoft Office 2010 by using App-V](appv-deploying-microsoft-office-2010-wth-appv.md)
-## Other Resources for Deploying App-V
+## Other App-V deployment resources
-
-- [Application Virtualization (App-V) overview](appv-for-windows.md)
-
-- [Getting Started with App-V](appv-getting-started.md)
-
-- [Planning for App-V](appv-planning-for-appv.md)
-
-- [Operations for App-V](appv-operations.md)
-
-- [Troubleshooting App-V](appv-troubleshooting.md)
-
-- [Technical Reference for App-V](appv-technical-reference.md)
+* [Application Virtualization (App-V) overview](appv-for-windows.md)
+* [Getting started with App-V](appv-getting-started.md)
+* [Planning for App-V](appv-planning-for-appv.md)
+* [Operations for App-V](appv-operations.md)
+* [Troubleshooting App-V](appv-troubleshooting.md)
+* [Technical reference for App-V](appv-technical-reference.md)
## Have a suggestion for App-V?
-Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv).
+Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
diff --git a/windows/application-management/app-v/appv-deploying-microsoft-office-2010-wth-appv.md b/windows/application-management/app-v/appv-deploying-microsoft-office-2010-wth-appv.md
index 28a866aa22..5d6bd60233 100644
--- a/windows/application-management/app-v/appv-deploying-microsoft-office-2010-wth-appv.md
+++ b/windows/application-management/app-v/appv-deploying-microsoft-office-2010-wth-appv.md
@@ -6,291 +6,95 @@ ms.pagetype: mdop, appcompat, virtualization
ms.mktglfcycl: deploy
ms.sitesec: library
ms.prod: w10
-ms.date: 04/19/2017
+ms.date: 04/18/2018
---
-
-
# Deploying Microsoft Office 2010 by Using App-V
-**Applies to**
-- Windows 10, version 1607
+>Applies to: Windows 10, version 1607
You can create Office 2010 packages for Microsoft Application Virtualization (App-V) using one of the following methods:
-- Application Virtualization (App-V) Sequencer
-
-- Application Virtualization (App-V) Package Accelerator
+* Application Virtualization (App-V) Sequencer
+* Application Virtualization (App-V) Package Accelerator
## App-V support for Office 2010
-
The following table shows the App-V versions, methods of Office package creation, supported licensing, and supported deployments for Office 2010.
-
-
-
-
+|Supported item|Support level|
+|---|---|
+|Package creation|- Sequencing
-
-
-
-Supported item
-Level of support
-
-
-
-
-
-
-
-
-
-
- Package Accelerator
- Office Deployment Kit|
+|Supported licensing|Volume Licensing|
+|Supported deployments|- Desktop
- Personal VDI
- RDS|
## Creating Office 2010 App-V using the sequencer
-
-Sequencing Office 2010 is one of the main methods for creating an Office 2010 package on App-V. Microsoft has provided a detailed recipe through a Knowledge Base article. To create an Office 2010 package on App-V, refer to the following link for detailed instructions:
-
-[How To Sequence Microsoft Office 2010 in Microsoft Application Virtualization 5.0](https://support.microsoft.com/en-us/kb/2830069)
+Sequencing Office 2010 is one of the main methods for creating an Office 2010 package on App-V. Microsoft has provided a detailed recipe through a Knowledge Base article. For detailed instructions about how to create an Office 2010 package on App-V, see [How To Sequence Microsoft Office 2010 in Microsoft Application Virtualization 5.0](https://support.microsoft.com/en-us/kb/2830069).
## Creating Office 2010 App-V packages using package accelerators
+Office 2010 App-V packages can be created through package accelerators. Microsoft has provided package accelerators for creating Office 2010 on Windows 10, Windows 8, and Windows 7. The following pages will show you which package accelerator is best for creating Office 2010 App-V packages on your version of Windows:
-Office 2010 App-V packages can be created through package accelerators. Microsoft has provided package accelerators for creating Office 2010 on Windows 10, Windows 8 and Windows 7. To create Office 2010 packages on App-V using Package accelerators, refer to the following pages to access the appropriate package accelerator:
-
-- [App-V 5.0 Package Accelerator for Office Professional Plus 2010 – Windows 8](https://gallery.technet.microsoft.com/App-V-50-Package-a29410db)
-
-- [App-V 5.0 Package Accelerator for Office Professional Plus 2010 – Windows 7](https://gallery.technet.microsoft.com/App-V-50-Package-e7ef536b)
+* [App-V 5.0 Package Accelerator for Office Professional Plus 2010 – Windows 8](https://gallery.technet.microsoft.com/App-V-50-Package-a29410db)
+* [App-V 5.0 Package Accelerator for Office Professional Plus 2010 – Windows 7](https://gallery.technet.microsoft.com/App-V-50-Package-e7ef536b)
For detailed instructions on how to create virtual application packages using App-V package accelerators, see [How to Create a Virtual Application Package Using an App-V Package Accelerator](appv-create-a-virtual-application-package-package-accelerator.md).
## Deploying the Microsoft Office package for App-V
-
You can deploy Office 2010 packages by using any of the following App-V deployment methods:
-- System Center Configuration Manager
-
-- App-V server
-
-- Stand-alone through Windows PowerShell commands
+* System Center Configuration Manager
+* App-V server
+* Stand-alone through Windows PowerShell commands
## Office App-V package management and customization
-
Office 2010 packages can be managed like any other App-V packages through known package management mechanisms. No special instructions are needed, for example, to add, publish, unpublish, or remove Office packages.
## Microsoft Office integration with Windows
-
The following table provides a full list of supported integration points for Office 2010.
-
-
+(POPULATE THE THIRD COLUMN)
-
+|Extension Point|Description|Office 2010|
+|---|---|---|
+|Lync meeting Join Plug-in for Firefox and Chrome|User can join Lync meetings from Firefox and Chrome||
+|Sent to OneNote Print Driver|User can print to OneNote|Yes|
+|OneNote Linked Notes|OneNote Linked Notes||
+|Send to OneNote Internet Explorer Add-In|User can send to OneNote from IE||
+|Firewall Exception for Lync and Outlook|Firewall Exception for Lync and Outlook||
+|MAPI Client|Native apps and add-ins can interact with virtual Outlook through MAPI||
+|SharePoint Plugin for Firefox|User can use SharePoint features in Firefox||
+|Mail Control Panel Applet|User gets the mail control panel applet in Outlook|Yes|
+|Primary Interop Assemblies|Support managed add-ins||
+|Office Document Cache Handler|Allows Document Cache for Office applications||
+|Outlook Protocol Search handler|User can search in Outlook|Yes|
+|Active X Controls:
-
-
-
-Extension Point
-Description
-Office 2010
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Groove.SiteClient
- PortalConnect.PersonalSite
- SharePoint.openDocuments
- SharePoint.ExportDatabase
- SharePoint.SpreadSheetLauncher
- SharePoint.StssyncHander
- SharePoint.DragUploadCtl
- SharePoint.DragDownloadCtl
- Sharpoint.OpenXMLDocuments
- Sharepoint.ClipboardCtl
- WinProj.Activator
- Name.NameCtrl
- STSUPld.CopyCtl
- CommunicatorMeetingJoinAx.JoinManager
- LISTNET.Listnet
- OneDrive Pro Browser Helper|Active X Control.
For more information about ActiveX controls, see the [ActiveX Control API Reference](
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv).
+Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
\ No newline at end of file
diff --git a/windows/application-management/app-v/appv-deploying-microsoft-office-2013-with-appv.md b/windows/application-management/app-v/appv-deploying-microsoft-office-2013-with-appv.md
index dbbd968cfa..7b63794730 100644
--- a/windows/application-management/app-v/appv-deploying-microsoft-office-2013-with-appv.md
+++ b/windows/application-management/app-v/appv-deploying-microsoft-office-2013-with-appv.md
@@ -6,229 +6,94 @@ ms.pagetype: mdop, appcompat, virtualization
ms.mktglfcycl: deploy
ms.sitesec: library
ms.prod: w10
-ms.date: 04/19/2017
+ms.date: 04/18/2018
---
-
-
# Deploying Microsoft Office 2013 by Using App-V
-**Applies to**
-- Windows 10, version 1607
+>Applies to: Windows 10, version 1607
Use the information in this article to use Application Virtualization (App-V) to deliver Microsoft Office 2013 as a virtualized application to computers in your organization. For information about using App-V to deliver Office 2010, see [Deploying Microsoft Office 2010 by Using App-V](appv-deploying-microsoft-office-2010-wth-appv.md). To successfully deploy Office 2013 with App-V, you need to be familiar with Office 2013 and App-V.
-This topic contains the following sections:
+## What to know before you start
-- [What to know before you start](#bkmk-before-you-start)
+Before you deploy Office 2013 with App-V, review the following planning information.
-- [Creating an Office 2013 package for App-V with the Office Deployment Tool](#bkmk-create-office-pkg)
+### Supported Office versions and Office coexistence
-- [Publishing the Office package for App-V](#bkmk-pub-pkg-office)
+The following table will direct you to more information about which versions of Office App-V supports and how to run App-V with coexisting versions of Office.
-- [Customizing and managing Office App-V packages](#bkmk-custmz-manage-office-pkgs)
+|Information to review|Description|
+|---|---|
+|[Supported versions of Microsoft Office](appv-planning-for-using-appv-with-office.md#supported-versions-of-microsoft-office)|- Supported versions of Office
- Supported deployment types like desktop, personal Virtual Desktop Infrastructure (VDI), and pooled VDI
- Office licensing options.|
+|[Planning for using App-V with coexisting versions of Office](appv-planning-for-using-appv-with-office.md#before-you-implement-office-coexistence)|Considerations for installing different versions of Office on the same computer.|
-## What to know before you start
+### Packaging, publishing, and deployment requirements
+Before you deploy Office with App-V, review the following requirements.
-Before you deploy Office 2013 by using App-V, review the following planning information.
-
-### Supported Office versions and Office coexistence
-
-Use the following table to get information about supported versions of Office and about running coexisting versions of Office.
-
-
-
-
-
-
-### Packaging, publishing, and deployment requirements
-
-Before you deploy Office by using App-V, review the following requirements.
-
-
-
-
-
-Information to review
-Description
-
-
-
-
-
-
-
-
-
-
+|Task|Requirement|
+|---|---|
+|Packaging|All Office applications you wish to deploy to users must be in a single package.
-
-
-
-Task
-Requirement
-
-
-
-
-
-
-
-
-
-
-
-
In App-V and later, you must use the Office Deployment Tool to create packages. The Sequencer doesn't support package creation.
If you're deploying Microsoft Visio 2013 and Microsoft Project 2013 along with Office, you must include them in the same package with Office. For more information, see [Deploying Visio 2013 and Project 2013 with Office](#bkmk-deploy-visio-project).|
+|Publishing|You can only publish one Office package per client computer.
You must publish the Office package globally, not to the user.|
+|Deploying Office 365 ProPlus, Visio Pro for Office 365, or Project Pro for Office 365 to a shared computer using Remote Desktop Services.|You must enable [shared computer activation](https://docs.microsoft.com/en-us/DeployOffice/overview-of-shared-computer-activation-for-office-365-proplus).
You don’t need to use shared computer activation if you’re deploying a volume licensed product, such as Office Professional Plus 2013, Visio Professional 2013, or Project Professional 2013.|
### Excluding Office applications from a package
The following table describes the recommended methods for excluding specific Office applications from a package.
-
-
-
-
-
-## Creating an Office 2013 package for App-V with the Office Deployment Tool
+|Task|Details|
+|---|---|
+|Use the **ExcludeApp** setting when you create the package by using the Office Deployment Tool.|Enables you to exclude specific Office applications from the package when the Office Deployment Tool creates the package. For example, you can use this setting to create a package that contains only Microsoft Word.
-
-
-
-Task
-Details
-
-
-
-
-
-
-
-
For more information, see [ExcludeApp element](https://docs.microsoft.com/en-us/DeployOffice/configuration-options-for-the-office-2016-deployment-tool?ui=en-US&rs=en-US&ad=US#excludeapp-element).|
+|Modify the **DeploymentConfig.xml** file|Modify the **DeploymentConfig.xml** file after creating the package. This file contains the default package settings for all users on a computer running the App-V Client.
For more information, see [Disabling Office 2013 applications](#bkmk-disable-office-apps).|
+## Creating an Office 2013 package for App-V with the Office Deployment Tool
Complete the following steps to create an Office 2013 package for App-V or later.
-**Important**
-In App-V and later, you must the Office Deployment Tool to create a package. You cannot use the Sequencer to create packages.
-
-
+>[!IMPORTANT]
+>In App-V and later, you must the Office Deployment Tool to create a package. You cannot use the Sequencer to create packages.
### Review prerequisites for using the Office Deployment Tool
-The computer on which you are installing the Office Deployment Tool must have:
+Before you start, make sure that the computer on which you are installing the Office Deployment Tool has the following:
-
-
+|Prerequisite|Description|
+|---|---|
+|Prerequisite software|.NET Framework 4|
+|Supported operating systems|64-bit version of Windows 8 or later
-
-
-
-Prerequisite
-Description
-
-
-
-
-
-
-
64-bit version of Windows 7|
-
+>[!NOTE]
+>In this topic, the term “Office 2013 App-V package” refers to subscription licensing and volume licensing.
-**Note**
-In this topic, the term “Office 2013 App-V package” refers to subscription licensing and volume licensing.
+### Create Office 2013 App-V packages using Office Deployment Tool
-
-
-### Create Office 2013 App-V Packages Using Office Deployment Tool
-
-You create Office 2013 App-V packages by using the Office Deployment Tool. The following instructions explain how to create an Office 2013 App-V package with Volume Licensing or Subscription Licensing.
+You create Office 2013 App-V packages with the Office Deployment Tool. The following instructions explain how to create an Office 2013 App-V package with Volume Licensing or Subscription Licensing.
Create Office 2013 App-V packages on 64-bit Windows computers. Once created, the Office 2013 App-V package will run on 32-bit and 64-bit Windows 7, Windows 8.1, and Windows 10 computers.
### Download the Office Deployment Tool
-Office 2013 App-V Packages are created using the Office Deployment Tool, which generates an Office 2013 App-V Package. The package cannot be created or modified through the App-V sequencer. To begin package creation:
+Office 2013 App-V Packages are created using the Office Deployment Tool, which generates an Office 2013 App-V Package. The App-V sequencer can't create or modify packages. To create a package:
-1. Download the [Office 2013 Deployment Tool for Click-to-Run](http://www.microsoft.com/download/details.aspx?id=36778).
-
-2. Run the .exe file and extract its features into the desired location. To make this process easier, you can create a shared network folder where the features will be saved.
+1. Download the [Office 2013 Deployment Tool for Click-to-Run](https://www.microsoft.com/download/details.aspx?id=36778).
+2. Run the .exe file and extract its features into the desired location. To make this process easier, you can create a shared network folder where the features will be saved.
Example: \\\\Server\\Office2013
-
-3. Check that a setup.exe and a configuration.xml file exist and are in the location you specified.
+3. Check that a **setup.exe** and a **configuration.xml** file exist and are in the location you specified.
### Download Office 2013 applications
-After you download the Office Deployment Tool, you can use it to get the latest Office 2013 applications. After getting the Office applications, you create the Office 2013 App-V package.
+After you download the Office Deployment Tool, you can use it to get the latest Office 2013 applications. You can create the Office 2013 App-V package after getting all the Office applications.
-The XML file that is included in the Office Deployment Tool specifies the product details, such as the languages and Office applications included.
+The XML file included in the Office Deployment Tool specifies the product details, such as the languages and Office applications included.
-1. **Customize the sample XML configuration file:** Use the sample XML configuration file that you downloaded with the Office Deployment Tool to customize the Office applications:
+1. **Customize the sample XML configuration file:** Use the sample XML configuration file that you downloaded with the Office Deployment Tool to customize the Office applications:
- 1. Open the sample XML file in Notepad or your favorite text editor.
+ 1. Open the sample XML file in Notepad or your favorite text editor.
- 2. With the sample configuration.xml file open and ready for editing, you can specify products, languages, and the path to which you save the Office 2013 applications. The following is a basic example of the configuration.xml file:
+ 2. With the sample configuration.xml file open and ready for editing, you can specify products, languages, and the path to which you save the Office 2013 applications. The following is a basic example of the configuration.xml file:
- ``` syntax
+ ```XML
- The configuration XML is a sample XML file. The file includes lines that are commented out. You can “uncomment” these lines to customize additional settings with the file.
+ >[!NOTE]
+ >The configuration XML is a sample XML file. This file includes lines that are commented out. You can “uncomment” these lines to customize additional settings with the file.
- The above XML configuration file specifies that Office 2013 ProPlus 32-bit edition, including Visio ProPlus, will be downloaded in English to the \\\\server\\Office 2013, which is the location where Office applications will be saved to. Note that the Product ID of the applications will not affect the final licensing of Office. Office 2013 App-V packages with various licensing can be created from the same applications through specifying licensing in a later stage. For more information, see [Customizable attributes and elements of the XML file](#customizable-attributes-and-elements-of-the-xml-file), later in this topic.
+ The previous example of an XML configuration file specifies that Office 2013 ProPlus 32-bit edition, including Visio ProPlus, will be downloaded in English to the \\\\server\\Office 2013, which is the location where Office applications will be saved to. Note that the Product ID of the applications will not affect the final licensing of Office. Office 2013 App-V packages with various licensing can be created from the same applications by specifying licensing in a later stage. For more information, see [Customizable attributes and elements of the XML file](#customizable-attributes-and-elements-of-the-xml-file), later in this topic.
After editing the configuration.xml file to specify the desired product, languages, and also the location which the Office 2013 applications will be saved onto, you can save the configuration file, for example, as Customconfig.xml.
+2. **Download the applications into the specified location:** Use an elevated command prompt and a 64-bit operating system to download the Office 2013 applications that will later be converted into an App-V package. The following is an example command:
-2. **Download the applications into the specified location:** Use an elevated command prompt and a 64 bit operating system to download the Office 2013 applications that will later be converted into an App-V package. Below is an example command with description of details:
-
- ``` syntax
+ ```PowerShell
\\server\Office2013\setup.exe /download \\server\Office2013\Customconfig.xml
```
- In the example:
+ The following is a table that describes each element of the command:
-
-
+ |Element|Description|
+ |---|---|
+ |```\\server\Office2013```|This is the network share location that contains the Office Deployment Tool and the custom Configuration.xml file, **Customconfig.xml**.|
+ |```setup.exe```|This is the Office Deployment Tool.|
+ |```/download```|This downloads the Office 2013 applications that you specify in the **Customconfig.xml** file. These bits can be later converted in an Office 2013 App-V package with Volume Licensing.|
+ |```\\server\Office2013\Customconfig.xml```|This passes the XML configuration file required to complete the download process. In this example, the file used is **Customconfig.xml**. After using the download command, Office applications should be found in the location specified in the XML configuration file, which in this example is ```\\Server\Office2013```.|
#### Customizable attributes and elements of the XML file
-
-
- \\server\Office2013
-
- setup.exe
-
- /download
-
-
- \\server\Office2013\Customconfig.xml
-
-
-
+|Input and description|Example|
+|---|---|
+|Add element:
-
-
-
-Input and description
-Example
-
-
-
Specifies the products and languages to include in the package.
-
-
Specifies the edition of Office 2013 product to use: 32-bit or 64-bit. The operation fails if OfficeClientEdition is not set to a valid value.OfficeClientEdition="32"OfficeClientEdition="64"
-
-
Specifies the application. Project 2013 and Visio 2013 must be specified here as an added product to be included in the applications.Product ID ="O365ProPlusRetail "Product ID ="VisioProRetail"Product ID ="ProjectProRetail"Product ID ="ProPlusVolume"Product ID ="VisioProVolume"Product ID = "ProjectProVolume"
-
-
Specifies the language supported in the applications.Language ID="en-us"
-
-
Optional. Specifies a build to use for the package. Defaults to latest advertised build (as defined in v32.CAB at the Office source).15.1.2.3
-
-
-
Specifies the location in which the applications will be saved to.Sourcepath = "\\Server\Office2013”
Specifies the products and languages to include in the package.|N/A|
+|OfficeClientEdition (attribute of Add element):
Specifies the edition of Office 2013 product to use: 32-bit or 64-bit. The operation fails if **OfficeClientEdition** is not set to a valid value.|```OfficeClientEdition="32"```
```OfficeClientEdition="64"```|
+|Product element:
Specifies the application. Project 2013 and Visio 2013 must be specified here as an added product to be included in the applications.|```Product ID="O365ProPlusRetail"```
```Product ID="VisioProRetail"```
```Product ID="ProjectProRetail"```
```Product ID="ProPlusVolume"```
```Product ID="ProjectProVolume"```|
+|Language element:
Specifies the language supported in the applications.|```Language ID="en-us"```|
+|Version (attribute of Add element):
Optional. Specifies a build to use for the package. Defaults to latest advertised build (as defined in v32.CAB at the Office source).|```15.1.2.3```|
+|SourcePath (attribute of Add element):
Specifies the location where the applications will be saved to.|```Sourcepath="\Server\Office2013”```|
### Convert the Office applications into an App-V package
-After you download the Office 2013 applications through the Office Deployment Tool, use the Office Deployment Tool to convert them into an Office 2013 App-V package. Complete the steps that correspond to your licensing model.
+After you download the Office 2013 applications through the Office Deployment Tool, use the Office Deployment Tool to convert them into an Office 2013 App-V package. You'll need to make sure to have the right procedure depending on your licensing model.
-**Summary of what you’ll need to do:**
+#### What you'll need to do
-- Create the Office 2013 App-V packages on 64-bit Windows computers. However, the package will run on 32-bit and 64-bit Windows 7, Windows 8, and Windows 10 computers.
+* Create the Office 2013 App-V packages on 64-bit Windows computers. However, the package will run on 32-bit and 64-bit Windows 7, Windows 8, and Windows 10 computers.
+* Create an Office App-V package for either the Subscription Licensing package or Volume Licensing by using the Office Deployment Tool, then modify the **Customconfig.xml** configuration file.
-- Create an Office App-V package for either Subscription Licensing package or Volume Licensing by using the Office Deployment Tool, and then modify the CustomConfig.xml configuration file.
+ The following table summarizes the values you need to enter in the **Customconfig.xml** file for the licensing model you’re using. The steps in the sections that follow the table will specify the exact entries you need to make.
- The following table summarizes the values you need to enter in the CustomConfig.xml file for the licensing model you’re using. The steps in the sections that follow the table will specify the exact entries you need to make.
-
-
-
+|Product ID|Volume Licensing|Subscription Licensing|
+|---|---|---|
+|Office 2013|ProPlusVolume|O365ProPlusRetail|
+|Office 2013 with Visio 2013|ProPlusVolume
-
-
-
-Product ID
-Volume Licensing
-Subscription Licensing
-
-
-
-
-
-
-
-
VisioProVolume|O365ProPlusRetail
VisioProRetail|
+|Office 2013 with Visio 2013 and Project 2013|ProPlusVolume
VisioProVolume
ProjectProVolume|O365ProPlusRetail
VisioProRetail
ProjectProRetail|
#### How to convert the Office applications into an App-V package
-1. In Notepad, reopen the CustomConfig.xml file, and make the following changes to the file:
+1. In Notepad, reopen the CustomConfig.xml file, and make the following changes to the file:
- - **SourcePath**: Point to the Office applications downloaded earlier.
-
- - **ProductID**: Specify the type of licensing, as shown in the following examples:
- - Subscription Licensing:
- ```
-
- **Product ID** for Office was changed to `O365ProPlusRetail`.
- **Product ID** for Visio was changed to `VisioProRetail`.
-
- - Volume Licensing
- ```
-
- **Product ID** for Office was changed to `ProPlusVolume`.
- **Product ID** for Visio was changed to `VisioProVolume`.
-
- - **ExcludeApp** (optional): Lets you specify Office programs that you don’t want included in the App-V package that the Office Deployment Tool creates. For example, you can exclude Access and InfoPath.
-
- - **PACKAGEGUID** (optional): By default, all App-V packages created by the Office Deployment Tool share the same App-V Package ID. You can use PACKAGEGUID to specify a different package ID for each package, which allows you to publish multiple App-V packages, created by the Office Deployment Tool, and manage them by using the App-V Server.
+ * **SourcePath** is the source's path, which was changed to point to the Office applications that were downloaded earlier.
+ * **Product ID** for Office was changed to `ProPlusVolume`.
+ * **Product ID** for Visio was changed to `VisioProVolume`.
+ * **ExcludeApp** (optional) lets you specify Office programs that you don’t want included in the App-V package that the Office Deployment Tool creates. For example, you can exclude Access and InfoPath.
+ * **PACKAGEGUID** (optional)—By default, all App-V packages created by the Office Deployment Tool share the same App-V Package ID. You can use PACKAGEGUID to specify a different package ID for each package, which allows you to publish multiple App-V packages, created by the Office Deployment Tool, and manage them by using the App-V Server.
An example of when to use this parameter is if you create different packages for different users. For example, you can create a package with just Office 2013 for some users, and create another package with Office 2013 and Visio 2013 for another set of users.
- **Note** Even if you use unique package IDs, you can still deploy only one App-V package to a single device.
-
-2. Use the /packager command to convert the Office applications to an Office 2013 App-V package.
+ >[!NOTE]
+ >Even if you use unique package IDs, you can still deploy only one App-V package to a single device.
+2. Use the **/packager** command to convert the Office applications to an Office 2013 App-V package.
For example:
- ``` syntax
+ ```PowerShell
\\server\Office2013\setup.exe /packager \\server\Office2013\Customconfig.xml \\server\share\Office2013AppV
```
In the example:
-
-
+ |Element|Description|
+ |---|---|
+ |```\\server\Office2013```|This is the network share location that contains the Office Deployment Tool and the custom Configuration.xml file, which in this example is named **Customconfig.xml**.|
+ |```setup.exe```|This is the Office Deployment Tool.|
+ |```/packager```|This creates the Office 2013 App-V package with Volume Licensing as specified in the **Customconfig.xml** file.|
+ |```\\server\Office2013\Customconfig.xml```|This passes the configuration XML file, which in this example is named "Customconfig," that has been prepared for the packaging stage.|
+ |```\\server\share\Office2013AppV```|This specifies the location of the newly created Office App-V package.|
- After you run the **/packager** command, the following folders appear up in the directory where you specified the package should be saved:
- **App-V Packages** – contains an Office 2013 App-V package and two deployment configuration files.
-
- \\server\Office2013
-
- setup.exe
-
- /packager
-
- \\server\Office2013\Customconfig.xml
-
-
- \\server\share\Office2013AppV
- **WorkingDir**
+ After you run the **/packager** command, the following folders will appear in the directory where you specified the package should be saved:
+
+ * **App-V Packages**, which contains an Office 2013 App-V package and two deployment configuration files.
+ * **WorkingDir**
- **Note** To troubleshoot any issues, see the log files in the %temp% directory (default).
+ >[!NOTE]
+ >To troubleshoot any issues, see the log files in the %temp% directory (default).
+3. Verify that the Office 2013 App-V package works correctly:
-3. Verify that the Office 2013 App-V package works correctly:
-
- 1. Publish the Office 2013 App-V package, which you created globally, to a test computer, and verify that the Office 2013 shortcuts appear.
-
- 2. Start a few Office 2013 applications, such as Excel or Word, to ensure that your package is working as expected.
-
-## Publishing the Office package for App-V
+ 1. Publish the Office 2013 App-V package that you created globally to a test computer and verify that the Office 2013 shortcuts appear.
+ 2. Start a few Office 2013 applications, such as Excel or Word, to test that your package is working as expected.
+## Publishing the Office package for App-V
Use the following information to publish an Office package.
@@ -493,121 +242,77 @@ Use the following information to publish an Office package.
Deploy the App-V package for Office 2013 by using the same methods you use for any other package:
-- System Center Configuration Manager
-
-- App-V Server
-
-- Stand-alone through Windows PowerShell commands
+* System Center Configuration Manager
+* App-V Server
+* Stand-alone through Windows PowerShell commands
### Publishing prerequisites and requirements
-
-
-
-
+|Prerequisite or requirement|Details|
+|---|---|
+|Enable Windows PowerShell scripting on the App-V clients.|To publish Office 2013 packages, you must run a script. Package scripts are disabled by default on App-V clients. To enable scripting, run the following Windows PowerShell command:
-
-
-
-Prerequisite or requirement
-Details
-
-
-Set-AppvClientConfiguration –EnablePackageScripts 1
-
-
-
```Set-AppvClientConfiguration –EnablePackageScripts 1```|
+|Publish the Office 2013 package globally.|Extension points in the Office App-V package require installation at the computer level.
When you publish at the computer level, no prerequisite actions or redistributables are needed, and the Office 2013 package globally enables its applications to work like natively installed Office, eliminating the need for administrators to customize packages.|
### How to publish an Office package
-Run the following command to publish an Office package globally:
+Run the following command to publish an Office package globally, wtih the bracketed value replaced by the path to the App-V package:
-- `Add-AppvClientPackage
-
+|Goal|Method|
+|---|---|
+|Create two different packages and deploy each one to a different group of users|Create and deploy the following packages:
-
-
-
-Goal
-Method
-
-
-
-
-
-
-
-
A package that contains only Office—deploy to computers whose users need only Office.
A package that contains Office, Visio, and Project—deploy to computers whose users need all three applications.|
+|Create just one package for the whole organization, or for users who share computers|Follow these steps:
1. Create a package that contains Office, Visio, and Project.
2. Deploy the package to all users.
3. Use [AppLocker](https://docs.microsoft.com/en-us/windows/security/threat-protection/applocker/applocker-overview) to prevent specific users from using Visio and Project.|
## Additional resources
+### Additional resources for Office 2013 App-V Packages
-**Office 2013 App-V Packages Additional Resources**
+* [Office 2013 Deployment Tool for Click-to-Run](https://www.microsoft.com/download/details.aspx?id=36778)
+* [Supported scenarios for deploying Microsoft Office as a sequenced App-V Package](https://support.microsoft.com/en-us/kb/2772509)
-[Office 2013 Deployment Tool for Click-to-Run](http://www.microsoft.com/download/details.aspx?id=36778)
+### Additional resources for Office 2010 App-V Packages
-[Supported scenarios for deploying Microsoft Office as a sequenced App-V Package](https://support.microsoft.com/en-us/kb/2772509)
+* [Microsoft Office 2010 Sequencing Kit for Microsoft Application Virtualization 5.0](https://www.microsoft.com/download/details.aspx?id=38399)
+* [Known issues when you create or use an App-V 5.0 Office 2010 package](https://support.microsoft.com/en-us/kb/2828619)
+* [How To Sequence Microsoft Office 2010 in Microsoft Application Virtualization 5.0](https://support.microsoft.com/en-us/kb/2830069)
-**Office 2010 App-V Packages**
+### Additional resources for Connection Groups
-[Microsoft Office 2010 Sequencing Kit for Microsoft Application Virtualization 5.0](https://www.microsoft.com/download/details.aspx?id=38399)
+* [Managing Connection Groups](appv-managing-connection-groups.md)
+* [Connection groups on the App-V team blog](https://blogs.msdn.microsoft.com/gladiator/tag/connection-groups/)
-[Known issues when you create or use an App-V 5.0 Office 2010 package](https://support.microsoft.com/en-us/kb/2828619)
+### Additional resources for Dynamic Configuration
-[How To Sequence Microsoft Office 2010 in Microsoft Application Virtualization 5.0](https://support.microsoft.com/en-us/kb/2830069)
-
-**Connection Groups**
-
-[Managing Connection Groups](appv-managing-connection-groups.md)
-
-[Connection groups on the App-V team blog](https://blogs.technet.microsoft.com/gladiatormsft/tag/connection-groups/)
-
-**Dynamic Configuration**
-
-[About App-V Dynamic Configuration](appv-dynamic-configuration.md)
+* [About App-V Dynamic Configuration](appv-dynamic-configuration.md)
## Have a suggestion for App-V?
-Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv).
+Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
\ No newline at end of file
diff --git a/windows/application-management/app-v/appv-deploying-microsoft-office-2016-with-appv.md b/windows/application-management/app-v/appv-deploying-microsoft-office-2016-with-appv.md
index a85db55986..e43a70509e 100644
--- a/windows/application-management/app-v/appv-deploying-microsoft-office-2016-with-appv.md
+++ b/windows/application-management/app-v/appv-deploying-microsoft-office-2016-with-appv.md
@@ -6,257 +6,216 @@ ms.pagetype: mdop, appcompat, virtualization
ms.mktglfcycl: deploy
ms.sitesec: library
ms.prod: w10
-ms.date: 04/19/2017
+ms.date: 04/18/2018
---
-
# Deploying Microsoft Office 2016 by Using App-V
-**Applies to**
-- Windows 10, version 1607
+>Applies to: Windows 10, version 1607
-Use the information in this article to use Application Virtualization (App-V) to deliver Microsoft Office 2016 as a virtualized application to computers in your organization. For information about using App-V to deliver Office 2013, see [Deploying Microsoft Office 2013 by Using App-V](appv-deploying-microsoft-office-2013-with-appv.md). For information about using App-V to deliver Office 2010, see [Deploying Microsoft Office 2010 by Using App-V](appv-deploying-microsoft-office-2010-wth-appv.md).
-
-This topic contains the following sections:
-
-- [What to know before you start](#what-to-know-before-you-start)
-
-- [Creating an Office 2016 package for App-V with the Office Deployment Tool](#creating-an-office-2016-package-for-app-v-with-the-office-deployment-tool)
-
-- [Publishing the Office package for App-V](#publishing-the-office-package-for-app-v)
-
-- [Customizing and managing Office App-V packages](#customizing-and-managing-office-app-v-packages)
+Use the information in this article to use Application Virtualization (App-V) to deliver Microsoft Office 2016 as a virtualized application to computers in your organization. For information about using App-V to deliver Office 2013, see [Deploying Microsoft Office 2013 by using App-V](appv-deploying-microsoft-office-2013-with-appv.md). For information about using App-V to deliver Office 2010, see [Deploying Microsoft Office 2010 by using App-V](appv-deploying-microsoft-office-2010-wth-appv.md).
## What to know before you start
-Before you deploy Office 2016 by using App-V, review the following planning information.
+Before you deploy Office 2016 with App-V, review the following planning information.
### Supported Office versions and Office coexistence
-Use the following table to get information about supported versions of Office and about running coexisting versions of Office.
+Use the following table to get information about supported versions of Office and running coexisting versions of Office.
-| **Information to review** | **Description** |
-|-------------------------------------|------------------------|
-| [Supported versions of Microsoft Office](appv-planning-for-using-appv-with-office.md#bkmk-office-vers-supp-appv) | - Supported versions of Office
- Supported deployment types (for example, desktop, personal Virtual Desktop Infrastructure (VDI), pooled VDI)
- Office licensing options |
-| [Planning for using App-V with coexisting versions of Office](appv-planning-for-using-appv-with-office.md#bkmk-plan-coexisting) | Considerations for installing different versions of Office on the same computer |
+|Information to review|Description|
+|---|---|
+|[Supported versions of Microsoft Office](appv-planning-for-using-appv-with-office.md#supported-versions-of-microsoft-office)|Supported versions of Office and deployment types (for example, desktop, personal Virtual Desktop Infrastructure (VDI), and pooled VDI), and Office licensing options.|
+|[Planning for using App-V with coexisting versions of Office](appv-planning-for-using-appv-with-office.md#before-you-implement-office-coexistence)|Considerations for installing different versions of Office on the same computer.|
### Packaging, publishing, and deployment requirements
-Before you deploy Office by using App-V, review the following requirements.
+Before you deploy Office with App-V, review the following requirements.
-
-
-| **Task** | **Requirement** |
+|Task|Requirement|
|-----------|-------------------|
-| Packaging | - All of the Office applications that you want to deploy to users must be in a single package.
- In App-V 5.0 and later, you must use the Office Deployment Tool to create packages. You cannot use the Sequencer.
- If you are deploying Microsoft Visio 2016 and Microsoft Project 2016 along with Office, you must include them in the same package with Office. For more information, see [Deploying Visio 2016 and Project 2016 with Office](#deploying-visio-2016-and-project-2016-with-office). |
-| Publishing | - You can publish only one Office package to each client computer.
- You must publish the Office package globally. You cannot publish to the user. |
-| Deploying any of the following products to a shared computer, for example, by using Remote Desktop Services:
- Office 365 ProPlus
- Visio Pro for Office 365
- Project Pro for Office 365 | You must enable [shared computer activation](https://technet.microsoft.com/library/dn782860.aspx). |
+| Packaging. | All Office applications that you deploy to users must be in a single package.
In App-V 5.0 and later, you must use the Office Deployment Tool to create packages. The Sequencer doesn't support package creation.
If you're deploying Microsoft Visio 2016 and Microsoft Project 2016 at the same time as Office, you must put them all in the same package. For more information, see [Deploying Visio 2016 and Project 2016 with Office](#deploying-visio-2016-and-project-2016-with-office). |
+| Publishing. | You can only publish one Office package per client computer.
You must publish the Office package globally, not to the user. |
+| Deploying Office 365 ProPlus, Visio Pro for Office 365, or Project Pro for Office 365 to a shared computer with Remote Desktop Services. | You must enable [shared computer activation](https://docs.microsoft.com/en-us/DeployOffice/overview-of-shared-computer-activation-for-office-365-proplus). |
### Excluding Office applications from a package
The following table describes the recommended methods for excluding specific Office applications from a package.
-| **Task** | **Details** |
+|Task|Details|
|-------------|---------------|
-| Use the **ExcludeApp** setting when you create the package by using the Office Deployment Tool. | Enables you to exclude specific Office applications from the package when the Office Deployment Tool creates the package. For example, you can use this setting to create a package that contains only Microsoft Word.
For more information, see [ExcludeApp element](https://technet.microsoft.com/library/jj219426.aspx#BKMK_ExcludeAppElement). |
-| Modify the DeploymentConfig.xml file | Modify the DeploymentConfig.xml file after the package has been created. This file contains the default package settings for all users on a computer that is running the App-V Client.
For more information, see [Disabling Office 2016 applications](#disabling-office-2016-applications). |
+| Use the **ExcludeApp** setting when you create the package by using the Office Deployment Tool. | With this setting, you can exclude specific Office applications from the package that the Office Deployment Tool creates. For example, you can use this setting to create a package that contains only Microsoft Word.
For more information, see [ExcludeApp element](https://docs.microsoft.com/en-us/DeployOffice/configuration-options-for-the-office-2016-deployment-tool?ui=en-US&rs=en-US&ad=US#excludeapp-element). |
+| Modify the DeploymentConfig.xml file | Modify the DeploymentConfig.xml file after the package has been created. This file contains the default package settings for all users on a computer that is running the App-V Client.
For more information, see [Disabling Office 2016 applications](#disabling-office-2016-applications). |
## Creating an Office 2016 package for App-V with the Office Deployment Tool
Complete the following steps to create an Office 2016 package for App-V.
->**Important** In App-V 5.0 and later, you must use the Office Deployment Tool to create a package. You cannot use the Sequencer to create packages.
+>[!IMPORTANT]
+>In App-V 5.0 and later, you must use the Office Deployment Tool to create a package. You cannot use the Sequencer to create packages.
### Review prerequisites for using the Office Deployment Tool
-The computer on which you are installing the Office Deployment Tool must have:
+The computer on which you are installing the Office Deployment Tool must have the following:
-
-
-| **Prerequisite** | **Description** |
+| Prerequisite | Description |
|----------------------|--------------------|
| Prerequisite software | .Net Framework 4 |
-| Supported operating systems | - 64-bit version of Windows 10
- 64-bit version of Windows 8 or 8.1
- 64-bit version of Windows 7 |
+| Supported operating systems | 64-bit version of Windows 10
64-bit version of Windows 8 or 8.1
64-bit version of Windows 7 |
->**Note** In this topic, the term “Office 2016 App-V package” refers to subscription licensing.
+>[!NOTE]
+>In this topic, the term “Office 2016 App-V package” refers to subscription licensing.
-### Create Office 2016 App-V Packages Using Office Deployment Tool
+### Create Office 2016 App-V packages with the Office Deployment Tool
-You create Office 2016 App-V packages by using the Office Deployment Tool. The following instructions explain how to create an Office 2016 App-V package with Subscription Licensing.
+You create Office 2016 App-V packages by using the Office Deployment Tool. The following instructions explain how to create an Office 2016 App-V package with subscription licensing.
Create Office 2016 App-V packages on 64-bit Windows computers. Once created, the Office 2016 App-V package will run on 32-bit and 64-bit Windows 7, Windows 8.1, and Windows 10 computers.
### Download the Office Deployment Tool
-Office 2016 App-V Packages are created using the Office Deployment Tool, which generates an Office 2016 App-V Package. The package cannot be created or modified through the App-V sequencer. To begin package creation:
+Office 2016 App-V packages are created using the Office Deployment Tool, which generates an Office 2016 App-V Package. The package cannot be created or modified through the App-V sequencer. To begin package creation, follow these steps:
-1. Download the [Office 2016 Deployment Tool for Click-to-Run](https://www.microsoft.com/download/details.aspx?id=49117).
+1. Download the [Office 2016 Deployment Tool for Click-to-Run](https://www.microsoft.com/download/details.aspx?id=49117).
- > **Important** You must use the Office 2016 Deployment Tool to create Office 2016 App-V Packages.
+ >[!IMPORTANT]
+ >You must use the Office 2016 Deployment Tool to create Office 2016 App-V Packages.
+2. Run the .exe file and extract its features into the desired location. To make this process easier, you can create a shared network folder where the features will be saved.
-2. Run the .exe file and extract its features into the desired location. To make this process easier, you can create a shared network folder where the features will be saved.
-
- Example: \\\\Server\\Office2016
-
-3. Check that a setup.exe and a configuration.xml file exist and are in the location you specified.
+ Example location: \\\\Server\\Office2016
+3. Check that the **setup.exe** and **configuration.xml** files exist and are in the location you specified.
### Download Office 2016 applications
After you download the Office Deployment Tool, you can use it to get the latest Office 2016 applications. After getting the Office applications, you create the Office 2016 App-V package.
-The XML file that is included in the Office Deployment Tool specifies the product details, such as the languages and Office applications included.
+The XML file included in the Office Deployment Tool specifies the product details, such as the languages and Office applications included.
-**Step 1: Customize the sample XML configuration file:** Use the sample XML configuration file that you downloaded with the Office Deployment Tool to customize the Office applications:
+1. **Customize the sample XML configuration file:** Use the sample XML configuration file that you downloaded with the Office Deployment Tool to customize the Office applications:
+ 1. Open the sample XML file in Notepad or your favorite text editor.
+ 2. With the sample **configuration.xml** file open and ready for editing, you can specify products, languages, and the path to which you save the Office 2016 applications. The following is a basic example of the **configuration.xml** file:
-1. Open the sample XML file in Notepad or your favorite text editor.
-
-2. With the sample configuration.xml file open and ready for editing, you can specify products, languages, and the path to which you save the Office 2016 applications. The following is a basic example of the configuration.xml file:
-
- ```
-
**OfficeClientEdition**="64" |
-| Product element | Specifies the application. Project 2016 and Visio 2016 must be specified here as an added product to be included in the applications.
For more information about the product IDs, see [Product IDs that are supported by the Office Deployment Tool for Click-to-Run](https://support.microsoft.com/kb/2842297). | `Product ID ="O365ProPlusRetail"`
`Product ID ="VisioProRetail"`
`Product ID ="ProjectProRetail"` |
-| Language element | Specifies the language supported in the applications | `Language ID="en-us"` |
-| Version (attribute of Add element) | Optional. Specifies a build to use for the package
Defaults to latest advertised build (as defined in v32.CAB at the Office source). | `16.1.2.3` |
-| SourcePath (attribute of Add element) | Specifies the location in which the applications will be saved to. | `Sourcepath = "\\Server\Office2016"` |
-| Channel (part of Add element) | Optional. Defines which channel to use for updating Office after it is installed.
The default is **Deferred** for Office 365 ProPlus and **Current** for Visio Pro for Office 365 and Project Online Desktop Client.
For more information about update channels, see [Overview of update channels for Office 365 ProPlus](https://technet.microsoft.com/library/mt455210.aspx). | `Channel="Current"`
`Channel="Deferred"`
`Channel="FirstReleaseDeferred"`
`Channel="FirstReleaseCurrent"` |
+ | Input | Description | Example |
+ |--------------|----------------------------|----------------|
+ | Add element | Specifies which products and languages the package will include. | N/A |
+ | **OfficeClientEdition** (attribute of **Add** element) | Specifies whether Office 2016 32-bit or 64-bit edition will be used. **OfficeClientEdition** must be set to a valid value for the operation to succeed. | `OfficeClientEdition="32"`
`OfficeClientEdition="64"` |
+ | Product element | Specifies the application. Project 2016 and Visio 2016 must be specified here as added products to include them in the applications.
For more information about Product IDs, see [Product IDs that are supported by the Office Deployment Tool for Click-to-Run](https://support.microsoft.com/kb/2842297). | `Product ID ="O365ProPlusRetail"`
`Product ID ="VisioProRetail"`
`Product ID ="ProjectProRetail"` |
+ | Language element | Specifies which language the applications support. | `Language ID="en-us"` |
+ | Version (attribute of **Add** element) | Optional. Specifies which build the package will use.
Defaults to latest advertised build (as defined in v32.CAB at the Office source). | `16.1.2.3` |
+ | SourcePath (attribute of **Add** element) | Specifies the location the applications will be saved to. | `Sourcepath = "\\Server\Office2016"` |
+ | Channel (part of **Add** element) | Optional. Defines which channel will be used to update Office after installation.
The default is **Deferred** for Office 365 ProPlus and **Current** for Visio Pro for Office 365 and Project Online Desktop Client.
For more information about update channels, see [Overview of update channels for Office 365 ProPlus](https://docs.microsoft.com/en-us/DeployOffice/overview-of-update-channels-for-office-365-proplus). | `Channel="Current"`
`Channel="Deferred"`
`Channel="FirstReleaseDeferred"`
`Channel="FirstReleaseCurrent"` |
-After editing the configuration.xml file to specify the desired product, languages, and also the location which the Office 2016 applications will be saved onto, you can save the configuration file, for example, as Customconfig.xml.
+After editing the **configuration.xml** file to specify the desired product, languages, and the location where the Office 2016 applications will be saved to, you can save the configuration file under a name of your choice, such as "Customconfig.xml."
+2. **Download the applications into the specified location:** Use an elevated command prompt and a 64-bit operating system to download the Office 2016 applications that will later be converted into an App-V package. The following is an example command:
-**Step 2: Download the applications into the specified location:** Use an elevated command prompt and a 64 bit operating system to download the Office 2016 applications that will later be converted into an App-V package. Below is an example command with description of details:
+ `\\server\Office2016\setup.exe /download \\server\Office2016\Customconfig.xml`
-`\\server\Office2016\setup.exe /download \\server\Office2016\Customconfig.xml`
+ The following table describes the example command's elements:
-In the example:
-
-| Element | Description |
-|-------------------------------|--------------------------------------|
-| **\\\\server\\Office2016** | is the network share location that contains the Office Deployment Tool and the custom Configuration.xml file, Customconfig.xml. |
-| **Setup.exe** | is the Office Deployment Tool. |
-| **/download** | downloads the Office 2016 applications that you specify in the customConfig.xml file. |
-| **\\\\server\\Office2016\\Customconfig.xml** | passes the XML configuration file required to complete the download process, in this example, customconfig.xml. After using the download command, Office applications should be found in the location specified in the configuration xml file, in this example \\\\Server\\Office2016. |
+ | Element | Description |
+ |-------------------------------|--------------------------------------|
+ | ```\\server\Office2016``` | This is the network share location that contains the Office Deployment Tool and the custom **Configuration.xml** file, which in this example is **Customconfig.xml**. |
+ | ``Setup.exe`` | This is the Office Deployment Tool. |
+ | ```/download``` | Downloads the Office 2016 applications that you specify in the **Customconfig.xml** file. |
+ | ```\\server\Office2016\Customconfig.xml```| This passes the XML configuration file required to complete the download process. In this example, the file used is **Customconfig.xml**. After using the download command, Office applications should be found in the location specified in the configuration file, which in this example is ```\\Server\Office2016```. |
### Convert the Office applications into an App-V package
After you download the Office 2016 applications through the Office Deployment Tool, use the Office Deployment Tool to convert them into an Office 2016 App-V package. Complete the steps that correspond to your licensing model.
-**Summary of what you’ll need to do:**
+#### What you’ll need to do
-- Create the Office 2016 App-V packages on 64-bit Windows computers. However, the package will run on 32-bit and 64-bit Windows 7, Windows 8 or 8.1, and Windows 10 computers.
+* Create the Office 2016 App-V packages on 64-bit Windows computers. However, the package will run on 32-bit and 64-bit Windows 7, Windows 8 or 8.1, and Windows 10 computers.
+* Create an Office App-V package for either Subscription Licensing package by using the Office Deployment Tool, and then modify the **Customconfig.xml** configuration file.
-- Create an Office App-V package for either Subscription Licensing package by using the Office Deployment Tool, and then modify the CustomConfig.xml configuration file.
+ The following table summarizes the values you need to enter in the **Customconfig.xml** file. The steps in the sections that follow the table will specify the exact entries you need to make.
- The following table summarizes the values you need to enter in the CustomConfig.xml file. The steps in the sections that follow the table will specify the exact entries you need to make.
+>[!NOTE]
+>You can use the Office Deployment Tool to create App-V packages for Office 365 ProPlus. Creating packages for the volume-licensed versions of Office Professional Plus or Office Standard is not supported.
->**Note** You can use the Office Deployment Tool to create App-V packages for Office 365 ProPlus. Creating packages for the volume-licensed versions of Office Professional Plus or Office Standard is not supported.
-
-| **Product ID** | **Subscription Licensing** |
-|--------------------------------------------------|-------------------------------------------------------------|
-| **Office 2016** | O365ProPlusRetail |
-| **Office 2016 with Visio 2016** | O365ProPlusRetail
VisioProRetail |
-| **Office 2016 with Visio 2016 and Project 2016** | O365ProPlusRetail
VisioProRetail
ProjectProRetail |
+| Product ID | Subscription licensing |
+|---|---|
+| Office 2016| O365ProPlusRetail |
+| Office 2016 with Visio 2016 | O365ProPlusRetail
VisioProRetail |
+| Office 2016 with Visio 2016 and Project 2016 | O365ProPlusRetail
VisioProRetail
ProjectProRetail |
#### How to convert the Office applications into an App-V package
+
1. In Notepad, reopen the CustomConfig.xml file, and make the following changes to the file:
- - **SourcePath**: Point to the Office applications downloaded earlier.
+ * **SourcePath**: Change to the location where you saved the Office applications you downloaded during setup.
+ * **ProductID**: Specify the type of licensing, as shown in the following example:
- - **ProductID**: Specify the type of licensing, as shown in the following example:
-
- - Subscription Licensing:
+ * Subscription Licensing:
+ ```XML
+
- **Product ID** for Office was changed to `O365ProPlusRetail`.
- **Product ID** for Visio was changed to `VisioProRetail`.
-
- - **ExcludeApp** (optional): Lets you specify Office programs that you don’t want included in the App-V package that the Office Deployment Tool creates. For example, you can exclude Access.
-
- - **PACKAGEGUID** (optional): By default, all App-V packages created by the Office Deployment Tool share the same App-V Package ID. You can use PACKAGEGUID to specify a different package ID for each package, which allows you to publish multiple App-V packages, created by the Office Deployment Tool, and manage them by using the App-V Server.
+ * **SourcePath** was changed to point to the Office applications that were downloaded earlier.
+ * **Product ID** for Office was changed to `O365ProPlusRetail`.
+ * **Product ID** for Visio was changed to `VisioProRetail`.
+ * **ExcludeApp** (optional): Lets you specify Office programs that you don’t want included in the App-V package created by the Office Deployment Tool. For example, you can exclude Access.
+ * **PACKAGEGUID** (optional): By default, all App-V packages created by the Office Deployment Tool share the same App-V Package ID. You can use **PACKAGEGUID** to specify a different package ID for each package, which allows you to publish multiple App-V packages created by the Office Deployment Tool, and then manage your published packages with the App-V Server.
An example of when to use this parameter is if you create different packages for different users. For example, you can create a package with just Office 2016 for some users, and create another package with Office 2016 and Visio 2016 for another set of users.
- >**Note** Even if you use unique package IDs, you can still deploy only one App-V package to a single device.
+ >[!NOTE]
+ >Even if you use unique package IDs, you can still deploy only one App-V package to a single device.
+2. Use the /packager command to convert the Office applications to an Office 2016 App-V package.
-2. Use the /packager command to convert the Office applications to an Office 2016 App-V package.
+ The following is an example packager command:
- For example:
-
- ``` syntax
+ ```syntax
\\server\Office2016\setup.exe /packager \\server\Office2016\Customconfig.xml \\server\share\Office2016AppV
```
- In the example:
+ The following table describes each element used in the example command:
-
-
+ | Element | Description |
+ |-------------------------------|--------------------------------------|
+ |```\\server\Office2016```|This is the network share location that contains the Office Deployment Tool and the custom Configuration.xml file, which in this example is Customconfig.xml.|
+ |```Setup.exe```|This is the Office Deployment Tool.|
+ |```/packager```|This command creates the Office 2016 App-V package with the license type specified in the Customconfig.xml file.|
+ |```\\server\Office2016\Customconfig.xml```|This passes the configuration XML file that has been prepared for the packaging stage. In this example, the file is Customconfig.xml.|
+ |```\\server\share\Office2016AppV```|This specifies the location of the newly created Office App-V package.|
- After you run the **/packager** command, the following folders appear up in the directory where you specified the package should be saved:
-
- \\server\Office2016
-
- Setup.exe
-
- /packager
-
- \\server\Office2016\Customconfig.xml
-
-
- \\server\share\Office2016AppV
+ After you run the **/packager** command, the following folders appear up in the directory where you specified the package should be saved:
- - **App-V Packages** – contains an Office 2016 App-V package and two deployment configuration files.
- - **WorkingDir**
-
- **Note** To troubleshoot any issues, see the log files in the %temp% directory (default).
+ * **App-V Packages**—contains an Office 2016 App-V package and two deployment configuration files.
+ * **WorkingDir**
+ >[!NOTE]
+ >To troubleshoot any issues, see the log files in the %temp% directory (default).
3. Verify that the Office 2016 App-V package works correctly:
- 1. Publish the Office 2016 App-V package, which you created globally, to a test computer, and verify that the Office 2016 shortcuts appear.
-
+ 1. Publish the Office 2016 App-V package that you created globally to a test computer and verify that the Office 2016 shortcuts appear.
2. Start a few Office 2016 applications, such as Excel or Word, to ensure that your package is working as expected.
## Publishing the Office package for App-V
@@ -265,94 +224,78 @@ Use the following information to publish an Office package.
### Methods for publishing Office App-V packages
-Deploy the App-V package for Office 2016 by using the same methods you use for any other package:
+Deploy the App-V package for Office 2016 by using the same methods as the other packages that you've already deployed:
-- System Center Configuration Manager
-
-- App-V Server
-
-- Stand-alone through Windows PowerShell commands
+* System Center Configuration Manager
+* App-V Server
+* Stand-alone through Windows PowerShell commands
### Publishing prerequisites and requirements
-| **Prerequisite or requirement** | **Details** |
+| Prerequisite or requirement | Details |
|---------------------------------------|--------------------|
-| Enable Windows PowerShell scripting on the App-V clients | To publish Office 2016 packages, you must run a script.
Package scripts are disabled by default on App-V clients. To enable scripting, run the following Windows PowerShell command:
`Set-AppvClientConfiguration -EnablePackageScripts 1` |
-| Publish the Office 2016 package globally | Extension points in the Office App-V package require installation at the computer level.
When you publish at the computer level, no prerequisite actions or redistributables are needed, and the Office 2016 package globally enables its applications to work like natively installed Office, eliminating the need for administrators to customize packages. |
+| Enable Windows PowerShell scripting on the App-V clients. | To publish Office 2016 packages, you must run a script. However, package scripts are disabled by default on App-V clients. To enable scripting, run the following Windows PowerShell command:
`Set-AppvClientConfiguration -EnablePackageScripts 1` |
+| Publish the Office 2016 package globally. | Extension points in the Office App-V package require installation at the computer level.
When you publish at the computer level, no prerequisite actions or redistributables are needed. The Office 2016 package globally enables its applications to work like natively installed Office, eliminating the need for administrators to customize packages. |
### How to publish an Office package
Run the following command to publish an Office package globally:
-- `Add-AppvClientPackage
If you are not deploying Office, you can create a package that contains Visio and/or Project, as long as you follow the packaging, publishing, and deployment requirements described in this topic. |
-| How can I deploy Visio 2016 and Project 2016 to specific users? | Use one of the following methods:
**To create two different packages and deploy each one to a different group of users**:
Create and deploy the following packages:
- A package that contains only Office - deploy to computers whose users need only Office.
- A package that contains Office, Visio, and Project - deploy to computers whose users need all three applications.
**To create only one package for the whole organization, or create a package intended for users who share computers**:
Follow these steps:
1. Create a package that contains Office, Visio, and Project.
2. Deploy the package to all users.
3. Use [AppLocker](https://technet.microsoft.com/itpro/windows/keep-secure/applocker-overview) to prevent specific users from using Visio and Project. |
+| How can I deploy Visio 2016 and Project 2016 to specific users? | Use one of the following methods:
**To create two different packages and deploy each one to a different group of users**:
Create and deploy the following packages:
- A package that contains only Office—deploy to computers whose users need only Office.
- A package that contains Office, Visio, and Project—deploy to computers whose users need all three applications.
**To create only one package for the whole organization, or to create a package intended for users who share computers**:
1. Create a package that contains Office, Visio, and Project.
2. Deploy the package to all users.
3. Use [AppLocker](https://docs.microsoft.com/en-us/windows/security/threat-protection/applocker/applocker-overview) to prevent specific users from using Visio and Project. |
## Related topics
-- [Deploying App-V for Windows 10](appv-deploying-appv.md)
-- [Deploying Microsoft Office 2013 by Using App-V](appv-deploying-microsoft-office-2013-with-appv.md)
-- [Deploying Microsoft Office 2010 by Using App-V](appv-deploying-microsoft-office-2010-wth-appv.md)
-- [Office 2016 Deployment Tool for Click-to-Run](https://www.microsoft.com/download/details.aspx?id=49117)
+* [Deploying App-V for Windows 10](appv-deploying-appv.md)
+* [Deploying Microsoft Office 2013 by using App-V](appv-deploying-microsoft-office-2013-with-appv.md)
+* [Deploying Microsoft Office 2010 by using App-V](appv-deploying-microsoft-office-2010-wth-appv.md)
+* [Office 2016 Deployment Tool for Click-to-Run](https://www.microsoft.com/download/details.aspx?id=49117)
## Have a suggestion for App-V?
-Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv).
\ No newline at end of file
+Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
\ No newline at end of file
diff --git a/windows/application-management/app-v/appv-deploying-packages-with-electronic-software-distribution-solutions.md b/windows/application-management/app-v/appv-deploying-packages-with-electronic-software-distribution-solutions.md
index 946c1b15fd..79da7a2972 100644
--- a/windows/application-management/app-v/appv-deploying-packages-with-electronic-software-distribution-solutions.md
+++ b/windows/application-management/app-v/appv-deploying-packages-with-electronic-software-distribution-solutions.md
@@ -36,7 +36,7 @@ Explains how to configure the App-V client to enable only administrators to publ
## Have a suggestion for App-V?
-Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv).
+Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv).
## Other resources for using an ESD and App-V
diff --git a/windows/application-management/app-v/appv-deploying-the-appv-sequencer-and-client.md b/windows/application-management/app-v/appv-deploying-the-appv-sequencer-and-client.md
index 68e3cdbb61..58d77d2a5a 100644
--- a/windows/application-management/app-v/appv-deploying-the-appv-sequencer-and-client.md
+++ b/windows/application-management/app-v/appv-deploying-the-appv-sequencer-and-client.md
@@ -6,29 +6,26 @@ ms.pagetype: mdop, appcompat, virtualization
ms.mktglfcycl: deploy
ms.sitesec: library
ms.prod: w10
-ms.date: 04/19/2017
+ms.date: 04/18/2018
---
+# Deploying the App-V Sequencer and configuring the client
+>Applies to: Windows 10, version 1607
-# Deploying the App-V Sequencer and Configuring the Client
-
-**Applies to**
-- Windows 10, version 1607
-
-The App-V Sequencer and client enable administrators to virtualize and run virtualized applications.
+The App-V Sequencer and client let administrators to virtualize and run virtual applications.
## Enable the client
-The App-V client is the component that runs a virtualized application on a target computer. The client enables users to interact with icons and to double-click file types, so that they can start a virtualized application. The client can also obtain the virtual application content from the management server.
+The App-V client is the component that runs a virtualized application on a target computer. The client lets users interact with icons and file types, starting virtualized applications. The client can also get the virtual application content from the management server.
-> [!NOTE]
-> In Windows 10, version 1607, App-V is included with the operating system. You only need to enable it.
+>[!NOTE]
+>In Windows 10, version 1607, App-V is included with the operating system. You only need to enable it.
[Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md)
-## Client Configuration Settings
+## Client configuration settings
-The App-V client stores its configuration in the registry. You can gather some useful information about the client if you understand the format of data in the registry. For information about client settings that you can configure through Windows PowerShell or through the registry, see [About Client Configuration Settings](appv-client-configuration-settings.md).
+The App-V client stores its configuration in the registry. Understanding the format used in the data registry can help you learn useful information about the client. For information about client settings that you can configure through Windows PowerShell or through the registry, see [About client configuration settings](appv-client-configuration-settings.md).
## Configure the client by using the ADMX template and Group Policy
@@ -36,28 +33,26 @@ You can use Group Policy to configure the client settings for the App-V client a
To manage the ADMX template, perform the following steps on the computer that you will use to manage Group Policy. This is typically the Domain Controller.
-1. Save the **.admx** file to the following directory: **Windows \\ PolicyDefinitions**
-
-2. Save the **.adml** file to the following directory: **Windows \\ PolicyDefinitions \\
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv).
+Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
\ No newline at end of file
diff --git a/windows/application-management/app-v/appv-deploying-the-appv-server.md b/windows/application-management/app-v/appv-deploying-the-appv-server.md
index 1112538222..2b88ff503b 100644
--- a/windows/application-management/app-v/appv-deploying-the-appv-server.md
+++ b/windows/application-management/app-v/appv-deploying-the-appv-server.md
@@ -6,83 +6,79 @@ ms.pagetype: mdop, appcompat, virtualization
ms.mktglfcycl: deploy
ms.sitesec: library
ms.prod: w10
-ms.date: 04/19/2017
+ms.date: 04/18/2018
---
-
# Deploying the App-V server
-**Applies to**
-- Windows Server 2016
+>Applies to: Windows Server 2016
->**Note**
If you plan to use the App-V server components in your deployment, note that they reference App-V 5.x. This is because the App-V server components have not changed in App-V for Windows 10.
+You can install the Application Virtualization (App-V) server components using different deployment configurations, which are described in this topic. Before you install the server features, review the server section of [App-V security considerations](appv-security-considerations.md).
-You can install the Application Virtualization (App-V) server components using different deployment configurations, which are described in this topic. Before you install the server features, review the server section of [App-V Security Considerations](appv-security-considerations.md).
+>[!NOTE]
+>If you plan to use the App-V server components in your deployment, note that the version number is still listed as App-V 5.x, as the App-V server components have not changed in App-V for Windows 10.
-For information about deploying App-V for Windows 10, see [What's new in App-V](appv-about-appv.md).
+To learn more about deploying App-V for Windows 10, read [What's new in App-V](appv-about-appv.md).
->**Important**
Before you install and configure the App-V servers, you must specify a port where each component will be hosted. You must also add the associated firewall rules to allow incoming requests to access the specified ports. The installer does not modify firewall settings.
+>[!IMPORTANT]
+>Before installing and configuring the App-V servers, you must specify the port or ports where each component will be hosted. You must also add the associated firewall rules to allow incoming requests to access the specified ports, as the installer does not modify firewall settings.
## Download and install App-V server components
->**Note**
-If you're already using App-V 5.x, you don't need to re-deploy the App-V server components as they haven't changed since App-V 5.0 was released.
+>[!NOTE]
+>If you're already using App-V 5.x, you don't need to re-deploy the App-V server components, as they haven't changed since App-V 5.0 was released.
-App-V offers the following five server components, each of which serves a specific purpose in an App-V environment.
+App-V offers the following five server components, each of which serves a specific purpose in an App-V environment.
-- **Management server.** Use the App-V management server and console to manage your App-V infrastructure. See [Administering App-V with the management console](appv-administering-virtual-applications-with-the-management-console.md) for more information about the management server.
+* **Management server.** Use the App-V management server and console to manage your App-V infrastructure. See [Administering App-V with the management console](appv-administering-virtual-applications-with-the-management-console.md) for more information about the management server.
- >**Note**
If you are using App-V with your electronic software distribution solution, you don’t need to use the management server and console. However, you may want to take advantage of the reporting and streaming capabilities in App-V.
-
-- **Management database.** Use the App-V management database to facilitate database pre-deployments for App-V management. See [How to Deploy the App-V Server](appv-deploy-the-appv-server.md) for more information about the management database.
-
-- **Publishing server.** Use the App-V publishing server to host and stream virtual applications. The publishing server supports the HTTP and HTTPS protocols and does not require a database connection. See [How to install the App-V publishing server](appv-install-the-publishing-server-on-a-remote-computer.md) for more information about configuring the publishing server.
+ >[!NOTE]
+ >If you are using App-V with your electronic software distribution solution, you don’t need to use the management server and console. However, you may want to take advantage of the reporting and streaming capabilities in App-V.
+* **Management database.** Use the App-V management database to facilitate database pre-deployments for App-V management. For more information about the management database, see [How to deploy the App-V server](appv-deploy-the-appv-server.md).
+* **Publishing server.** Use the App-V publishing server to host and stream virtual applications. The publishing server supports the HTTP and HTTPS protocols and does not require a database connection. To learn how to configure the publishing server, see [How to install the App-V publishing server](appv-install-the-publishing-server-on-a-remote-computer.md).
+* **Reporting server.** Use the App-V reporting server to generate reports that help you manage your App-V infrastructure. The reporting server requires a connection to the reporting database. To learn more about App-V's reporting capabilities, see [About App-V reporting](appv-reporting.md).
+* **Reporting database.** Use the App-V reporting database to facilitate database pre-deployments for App-V reporting. To learn more about the reporting database, see [How to deploy the App-V server](appv-deploy-the-appv-server.md).
-- **Reporting server.** Use the App-V reporting server to generate reports that help you manage your App-V infrastructure. The reporting server requires a connection to the reporting database. See [About App-V reporting](appv-reporting.md) for more information about the reporting capabilities in App-V.
+All five App-V server components are included in the Microsoft Desktop Optimization Pack (MDOP) 2015 ISO package, which can be downloaded from either of the following locations:
-- **Reporting database.** Use the App-V reporting database to facilitate database pre-deployments for App-V reporting. See [How to Deploy the App-V Server](appv-deploy-the-appv-server.md) for more information about the reporting database.
+* The [MSDN (Microsoft Developer Network) subscriptions site](https://msdn.microsoft.com/en-us/subscriptions/downloads/default.aspx#FileId=65215). You must have a MSDN subscription to download the MDOP ISO package from this site.
+* The [Volume Licensing Service Center](https://www.microsoft.com/en-us/licensing/default.aspx) if you're using [Windows 10 for Enterprise or Education](https://www.microsoft.com/en-us/WindowsForBusiness/windows-product-home).
-All five App-V server components are included in the Microsoft Desktop Optimization Pack (MDOP) 2015 ISO package, which can be downloaded from:
+In large organizations, you might want to install more than one instance of the server components to get the following benefits.
-- The [MSDN (Microsoft Developer Network) subscriptions site](https://msdn.microsoft.com/en-us/subscriptions/downloads/default.aspx#FileId=65215) You must have a MSDN subscription to download the MDOP ISO package from the MSDN subscriptions site.
-
-- The [Volume Licensing Service Center](https://www.microsoft.com/en-us/licensing/default.aspx) if you're using [Windows 10 for Enterprise or Education](https://www.microsoft.com/en-us/WindowsForBusiness/windows-product-home).
-
-In large organizations, you might want to install more than one instance of the server components to get:
-
-- Fault tolerance for situations when one of the servers is unavailable.
-
-- High availability to balance server requests. We recommend using a network load balancer to achieve this.
-
-- Scalability to support a high load. For example, you can install additional servers behind a network load balancer.
+* Fault tolerance for situations when one of the servers is unavailable.
+* High availability to balance server requests. A network load balancer can also help you acheive this.
+* Scalability to support high loads. For example, you can install additional servers behind a network load balancer.
## App-V standalone deployment
-The App-V standalone deployment provides a good topology for a small deployment or a test environment. When you use this type of implementation, all server components are installed on a single computer. The services and associated databases will compete for the resources on the computer that runs the App-V components. Therefore, you should not use this strategy for larger deployments.
-- [How to Deploy the App-V Server](appv-deploy-the-appv-server.md)
+The App-V standalone deployment's topology is good for small deployments or test environments. In this implementation type, all server components are installed on a single computer. The services and associated databases will compete for the resources on the computer that runs the App-V components. However, because services and associated databases will compete for the computer's resources, it's not a good idea to use the standalone deployment for larger deployments.
-- [How to Deploy the App-V Server Using a Script](appv-deploy-the-appv-server-with-a-script.md)
+The following articles will give you more information about how to set up an App-V standalone deployment.
-## App-V Server distributed deployment
-The distributed deployment topology can support a large App-V client base and it allows you to more easily manage and scale your environment. When you use this type of deployment, the App-V server components are deployed across multiple computers, based on the structure and requirements of the organization.
+* [How to deploy the App-V server](appv-deploy-the-appv-server.md)
+* [How to deploy the App-V server using a script](appv-deploy-the-appv-server-with-a-script.md)
-- [How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services](appv-install-the-management-and-reporting-databases-on-separate-computers.md)
+## App-V server distributed deployment
-- [How to install the Management Server on a Standalone Computer and Connect it to the Database](appv-install-the-management-server-on-a-standalone-computer.md)
+The distributed deployment topology can support a large App-V client base, allowing you to more easily manage and scale your environment. When you use this type of deployment the App-V server components are deployed across multiple computers, based on your organization's structure and requirements.
-- [How to Deploy the App-V Server Using a Script](appv-deploy-the-appv-server-with-a-script.md)
-
-- [How to Install the Publishing Server on a Remote Computer](appv-install-the-publishing-server-on-a-remote-computer.md)
-
-- [How to install the Management Server on a Standalone Computer and Connect it to the Database](appv-install-the-management-server-on-a-standalone-computer.md)
+* [How to install the management and reporting databases on separate computers from the management and reporting services](appv-install-the-management-and-reporting-databases-on-separate-computers.md)
+* [How to install the management server on a standalone computer and connect it to the database](appv-install-the-management-server-on-a-standalone-computer.md)
+* [How to deploy the App-V server using a script](appv-deploy-the-appv-server-with-a-script.md)
+* [How to install the publishing server on a remote computer](appv-install-the-publishing-server-on-a-remote-computer.md)
+* [How to install the management server on a standalone computer and connect it to the database](appv-install-the-management-server-on-a-standalone-computer.md)
## Using an Enterprise Software Distribution (ESD) solution and App-V
-You can also deploy packages by using an ESD. The full capabilities for integration will vary depending on the ESD that you use.
->**Note**
The App-V reporting server and reporting database can still be deployed alongside the ESD to collect the reporting data from the App-V clients. However, the other three server components should not be deployed, because they will conflict with the ESD functionality.
+You can also deploy packages with an ESD. Its full integration capabilities will vary depending on which ESD you use.
-[Deploying App-V Packages by Using Electronic Software Distribution (ESD)](appv-deploying-packages-with-electronic-software-distribution-solutions.md)
+>[!NOTE]
+>The App-V reporting server and reporting database can still be deployed alongside the ESD to collect the reporting data from the App-V clients. However, the other three server components should not be deployed, because they will conflict with the ESD functionality.
+
+* [Deploying App-V packages by Using Electronic Software Distribution (ESD)](appv-deploying-packages-with-electronic-software-distribution-solutions.md)
## App-V Server logs
+
You can use App-V server log information to help troubleshoot the server installation and operational events while using App-V. The server-related log information can be reviewed with the **Event Viewer**. The following line displays the specific path for Server-related events:
**Event Viewer \\ Applications and Services Logs \\ Microsoft \\ App V**
@@ -92,22 +88,23 @@ Associated setup logs are saved in the following directory:
**%temp%**
## App-V reporting
+
App-V reporting allows App-V clients to collect data and then send it back to be stored in a central repository. You can use this information to get a better view of the virtual application usage within your organization. The following list displays some of the types of information the App-V client collects:
-- Information about the computer that runs the App-V client.
+* Information about the computer running the App-V client.
+* Information about virtualized packages on a specific computer running the App-V client.
+* Information about package open and shutdown for a specific user.
-- Information about virtualized packages on a specific computer that runs the App-V client.
+The reporting information will be maintained until it is successfully sent to the reporting server database. After the data is in the database, you can use Microsoft SQL Server Reporting Services (SSRS) to generate any necessary reports.
-- Information about package open and shutdown for a specific user.
+If you want to retrieve report information, you must use Microsoft SQL SSRS, which is available with Microsoft SQL. SSRS must be deployed separately to generate the associated reports, as it isn't automatically installed during App-V server installation.
-The reporting information will be maintained until it is successfully sent to the reporting server database. After the data is in the database, you can use Microsoft SQL Server Reporting Services to generate any necessary reports.
+For more information, see [About App-V reporting](appv-reporting.md) and [How to enable reporting on the App-V client by using Windows PowerShell](appv-enable-reporting-on-the-appv-client-with-powershell.md).
-If you want to retrieve report information, you must use Microsoft SQL Server Reporting Services (SSRS) which is available with Microsoft SQL. SSRS is not installed when you install the App-V reporting server and it must be deployed separately to generate the associated reports.
+## Other App-V server resources
-For more information, see [About App-V Reporting](appv-reporting.md) and [How to Enable Reporting on the App-V Client by Using Windows PowerShell](appv-enable-reporting-on-the-appv-client-with-powershell.md).
-
-## Other resources for the App-V server
-- [Deploying App-V](appv-deploying-appv.md)
+* [Deploying App-V](appv-deploying-appv.md)
## Have a suggestion for App-V?
-Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv).
\ No newline at end of file
+
+Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
\ No newline at end of file
diff --git a/windows/application-management/app-v/appv-deployment-checklist.md b/windows/application-management/app-v/appv-deployment-checklist.md
index 2382fb9bf3..e979c7f02f 100644
--- a/windows/application-management/app-v/appv-deployment-checklist.md
+++ b/windows/application-management/app-v/appv-deployment-checklist.md
@@ -6,74 +6,27 @@ ms.pagetype: mdop, appcompat, virtualization
ms.mktglfcycl: deploy
ms.sitesec: library
ms.prod: w10
-ms.date: 04/19/2017
+ms.date: 04/18/2018
---
-
-
# App-V Deployment Checklist
-**Applies to**
-- Windows 10, version 1607
+>Applies to: Windows 10, version 1607
-This checklist can be used to help you during an App-V deployment.
+This checklist outlines the recommended steps and items to consider when deploying App-V features. Use it to organize your priorites while you deploy App-V. You can copy this checklist into a spreadsheet program and customize it for your use.
->**Note**
-This checklist outlines the recommended steps and items to consider when deploying App-V features. We recommend that you copy this checklist into a spreadsheet program and customize it for your use.
+|Status|Task|References|Notes|
+|---|---|---|---|
+||Prepare the computing environment for App-V deployment during your planning phase.|[App-V planning checklist](appv-planning-checklist.md)||
+||Review App-V's supported configurations.|[App-V supported configurations](appv-supported-configurations.md)||
+||Run App-V Setup to deploy the required App-V features for your environment.|[How to install the sequencer](appv-install-the-sequencer.md)
[Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md)
[How to deploy the App-V server](appv-deploy-the-appv-server.md)||
-
-
+>[!NOTE]
+>Keep track of server names and associated URLs you create during installation. You'll need this information throughout the installation process.
## Have a suggestion for App-V?
-
-Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
-
-
-
-
- Task
-References
-Notes
-
-
-
-
-
-
-
-
-
-
-
-
-
-
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv).
+Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
## Related topics
-[Deploying App-V](appv-deploying-appv.md)
+* [Deploying App-V](appv-deploying-appv.md)
diff --git a/windows/application-management/app-v/appv-dynamic-configuration.md b/windows/application-management/app-v/appv-dynamic-configuration.md
index 765d08ffa9..5cc4247912 100644
--- a/windows/application-management/app-v/appv-dynamic-configuration.md
+++ b/windows/application-management/app-v/appv-dynamic-configuration.md
@@ -735,7 +735,7 @@ To create the file manually, the information above in previous sections can be c
## Have a suggestion for App-V?
-Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv).
+Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv).
## Related topics
diff --git a/windows/application-management/app-v/appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions.md b/windows/application-management/app-v/appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions.md
index 4201fc2dd5..3ae3740c77 100644
--- a/windows/application-management/app-v/appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions.md
+++ b/windows/application-management/app-v/appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions.md
@@ -29,4 +29,4 @@ Starting in App-V 5.0 SP3, you can configure the App-V client so that only admin
## Have a suggestion for App-V?
-Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv).
+Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv).
diff --git a/windows/application-management/app-v/appv-enable-reporting-on-the-appv-client-with-powershell.md b/windows/application-management/app-v/appv-enable-reporting-on-the-appv-client-with-powershell.md
index 40e2ad2093..c21abca90a 100644
--- a/windows/application-management/app-v/appv-enable-reporting-on-the-appv-client-with-powershell.md
+++ b/windows/application-management/app-v/appv-enable-reporting-on-the-appv-client-with-powershell.md
@@ -41,7 +41,7 @@ Use the following procedure to configure the App-V for reporting.
ReportingServerURL
Specifies the location on the reporting server where client information is saved. For example, http://<reportingservername>:<reportingportnumber>.
+Specifies the location on the reporting server where client information is saved. For example, https://<reportingservername>:<reportingportnumber>.
This is the port number that was assigned during the Reporting Server setup
@@ -82,7 +82,7 @@ Use the following procedure to configure the App-V for reporting. ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/application-management/app-v/appv-enable-the-app-v-desktop-client.md b/windows/application-management/app-v/appv-enable-the-app-v-desktop-client.md index 99775a8445..ff0ad45667 100644 --- a/windows/application-management/app-v/appv-enable-the-app-v-desktop-client.md +++ b/windows/application-management/app-v/appv-enable-the-app-v-desktop-client.md @@ -6,49 +6,37 @@ ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 04/19/2017 +ms.date: 04/18/2018 --- - # Enable the App-V in-box client -**Applies to** -- Windows 10, version 1607 +>Applies to: Windows 10, version 1607 -The App-V client is the component that runs virtualized applications on user devices. The client enables users to interact with icons and file names to start virtualized applications. The client can also get virtual application content from the management server. +The App-V client is the component that runs virtualized applications on user devices. Once you enable the client, users can interact with icons and file names to start virtualized applications. The client can also get virtual application content from the management server. -With Windows 10, version 1607, the App-V client is installed automatically. You need to enable the client to allow user devices to access and run virtual applications. You can enable the client with the Group Policy editor or with Windows PowerShell. +With Windows 10, version 1607, the App-V client is installed automatically. However, you'll still need to enable the client yourself to allow user devices to access and run virtual applications. You can set up the client with the Group Policy editor or with Windows PowerShell. -**To enable the App-V client with Group Policy:** +Here's how to enable the App-V client with Group Policy: -1. Open the device’s **Group Policy Editor**. +1. Open the device’s **Group Policy Editor**. +2. Navigate to **Computer Configuration** > **Administrative Templates** > **System** > **App-V**. +3. Run **Enables App-V Client**, then select **Enabled**. +4. Restart the device. -2. Navigate to **Computer Configuration** > **Administrative Templates** > **System** > **App-V**. +Here's how to enable the App-V client with Windows PowerShell: -3. Run **Enables App-V Client** and then select **Enabled** on the screen that appears. +1. Open Windows PowerShell. +2. Enter **Enable-Appv**, then select the Enter key. +3. Restart the device. +4. To verify that the App-V client is working, enter **Get-AppvStatus**, then select the Enter key. -4. Restart the device. +Check out these articles for more information about how to configure the App-V client: -**To enable the App-V client with Windows PowerShell:** - -1. Open Windows PowerShell. - -2. Type `Enable-Appv` and press ENTER. - -3. Restart the device. - -4. To verify that the App-V client is enabled on the device, type `Get-AppvStatus` and press ENTER. - - -For information about configuring the App-V client, see: - -- [Deploying the App-V Sequencer and Configuring the Client](appv-deploying-the-appv-sequencer-and-client.md) - -- [How to Modify Client Configuration by Using Windows PowerShell](appv-modify-client-configuration-with-powershell.md) - -- [Using the client management console](appv-using-the-client-management-console.md) - -- [How to Configure the Client to Receive Package and Connection Groups Updates From the Publishing Server](appv-configure-the-client-to-receive-updates-from-the-publishing-server.md) +* [Deploying the App-V Sequencer and configuring the client](appv-deploying-the-appv-sequencer-and-client.md) +* [How to modify client configuration by using Windows PowerShell](appv-modify-client-configuration-with-powershell.md) +* [Using the client management console](appv-using-the-client-management-console.md) +* [How to configure the client to receive package and connection group updates From the Publishing server](appv-configure-the-client-to-receive-updates-from-the-publishing-server.md) ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization). \ No newline at end of file diff --git a/windows/application-management/app-v/appv-evaluating-appv.md b/windows/application-management/app-v/appv-evaluating-appv.md index 655ab01b0e..d055f0c12d 100644 --- a/windows/application-management/app-v/appv-evaluating-appv.md +++ b/windows/application-management/app-v/appv-evaluating-appv.md @@ -47,7 +47,7 @@ Use the following links for more information about creating and managing virtual ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/application-management/app-v/appv-for-windows.md b/windows/application-management/app-v/appv-for-windows.md index 9b59235639..857938e467 100644 --- a/windows/application-management/app-v/appv-for-windows.md +++ b/windows/application-management/app-v/appv-for-windows.md @@ -66,4 +66,4 @@ The topics in this section provide information and step-by-step procedures to he ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). diff --git a/windows/application-management/app-v/appv-getting-started.md b/windows/application-management/app-v/appv-getting-started.md index c70689420c..1003f2f5a6 100644 --- a/windows/application-management/app-v/appv-getting-started.md +++ b/windows/application-management/app-v/appv-getting-started.md @@ -6,73 +6,52 @@ ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 04/19/2017 +ms.date: 04/18/2018 --- +# Getting started with App-V for Windows 10 +>Applies to: Windows 10, version 1607 -# Getting Started with App-V for Windows 10 +Microsoft Application Virtualization (App-V) for Windows 10 delivers Win32 applications to users as virtual applications. Virtual applications are installed on centrally managed servers and delivered to users as a service in real time and on an as-needed basis. Users launch virtual applications from familiar access points and interact with them as if they were installed locally. -**Applies to** -- Windows 10, version 1607 - -Microsoft Application Virtualization (App-V) for Windows 10 enables organizations to deliver Win32 applications to users as virtual applications. Virtual applications are installed on centrally managed servers and delivered to users as a service – in real time and on as as-needed basis. Users launch virtual applications from familiar access points and interact with them as if they were installed locally. - -With the release of Windows 10, version 1607, App-V is included with the [Windows 10 for Enterprise edition](https://www.microsoft.com/en-us/WindowsForBusiness/windows-for-enterprise). If you are new to Windows 10 and App-V, you’ll need to download, activate, and install server- and client-side components to start delivering virtual applications to users. For information about what you need to know before getting started with App-V, see the [Application Virtualization (App-V) overview](appv-for-windows.md). +With the release of Windows 10, version 1607, App-V is included with the [Windows 10 for Enterprise edition](https://www.microsoft.com/en-us/WindowsForBusiness/windows-for-enterprise). If you're new to Windows 10 and App-V, you’ll need to download, activate, and install server- and client-side components to start delivering virtual applications to users. To learn what you need to know before getting started with App-V, see the [Application Virtualization (App-V) overview](appv-for-windows.md). If you’re already using App-V, performing an in-place upgrade to Windows 10 on user devices automatically installs the App-V client and migrates users’ App-V applications and settings. For more information about how to configure an existing App-V installation after upgrading user devices to Windows 10, see [Upgrading to App-V for Windows 10 from an existing installation](appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md). ->**Important** -You can upgrade your existing App-V installation to App-V for Windows from App-V versions 5.0 SP2 and higher only. If you are using an earlier version of App-V, you’ll need to upgrade from that version to App-V 5.0 SP2 before you upgrade. +>[!IMPORTANT] +>You can upgrade your existing App-V installation to App-V for Windows from App-V versions 5.0 SP2 and higher only. If you are using an earlier version of App-V, you’ll need to upgrade your existing App-V installation to App-V 5.0 SP2 before upgrading to App-V for Windows. -For information about previous versions of App-V, see [MDOP Information Experience](https://technet.microsoft.com/itpro/mdop/index). +To learn more about previous versions of App-V, see [MDOP information experience](https://docs.microsoft.com/en-us/microsoft-desktop-optimization-pack/index). ## Getting started with App-V for Windows 10 (new installations) -To start using App-V to deliver virtual applications to users, you’ll need to download, enable, and install server- and client-side components. The following table provides information about the App-V for Windows 10 components and where to find them. +To start using App-V to deliver virtual applications to users, you’ll need to download, enable, and install server- and client-side components. The following table describes the App-V for Windows 10 components, what they do, and where to find them. | Component | What it does | Where to find it | |------------|--|------| -| App-V server components | App-V offers five server components that work together to allow you to host and publish virtual applications, generate usage reports, and manage your App-V environment. For information about the server components, see [Deploying the App-V Server](appv-deploying-the-appv-server.md).
**Note** If you're already using App-V 5.x, you don't need to re-deploy the App-V server components as they haven't changed since App-V 5.0 was released. | The App-V server components are included in the Microsoft Desktop Optimization Pack (MDOP) 2015 ISO package, which can be downloaded from:
- The [MSDN (Microsoft Developer Network) subscriptions site](https://msdn.microsoft.com/en-us/subscriptions/downloads/default.aspx#FileId=65215). You must have a MSDN subscription to download the MDOP ISO package from the MSDN subscriptions site.
- The [Volume Licensing Service Center](https://www.microsoft.com/en-us/licensing/default.aspx) if you're using [Windows 10 for Enterprise or Education](https://www.microsoft.com/en-us/WindowsForBusiness/windows-product-home).
See [Deploying the App-V Server](appv-deploying-the-appv-server.md) for more information about installing and using the server components. -| App-V client and App-V Remote Desktop Services (RDS) client | The App-V client is the component that runs virtualized applications on user devices. The client enables users to interact with icons and file names to start virtualized applications. | The App-V client is automatically installed with Windows 10, version 1607.
For information about enabling the client, see [Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md). | -| App-V sequencer | Use the App-V sequencer to convert Win32 applications into virtual packages for deployment to user devices. Devices must be running the App-V client to allow users to interact with virtual applications. | Installed with the [Windows Assessment and Deployment kit (ADK) for Windows 10, version 1607](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit). | +| App-V server components | App-V offers five server components that work together to allow you to host and publish virtual applications, generate usage reports, and manage your App-V environment. For more details, see [Deploying the App-V Server](appv-deploying-the-appv-server.md).
If you're already using App-V 5.x, you don't need to redeploy the App-V server components, as they haven't changed since App-V 5.0's release. | The App-V server components are included in the Microsoft Desktop Optimization Pack (MDOP) 2015 ISO package that can be downloaded from the following locations:
If you have a Microsoft Developer Network (MSDN) subscription, use the [MSDN (Microsoft Developer Network) subscriptions site](https://msdn.microsoft.com/en-us/subscriptions/downloads/default.aspx#FileId=65215) to download the MDOP ISO package.
If you're using [Windows 10 for Enterprise or Education](https://www.microsoft.com/en-us/WindowsForBusiness/windows-product-home), download it from the [Volume Licensing Service Center](https://www.microsoft.com/en-us/licensing/default.aspx).
See [Deploying the App-V Server](appv-deploying-the-appv-server.md) for more information about installing and using the server components.| +| App-V client and App-V Remote Desktop Services (RDS) client | The App-V client is the component that runs virtualized applications on user devices, allowing users to interact with icons and file names to start virtualized applications. | The App-V client is automatically installed with Windows 10, version 1607.
To learn how to enable the client, see [Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md). | +| App-V sequencer | Use the App-V sequencer to convert Win32 applications into virtual packages for deployment to user devices. Devices must run the App-V client to allow users to interact with virtual applications. | Installed with the [Windows Assessment and Deployment kit (ADK) for Windows 10, version 1607](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit). | For more information about these components, see [High Level Architecture for App-V](appv-high-level-architecture.md). -If you are new to this product, we recommend that you read the documentation thoroughly. Before you deploy it to a production environment, we also recommend that you validate your deployment plan in a test network environment. You might also consider taking a class about relevant technologies. For information about Microsoft training opportunities, see the [Microsoft Training Overview](https://www.microsoft.com/en-us/learning/default.aspx). +If you're new to App-V, it's a good idea to read the documentation thoroughly. Before deploying App-V in a production environment, you can ensure installation goes smoothly by validating your deployment plan in a test network environment. You might also consider taking a class about relevant technologies. To get started, see the [Microsoft Training Overview](https://www.microsoft.com/en-us/learning/default.aspx). ## Getting started with App-V +[What's new in App-V](appv-about-appv.md) provides a high-level overview of App-V and how it can be used in your organization. -- [What's new in App-V](appv-about-appv.md) +[Evaluating App-V](appv-evaluating-appv.md) provides information about how you can best evaluate App-V for use in your organization. - Provides a high-level overview of App-V and how it can be used in your organization. +[High Level Architecture for App-V](appv-high-level-architecture.md) provides a description of the App-V features and how they work together. -- [Evaluating App-V](appv-evaluating-appv.md) - - Provides information about how you can best evaluate App-V for use in your organization. - -- [High Level Architecture for App-V](appv-high-level-architecture.md) - - Provides a description of the App-V features and how they work together. - -## Other resources for this product - - -- [Application Virtualization (App-V) overview](appv-for-windows.md) - -- [Planning for App-V](appv-planning-for-appv.md) - -- [Deploying App-V](appv-deploying-appv.md) - -- [Operations for App-V](appv-operations.md) - -- [Troubleshooting App-V](appv-troubleshooting.md) - -- [Technical Reference for App-V](appv-technical-reference.md) - -## Have a suggestion for App-V? - -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +## Other resources for this product +* [Application Virtualization (App-V) overview](appv-for-windows.md) +* [Planning for App-V](appv-planning-for-appv.md) +* [Deploying App-V](appv-deploying-appv.md) +* [Operations for App-V](appv-operations.md) +* [Troubleshooting App-V](appv-troubleshooting.md) +* [Technical reference for App-V](appv-technical-reference.md) \ No newline at end of file diff --git a/windows/application-management/app-v/appv-high-level-architecture.md b/windows/application-management/app-v/appv-high-level-architecture.md index 53dae3fb94..3b799fe1ab 100644 --- a/windows/application-management/app-v/appv-high-level-architecture.md +++ b/windows/application-management/app-v/appv-high-level-architecture.md @@ -1,85 +1,33 @@ --- -title: High Level Architecture for App-V (Windows 10) -description: High Level Architecture for App-V +title: High-level architecture for App-V (Windows 10) +description: High-level Architecture for App-V. author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 04/19/2017 +ms.date: 04/18/2018 --- +# High-level architecture for App-V +>Applies to: Windows 10, version 1607 -# High Level Architecture for App-V - -**Applies to** -- Windows 10, version 1607 - -Use the following information to help you simplify you Microsoft Application Virtualization (App-V) deployment. - -## Architecture Overview +Use the following information to simplify your Microsoft Application Virtualization (App-V) deployment. +## Architecture overview A typical App-V implementation consists of the following elements. -
| Element | -More information | -
|---|---|
App-V Management Server |
-The App-V Management server provides overall management functionality for the App-V infrastructure. Additionally, you can install more than one instance of the management server in your environment which provides the following benefits: -
|
-
App-V Publishing Server |
-The App-V publishing server provides functionality for virtual application hosting and streaming. The publishing server does not require a database connection and supports the following protocols: -
You can also help increase App-V availability by installing the Publishing server on multiple computers. A network load balancer should also be considered so that server requests are balanced. |
-
App-V Reporting Server |
-The App-V Reporting server enables authorized users to run and view existing App-V reports and ad hoc reports that can help them manage the App-V infrastructure. The Reporting server requires a connection to the App-V reporting database. You can also help increase App-V availability by installing the Reporting server on multiple computers. A network load balancer should also be considered so that server requests are balanced. |
-
App-V Client |
-The App-V client enables packages created using App-V to run on target computers. |
-
**Fault tolerance and high availability**—installing and configuring the App-V Management server on two separate computers can help in situations when one of the servers is unavailable or offline. You can also help increase App-V availability by installing the Management server on multiple computers. In this scenario, consider using a network load balancer to keep server requests balanced.
**Scalability**—you can add additional management servers as necessary to support a high load. For example, you can install multiple servers behind a load balancer.| +|App-V Publishing Server|The App-V publishing server provides functionality for virtual application hosting and streaming. The publishing server does not require a database connection and supports HTTP and HTTPS protocols.
You can also help increase App-V availability by installing the Publishing server on multiple computers. You should also consider having a network load balancer to keep server requests balanced.| +|App-V Reporting Server|The App-V Reporting server lets authorized users run and view existing App-V reports and ad hoc reports for managing App-V infrastructure. The Reporting server requires a connection to the App-V reporting database. You can also help increase App-V availability by installing the Reporting server on multiple computers. You should also consider having a network load balancer to keep server requests balanced.| +|App-V Client|The App-V client enables packages created using App-V to run on target computers.| - -**Note** -If you are using App-V with Electronic Software Distribution (ESD) you are not required to use the App-V Management server. However, you can still utilize the reporting and streaming functionality of App-V. - -## Have a suggestion for App-V? - -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +>[!NOTE] +>If you are using App-V with electronic software distribution (ESD), you aren't required to use the App-V Management server. However, you can still use App-V's reporting and streaming functionality. ## Related topics - -[Getting Started with App-V](appv-getting-started.md) - - - - - - - - - +- [Getting Started with App-V](appv-getting-started.md) \ No newline at end of file diff --git a/windows/application-management/app-v/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md b/windows/application-management/app-v/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md index b2d945ee06..efc8ef2948 100644 --- a/windows/application-management/app-v/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md +++ b/windows/application-management/app-v/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md @@ -139,7 +139,7 @@ Before attempting this procedure, you should read and understand the information ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/application-management/app-v/appv-install-the-management-and-reporting-databases-on-separate-computers.md b/windows/application-management/app-v/appv-install-the-management-and-reporting-databases-on-separate-computers.md index eb3ed96877..3097201087 100644 --- a/windows/application-management/app-v/appv-install-the-management-and-reporting-databases-on-separate-computers.md +++ b/windows/application-management/app-v/appv-install-the-management-and-reporting-databases-on-separate-computers.md @@ -1,100 +1,77 @@ --- -title: How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services (Windows 10) -description: How to install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services +title: How to Install the Management and Reporting Databases on separate computers from the Management and Reporting Services (Windows 10) +description: How to install the Management and Reporting Databases on separate computers from the Management and Reporting Services. author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 04/19/2017 +ms.date: 04/18/2018 --- +# How to Install the Management and Reporting Databases on separate computers from the Management and Reporting Services - -# How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services - -**Applies to** -- Windows Server 2016 +>Applies to: Windows Server 2016 Use the following procedure to install the database server and management server on different computers. The computer you plan to install the database server on must be running a supported version of Microsoft SQL or the installation will fail. ->**Note** -After you complete the deployment, the **Microsoft SQL Server name**, **instance name** and **database name** will be required by the administrator installing the service to be able to connect to these databases. +>[!NOTE] +>After you complete the deployment, the administrator installing the service will need the Microsoft SQL Server name, instance name and the database name to connect to these databases. -**To install the management database and the management server on separate computers** +## Installing the management database and the management server on separate computers -1. Copy the App-V server installation files to the computer on which you want to install it on. To start the App-V server installation right-click and run **appv\_server\_setup.exe** as an administrator. Click **Install**. +1. Copy the App-V server installation files to the computer you want to install it on. To start the App-V server installation, run **appv\_server\_setup.exe** as an administrator, then select **Install**. +2. On the **Getting started** page, review and accept the license terms, then select **Next**. +3. On the **Use Microsoft Update to help keep your computer secure and up-to-date** page, to enable Microsoft updates, select **Use Microsoft Update when I check for updates (recommended).** To disable Microsoft updates, select **I don’t want to use Microsoft Update**, then select **Next**. +4. On the **Feature selection** page, select the components you want to install by first selecting the **Management Server Database** checkbox, then selecting **Next**. +5. On the **Installation location** page, accept the default location and select **Next**. +6. On the initial **Create new management server database** page, accept the default selections if appropriate, then select **Next**. + * If you are using a custom SQL Server instance, select **Use a custom instance** and enter the name of the instance. + * If you are using a custom database name, select **Custom configuration** and enter the database name. +7. On the next **Create new management server database** page, select **Use a remote computer**, then enter the remote machine account using the following format: ```Domain\MachineAccount```. -2. On the **Getting Started** page, review and accept the license terms, and click **Next**. + >[!NOTE] + >If you plan to deploy the management server on the same computer you must select **Use this local computer**. Specify the user name for the management server **Install Administrator** using the following format: ```Domain\AdministratorLoginName```. After that, select **Next**. +8. To start the installation, select **Install**. -3. On the **Use Microsoft Update to help keep your computer secure and up-to-date** page, to enable Microsoft updates, select **Use Microsoft Update when I check for updates (recommended).** To disable Microsoft updates, select **I don’t want to use Microsoft Update**. Click **Next**. +## Installing the reporting database and the reporting server on separate computers -4. On the **Feature Selection** page, select the components you want to install by selecting the **Management Server Database** checkbox and click **Next**. +1. Copy the App-V server installation files to the computer you want to install it on. To start the App-V server installation, run **appv\_server\_setup.exe** as an administrator, then select **Install**. +2. On the **Getting started** page, review and accept the license terms, then select **Next**. +3. On the **Use Microsoft Update to help keep your computer secure and up-to-date** page, to enable Microsoft Update, select **Use Microsoft Update when I check for updates (recommended)**. To disable Microsoft Update, select **I don’t want to use Microsoft Update**. After that, select **Next**. +4. On the **Feature selection** page, select the components you want to install by first selecting the **Reporting Server Database** checkbox, then selecting **Next**. +5. On the **Installation Location** page, accept the default location and select **Next**. +6. On the initial **Create new management server database** page, accept the default selections if appropriate, then select **Next**. + * If you're using a custom SQL Server instance, select **Use a custom instance** and enter the instance name. + * If you're using a custom database name, select **Custom configuration** and enter the database name. +7. On the next **Create new management server database** page, select **Use a remote computer**, and enter the remote machine account using the following format: ```Domain\MachineAccount```. -5. On the **Installation Location** page, accept the default location and click **Next**. + >[!NOTE] + >If you plan to deploy the reporting server on the same computer you must select **Use this local computer**. Specify the user name for the reporting server **Install Administrator** using the following format: Domain\\AdministratorLoginName. After that, select **Next**. +8. To start the installation, select **Install**. -6. On the initial **Create New Management Server Database page**, accept the default selections if appropriate, and click **Next**. +## Installing the management and reporting databases using App-V database scripts - If you are using a custom SQL Server instance, then select **Use a custom instance** and type the name of the instance. +1. Copy the App-V server installation files to the computer on which you want to install it on. +2. To extract the App-V database scripts, open a command prompt and specify the location where the installation files are saved and run the following command: - If you are using a custom database name, then select **Custom configuration** and type the database name. + ```SQL + appv\_server\_setup.exe /LAYOUT /LAYOUTDIR=”InstallationExtractionLocation” + ``` + +3. After the extraction has been completed, to access the App-V database scripts and instructions readme file: -7. On the next **Create New Management Server Database** page, select **Use a remote computer**, and type the remote machine account using the following format: **Domain\\MachineAccount**. + * The App-V Management Database scripts and instructions readme are located in the following folder: **InstallationExtractionLocation** \\ **Database Scripts** \\ **Management Database**. + * The App-V Reporting Database scripts and instructions readme are located in the following folder: **InstallationExtractionLocation** \\ **Database Scripts** \\ **Reporting Database**. +4. For each database, copy the scripts to a share and modify them following the instructions in the readme file. - >**Note** - If you plan to deploy the management server on the same computer you must select **Use this local computer**. Specify the user name for the management server **Install Administrator** using the following format: Domain\\AdministratorLoginName. Click **Next**. + >[!NOTE] + >For more information about modifying the required SIDs contained in the scripts see, [How to Install the App-V Databases and Convert the Associated Security Identifiers by Using Windows PowerShell](appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md). +5. Run the scripts on the computer running Microsoft SQL Server. -8. To start the installation, click **Install**. +## Have a suggestion for App-V? -**To install the reporting database and the reporting server on separate computers** - -1. Copy the App-V server installation files to the computer on which you want to install it on. To start the App-V server installation right-click and run **appv\_server\_setup.exe** as an administrator. Click **Install**. - -2. On the **Getting Started** page, review and accept the license terms, and click **Next**. - -3. On the **Use Microsoft Update to help keep your computer secure and up-to-date** page, to enable Microsoft updates, select **Use Microsoft Update when I check for updates (recommended).** To disable Microsoft updates, select **I don’t want to use Microsoft Update**. Click **Next**. - -4. On the **Feature Selection** page, select the components you want to install by selecting the **Reporting Server Database** checkbox and click **Next**. - -5. On the **Installation Location** page, accept the default location and click **Next**. - -6. On the initial **Create New Reporting Server Database** page, accept the default selections if appropriate, and click **Next**. - - If you are using a custom SQL Server instance, then select **Use a custom instance** and type the name of the instance. - - If you are using a custom database name, then select **Custom configuration** and type the database name. - -7. On the next **Create New Reporting Server Database** page, select **Use a remote computer**, and type the remote machine account using the following format: Domain\\MachineAccount. - - **Note** - If you plan to deploy the reporting server on the same computer you must select **Use this local computer**. Specify the user name for the reporting server **Install Administrator** using the following format: Domain\\AdministratorLoginName. Click **Next**. - -8. To start the installation, click **Install**. - -**To install the management and reporting databases using App-V database scripts** - -1. Copy the App-V server installation files to the computer on which you want to install it on. - -2. To extract the App-V database scripts, open a command prompt and specify the location where the installation files are saved and run the following command: - - **appv\_server\_setup.exe** **/LAYOUT** **/LAYOUTDIR=”InstallationExtractionLocation”** - -3. After the extraction has been completed, to access the App-V database scripts and instructions readme file: - - - The App-V Management Database scripts and instructions readme are located in the following folder: **InstallationExtractionLocation** \\ **Database Scripts** \\ **Management Database**. - - - The App-V Reporting Database scripts and instructions readme are located in the following folder: **InstallationExtractionLocation** \\ **Database Scripts** \\ **Reporting Database**. - -4. For each database, copy the scripts to a share and modify them following the instructions in the readme file. - - **Note** - For more information about modifying the required SIDs contained in the scripts see, [How to Install the App-V Databases and Convert the Associated Security Identifiers by Using Windows PowerShell](appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md). - -5. Run the scripts on the computer running Microsoft SQL Server. - -## Have a suggestion for App-V? - -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization). ## Related topics -[Deploying App-V](appv-deploying-appv.md) +* [Deploying App-V](appv-deploying-appv.md) \ No newline at end of file diff --git a/windows/application-management/app-v/appv-install-the-management-server-on-a-standalone-computer.md b/windows/application-management/app-v/appv-install-the-management-server-on-a-standalone-computer.md index fa923602c4..2da4a3b2f6 100644 --- a/windows/application-management/app-v/appv-install-the-management-server-on-a-standalone-computer.md +++ b/windows/application-management/app-v/appv-install-the-management-server-on-a-standalone-computer.md @@ -6,56 +6,34 @@ ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 04/19/2017 +ms.date: 04/18/2018 --- - - # How to install the Management Server on a Standalone Computer and Connect it to the Database -**Applies to** -- Windows Server 2016 +>Applies to: Windows Server 2016 -Use the following procedure to install the management server on a standalone computer and connect it to the database. +To install the management server on a standalone computer and connect it to the database, follow these steps. -**To install the management server on a standalone computer and connect it to the database** +1. Copy the App-V server installation files to the computer on which you want to install it on. To start the App-V server installation, run **appv\_server\_setup.exe** as an administrator, then select **Install**. +2. On the **Getting Started** page, review and accept the license terms, then select **Next**. +3. On the **Use Microsoft Update to help keep your computer secure and up-to-date** page, to enable Microsoft Udpate, select **Use Microsoft Update when I check for updates (recommended)**. To disable Microsoft Update, select **I don’t want to use Microsoft Update**, then select **Next**. +4. On the **Feature Selection** page, select the **Management Server** checkbox, then select **Next**. +5. On the **Installation Location** page, accept the default location, then select **Next**. +6. On the **Configure Existing Management Database** page, select **Use a remote SQL Server**, then enter the computer running Microsoft SQL's machine name, such as ```SqlServerMachine```. -1. Copy the App-V server installation files to the computer on which you want to install it on. To start the App-V server installation right-click and run **appv\_server\_setup.exe** as an administrator. Click **Install**. + >[!NOTE] + >If the Microsoft SQL Server is deployed on the same server, select **Use local SQL Server**. For the SQL Server Instance, select **Use the default instance**. If you are using a custom Microsoft SQL Server instance, you must select **Use a custom instance**, then enter the instance's name. Specify the **SQL Server Database name** that this management server will use, such as ```AppvManagement```. +7. On the **Configure management server configuration** page, specify the following items: + * The AD group or account that will connect to the management console for administrative purposes for example **MyDomain\\MyUser** or **MyDomain\\AdminGroup**. The account or AD group you specify will be enabled to manage the server through the management console. You can add additional users or groups using the management console after installation + * The **Website Name** you want to use for the management service. Accept the default if you do not have a custom name. + * For the **Port Binding**, specify a unique port number, such as **12345**. +8. Select **Install**. +9. To confirm that the setup has completed successfully, open a web browser and enter the following URL: https://managementserver:portnumber/Console. If the installation was successful, you should see the **Management Console** appear without any error messages or warnings displayed. -2. On the **Getting Started** page, review and accept the license terms, and click **Next**. +## Have a suggestion for App-V? -3. On the **Use Microsoft Update to help keep your computer secure and up-to-date** page, to enable Microsoft updates, select **Use Microsoft Update when I check for updates (recommended).** To disable Microsoft updates, select **I don’t want to use Microsoft Update**. Click **Next**. - -4. On the **Feature Selection** page, select the **Management Server** checkbox and click **Next**. - -5. On the **Installation Location** page, accept the default location and click **Next**. - -6. On the **Configure Existing Management Database** page, select **Use a remote SQL Server**, and type the machine name of the computer running Microsoft SQL SQL, for example **SqlServerMachine**. - - >**Note** - If the Microsoft SQL Server is deployed on the same server, select **Use local SQL Server**. For the SQL Server Instance, select **Use the default instance**. If you are using a custom Microsoft SQL Server instance, you must select **Use a custom instance** and then type the name of the instance. Specify the **SQL Server Database name** that this management server will use, for example **AppvManagement**. - -7. On the **Configure Management Server Configuration** page, specify the AD group or account that will connect to the management console for administrative purposes for example **MyDomain\\MyUser** or **MyDomain\\AdminGroup**. The account or AD group you specify will be enabled to manage the server through the management console. You can add additional users or groups using the management console after installation - - Specify the **Website Name** that you want to use for the management service. Accept the default if you do not have a custom name. For the **Port Binding**, specify a unique port number to be used, for example **12345**. - -8. Click **Install**. - -9. To confirm that the setup has completed successfully, open a web browser, and type the following URL: http://managementserver:portnumber/Console. If the installation was successful, you should see the **Management Console** appear without any error messages or warnings being displayed. - -## Have a suggestion for App-V? - -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization). ## Related topics - -[Deploying App-V](appv-deploying-appv.md) - - - - - - - - - +* [Deploying App-V](appv-deploying-appv.md) \ No newline at end of file diff --git a/windows/application-management/app-v/appv-install-the-publishing-server-on-a-remote-computer.md b/windows/application-management/app-v/appv-install-the-publishing-server-on-a-remote-computer.md index 5a9a64344a..a67700ab9a 100644 --- a/windows/application-management/app-v/appv-install-the-publishing-server-on-a-remote-computer.md +++ b/windows/application-management/app-v/appv-install-the-publishing-server-on-a-remote-computer.md @@ -6,50 +6,35 @@ ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 04/19/2017 +ms.date: 04/18/2018 --- +# How to install the publishing server on a remote computer - -# How to Install the Publishing Server on a Remote Computer - -**Applies to** -- Windows Server 2016 +>Applies to: Windows Server 2016 Use the following procedure to install the publishing server on a separate computer. Before you perform the following procedure, ensure the database and management server are available. -**To install the publishing server on a separate computer** +## Installing the publishing server on a separate computer -1. Copy the App-V server installation files to the computer on which you want to install it on. To start the App-V server installation right-click and run **appv\_server\_setup.exe** as an administrator. Click **Install**. +1. Copy the App-V server installation files to the computer on which you want to install it on. To start the App-V server installation, run **appv\_server\_setup.exe** as an administrator, then select **Install**. +2. On the **Getting started** page, review and accept the license terms, then select **Next**. +3. On the **Use Microsoft Update to help keep your computer secure and up-to-date** page, to enable Microsoft updates, select **Use Microsoft Update when I check for updates (recommended)**. To disable Microsoft Update, select **I don’t want to use Microsoft Update**. Click **Next**. +4. On the **Feature selection** page, select the **Publishing Server** checkbox, then select **Next**. +5. On the **Installation location** page, accept the default location, then select **Next**. +6. On the **Configure publishing server configuration** page, specify the following items: -2. On the **Getting Started** page, review and accept the license terms, and click **Next**. + * The URL for the management service that the publishing server will connect to. For example, **http://ManagementServerName:12345**. + * Specify the website name that you want to use for the publishing service. If you don't have a custom name, then use the default name. + * For the **Port binding**, specify a unique port number that will be used by App-V. For example, **54321**. +7. On the **Ready to install** page, select **Install**. +8. After the installation is complete, the publishing server must be registered with the management server. In the App-V management console, use the following steps to register the server: -3. On the **Use Microsoft Update to help keep your computer secure and up-to-date** page, to enable Microsoft updates, select **Use Microsoft Update when I check for updates (recommended).** To disable Microsoft updates, select **I don’t want to use Microsoft Update**. Click **Next**. + 1. Open the App-V management server console. + 2. In the left pane, select **Servers**, then select **Register New Server**. + 3. Enter the server name and a description (if required), then select **Add**. +9. To verify that the publishing server is running correctly, you should import a package to the management server, entitle that package to an AD group, then publish it. Using an internet browser, open the following URL: **https://publishingserver:pubport**. If the server is running correctly, information like the following example should appear. -4. On the **Feature Selection** page, select the **Publishing Server** checkbox and click **Next**. - -5. On the **Installation Location** page, accept the default location and click **Next**. - -6. On the **Configure Publishing Server Configuration** page, specify the following items: - - - The URL for the management service that the publishing server will connect to. For example, **http://ManagementServerName:12345**. - - - Specify the website name that you want to use for the publishing service. Accept the default if you do not have a custom name. - - - For the **Port Binding**, specify a unique port number that will be used by App-V, for example **54321**. - -7. On the **Ready to Install** page, click **Install**. - -8. After the installation is complete, the publishing server must be registered with the management server. In the App-V management console, use the following steps to register the server: - - 1. Open the App-V management server console. - - 2. In the left pane, select **Servers**, and then select **Register New Server**. - - 3. Type the name of this server and a description (if required) and click **Add**. - -9. To verify that the publishing server is running correctly, you should import a package to the management server, entitle the package to an AD group, and publish the package. Using an internet browser, open the following URL: **http://publishingserver:pubport**. If the server is running correctly information similar to the following will be displayed: - - ```syntax + ```SQL
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization). ## Related topics - -[Deploying App-V](appv-deploying-appv.md) - - - - - - - - - +* [Deploying App-V](appv-deploying-appv.md) \ No newline at end of file diff --git a/windows/application-management/app-v/appv-install-the-reporting-server-on-a-standalone-computer.md b/windows/application-management/app-v/appv-install-the-reporting-server-on-a-standalone-computer.md index 99f591c3af..edf22cbc3d 100644 --- a/windows/application-management/app-v/appv-install-the-reporting-server-on-a-standalone-computer.md +++ b/windows/application-management/app-v/appv-install-the-reporting-server-on-a-standalone-computer.md @@ -1,58 +1,45 @@ --- -title: How to install the Reporting Server on a Standalone Computer and Connect it to the Database (Windows 10) +title: How to install the Reporting Server on a standalone computer and connect it to the database (Windows 10) description: How to install the App-V Reporting Server on a Standalone Computer and Connect it to the Database author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 04/19/2017 +ms.date: 04/18/2018 --- +# How to install the reporting server on a standalone computer and connect it to the database - -# How to install the Reporting Server on a Standalone Computer and Connect it to the Database - -**Applies to** -- Windows Server 2016 +>Applies to: Windows Server 2016 Use the following procedure to install the reporting server on a standalone computer and connect it to the database. -> **Important** Before performing the following procedure you should read and understand [About App-V Reporting](appv-reporting.md). +>[!IMPORTANT] +>Before performing the following procedure you should read and understand [About App-V reporting](appv-reporting.md). -**To install the reporting server on a standalone computer and connect it to the database** +## Install the reporting server on a standalone computer and connect it to the database -1. Copy the App-V server installation files to the computer on which you want to install it on. To start the App-V server installation right-click and run **appv\_server\_setup.exe** as an administrator. Click **Install**. +1. Copy the App-V server installation files to the computer you plan to install it on. To start the App-V server installation, run **appv\_server\_setup.exe** as an administrator, then select **Install**. +2. On the **Getting started** page, review and accept the license terms, then select **Next**. +3. On the **Use Microsoft Update to help keep your computer secure and up-to-date** page, to enable Microsoft Update, select **Use Microsoft Update when I check for updates (recommended)**. To disable Microsoft Update, select **I don’t want to use Microsoft Update**. Select **Next**. +4. On the **Feature selection** page, select the **Reporting Server** checkbox, then select **Next**. +5. On the **Installation location** page, accept the default location and select **Next**. +6. On the **Configure existing reporting database** page, select **Use a remote SQL Server**, then enter the machine name of the computer running Microsoft SQL Server. For example, you can name your computer **SqlServerMachine**. -2. On the **Getting Started** page, review and accept the license terms, and click **Next**. + >[!NOTE] + >If the Microsoft SQL Server is deployed on the same server, select **Use local SQL Server**. For the SQL Server instance, select **Use the default instance**. If you're using a custom Microsoft SQL Server instance, select **Use a custom instance**, then enter the name of your custom instance. Specify the **SQL Server Database name** that this reporting server will use; for example, you can name the server **AppvReporting**. +7. On the **Configure reporting server configuration** page. -3. On the **Use Microsoft Update to help keep your computer secure and up-to-date** page, to enable Microsoft updates, select **Use Microsoft Update when I check for updates (recommended).** To disable Microsoft updates, select **I don’t want to use Microsoft Update**. Click **Next**. - -4. On the **Feature Selection** page, select the **Reporting Server** checkbox and click **Next**. - -5. On the **Installation Location** page, accept the default location and click **Next**. - -6. On the **Configure Existing Reporting Database** page, select **Use a remote SQL Server**, and type the machine name of the computer running Microsoft SQL Server, for example **SqlServerMachine**. - - **Note** - If the Microsoft SQL Server is deployed on the same server, select **Use local SQL Server**. For the SQL Server Instance, select **Use the default instance**. If you are using a custom Microsoft SQL Server instance, you must select **Use a custom instance** and then type the name of the instance. Specify the **SQL Server Database name** that this reporting server will use, for example **AppvReporting**. - -7. On the **Configure Reporting Server Configuration** page. - - - Specify the Website Name that you want to use for the Reporting Service. Leave the default unchanged if you do not have a custom name. - - - For the **Port binding**, specify a unique port number that will be used by App-V, for example **55555**. You should also ensure that the port specified is not being used by another website. - -8. Click **Install**. + * Specify the website name you want to use for the reporting service. Leave the default unchanged if you do not have a custom name. + * For the **Port binding**, specify a unique, five-digit port number for App-V to use, such as **55555**. Make sure that the specified port isn't being used by another website. +8. Select **Install**. ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization). ## Related topics - -[About App-V Reporting](appv-reporting.md) - -[Deploying App-V](appv-deploying-appv.md) - -[How to Enable Reporting on the App-V Client by Using Windows PowerShell](appv-enable-reporting-on-the-appv-client-with-powershell.md) +* [About App-V reporting](appv-reporting.md) +* [Deploying App-V](appv-deploying-appv.md) +* [How to enable reporting on the App-V client by using Windows PowerShell](appv-enable-reporting-on-the-appv-client-with-powershell.md) \ No newline at end of file diff --git a/windows/application-management/app-v/appv-install-the-sequencer.md b/windows/application-management/app-v/appv-install-the-sequencer.md index c07313e6e7..c799df5bae 100644 --- a/windows/application-management/app-v/appv-install-the-sequencer.md +++ b/windows/application-management/app-v/appv-install-the-sequencer.md @@ -6,48 +6,43 @@ ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 04/19/2017 +ms.date: 04/18/2018 --- - - # Install the App-V Sequencer -**Applies to** -- Windows 10, version 1607 +>Applies to: Windows 10, version 1607 Use the App-V Sequencer to convert Win32 applications into virtual packages for deployment to user devices. Those devices must be running the App-V client to allow users to interact with virtual applications. The App-V Sequencer is included in the Windows 10 Assessment and Deployment Kit (Windows ADK). -> [!NOTE] -> The computer that will run the sequencer must not have the App-V client enabled on it. As a best practice, choose a computer with the same hardware and software configurations as the computers that will run the virtual applications. The sequencing process is resource intensive, so make sure that the computer that runs the Sequencer has plenty of memory, a fast processor, and a fast hard drive. +>[!NOTE] +>The computer that will run the sequencer must not have the App-V client enabled. As a best practice, choose a computer with the same hardware and software configurations as the computers that will run the virtual applications. The sequencing process is resource-intensive, so make sure the computer that will run the Sequencer has plenty of memory, a fast processor, and a fast hard drive. -To install the App-V Sequencer: +## How to install the App-V Sequencer -1. Go to [Download the Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit). - -2. Click or press the **Get Windows ADK for Windows 10** button on the page to start the ADK installer. Make sure that **Microsoft Application Virtualization (App-V) Sequencer** is selected during the installation. +1. Go to [Download the Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit). +2. Select the **Get Windows ADK for Windows 10** button on the page to start the ADK installer. Make sure that **Microsoft Application Virtualization (App-V) Sequencer** is selected during the installation.  +3. To open the Sequencer, go to the **Start** menu and select **Microsoft Application Virtualization (App-V) Sequencer**. -3. To open the Sequencer, from the **Start** menu, select **Microsoft Application Virtualization (App-V) Sequencer** . - -See [Creating and managing virtual applications](appv-creating-and-managing-virtualized-applications.md) and the [Application Virtualization Sequencing Guide](http://download.microsoft.com/download/F/7/8/F784A197-73BE-48FF-83DA-4102C05A6D44/App-V%205.0%20Sequencing%20Guide.docx) for information about creating virtual applications with the Sequencer. +See [Creating and managing virtual applications](appv-creating-and-managing-virtualized-applications.md) and the [Application Virtualization Sequencing Guide](https://download.microsoft.com/download/F/7/8/F784A197-73BE-48FF-83DA-4102C05A6D44/App-V%205.0%20Sequencing%20Guide.docx) for information about creating virtual applications with the Sequencer. ## Command-line options for installing the sequencer You can also use the command line to install the App-V sequencer. The following list displays information about options for installing the sequencer using the command line and **appv\_sequencer\_setup.exe**: -| **Command** | **Description** | +| Command | Description | |-------------------|------------------| -| /INSTALLDIR | Specifies the installation directory. | -| /Log | Specifies where the installation log will be saved, the default location is **%Temp%**. For example, **C:\\Logs\\ log.log**. | -| /q | Specifies a quiet or silent installation. | -| /Uninstall | Specifies the removal of the sequencer. | -| /ACCEPTEULA | Accepts the license agreement. This is required for an unattended installation. Example usage: **/ACCEPTEULA** or **/ACCEPTEULA=1**. | -| /LAYOUT | Specifies the associated layout action. It also extracts the Windows Installer (.msi) and script files to a folder without installing App-V. No value is expected. | -| /LAYOUTDIR | Specifies the layout directory. Requires a string value. Example usage:**/LAYOUTDIR=”C:\\Application Virtualization Client”**. | -| /? Or /h or /help | Displays associated help. | +| **/INSTALLDIR** | Specifies the installation directory. | +| **/Log** | Specifies where the installation log will be saved. The default location is **%Temp%**. For example, **C:\\Logs\\log.log**. | +| **/q** | Specifies a quiet or silent installation. | +| **/Uninstall** | Specifies the removal of the sequencer. | +| **/ACCEPTEULA** | Accepts the license agreement. This is required for an unattended installation. For example, **/ACCEPTEULA** or **/ACCEPTEULA=1**. | +| **/LAYOUT** | Specifies the associated layout action. It also extracts the Windows Installer (.msi) and script files to a folder without installing App-V. No value is expected. | +| **/LAYOUTDIR** | Specifies the layout directory. Requires a string value. For example, **/LAYOUTDIR=”C:\\Application Virtualization Client”**. | +| **/?** or **/h** or **/help** | Displays associated help. | ## To troubleshoot the App-V sequencer installation @@ -55,8 +50,8 @@ For more information regarding the sequencer installation, you can view the erro ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization). ## Related topics -- [Planning to Deploy App-V](appv-planning-to-deploy-appv.md) +* [Planning to deploy App-V](appv-planning-to-deploy-appv.md) diff --git a/windows/application-management/app-v/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md b/windows/application-management/app-v/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md index a42284d262..2a510d8f89 100644 --- a/windows/application-management/app-v/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md +++ b/windows/application-management/app-v/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md @@ -160,7 +160,7 @@ Starting in App-V 5.0 SP3, cmdlet help is available in two formats:
-- **On TechNet as web pages**: See the App-V node under [Microsoft Desktop Optimization Pack Automation with Windows PowerShell](http://technet.microsoft.com/library/dn520245.aspx). +- **On TechNet as web pages**: See the App-V node under [Microsoft Desktop Optimization Pack Automation with Windows PowerShell](https://technet.microsoft.com/library/dn520245.aspx). ## Displaying the help for a Windows PowerShell cmdlet @@ -174,4 +174,4 @@ To display help for a specific Windows PowerShell cmdlet: ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). diff --git a/windows/application-management/app-v/appv-maintaining-appv.md b/windows/application-management/app-v/appv-maintaining-appv.md index faf98d1a83..3db885c191 100644 --- a/windows/application-management/app-v/appv-maintaining-appv.md +++ b/windows/application-management/app-v/appv-maintaining-appv.md @@ -33,7 +33,7 @@ Additionally, ISV’s who want to explicitly virtualize or not virtualize calls ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Other resources for maintaining App-V diff --git a/windows/application-management/app-v/appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md b/windows/application-management/app-v/appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md index 97eee09c9b..e3c9eca586 100644 --- a/windows/application-management/app-v/appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md +++ b/windows/application-management/app-v/appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md @@ -273,7 +273,7 @@ For more information about pending tasks, see [Upgrading an in-use App-V package ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/application-management/app-v/appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md b/windows/application-management/app-v/appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md index d355206820..a82855cb2a 100644 --- a/windows/application-management/app-v/appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md +++ b/windows/application-management/app-v/appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md @@ -128,7 +128,7 @@ This topic explains the following procedures: ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/application-management/app-v/appv-managing-connection-groups.md b/windows/application-management/app-v/appv-managing-connection-groups.md index 7822555b01..3f69438c95 100644 --- a/windows/application-management/app-v/appv-managing-connection-groups.md +++ b/windows/application-management/app-v/appv-managing-connection-groups.md @@ -67,7 +67,7 @@ In some previous versions of App-V, connection groups were referred to as Dynami ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Other resources for App-V connection groups diff --git a/windows/application-management/app-v/appv-migrating-to-appv-from-a-previous-version.md b/windows/application-management/app-v/appv-migrating-to-appv-from-a-previous-version.md index f08ad71d32..e74aecb295 100644 --- a/windows/application-management/app-v/appv-migrating-to-appv-from-a-previous-version.md +++ b/windows/application-management/app-v/appv-migrating-to-appv-from-a-previous-version.md @@ -250,7 +250,7 @@ There is no direct method to upgrade to a full App-V infrastructure. Use the inf ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Other resources for performing App-V migration tasks diff --git a/windows/application-management/app-v/appv-modify-an-existing-virtual-application-package.md b/windows/application-management/app-v/appv-modify-an-existing-virtual-application-package.md index 0d54d46c3d..c3c5a98cac 100644 --- a/windows/application-management/app-v/appv-modify-an-existing-virtual-application-package.md +++ b/windows/application-management/app-v/appv-modify-an-existing-virtual-application-package.md @@ -147,7 +147,7 @@ This topic explains how to: ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/application-management/app-v/appv-modify-client-configuration-with-powershell.md b/windows/application-management/app-v/appv-modify-client-configuration-with-powershell.md index 2390fd040c..febf5efcda 100644 --- a/windows/application-management/app-v/appv-modify-client-configuration-with-powershell.md +++ b/windows/application-management/app-v/appv-modify-client-configuration-with-powershell.md @@ -30,7 +30,7 @@ Use the following procedure to configure the App-V client configuration. ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/application-management/app-v/appv-move-the-appv-server-to-another-computer.md b/windows/application-management/app-v/appv-move-the-appv-server-to-another-computer.md index 51ac36eeca..fc39d7dc05 100644 --- a/windows/application-management/app-v/appv-move-the-appv-server-to-another-computer.md +++ b/windows/application-management/app-v/appv-move-the-appv-server-to-another-computer.md @@ -28,7 +28,7 @@ Follow these steps to create a new management server console: ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/application-management/app-v/appv-operations.md b/windows/application-management/app-v/appv-operations.md index ff65d8049c..23b04fbff1 100644 --- a/windows/application-management/app-v/appv-operations.md +++ b/windows/application-management/app-v/appv-operations.md @@ -6,73 +6,47 @@ ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 04/19/2017 +ms.date: 04/18/2018 --- - - # Operations for App-V -**Applies to** -- Windows 10, version 1607 +>Applies to: Windows 10, version 1607 This section of the Microsoft Application Virtualization (App-V) Administrator’s Guide includes information about the various types of App-V administration and operating tasks that are typically performed by an administrator. This section also includes step-by-step procedures to help you successfully perform those tasks. ## Operations Information - -- [Creating and Managing App-V Virtualized Applications](appv-creating-and-managing-virtualized-applications.md) +- [Creating and Managing App-V Virtualized Applications](appv-creating-and-managing-virtualized-applications.md) Describes how to create, modify, and convert virtualized packages. - -- [Administering App-V Virtual Applications by Using the Management Console](appv-administering-virtual-applications-with-the-management-console.md) +- [Administering App-V Virtual Applications by Using the Management Console](appv-administering-virtual-applications-with-the-management-console.md) Describes how to use the App-V Management console to perform tasks such as sequencing an application, changing a package, using a project template, and using a package accelerator. - -- [Managing Connection Groups](appv-managing-connection-groups.md) +- [Managing Connection Groups](appv-managing-connection-groups.md) Describes how connection groups enable virtualized applications to communicate with each other in the virtual environment; explains how to create, publish, and delete them; and describes how connection groups can help you better manage your virtualized applications. - -- [Deploying App-V Packages by Using Electronic Software Distribution (ESD)](appv-deploying-packages-with-electronic-software-distribution-solutions.md) +- [Deploying App-V Packages by Using Electronic Software Distribution (ESD)](appv-deploying-packages-with-electronic-software-distribution-solutions.md) Describes how to deploy App-V packages by using an ESD. - -- [Using the App-V Client Management Console](appv-using-the-client-management-console.md) +- [Using the App-V Client Management Console](appv-using-the-client-management-console.md) Describes how perform client configuration tasks using the client management console. - -- [Migrating to App-V from a Previous Version](appv-migrating-to-appv-from-a-previous-version.md) +- [Migrating to App-V from a Previous Version](appv-migrating-to-appv-from-a-previous-version.md) Provides instructions for migrating to App-V from a previous version. - -- [Administering App-V by Using Windows PowerShell](appv-administering-appv-with-powershell.md) +- [Administering App-V by Using Windows PowerShell](appv-administering-appv-with-powershell.md) Describes the set of Windows PowerShell cmdlets available for administrators performing various App-V server tasks. +## Additional information + +- [Application Virtualization (App-V) overview](appv-for-windows.md) +- [Getting Started with App-V](appv-getting-started.md) +- [Planning for App-V](appv-planning-for-appv.md) +- [Deploying App-V](appv-deploying-appv.md) +- [Troubleshooting App-V](appv-troubleshooting.md) +- [Technical Reference for App-V](appv-technical-reference.md) + ## Have a suggestion for App-V? - -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). - -## Other Resources for App-V Operations - - -- [Application Virtualization (App-V) overview](appv-for-windows.md) - -- [Getting Started with App-V](appv-getting-started.md) - -- [Planning for App-V](appv-planning-for-appv.md) - -- [Deploying App-V](appv-deploying-appv.md) - -- [Troubleshooting App-V](appv-troubleshooting.md) - -- [Technical Reference for App-V](appv-technical-reference.md) - - - - - - - - - +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization). \ No newline at end of file diff --git a/windows/application-management/app-v/appv-performance-guidance.md b/windows/application-management/app-v/appv-performance-guidance.md index 5fe043b48f..faf22cca11 100644 --- a/windows/application-management/app-v/appv-performance-guidance.md +++ b/windows/application-management/app-v/appv-performance-guidance.md @@ -271,7 +271,7 @@ For more information, see: - [Get Started with UE-V](/windows/configuration/ue-v/uev-getting-started) -In essence all that is required is to enable the UE-V service and download the following Microsoft authored App-V settings template from the [Microsoft User Experience Virtualization (UE-V) template gallery](http://gallery.technet.microsoft.com/Authored-UE-V-Settings-bb442a33). Register the template. For more information about UE-V templates, see [User Experience Virtualization (UE-V) for Windows 10 overview](/windows/configuration/ue-v/uev-for-windows). +In essence all that is required is to enable the UE-V service and download the following Microsoft authored App-V settings template from the [Microsoft User Experience Virtualization (UE-V) template gallery](https://gallery.technet.microsoft.com/Authored-UE-V-Settings-bb442a33). Register the template. For more information about UE-V templates, see [User Experience Virtualization (UE-V) for Windows 10 overview](/windows/configuration/ue-v/uev-for-windows). **Note** Without performing an additional configuration step, User Environment Virtualization (UE-V) will not be able to synchronize the Start menu shortcuts (.lnk files) on the target computer. The .lnk file type is excluded by default. @@ -444,41 +444,41 @@ In a non-persistent environment, it is unlikely these pended operations will be The following section contains lists with information about Microsoft documentation and downloads that may be useful when optimizing your environment for performance. - + **.NET NGEN Blog (Highly Recommended)** -- [How to speed up NGEN optimization](http://blogs.msdn.com/b/dotnet/archive/2013/08/06/wondering-why-mscorsvw-exe-has-high-cpu-usage-you-can-speed-it-up.aspx) +- [How to speed up NGEN optimization](https://blogs.msdn.com/b/dotnet/archive/2013/08/06/wondering-why-mscorsvw-exe-has-high-cpu-usage-you-can-speed-it-up.aspx) **Windows Server and Server Roles** Server Performance Tuning Guidelines for -- [Microsoft Windows Server 2012 R2](http://msdn.microsoft.com/library/windows/hardware/dn529133.aspx) +- [Microsoft Windows Server 2012 R2](https://msdn.microsoft.com/library/windows/hardware/dn529133.aspx) -- [Microsoft Windows Server 2012](http://download.microsoft.com/download/0/0/B/00BE76AF-D340-4759-8ECD-C80BC53B6231/performance-tuning-guidelines-windows-server-2012.docx) +- [Microsoft Windows Server 2012](https://download.microsoft.com/download/0/0/B/00BE76AF-D340-4759-8ECD-C80BC53B6231/performance-tuning-guidelines-windows-server-2012.docx) -- [Microsoft Windows Server 2008 R2](http://download.microsoft.com/download/6/B/2/6B2EBD3A-302E-4553-AC00-9885BBF31E21/Perf-tun-srv-R2.docx) +- [Microsoft Windows Server 2008 R2](https://download.microsoft.com/download/6/B/2/6B2EBD3A-302E-4553-AC00-9885BBF31E21/Perf-tun-srv-R2.docx) **Server Roles** -- [Remote Desktop Virtualization Host](http://msdn.microsoft.com/library/windows/hardware/dn567643.aspx) +- [Remote Desktop Virtualization Host](https://msdn.microsoft.com/library/windows/hardware/dn567643.aspx) -- [Remote Desktop Session Host](http://msdn.microsoft.com/library/windows/hardware/dn567648.aspx) +- [Remote Desktop Session Host](https://msdn.microsoft.com/library/windows/hardware/dn567648.aspx) -- [IIS Relevance: App-V Management, Publishing, Reporting Web Services](http://msdn.microsoft.com/library/windows/hardware/dn567678.aspx) +- [IIS Relevance: App-V Management, Publishing, Reporting Web Services](https://msdn.microsoft.com/library/windows/hardware/dn567678.aspx) -- [File Server (SMB) Relevance: If used for App-V Content Storage and Delivery in SCS Mode](http://technet.microsoft.com/library/jj134210.aspx) +- [File Server (SMB) Relevance: If used for App-V Content Storage and Delivery in SCS Mode](https://technet.microsoft.com/library/jj134210.aspx) **Windows Client (Guest OS) Performance Tuning Guidance** -- [Microsoft Windows 7](http://download.microsoft.com/download/E/5/7/E5783D68-160B-4366-8387-114FC3E45EB4/Performance Tuning Guidelines for Windows 7 Desktop Virtualization v1.9.docx) +- [Microsoft Windows 7](https://download.microsoft.com/download/E/5/7/E5783D68-160B-4366-8387-114FC3E45EB4/Performance Tuning Guidelines for Windows 7 Desktop Virtualization v1.9.docx) -- [Optimization Script: (Provided by Microsoft Support)](http://blogs.technet.com/b/jeff_stokes/archive/2012/10/15/the-microsoft-premier-field-engineer-pfe-view-on-virtual-desktop-vdi-density.aspx) +- [Optimization Script: (Provided by Microsoft Support)](https://blogs.technet.com/b/jeff_stokes/archive/2012/10/15/the-microsoft-premier-field-engineer-pfe-view-on-virtual-desktop-vdi-density.aspx) -- [Microsoft Windows 8](http://download.microsoft.com/download/6/0/1/601D7797-A063-4FA7-A2E5-74519B57C2B4/Windows_8_VDI_Image_Client_Tuning_Guide.pdf) +- [Microsoft Windows 8](https://download.microsoft.com/download/6/0/1/601D7797-A063-4FA7-A2E5-74519B57C2B4/Windows_8_VDI_Image_Client_Tuning_Guide.pdf) -- [Optimization Script: (Provided by Microsoft Support)](http://blogs.technet.com/b/jeff_stokes/archive/2013/04/09/hot-off-the-presses-get-it-now-the-windows-8-vdi-optimization-script-courtesy-of-pfe.aspx) +- [Optimization Script: (Provided by Microsoft Support)](https://blogs.technet.com/b/jeff_stokes/archive/2013/04/09/hot-off-the-presses-get-it-now-the-windows-8-vdi-optimization-script-courtesy-of-pfe.aspx) ## Sequencing Steps to Optimize Packages for Publishing Performance @@ -735,7 +735,7 @@ The following terms are used when describing concepts and actions related to App ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/application-management/app-v/appv-planning-checklist.md b/windows/application-management/app-v/appv-planning-checklist.md index e83f075640..9525003f91 100644 --- a/windows/application-management/app-v/appv-planning-checklist.md +++ b/windows/application-management/app-v/appv-planning-checklist.md @@ -6,78 +6,29 @@ ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 04/19/2017 +ms.date: 04/18/2018 --- - - # App-V Planning Checklist -**Applies to** -- Windows 10, version 1607 +>Applies to: Windows 10, version 1607 This checklist can be used to help you plan for preparing your organization for an App-V deployment. -> [!NOTE] -> This checklist outlines the recommended steps and a high-level list of items to consider when planning for an App-V deployment. It is recommended that you copy this checklist and customize it for your use. +>[!NOTE] +>This checklist outlines the recommended steps and a high-level list of items to consider when planning an App-V deployment. It's a good idea to copy this checklist and customize it for your use. -
| - | Task | -References | -Notes | -
|---|---|---|---|
|
-Review the getting started information about App-V to gain a basic understanding of the product before beginning deployment planning. |
-[Getting Started with App-V](appv-getting-started.md) |
-- |
|
-Plan for App-V deployment prerequisites and prepare your computing environment. |
-[App-V Prerequisites](appv-prerequisites.md) |
-- |
|
-If you plan to use the App-V management server, plan for the required roles. |
-[Planning for the App-V Server Deployment](appv-planning-for-appv-server-deployment.md) |
-- |
|
-Plan for the App-V sequencer and client so you to create and run virtualized applications. |
-[Planning for the App-V Sequencer and Client Deployment](appv-planning-for-sequencer-and-client-deployment.md) |
-- |
|
-If applicable, review the options and steps for migrating from a previous version of App-V. |
-[Migrating to App-V from a Previous Version](appv-migrating-to-appv-from-a-previous-version.md) |
-- |
|
-Decide whether to configure App-V clients in Shared Content Store mode. |
-[Deploying the App-V Sequencer and Configuring the Client](appv-deploying-the-appv-sequencer-and-client.md) |
-- |
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization). ## Related topics diff --git a/windows/application-management/app-v/appv-planning-folder-redirection-with-appv.md b/windows/application-management/app-v/appv-planning-folder-redirection-with-appv.md index 965c94670f..28f695046f 100644 --- a/windows/application-management/app-v/appv-planning-folder-redirection-with-appv.md +++ b/windows/application-management/app-v/appv-planning-folder-redirection-with-appv.md @@ -6,145 +6,56 @@ ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 04/19/2017 +ms.date: 04/18/2018 --- - # Planning to Use Folder Redirection with App-V -**Applies to** -- Windows 10, version 1607 +>Applies to: Windows 10, version 1607 Microsoft Application Virtualization (App-V) supports the use of folder redirection, a feature that enables users and administrators to redirect the path of a folder to a new location. -This topic contains the following sections: +## What is folder redirection? -- [Requirements for using folder redirection](#bkmk-folder-redir-reqs) +Folder redirection lets end users work with files that have been redirected to another folder as if the files still exist on the local drive. -- [How to configure folder redirection for use with App-V](#bkmk-folder-redir-cfg) +* Users and administrators can redirect the path of a folder to a network location. The documents in the specified folder will be available to users from any computer in the network. + * For example, you can redirect the Documents folder from your computer's local hard disk to a network location. The user can then access the folder's documents from any computer on the network. +* The new location can be a folder on either the local computer or a shared network. +* Folder redirection immediately updates the files, while roaming data is typically synchronized when the user logs in or out of a session. -- [How folder redirection works with App-V](#bkmk-folder-redir-works) +## Requirements for using folder redirection with App-V -- [Overview of folder redirection](#bkmk-folder-redir-overview) +To use %AppData% folder redirection, you must: -## Requirements and unsupported scenarios for using folder redirection +* Have an App-V package that has an AppData virtual file system (VFS) folder. +* Enable folder redirection and redirect users’ folders to a shared folder, typically a network folder. +* Roam both or neither of the following: + * Files under %appdata%\Microsoft\AppV\Client\Catalog + * Registry settings under HKEY_CURRENT_USER\Software\Microsoft\AppV\Client\Packages +For more information, see [Application publishing and client interaction](appv-application-publishing-and-client-interaction.md#bkmk-clt-inter-roam-reqs). -
Requirements |
-To use %AppData% folder redirection, you must: -
|
-
Unsupported scenarios |
-
|
-
| Virtual environment state | -Action that occurs | -
|---|---|
When the virtual environment starts |
-The virtual file system (VFS) AppData folder is mapped to the local AppData folder (%LocalAppData%) instead of to the user’s roaming AppData folder (%AppData%). -
|
-
When the virtual environment shuts down |
-The local cached data in AppData (roaming) is zipped up and copied to the “real” roaming AppData folder in %AppData%. A time stamp, which indicates the last known upload, is simultaneously saved as a registry key under: -
To provide redundancy, App-V keeps the three most recent copies of the compressed data under %AppData%. |
-
Purpose |
-Enables end users to work with files, which have been redirected to another folder, as if the files still existed on the local drive. |
-
Description |
-Folder redirection allows users and administrators to redirect the path of a folder to a network location. The documents in the folder are available to the user from any computer on the network. -
|
-
Usage example |
-You can redirect the Documents folder, which is usually stored on the computer's local hard disk, to a network location. The user can access the documents in the folder from any computer on the network. |
-
More resources |
-[Folder redirection overview](http://technet.microsoft.com/library/cc778976.aspx) |
-
- LocalAppData contains a local cache of the user’s roaming AppData folder for the package in use. The local cache is located under ```%LocalAppData%\Microsoft\AppV\Client\VFS\PackageGUID\AppData```
- The latest data from the user’s roaming AppData folder is copied to and replaces the data currently in the local cache.
- While the virtual environment is running, data continues to be saved to the local cache. Data is served only out of %LocalAppData% and is not moved or synchronized with %AppData% until the end user shuts down the computer.
- Entries to the AppData folder are made using the user context, not the system context.| +|When the virtual environment shuts down.|The local cached data in AppData (roaming) is zipped up and copied to the “real” roaming AppData folder in %AppData%. A time stamp that indicates the last known upload is simultaneously saved as a registry key under ```HKCU\Software\Microsoft\AppV\Client\Packages\
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization). diff --git a/windows/application-management/app-v/appv-planning-for-appv-server-deployment.md b/windows/application-management/app-v/appv-planning-for-appv-server-deployment.md index 2080ab4880..eb5dc60914 100644 --- a/windows/application-management/app-v/appv-planning-for-appv-server-deployment.md +++ b/windows/application-management/app-v/appv-planning-for-appv-server-deployment.md @@ -6,102 +6,54 @@ ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 04/19/2017 +ms.date: 04/18/2018 --- +# Planning for the App-V server deployment - -# Planning for the App-V Server Deployment - -**Applies to** -- Windows Server 2016 +>Applies to: Windows Server 2016 The Microsoft Application Virtualization (App-V) server infrastructure consists of a set of specialized features that can be installed on one or more server computers, based on the requirements of the enterprise. -## Planning for App-V Server Deployment - +## About the App-V server The App-V server consists of the following features: -- Management Server – provides overall management functionality for the App-V infrastructure. +* Management Server—provides overall management functionality for the App-V infrastructure. +* Management Database—facilitates database predeployments for App-V management. +* Publishing Server—provides hosting and streaming functionality for virtual applications. +* Reporting Server—provides App-V reporting services. +* Reporting Database—facilitates database predeployments for App-V reporting. -- Management Database – facilitates database predeployments for App-V management. +The following list describes recommended App-V server infrastructure installation methods: -- Publishing Server – provides hosting and streaming functionality for virtual applications. +* Install the App-V server. For more information, see [How to deploy the App-V Server](appv-deploy-the-appv-server.md). +* Install the database, reporting, and management features on separate computers. For more information, see [How to install the Management and Reporting databases on separate computers from the Management and Reporting services](appv-install-the-management-and-reporting-databases-on-separate-computers.md). +* Use Electronic Software Distribution (ESD). For more information, see [How to deploy App-V packages using Electronic Software Distribution](appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md). +* Install all server features on a single computer. -- Reporting Server – provides App-V reporting services. +## App-V server interaction -- Reporting Database – facilitates database predeployments for App-V reporting. +This section describes how the various App-V server roles interact with each other. -The following list displays the recommended methods for installing the App-V server infrastructure: +The App-V Management Server contains the repository of packages and their assigned configurations. For Publishing Servers that are registered with the Management Server, the associated metadata is provided to the Publishing servers for use when publishing refresh requests are received from computers running the App-V Client. App-V publishing servers managed by a single management server can serve different clients with different website names and port bindings. Additionally, all Publishing Servers managed by the same Management Server are replicas of each other. -- Install the App-V server. For more information, see [How to Deploy the App-V Server](appv-deploy-the-appv-server.md). +>[!NOTE] +>The Management Server does not perform load balancing. The associated metadata is passed to the publishing server for use when processing client requests. -- Install the database, reporting, and management features on separate computers. For more information, see [How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services](appv-install-the-management-and-reporting-databases-on-separate-computers.md). +## Server-related protocols and external features -- Use Electronic Software Distribution (ESD). For more information, see [How to deploy App-V Packages Using Electronic Software Distribution](appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md). - -- Install all server features on a single computer. - -## App-V Server Interaction - - -This section contains information about how the various App-V server roles interact with each other. - -The App-V Management Server contains the repository of packages and their assigned configurations. For Publishing Servers that are registered with the Management Server, the associated metadata is provided to the Publishing servers for use when publishing refresh requests are received from computers running the App-V Client. App-V publishing servers managed by a single management server can be serving different clients and can have different website names and port bindings. Additionally, all Publishing Servers managed by the same Management Server are replicas of each other. - -**Note** -The Management Server does not perform any load balancing. The associated metadata is simply passed to the publishing server for use when processing client requests. - - - -## Server-Related Protocols and External Features - - -The following displays information about server-related protocols used by the App-V servers. The table also includes the reporting mechanism for each server type. - -
| Server Type | -Protocols | -External Features Needed | -Reporting | -- |
|---|---|---|---|---|
IIS server |
-HTTP -HTTPS |
-This server-protocol combination requires a mechanism to synchronize the content between the Management Server and the Streaming Server. When using HTTP or HTTPS, use an IIS server and a firewall to protect the server from exposure to the Internet. |
-Internal |
-- |
File |
-SMB |
-This server-protocol combination requires support to synchronize the content between the Management Server and the Streaming Server. Use a client computer with file sharing or streaming capability. |
-Internal |
-- |
HTTPS|This server-protocol combination requires a mechanism to synchronize content between the Management Server and the Streaming Server. When using HTTP or HTTPS, use an IIS server and a firewall to protect the server from exposure to the Internet.|Internal| +|File|SMB|This server-protocol combination requires support to synchronize the content between the Management Server and the Streaming Server. Use a client computer that's capable of file sharing or streaming.|Internal| ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization). ## Related topics -[Planning to Deploy App-V](appv-planning-to-deploy-appv.md) - -[Deploying the App-V Server](appv-deploying-the-appv-server.md) +* [Planning to deploy App-V](appv-planning-to-deploy-appv.md) +* [Deploying the App-V server](appv-deploying-the-appv-server.md) diff --git a/windows/application-management/app-v/appv-planning-for-appv.md b/windows/application-management/app-v/appv-planning-for-appv.md index c6410c847f..6a3f8107da 100644 --- a/windows/application-management/app-v/appv-planning-for-appv.md +++ b/windows/application-management/app-v/appv-planning-for-appv.md @@ -6,45 +6,27 @@ ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 04/19/2017 +ms.date: 04/18/2018 --- - - # Planning for App-V -**Applies to** -- Windows 10, version 1607 +>Applies to: Windows 10, version 1607 -Use this information to plan how to deploy App-V so that it does not disrupt your users or the network. +Use the following information to plan to deploy App-V without disrupting your existing network or user experience. ## Planning information -- [Preparing Your Environment for App-V](appv-preparing-your-environment.md) +[Preparing your environment for App-V](appv-preparing-your-environment.md) describes the computing environment requirements and installation prerequisites that should be planned for before beginning App-V setup. - This section describes the computing environment requirements and installation prerequisites that should be planned for before beginning App-V setup. +[Planning to deploy App-V](appv-planning-to-deploy-appv.md) describes the minimum hardware and software requirements and other planning information for the App-V sequencer and App-V server components. -- [Planning to Deploy App-V](appv-planning-to-deploy-appv.md) +[App-V planning checklist](appv-planning-checklist.md) is a planning checklist that can assist you with App-V deployment planning. - This section describes the minimum hardware and software requirements and other planning information for the App-V sequencer and App-V server components. +## Other App-V planning resources -- [App-V Planning Checklist](appv-planning-checklist.md) - - Planning checklist that can be used to assist in App-V deployment planning. - -## Have a suggestion for App-V? - -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). - -## Other resources for App-V planning - -- [Application Virtualization (App-V) overview](appv-for-windows.md) - -- [Getting started with App-V](appv-getting-started.md) - -- [Deploying App-V](appv-deploying-appv.md) - -- [Operations for App-V](appv-operations.md) - -- [Troubleshooting App-V](appv-troubleshooting.md) - -- [Technical reference for App-V](appv-technical-reference.md) +* [Application Virtualization (App-V) overview](appv-for-windows.md) +* [Getting started with App-V](appv-getting-started.md) +* [Deploying App-V](appv-deploying-appv.md) +* [Operations for App-V](appv-operations.md) +* [Troubleshooting App-V](appv-troubleshooting.md) +* [Technical reference for App-V](appv-technical-reference.md) diff --git a/windows/application-management/app-v/appv-planning-for-high-availability-with-appv.md b/windows/application-management/app-v/appv-planning-for-high-availability-with-appv.md index 7b1341c67d..32232234da 100644 --- a/windows/application-management/app-v/appv-planning-for-high-availability-with-appv.md +++ b/windows/application-management/app-v/appv-planning-for-high-availability-with-appv.md @@ -6,133 +6,100 @@ ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 04/19/2017 +ms.date: 04/18/2018 --- +# Planning for high availability with App-V Server +>Applies to: Windows 10, version 1607 -# Planning for High Availability with App-V Server +Microsoft Application Virtualization (App-V) system configurations can take advantage of options that maintain a high available service level. -**Applies to** -- Windows 10, version 1607 +The following sections will he following sections to help you understand the options to deploy App-V in a highly available configuration. -Microsoft Application Virtualization (App-V) system configurations can take advantage of options that maintain a high level of available service. +## Support for Microsoft SQL Server clustering -Use the information in the following sections to help you understand the options to deploy App-V in a highly available configuration. +You can run the App-V Management and Reporting databases on computers running Microsoft SQL Server clusters. However, you must install the databases using scripts. -- [Support for Microsoft SQL Server clustering](#bkmk-sqlcluster) +For deployment instructions, see [How to deploy the App-V databases by using SQL scripts](appv-deploy-appv-databases-with-sql-scripts.md). -- [Support for IIS Network Load Balancing](#bkmk-iisloadbal) +## Support for IIS network load balancing -- [Support for clustered file servers when running (SCS) mode](#bkmk-clusterscsmode) +You can use Internet Information Services' (IIS) network load balancing (NLB) to configure a highly available environment for computers running the App-V Management, Publishing, and Reporting services that are deployed through IIS. -- [Support for Microsoft SQL Server Mirroring](#bkmk-sqlmirroring) +Review the following articles to learn more about configuring IIS and NLB for computers running Windows Server operating systems: -- [Support for Microsoft SQL Server Always On](#bkmk-sqlalwayson) +* [Achieving High Availability and Scalability - ARR and NLB](https://www.iis.net/learn/extensions/configuring-application-request-routing-arr/achieving-high-availability-and-scalability-arr-and-nlb) describes how to configure IIS 7.0. -## Support for Microsoft SQL Server clustering +* [Network load balancing overview](
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization). ## Related topics -[Planning to Deploy App-V](appv-planning-to-deploy-appv.md) +* [Planning to deploy App-V](appv-planning-to-deploy-appv.md) diff --git a/windows/application-management/app-v/appv-planning-for-sequencer-and-client-deployment.md b/windows/application-management/app-v/appv-planning-for-sequencer-and-client-deployment.md index 44f198b58d..bcc0dd487f 100644 --- a/windows/application-management/app-v/appv-planning-for-sequencer-and-client-deployment.md +++ b/windows/application-management/app-v/appv-planning-for-sequencer-and-client-deployment.md @@ -6,38 +6,31 @@ ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 04/19/2017 +ms.date: 04/18/2018 --- - # Planning for the App-V Sequencer and Client Deployment -**Applies to** -- Windows 10, version 1607 +>Applies to: Windows 10, version 1607 -Before you can use App-V, you must install the App-V Sequencer, enable the App-V client, and optionally the App-V shared content store. The following sections address planning for these installations. +Before you can use App-V, you must install the App-V Sequencer and enable the App-V client. You can also the App-V shared content store, although it isn't required. The following sections will tell you how to set these up. ## Planning for App-V Sequencer deployment - App-V uses a process called sequencing to create virtualized applications and application packages. Sequencing requires the use of a computer that runs the App-V Sequencer. -> [!NOTE] +> [!NOTE] > For information about the new functionality of App-V sequencer, see [What's new in App-V](appv-about-appv.md). +The computer running the App-V sequencer must meet the minimum system requirements. For a list of these requirements, see [App-V supported configurations](appv-supported-configurations.md). -The computer that runs the App-V sequencer must meet the minimum system requirements. For a list of these requirements, see [App-V Supported Configurations](appv-supported-configurations.md). +Ideally, you should install the sequencer on a computer running as a virtual machine. This lets you revert the computer that's running the sequencer to a “clean” state before sequencing another application. When installing the sequencer using a virtual machine, you should do the following things: -Ideally, you should install the sequencer on a computer running as a virtual machine. This enables you to more easily revert the computer running the sequencer to a “clean” state before sequencing another application. When you install the sequencer using a virtual machine, you should perform the following steps: - -1. Install all associated sequencer prerequisites. - -2. Install the sequencer. - -3. Take a “snapshot” of the environment. - -> [!IMPORTANT] ->You should have your corporate security team review and approve the sequencing process plan. For security reasons, you should keep the sequencer operations in a lab that is separate from the production environment. The separation arrangement can be as simple or as comprehensive as necessary, based on your business requirements. The sequencing computers must be able to connect to the corporate network to copy finished packages to the production servers. However, because the sequencing computers are typically operated without antivirus protection, they must not be on the corporate network unprotected. For example, you might be able to operate behind a firewall or on an isolated network segment. You might also be able to use virtual machines that are configured to share an isolated virtual network. Follow your corporate security policies to safely address these concerns. +1. Install all associated sequencer prerequisites. +2. Install the sequencer. +3. Take a “snapshot” of the environment. +>[!IMPORTANT] +>Your corporate security team should review and approve the sequencing process plan before implementing it. For security reasons, it's a good idea to keep sequencer operations in a lab separate from the production environment. The sequencing computers must be capapble of connecting to the corporate network to copy finished packages to the production servers. However, because the sequencing computers are typically operated without antivirus protection, they shouldn't remail on the corporate network unprotected. You can protect your sequencing computers by operating them on an isolated network, behind a firewall, or by using virtual machines on an isolated virtual network. Make sure your solution follows your company's corporate security policies. ## Planning for App-V client deployment @@ -45,28 +38,24 @@ In Windows 10, version 1607, the App-V client is included with the operating sys ## Planning for the App-V Shared Content Store (SCS) -The App-V Shared Content Store mode allows the computer running the App-V client to run virtualized applications and none of the package contents is saved on the computer running the App-V client. Virtual applications are streamed to target computers only when requested by the client. +The App-V Shared Content Store mode allows computers running the App-V client to run virtualized applications without saving any package contents to the App-V client computer. Virtual applications are streamed to target computers only when requested by the client. -The following list displays some of the benefits of using the App-V Shared Content Store: +The following list displays some of the benefits of using App-V SCS: -- Reduced app-to-app and multi-user application conflicts and hence a reduced need for regression testing - -- Accelerated application deployment by reduction of deployment risk - -- Simplified profile management +* Reduced app-to-app and multi-user application conflicts reduces the need for regression testing +* Reduced deployment risk accelerates application deployment +* Simplified profile management ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization). -## Other resources for the App-V deployment +## Other App-V deployment resources -- [Planning to Deploy App-V](appv-planning-to-deploy-appv.md) +* [Planning to deploy App-V](appv-planning-to-deploy-appv.md) ## Related topics -- [How to Install the Sequencer](appv-install-the-sequencer.md) - -- [Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md) - -- [Deploying the App-V Sequencer and Configuring the Client](appv-deploying-the-appv-sequencer-and-client.md) +* [How to install the sequencer](appv-install-the-sequencer.md) +* [Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md) +* [Deploying the App-V Sequencer and configuring the client](appv-deploying-the-appv-sequencer-and-client.md) diff --git a/windows/application-management/app-v/appv-planning-for-using-appv-with-office.md b/windows/application-management/app-v/appv-planning-for-using-appv-with-office.md index ec4b6f331f..378e61401d 100644 --- a/windows/application-management/app-v/appv-planning-for-using-appv-with-office.md +++ b/windows/application-management/app-v/appv-planning-for-using-appv-with-office.md @@ -1,266 +1,138 @@ --- -title: Planning for Using App-V with Office (Windows 10) +title: Planning for Deploying App-V with Office (Windows 10) description: Planning for Using App-V with Office author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 04/19/2017 +ms.date: 04/18/2018 --- +# Planning for deploying App-V with Office +>Applies to: Windows 10, version 1607 -# Planning for Using App-V with Office +Use the following information to plan how to deploy Office within Microsoft Application Virtualization (App-V). -**Applies to** -- Windows 10, version 1607 +## App-V language pack support -Use the following information to plan how to deploy Office by using Microsoft Application Virtualization (App-V). This article includes: - -- [App-V support for Language Packs](#bkmk-lang-pack) - -- [Supported versions of Microsoft Office](#bkmk-office-vers-supp-appv) - -- [Planning for using App-V with coexisting versions of Office](#bkmk-plan-coexisting) - -- [How Office integrates with Windows when you deploy use App-V to deploy Office](#bkmk-office-integration-win) - -## App-V support for Language Packs - -You can use the App-V Sequencer to create plug-in packages for Language Packs, Language Interface Packs, Proofing Tools and ScreenTip Languages. You can then include the plug-in packages in a Connection Group, along with the Office package that you create by using the Office Deployment Toolkit. The Office applications and the plug-in Language Packs interact seamlessly in the same connection group, just like any other packages that are grouped together in a connection group. - ->[!NOTE] ->Microsoft Visio and Microsoft Project do not provide support for the Thai Language Pack. - -## Supported versions of Microsoft Office -See [Microsoft Office Product IDs that App-V supports](https://support.microsoft.com/en-us/help/2842297/product-ids-that-are-supported-by-the-office-deployment-tool-for-click) for a list of supported Office products. +You can use the App-V Sequencer to create plug-in packages for language packs, language interface packs, proofing tools, and ScreenTip languages. You can then include the plug-in packages in a connection group, along with the Office package that you create by using the Office Deployment Toolkit. The Office applications and the plug-in language packs will interact seamlessly in the same connection group. >[!NOTE] ->You must use the Office Deployment Tool to create App-V packages for Office 365 ProPlus. Creating packages for the volume-licensed versions of Office Professional Plus or Office Standard is not supported. You cannot use the App-V Sequencer. +>Microsoft Visio and Microsoft Project do not support the Thai Language Pack. ->Support for the [Office 2013 version of Office 365 ended in Februrary 2017](https://support.microsoft.com/kb/3199744) +## Supported versions of Microsoft Office -## Planning for using App-V with coexisting versions of Office +For a list of supported Office products, see [Microsoft Office Product IDs that App-V supports](https://support.microsoft.com/en-us/help/2842297/product-ids-that-are-supported-by-the-office-deployment-tool-for-click). -You can install more than one version of Microsoft Office side by side on the same computer by using “Microsoft Office coexistence.” You can implement Office coexistence with combinations of all major versions of Office and with installation methods, as applicable, by using the Windows Installer-based (MSI) version of Office, Click-to-Run, and App-V. However, using Office coexistence is not recommended by Microsoft. +>[!NOTE] +>You must use the Office Deployment Tool instead of the App-V Sequencer to create App-V packages for Office 365 ProPlus. App-V does not support package creation for volume-licensed versions of Office Professional Plus or Office Standard. Support for the [Office 2013 version of Office 365 ended in Februrary 2017](https://support.microsoft.com/kb/3199744). -Microsoft’s recommended best practice is to avoid Office coexistence completely to prevent compatibility issues. However, when you are migrating to a newer version of Office, issues occasionally arise that can’t be resolved immediately, so you can temporarily implement coexistence to help facilitate a faster migration to the latest product version. Using Office coexistence on a long-term basis is never recommended, and your organization should have a plan to fully transition in the immediate future. +## Using App-V with coexisting versions of Office + +You can simultaneously install more than one version of Microsoft Office on the same computer with a feature called “Microsoft Office coexistence.” You can implement Office coexistence with combinations of all major versions of Office and with installation methods, as applicable, by using the Windows Installer-based (MSI) version of Office, Click-to-Run, and App-V. However, Microsoft doesn't recommend using Office coexistence. + +Microsoft’s recommended best practice is to avoid Office coexistence completely to prevent compatibility issues. However, in cases where issues arise during migration that you can't immediately resolve, Office coexistence can allow for faster migration to the latest Office version. Since this solution is only meant to be temporary, your organization must set up a plan to fully transition to the newer version of Office in the meantime. ### Before you implement Office coexistence -Before implementing Office coexistence, review the following Office documentation. Choose the article that corresponds to the newest version of Office for which you plan to implement coexistence. +Before implementing Office coexistence, review the information in the following table that corresponds to the newest version of Office that you will use in coexistence. The documentation linked here will guide you in implementing coexistence for Windows Installer-based (MSI) and Click-to-Run installations of Office. -
| Office version | -Link to guidance | -
|---|---|
Office 2016 |
-[Information about how to use Outlook 2016 or 2013 and an earlier version of Outlook installed on the same computer](https://support.microsoft.com/kb/2782408) |
-
Office 2013 |
-[Information about how to use Office 2013 suites and programs (MSI deployment) on a computer that is running another version of Office](http://support.microsoft.com/kb/2784668) |
-
Office 2010 |
-[Information about how to use Office 2010 suites and programs on a computer that is running another version of Office](http://support.microsoft.com/kb/2121447) |
-
| - | Mode in which App-V can sequence this version of Office | -
|---|---|
Office 2007 |
-Always non-integrated. App-V does not offer any operating system integrations with a virtualized version of Office 2007. |
-
Office 2010 |
-Integrated and non-integrated mode. |
-
Office 2013 |
-Always integrated. Windows operating system integrations cannot be disabled. |
-
Office 2016 |
-Always integrated. Windows operating system integrations cannot be disabled. |
-
| Extension Point | -Description | -
|---|---|
Skype for Business (formerly Lync) meeting Join Plug-in for Firefox and Chrome |
-User can join Skype meetings from Firefox and Chrome |
-
Sent to OneNote Print Driver |
-User can print to OneNote |
-
OneNote Linked Notes |
-OneNote Linked Notes |
-
Send to OneNote Internet Explorer Add-In |
-User can send to OneNote from IE |
-
Firewall Exception for Skype for Business (formerly Lync) and Outlook |
-Firewall Exception for Skype for Business (formerly Lync) and Outlook |
-
MAPI Client |
-Native apps and add-ins can interact with virtual Outlook through MAPI |
-
SharePoint Plug-in for Firefox |
-User can use SharePoint features in Firefox |
-
Mail Control Panel Applet |
-User gets the mail control panel applet in Outlook |
-
Primary Interop Assemblies |
-Support managed add-ins |
-
Office Document Cache Handler |
-Allows Document Cache for Office applications |
-
Outlook Protocol Search handler |
-User can search in outlook |
-
Active X Controls |
-For more information on ActiveX controls, refer to [ActiveX Control API Reference](https://msdn.microsoft.com/library/vs/alm/ms440037(v=office.14).aspx). |
-
OneDrive Pro Icon Overlays |
-Windows Explorer shell icon overlays when users look at folders OneDrive Pro folders |
-
Shell extensions |
-- |
Shortcuts |
-- |
Windows Search |
-- |
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization). ## Related topics -- [Deploying Microsoft Office 2016 by Using App-V](appv-deploying-microsoft-office-2016-with-appv.md) -- [Deploying Microsoft Office 2013 by Using App-V](appv-deploying-microsoft-office-2013-with-appv.md) -- [Deploying Microsoft Office 2010 by Using App-V](appv-deploying-microsoft-office-2010-wth-appv.md) +* [Deploying Microsoft Office 2016 by Using App-V](appv-deploying-microsoft-office-2016-with-appv.md) +* [Deploying Microsoft Office 2013 by Using App-V](appv-deploying-microsoft-office-2013-with-appv.md) +* [Deploying Microsoft Office 2010 by Using App-V](appv-deploying-microsoft-office-2010-wth-appv.md) \ No newline at end of file diff --git a/windows/application-management/app-v/appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions.md b/windows/application-management/app-v/appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions.md index 5e18534d50..ee75ec9087 100644 --- a/windows/application-management/app-v/appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions.md +++ b/windows/application-management/app-v/appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions.md @@ -6,32 +6,27 @@ ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 04/19/2017 +ms.date: 04/18/2018 --- - # Planning to Deploy App-V with an electronic software distribution system -**Applies to** -- Windows 10, version 1607 +>Applies to: Windows 10, version 1607 -If you are using an electronic software distribution system to deploy App-V packages, review the following planning considerations. For information about using System Center Configuration Manager to deploy App-V, see [Introduction to Application Management in Configuration Manager](https://technet.microsoft.com/en-us/library/gg682125.aspx#BKMK_Appv). +If you are using an electronic software distribution (ESD) system to deploy App-V packages, review the following planning considerations. For information about deploying App-V with System Center Configuration Manager, see [Introduction to application management in Configuration Manager](https://technet.microsoft.com/en-us/library/gg682125.aspx#BKMK_Appv). Review the following component and architecture requirements options that apply when you use an ESD to deploy App-V packages: | Deployment requirement or option | Description | -| - | - | +|---|---| | The App-V Management server, Management database, and Publishing server are not required. | These functions are handled by the implemented ESD solution. | -| You can deploy the App-V Reporting server and Reporting database side by side with the ESD. | The side-by-side deployment lets you to collect data and generate reports.
If you enable the App-V client to send report information, and you are not using the App-V Reporting server, the reporting data is stored in associated .xml files. | +| You can deploy the App-V Reporting server and Reporting database side-by-side with the ESD. | The side-by-side deployment lets you collect data and generate reports.
If you enable the App-V client to send report information without using the App-V Reporting server, the reporting data will be stored in associated .xml files. | ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization). ## Related topics -- [Planning to deploy App-V](appv-planning-to-deploy-appv.md) - -- [How to deploy App-V Packages Using Electronic Software Distribution](appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md) - -- [How to Enable Only Administrators to Publish Packages by Using an ESD](appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions.md) - +* [Planning to deploy App-V](appv-planning-to-deploy-appv.md) +* [How to deploy App-V packages Using Electronic Software Distribution](appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md) +* [How to enable only administrators to publish packages by using an ESD](appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions.md) \ No newline at end of file diff --git a/windows/application-management/app-v/appv-planning-to-deploy-appv.md b/windows/application-management/app-v/appv-planning-to-deploy-appv.md index dab76ddfbf..7e9a2005e7 100644 --- a/windows/application-management/app-v/appv-planning-to-deploy-appv.md +++ b/windows/application-management/app-v/appv-planning-to-deploy-appv.md @@ -6,77 +6,51 @@ ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 04/19/2017 +ms.date: 04/18/2018 --- - - # Planning to Deploy App-V for Windows 10 -**Applies to** -- Windows 10, version 1607 +>Applies to: Windows 10, version 1607 -There are a number of different deployment configurations and requirements to consider before you deploy App-V for Windows 10. Review this topic for information about what you'll need to formulate a deployment plan that best meets your business requirements. +There are several different deployment configurations and requirements to consider before you deploy App-V for Windows 10. Review this topic for information about what you'll need to make a deployment plan that best meets your needs. ## App-V supported configurations -Describes the minimum hardware and operating system requirements for each App-V components. For information about software that you must install before you install App-V, see [App-V Prerequisites](appv-prerequisites.md). - -[App-V Supported Configurations](appv-supported-configurations.md) +[App-V supported configurations](appv-supported-configurations.md) describes the minimum hardware and operating system requirements for each App-V components. For information about software that you must install before you install App-V, see [App-V Prerequisites](appv-prerequisites.md). ## App-V capacity planning -Describes the available options for scaling your App-V deployment. - -[App-V Capacity Planning](appv-capacity-planning.md) +[App-V capacity planning](appv-capacity-planning.md) describes the available options for scaling your App-V deployment. ## Planning for high availability with App-V -Describes the available options for ensuring high availability of App-V databases and services. - -[Planning for High Availability with App-V](appv-planning-for-high-availability-with-appv.md) +[Planning for high availability with App-V](appv-planning-for-high-availability-with-appv.md) describes the available options for ensuring high availability of App-V databases and services. ## Planning to Deploy App-V with an Electronic Software Distribution System -Describes the options and requirements for deploying App-V with an electronic software distribution system. - -[Planning to Deploy App-V with an Electronic Software Distribution System](appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions.md) +[Planning to Deploy App-V with an Electronic Software Distribution System](appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions.md) describes the options and requirements for deploying App-V with an electronic software distribution system. ## Planning for App-V server deployment -Describes the planning considerations for the App-V Server components and their functions. - -[Planning for the App-V Server Deployment](appv-planning-for-appv-server-deployment.md) +[Planning for the App-V server deployment](appv-planning-for-appv-server-deployment.md) describes the planning considerations for the App-V Server components and their functions. ## Planning for the App-V Sequencer and Client deployment -Describes the planning considerations for the App-V Client and for the Sequencer software, which you use to create virtual applications and application packages. - -[Planning for the App-V Sequencer and Client Deployment](appv-planning-for-sequencer-and-client-deployment.md) +[Planning for the App-V Sequencer and Client deployment](appv-planning-for-sequencer-and-client-deployment.md) describes planning considerations you should make for deploying the App-V Client and the Sequencer software, which you use to create virtual applications and application packages. ## Planning for migrating from a previous version of App-V -Describes the recommended path for migrating from previous versions of App-V, while ensuring that existing server configurations, packages and clients continue to work in your new App-V environment. - -[Migrating to App-V from a Previous Version](appv-migrating-to-appv-from-a-previous-version.md) +[Migrating to App-V from a previous version](appv-migrating-to-appv-from-a-previous-version.md) describes the recommended path for migrating from previous versions of App-V without disrupting your existing server configurations, packages, and clients. ## Planning for using App-V with Office -Describes the requirements for using App-V with Office and explains the supported scenarios, including information about coexisting versions of Office. - -[Planning for Using App-V with Office](appv-planning-for-using-appv-with-office.md) +[Planning for using App-V with Office](appv-planning-for-using-appv-with-office.md) describes the requirements for using App-V with Office and the supported scenarios, including information about coexisting versions of Office. ## Planning to use folder redirection with App-V -Explains how folder redirection works with App-V. - -[Planning to Use Folder Redirection with App-V](appv-planning-folder-redirection-with-appv.md) +[Planning to use folder redirection with App-V](appv-planning-folder-redirection-with-appv.md) explains how folder redirection works with App-V. ## Other Resources for App-V Planning -- [Planning for App-V](appv-planning-for-appv.md) - -- [Performance Guidance for Application Virtualization](appv-performance-guidance.md) - -## Have a suggestion for App-V? - -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +* [Planning for App-V](appv-planning-for-appv.md) +* [Performance Guidance for Application Virtualization](appv-performance-guidance.md) diff --git a/windows/application-management/app-v/appv-preparing-your-environment.md b/windows/application-management/app-v/appv-preparing-your-environment.md index cb6cfe9f54..045ae3eac4 100644 --- a/windows/application-management/app-v/appv-preparing-your-environment.md +++ b/windows/application-management/app-v/appv-preparing-your-environment.md @@ -6,32 +6,22 @@ ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 04/19/2017 +ms.date: 04/18/2018 --- +# Preparing your environment for App-V -# Preparing Your Environment for App-V +>Applies to: Windows 10, version 1607 -**Applies to** -- Windows 10, version 1607 - -There are a number of different deployment configurations and prerequisites that you must consider before you create your deployment plan for Microsoft Application Virtualization (App-V). This section includes information that can help you gather the information that you must have to formulate a deployment plan that best meets your business requirements. +There are several different deployment configurations and prerequisites that you must consider before creating your deployment plan for Microsoft App-V. The following articles will help you gather the information you need to set up a deployment plan that best suits your business’ needs. ## App-V prerequisites -- [App-V Prerequisites](appv-prerequisites.md) - - Lists the prerequisite software that you must install before installing App-V. +[App-V prerequisites](appv-prerequisites.md) lists the prerequisite software that you must install before installing App-V. ## App-V security considerations -- [App-V Security Considerations](appv-security-considerations.md) +[App-V security considerations](appv-security-considerations.md) describes accounts, groups, log files, and other considerations for securing your App-V environment. - Describes accounts, groups, log files, and other considerations for securing your App-V environment. +## Other App-V planning resources -## Have a suggestion for App-V? - -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). - -## Other resources for App-V planning - -- [Planning for App-V](appv-planning-for-appv.md) +* [Planning for App-V](appv-planning-for-appv.md) diff --git a/windows/application-management/app-v/appv-prerequisites.md b/windows/application-management/app-v/appv-prerequisites.md index 1181322016..f8f7d4b0e9 100644 --- a/windows/application-management/app-v/appv-prerequisites.md +++ b/windows/application-management/app-v/appv-prerequisites.md @@ -6,14 +6,11 @@ ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 04/19/2017 +ms.date: 04/18/2018 --- +# App-V for Windows 10 prerequisites - -# App-V for Windows 10 Prerequisites - -**Applies to** -- Windows 10, version 1607 +>Applies to: Windows 10, version 1607 Before installing App-V for Windows 10, ensure that you have installed all of the following required prerequisite software. @@ -21,559 +18,145 @@ For a list of supported operating systems and hardware requirements for the App- ## Summary of software preinstalled on each operating system - The following table indicates the software that is already installed for different operating systems. -
| Operating system | -Prerequisite description | -
|---|---|
Windows 10 |
-All of the prerequisite software is already installed. |
-
Windows 8.1 |
-All of the prerequisite software is already installed. -
-Note
-
-If you are running Windows 8, upgrade to Windows 8.1 before using App-V. -
-
- |
-
Windows Server 2016 |
-The following prerequisite software is already installed: -
|
-
Windows 7 |
-The prerequisite software is not already installed. You must install it before you can install App-V. |
-
If you're running Windows 8, upgrade to Windows 8.1 before using App-V.| +|Windows Server 2016|The following prerequisite software is already installed:
- Microsoft .NET Framework 4.5
- Windows PowerShell 3.0
Installing Windows PowerShell requires a restart.| +|Windows 7|No prerequisite software is installed. You must install the software before you can install App-V.| ## App-V Server prerequisite software - Install the required prerequisite software for the App-V server components. ### What to know before you start -
Account for installing the App-V Server |
-The account that you use to install the App-V Server components must have: -
|
-
Port and firewall |
-
|
-
Web Distributed Authoring and Versioning (WebDAV) |
-WebDAV is automatically disabled for the Management Service. |
-
Supported deployment scenarios |
-
|
-
Unsupported deployment scenarios |
-
|
-
- Administrative rights on the computer on which you are installing the components.
- The ability to query Active Directory Domain Services.| +|Port and firewall|- Specify a port where each component will be hosted.
- Add the associated firewall rules to allow incoming requests to the specified ports.| +|Web Distributed Authoring and Versioning (WebDAV)|WebDAV is automatically disabled for the Management Service.| +|Supported deployment scenarios|- A stand-alone deployment, where all components are deployed on the same server.
- A distributed deployment.| +|Unsupported deployment scenarios|- Installing side-by-side instances of multiple App-V Server versions on the same server.
- Installing the App-V server components on a computer that runs server core or domain controller.| ### Management server prerequisite software -
| Prerequisites and required settings | -Details | -
|---|---|
Supported version of SQL Server |
-For supported versions, see [App-V Supported Configurations](appv-supported-configurations.md). |
-
[Microsoft .NET Framework 4.5.1 (Web Installer)](http://www.microsoft.com//download/details.aspx?id=40773) |
-- |
[Windows PowerShell 3.0](http://www.microsoft.com/download/details.aspx?id=34595) |
-Installing Windows PowerShell 3.0 requires a restart. |
-
Download and install [KB2533623](http://support.microsoft.com/kb/2533623) |
-Applies to Windows 7 only. |
-
[Visual C++ Redistributable Packages for Visual Studio 2013](http://www.microsoft.com/download/details.aspx?id=40784) |
-- |
64-bit ASP.NET registration |
-- |
Windows Server Web Server Role |
-This role must be added to a server operating system that is supported for the Management server. |
-
Web Server (IIS) Management Tools |
-Click IIS Management Scripts and Tools. |
-
Web Server Role Services |
-Common HTTP Features: -
Application Development: -
Security: -
Management Tools: -
|
-
Default installation location |
-%PROGRAMFILES%\Microsoft Application Virtualization Server |
-
Location of the Management database |
-SQL Server database name, SQL Server database instance name, and database name. |
-
Management console and Management database permissions |
-A user or group that can access the Management console and database after the deployment is complete. Only these users or groups will have access to the Management console and database unless additional administrators are added by using the Management console. |
-
Management service website name |
-Name for the Management console website. |
-
Management service port binding |
-Unique port number for the Management service. This port cannot be used by another process on the computer. |
-
- Static content
- Default document
Application development:
- ASP.NET
- .NET Extensibility
- ISAPI Extensions
- ISAPI Filters
Security:
- Windows Authentication
- Request Filtering
Management Tools:
- IIS Management Console| +|Default installation location|%PROGRAMFILES%\Microsoft Application Virtualization Server| +|Location of the Management database|SQL Server database name, SQL Server database instance name, and database name.| +|Management console and Management database permissions|A user or group that can access the Management console and database after the deployment is complete. Only these users or groups can access the Management console and database unless the Management console is used to add additional administrators.| +|Management service website name|Name for the Management console website.| +|Management service port binding|Unique port number for the Management service. This port cannot be used by another process on the computer.| -> [!IMPORTANT] -> JavaScript must be enabled on the browser that opens the Web Management Console. +>[!IMPORTANT] +>JavaScript must be enabled on the browser that opens the Web Management Console. ### Management server database prerequisite software -The Management database is required only if you are using the App-V Management server. +The Management database is only required if you use the App-V Management server. -
| Prerequisites and required settings | -Details | -
|---|---|
[Microsoft .NET Framework 4.5.1 (Web Installer)](http://www.microsoft.com//download/details.aspx?id=40773) |
-- |
[Visual C++ Redistributable Packages for Visual Studio 2013](http://www.microsoft.com/download/details.aspx?id=40784) |
-- |
Default installation location |
-%PROGRAMFILES%\Microsoft Application Virtualization Server |
-
Custom SQL Server instance name (if applicable) |
-Format to use: INSTANCENAME -This format is based on the assumption that the installation is on the local computer. -If you specify the name with the format SVR\INSTANCE, the installation will fail. |
-
Custom database name (if applicable) |
-Unique database name. -Default: AppVManagement |
-
Management server location |
-Machine account on which the Management server is deployed. -Format to use: Domain\MachineAccount |
-
Management server installation administrator |
-Account used to install the Management server. -Format to use: Domain\AdministratorLoginName |
-
Microsoft SQL Server Service Agent |
-Configure the Management database computer so that the Microsoft SQL Server Agent service is restarted automatically. For instructions, see [Configure SQL Server Agent to Restart Services Automatically](http://technet.microsoft.com/magazine/gg313742.aspx). |
-
This format assumes that the installation is on the local computer.
If you specify the name with the format **SVR\INSTANCE**, the installation will fail.| +|Custom database name (if applicable)|Unique database name.
Default: AppVManagement| +|Management server location|Machine account on which the Management server is deployed.
Format to use: **Domain\MachineAccount**| +|Management server installation administrator|Account used to install the Management server.
Format to use: **Domain\AdministratorLoginName**| +|Microsoft SQL Server Service Agent|Configure the Management database computer so that the Microsoft SQL Server Agent service is restarted automatically. For instructions, see [Configure SQL Server Agent to restart services automatically](https://technet.microsoft.com/magazine/gg313742.aspx).| ### Publishing server prerequisite software -
| Prerequisites and required settings | -Details | -||||||
|---|---|---|---|---|---|---|---|
[Microsoft .NET Framework 4.5.1 (Web Installer)](http://www.microsoft.com//download/details.aspx?id=40773) |
-- | ||||||
[Visual C++ Redistributable Packages for Visual Studio 2013](http://www.microsoft.com/download/details.aspx?id=40784) |
-- | ||||||
64-bit ASP.NET registration |
-- | ||||||
Web Server Role |
-This role must be added to a server operating system that is supported for the Management server. |
-||||||
Web Server (IIS) Management Tools |
-Click IIS Management Scripts and Tools. |
-||||||
Web Server Role Services |
-Common HTTP Features: -
Application Development: -
Security: -
Management Tools: -
|
-||||||
Default installation location |
-%PROGRAMFILES%\Microsoft Application Virtualization Server |
-||||||
Management service URL |
-URL of the App-V Management service. This is the port with which the Publishing server communicates. -
- |
-||||||
Publishing service website name |
-Name for the Publishing website. |
-||||||
Publishing service port binding |
-Unique port number for the Publishing service. This port cannot be used by another process on the computer. |
-
- Static content
- Default document
Application development:
- ASP.NET
- .NET Extensibility
- ISAPI Extensions
- ISAPI Filters
Security:
- Windows Authentication
- Request Filtering
Management Tools:
- IIS Management Console| +|Default installation location|%PROGRAMFILES%\Microsoft Application Virtualization Server| +|Management service URL|URL of the App-V Management service. This is the port with which the Publishing server communicates.
Management server and Publishing server are installed on the same server, use the format **https://localhost:12345**.
If the Management server and Publishing server are installed on different servers, use the format **https://MyAppvServer.MyDomain.com**.| +|Publishing service website name|Name for the Publishing website.| +|Publishing service port binding|Unique port number for the Publishing service. This port cannot be used by another process on the computer.| ### Reporting server prerequisite software -
| Prerequisites and required settings | -Details | -
|---|---|
Supported version of SQL Server |
-For supported versions, see [App-V Supported Configurations](appv-supported-configurations.md). |
-
[Microsoft .NET Framework 4.5.1 (Web Installer)](http://www.microsoft.com//download/details.aspx?id=40773) |
-- |
[Visual C++ Redistributable Packages for Visual Studio 2013](http://www.microsoft.com/download/details.aspx?id=40784) |
-- |
64-bit ASP.NET registration |
-- |
Windows Server Web Server Role |
-This role must be added to a server operating system that is supported for the Management server. |
-
Web Server (IIS) Management Tools |
-Click IIS Management Scripts and Tools. |
-
Web Server Role Services |
-To reduce the risk of unwanted or malicious data being sent to the Reporting server, you should restrict access to the Reporting Web Service per your corporate security policy. -Common HTTP Features: -
Application Development: -
Security: -
Management Tools: -
|
-
Default installation location |
-%PROGRAMFILES%\Microsoft Application Virtualization Server |
-
Reporting service website name |
-Name for the Reporting website. |
-
Reporting service port binding |
-Unique port number for the Reporting service. This port cannot be used by another process on the computer. |
-
Common HTTP features:
- Static content
- Default document
Application development:
- ASP.NET
- .NET Extensibility
- ISAPI Extensions
- ISAPI Filters
Security:
- Windows Authentication
- Request Filtering
- Management Tools:
- IIS Management Console| +|Default installation location|%PROGRAMFILES%\Microsoft Application Virtualization Server| +|Reporting service website name|Name for the Reporting website.| +|Reporting service port binding|Unique port number for the Reporting service. This port cannot be used by another process on the computer.| ### Reporting database prerequisite software -The Reporting database is required only if you are using the App-V Reporting server. - -
| Prerequisites and required settings | -Details | -
|---|---|
[Microsoft .NET Framework 4.5.1 (Web Installer)](http://www.microsoft.com//download/details.aspx?id=40773) |
-- |
[Visual C++ Redistributable Packages for Visual Studio 2013](http://www.microsoft.com/download/details.aspx?id=40784) |
-- |
Default installation location |
-%PROGRAMFILES%\Microsoft Application Virtualization Server |
-
Custom SQL Server instance name (if applicable) |
-Format to use: INSTANCENAME -This format is based on the assumption that the installation is on the local computer. -If you specify the name with the format SVR\INSTANCE, the installation will fail. |
-
Custom database name (if applicable) |
-Unique database name. -Default: AppVReporting |
-
Reporting server location |
-Machine account on which the Reporting server is deployed. -Format to use: Domain\MachineAccount |
-
Reporting server installation administrator |
-Account used to install the Reporting server. -Format to use: Domain\AdministratorLoginName |
-
Microsoft SQL Server Service and Microsoft SQL Server Service Agent |
-Configure these services to be associated with user accounts that have access to query AD DS. |
-
his format assumes that the installation is on the local computer.
If you specify the name with the format **SVR\INSTANCE**, the installation will fail.| +|Custom database name (if applicable)|Unique database name.
Default: AppVReporting| +|Reporting server location|The Reporting server will be deployed on this machine account.
Format to use: **Domain\MachineAccount**| +|Reporting server installation administrator|Account used to install the Reporting server.
Format to use: **Domain\AdministratorLoginName**| +|Microsoft SQL Server Service and Microsoft SQL Server Service Agent|Configure these services to be associated with user accounts that have access to query AD DS.| ## Sequencer prerequisite software +What to know before installing the prerequisites: -**What to know before installing the prerequisites:** +* Best practice: The computer that runs the sequencer should have the same hardware and software configurations as the computers running the virtual applications. -- Best practice: The computer that runs the Sequencer should have the same hardware and software configurations as the computers that will run the virtual applications. +* The sequencing process is resource-intensive, so make sure that the computer running the sequencer has plenty of memory, a fast processor, and a fast hard drive. The system requirements of locally installed applications must not exceed those of the sequencer. For more information, see [App-V supported configurations](appv-supported-configurations.md). -- The sequencing process is resource intensive, so make sure that the computer that runs the Sequencer has plenty of memory, a fast processor, and a fast hard drive. The system requirements of locally installed applications cannot exceed those of the Sequencer. For more information, see [App-V Supported Configurations](appv-supported-configurations.md). - -
| Prerequisite | -Details | -
|---|---|
[Microsoft .NET Framework 4.5.1 (Web Installer)](http://www.microsoft.com//download/details.aspx?id=40773) |
-- |
[Windows PowerShell 3.0](http://www.microsoft.com/download/details.aspx?id=34595) - |
-Installing Windows PowerShell 3.0 requires a restart. |
-
[KB2533623](http://support.microsoft.com/kb/2533623) |
-Applies to Windows 7 only: Download and install the KB. |
-
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +|Prerequisite|Details| +|---|---| +|[Microsoft .NET Framework 4.5.1 (Web Installer)](https://www.microsoft.com//download/details.aspx?id=40773)|| +|[Windows PowerShell 3.0](https://www.microsoft.com/download/details.aspx?id=34595)|Installing Windows PowerShell 3.0 requires a restart.| +|[KB2533623](https://support.microsoft.com/kb/2533623)|Applies to Windows 7 only: download and install the KB.| ## Related topics -- [Planning for App-V](appv-planning-for-appv.md) -- [App-V Supported Configurations](appv-supported-configurations.md) - - - - - - - - - +* [Planning for App-V](appv-planning-for-appv.md) +* [App-V Supported Configurations](appv-supported-configurations.md) \ No newline at end of file diff --git a/windows/application-management/app-v/appv-publish-a-connection-group.md b/windows/application-management/app-v/appv-publish-a-connection-group.md index b826d5365e..739de9f0a3 100644 --- a/windows/application-management/app-v/appv-publish-a-connection-group.md +++ b/windows/application-management/app-v/appv-publish-a-connection-group.md @@ -25,7 +25,7 @@ After you create a connection group, you must publish it to computers that run t ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/application-management/app-v/appv-publish-a-packages-with-the-management-console.md b/windows/application-management/app-v/appv-publish-a-packages-with-the-management-console.md index bf8d8c0686..fb9ad9b19f 100644 --- a/windows/application-management/app-v/appv-publish-a-packages-with-the-management-console.md +++ b/windows/application-management/app-v/appv-publish-a-packages-with-the-management-console.md @@ -42,7 +42,7 @@ The ability to enable only administrators to publish or unpublish packages (desc ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/application-management/app-v/appv-register-and-unregister-a-publishing-server-with-the-management-console.md b/windows/application-management/app-v/appv-register-and-unregister-a-publishing-server-with-the-management-console.md index d5c5f8ec6c..c337d9ddd7 100644 --- a/windows/application-management/app-v/appv-register-and-unregister-a-publishing-server-with-the-management-console.md +++ b/windows/application-management/app-v/appv-register-and-unregister-a-publishing-server-with-the-management-console.md @@ -39,7 +39,7 @@ Use the following procedure to register or unregister a publishing server. ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/application-management/app-v/appv-release-notes-for-appv-for-windows-1703.md b/windows/application-management/app-v/appv-release-notes-for-appv-for-windows-1703.md index cbfeb16785..96cb952b96 100644 --- a/windows/application-management/app-v/appv-release-notes-for-appv-for-windows-1703.md +++ b/windows/application-management/app-v/appv-release-notes-for-appv-for-windows-1703.md @@ -105,7 +105,7 @@ The following are known issues and workarounds for Application Virtualization (A ## Related resources list For information that can help with troubleshooting App-V for Windows 10, see: -- [Application Virtualization (App-V): List of Microsoft Support Knowledge Base Articles](http://social.technet.microsoft.com/wiki/contents/articles/14272.app-v-v5-x-list-of-microsoft-support-knowledge-base-articles.aspx) +- [Application Virtualization (App-V): List of Microsoft Support Knowledge Base Articles](https://social.technet.microsoft.com/wiki/contents/articles/14272.app-v-v5-x-list-of-microsoft-support-knowledge-base-articles.aspx) - [The Official Microsoft App-V Team Blog](https://blogs.technet.microsoft.com/appv/) @@ -114,7 +114,7 @@ For information that can help with troubleshooting App-V for Windows 10, see: - [App-V TechNet Forum](https://social.technet.microsoft.com/forums/en-us/home?forum=mdopappv) ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics - [What's new in App-V for Windows 10](appv-about-appv.md) diff --git a/windows/application-management/app-v/appv-release-notes-for-appv-for-windows.md b/windows/application-management/app-v/appv-release-notes-for-appv-for-windows.md index 9b6c2d8902..ac04ab1fb4 100644 --- a/windows/application-management/app-v/appv-release-notes-for-appv-for-windows.md +++ b/windows/application-management/app-v/appv-release-notes-for-appv-for-windows.md @@ -149,13 +149,13 @@ The App-V Sequencer cannot sequence applications with filenames matching "CO_< ## Related resources list For information that can help with troubleshooting App-V for Windows 10, see: -- [Application Virtualization (App-V): List of Microsoft Support Knowledge Base Articles](http://social.technet.microsoft.com/wiki/contents/articles/14272.app-v-v5-x-list-of-microsoft-support-knowledge-base-articles.aspx) +- [Application Virtualization (App-V): List of Microsoft Support Knowledge Base Articles](https://social.technet.microsoft.com/wiki/contents/articles/14272.app-v-v5-x-list-of-microsoft-support-knowledge-base-articles.aspx) - [The Official Microsoft App-V Team Blog](https://blogs.technet.microsoft.com/appv/) - [Technical Reference for App-V](https://technet.microsoft.com/itpro/windows/manage/appv-technical-reference) - [App-V TechNet Forum](https://social.technet.microsoft.com/forums/en-us/home?forum=mdopappv) ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). Help us to improve diff --git a/windows/application-management/app-v/appv-reporting.md b/windows/application-management/app-v/appv-reporting.md index c516639d17..afe9597029 100644 --- a/windows/application-management/app-v/appv-reporting.md +++ b/windows/application-management/app-v/appv-reporting.md @@ -6,288 +6,209 @@ ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 04/19/2017 +ms.date: 04/16/2018 --- +# About App-V reporting +>Applies to: Windows 10, version 1607 -# About App-V Reporting - -**Applies to** -- Windows 10, version 1607 - -Application Virtualization (App-V) includes a built-in reporting feature that helps you collect information about computers running the App-V client as well as information about virtual application package usage. You can use this information to generate reports from a centralized database. - -## App-V Reporting Overview +Application Virtualization (App-V) includes a built-in reporting feature that collects information about computers running the App-V client and virtual application package usage. You can generate reports from a centralized database with this information. +## App-V reporting overview The following list displays the end–to-end high-level workflow for reporting in App-V. -1. The App-V Reporting server has the following prerequisites: +1. The App-V Reporting server requires the following things: - - Internet Information Service (IIS) web server role + * Internet Information Service (IIS) web server role + * Windows Authentication role (under **IIS / Security**) + * SQL Server installed and running with SQL Server Reporting Services (SSRS) - - Windows Authentication role (under **IIS / Security**) + To confirm SQL Server Reporting Services is running, enter
| Client Information | -Package Information | -Application Usage | -
|---|---|---|
Host Name |
-Package Name |
-Start and End Times |
-
App-V Client Version |
-Package Version |
-Run Status |
-
Processor Architecture |
-Package Source |
-Shutdown State |
-
Operating System Version |
-Percent Cached |
-Application Name |
-
Service Pack Level |
-- | Application Version |
-
Operating System Type |
-- | Username |
-
| - | - | Connection Group |
-
| With a Reporting Server | -Without a Reporting Server | -
|---|---|
If you have an existing App-V reporting Server, create a customized scheduled task or script. Specify that the client send the data to the specified location with the desired frequency. |
-If you do not have an existing App-V reporting Server, use the –URL parameter to send the data to a specified share. For example: -
The previous example will send the reporting data to \\MyShare\MyData\ location indicated by the -URL parameter. After the data has been sent, the cache is cleared. -
-Note
-
-If a location other than the Reporting Server is specified, the data is sent using .xml format with no additional processing. -
-
- |
-
The previous example will send the reporting data to the ```\\MyShare\MyData\``` location indicated by the **-URL** parameter. After the data has been sent, the cache is cleared.| - +>[!NOTE] +>If a location other than the Reporting Server is specified, the data is sent in **.xml** format with no additional processing. -### Creating Reports +### Creating reports To retrieve report information and create reports using App-V you must use one of the following methods: -- **Microsoft SQL Server Reporting Services (SSRS)** - Microsoft SQL Server Reporting Services is available with Microsoft SQL Server. SSRS is not installed when you install the App-V reporting server. It must be deployed separately to generate the associated reports. +* Microsoft SQL Server Reporting Services (SSRS)—Microsoft SSRS is available with Microsoft SQL Server. SSRS is not installed when you install the App-V reporting server. It must be deployed separately to generate the associated reports. For more information, see the [What is SQL Server Reporting Services (SSRS)?](https://docs.microsoft.com/en-us/sql/reporting-services/create-deploy-and-manage-mobile-and-paginated-reports) article. - Use the following link for more information about using [Microsoft SQL Server Reporting Services](https://technet.microsoft.com/en-us/library/ms159106(v=sql.130).aspx). - -- **Scripting** – You can generate reports by scripting directly against the App-V reporting database. For example: +* Scripting—You can generate reports by scripting directly against the App-V reporting database. For example: **Stored Procedure:** **spProcessClientReport** is scheduled to run at midnight or 12:00 AM. - To run the Microsoft SQL Server Scheduled Stored procedure, the Microsoft SQL Server Agent must be running. You should ensure that the Microsoft SQL Server Agent is set to **AutoStart**. For more information see [Autostart SQL Server Agent (SQL Server Management Studio)](https://technet.microsoft.com/library/ms178130). + To run the Microsoft SQL Server Scheduled Stored procedure, the Microsoft SQL Server Agent must be running. Make sure the Microsoft SQL Server Agent is set to **AutoStart**. For more information, see [Autostart SQL Server Agent (SQL Server Management Studio)](https://docs.microsoft.com/en-us/sql/ssms/agent/autostart-sql-server-agent-sql-server-management-studio). - The stored procedure is also created when using the App-V database scripts. + The stored procedure is also created when when you use the App-V database scripts. -You should also ensure that the reporting server web service’s **Maximum Concurrent Connections** is set to a value that the server will be able to manage without impacting availability. The recommended number of **Maximum Concurrent Connections** for the **Reporting Web Service** is **10,000**. +You should also ensure that the reporting server web service’s **Maximum Concurrent Connections** is set to a value that the server can manage without affecting availability. The recommended number of **Maximum Concurrent Connections** for the **Reporting Web Service** is **10,000**. ## Have a suggestion for App-V? - -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization). ## Related topics - -[Deploying the App-V server](appv-deploying-the-appv-server.md) - -[How to install the Reporting Server on a Standalone Computer and Connect it to the Database](appv-install-the-reporting-server-on-a-standalone-computer.md) - - - - - - - - - +* [Deploying the App-V server](appv-deploying-the-appv-server.md) +* [How to install the reporting server on a standalone computer and connect it to the database](appv-install-the-reporting-server-on-a-standalone-computer.md) \ No newline at end of file diff --git a/windows/application-management/app-v/appv-running-locally-installed-applications-inside-a-virtual-environment.md b/windows/application-management/app-v/appv-running-locally-installed-applications-inside-a-virtual-environment.md index c404cdd892..16285b7ef5 100644 --- a/windows/application-management/app-v/appv-running-locally-installed-applications-inside-a-virtual-environment.md +++ b/windows/application-management/app-v/appv-running-locally-installed-applications-inside-a-virtual-environment.md @@ -155,7 +155,7 @@ This method lets you launch any command within the context of an App-V package, ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/application-management/app-v/appv-security-considerations.md b/windows/application-management/app-v/appv-security-considerations.md index b29f528873..c5286a0658 100644 --- a/windows/application-management/app-v/appv-security-considerations.md +++ b/windows/application-management/app-v/appv-security-considerations.md @@ -6,143 +6,66 @@ ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 04/19/2017 +ms.date: 04/16/2018 --- +# App-V security considerations - -# App-V Security Considerations - -**Applies to** -- Windows 10, version 1607 +>Applies to: Windows 10, version 1607 This topic contains a brief overview of the accounts and groups, log files, and other security-related considerations for Microsoft Application Virtualization (App-V). -**Important** -App-V is not a security product and does not provide any guarantees for a secure environment. +>[!IMPORTANT] +>App-V is not a security product and does not provide any guarantees for a secure environment. - +## The PackageStoreAccessControl (PSAC) feature has been deprecated -## PackageStoreAccessControl (PSAC) feature has been deprecated - - -Effective as of June, 2014, the PackageStoreAccessControl (PSAC) feature that was introduced in Microsoft Application Virtualization (App-V) 5.0 Service Pack 2 (SP2) has been deprecated in both single-user and multi-user environments. +Effective as of June, 2014, the PackageStoreAccessControl (PSAC) feature introduced in Microsoft Application Virtualization (App-V) 5.0 Service Pack 2 (SP2) has been deprecated in both single-user and multi-user environments. ## General security considerations +**Understand the security risks.** The most serious risk to App-V is from unauthorized users hijacking an App-V client's functionality, giving the hacker the ability to reconfigure key data on App-V clients. By comparison, short-term loss of App-V functionality from a denial-of-service attack would not be as catastrophic. -**Understand the security risks.** The most serious risk to App-V is that its functionality could be hijacked by an unauthorized user who could then reconfigure key data on App-V clients. The loss of App-V functionality for a short period of time due to a denial-of-service attack would not generally have a catastrophic impact. +**Physically secure your computers**. A security strategy that doesn't consider physical security is incomplete. Anyone with physical access to an App-V server could potentially attack the entire client base, so potential physical attacks or thefts should be prevented at all cost. App-V servers should be stored in a physically secure server room with controlled access. Lock the computer with the operating system or a secured screen saver to keep computers secure when the administrators are away. -**Physically secure your computers**. Security is incomplete without physical security. Anyone with physical access to an App-V server could potentially attack the entire client base. Any potential physical attacks must be considered high risk and mitigated appropriately. App-V servers should be stored in a physically secure server room with controlled access. Secure these computers when administrators are not physically present by having the operating system lock the computer, or by using a secured screen saver. +**Apply the most recent security updates to all computers**. To stay informed about the latest updates for operating systems, Microsoft SQL Server, and App-V, see the [Microsoft Security TechCenter](https://technet.microsoft.com/en-us/security/bb291012). (THIS LINK NEEDS TO BE UPDATED) -**Apply the most recent security updates to all computers**. To stay informed about the latest updates for operating systems, Microsoft SQL Server, and App-V, see the [Microsoft Security TechCenter](https://technet.microsoft.com/en-us/security/bb291012). - -**Use strong passwords or pass phrases**. Always use strong passwords with 15 or more characters for all App-V and App-V administrator accounts. Never use blank passwords. For more information about password concepts, see [Password Policy](https://technet.microsoft.com/library/hh994572.aspx). +**Use strong passwords or pass phrases**. Always use strong passwords with 15 or more characters for all App-V and App-V administrator accounts. Never use blank passwords. For more information about password concepts, see [Password Policy](https://docs.microsoft.com/en-us/sql/relational-databases/security/password-policy) and [Strong Passwords](https://docs.microsoft.com/en-us/sql/relational-databases/security/strong-passwords). (THIS LINK NEEDS TO BE UPDATED) ## Accounts and groups in App-V +A best practice for user account management is to create domain global groups and add user accounts to them. After that, add the domain global accounts to the necessary App-V local groups on the App-V servers. -A best practice for user account management is to create domain global groups and add user accounts to them. Then, add the domain global accounts to the necessary App-V local groups on the App-V servers. +>[!NOTE] +>App-V client computer accounts that need to connect to the publishing server must be part of the publishing server’s **Users** local group. By default, all computers in the domain are part of the **Authorized Users** group, which is part of the **Users** local group. -**Note** -App-V client computer accounts that need to connect to the publishing server must be part of the publishing server’s **Users** local group. By default, all computers in the domain are part of the **Authorized Users** group, which is part of the **Users** local group. +### App-V server security - +No groups are created automatically during App-V setup. You should create the following Active Directory Domain Services global groups to manage App-V server operations. -### App-V server security - -No groups are created automatically during App-V Setup. You should create the following Active Directory Domain Services global groups to manage App-V server operations. - -
| Group name | -Details | -
|---|---|
App-V Management Admin group |
-Used to manage the App-V management server. This group is created during the App-V Management Server installation. -
-Important
-
-There is no method to create the group using the management console after you have completed the installation. -
-
- |
-
Database read/write for Management Service account |
-Provides read/write access to the management database. This account should be created during the App-V management database installation. |
-
App-V Management Service install admin account -
-Note
-
-This is only required if management database is being installed separately from the service. -
-
- |
-Provides public access to schema-version table in management database. This account should be created during the App-V management database installation. |
-
App-V Reporting Service install admin account -
-Note
-
-This is only required if reporting database is being installed separately from the service. -
-
- |
-Public access to schema-version table in reporting database. This account should be created during the App-V reporting database installation. |
-
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +During App-V setup, setup log files are created in the **%temp%** folder of the installing user. ## Related topics - -[Preparing Your Environment for App-V](appv-preparing-your-environment.md) - - - - - - - - - +[Preparing Your Environment for App-V](appv-preparing-your-environment.md) \ No newline at end of file diff --git a/windows/application-management/app-v/appv-sequence-a-new-application.md b/windows/application-management/app-v/appv-sequence-a-new-application.md index 0fcb1d5719..ba31867ad8 100644 --- a/windows/application-management/app-v/appv-sequence-a-new-application.md +++ b/windows/application-management/app-v/appv-sequence-a-new-application.md @@ -6,220 +6,211 @@ ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 04/19/2017 +ms.date: 04/16/2018 --- - - # Manually sequence a new app using the Microsoft Application Virtualization Sequencer (App-V Sequencer) -**Applies to** -- Windows 10, version 1607 and later +>Applies to: Windows 10, version 1607 and later In Windows 10, version 1607, the App-V Sequencer is included with the Windows ADK. For more info on how to install the App-V Sequencer, see [Install the App-V Sequencer](appv-install-the-sequencer.md). -**To review or do before you start sequencing** +## Before you start sequencing -1. Determine the type of virtualized application package you want to create: +1. Determine the type of virtualized application package you want to create: | Application type | Description | - | - | - | + |---|---| | Standard | Creates a package that contains an application or a suite of applications. This is the preferred option for most application types. | | Add-on or plug-in | Creates a package that extends the functionality of a standard application, for example, a plug-in for Microsoft Excel. Additionally, you can use plug-ins for natively installed applications, or for another package that is linked by using connection groups. | - | Middleware | Creates a package that is required by a standard application, for example, Java. Middleware packages are used for linking to other packages by using connection groups. | + | Middleware | Creates a package that is required by a standard application, for example, Java. Middleware packages are used for linking to other packages through connection groups. | -2. Copy all required installation files to the computer that is running the sequencer. +2. Copy all required installation files to the computer that is running the sequencer. -3. Make a backup image of your virtual environment before sequencing an application, and then revert to that image each time after you finish sequencing an application. +3. Make a backup image of your virtual environment before sequencing an application, and then revert to that image each time after you finish sequencing an application. -4. Review the following items: +4. Review the following items: - - If an application installer changes the security access to a new or existing file or directory, those changes are not captured in the package. + - If an application installer changes the security access to a new or existing file or directory, those changes are not captured in the package. + - If short paths have been disabled for the virtualized package’s target volume, you must also sequence the package to a volume that was created and still has short-paths disabled. It cannot be the system volume. - - If short paths have been disabled for the virtualized package’s target volume, you must also sequence the package to a volume that was created and still has short-paths disabled. It cannot be the system volume. +>[!NOTE] +>The App-V Sequencer cannot sequence applications with filenames matching "CO_<_x_>" where *x* is any numeral. Error 0x8007139F will be generated. ->[!NOTE] ->The App-V Sequencer cannot sequence applications with filenames matching "CO_<_x_>" where x is any numeral. Error 0x8007139F will be generated. +## Sequence a new standard application -**To sequence a new standard application** +1. On the computer that runs the sequencer, select **All Programs**, and then select **Microsoft Application Virtualization**, and then select **Microsoft Application Virtualization Sequencer**. -1. On the computer that runs the sequencer, click **All Programs**, and then click **Microsoft Application Virtualization**, and then click **Microsoft Application Virtualization Sequencer**. +2. In the sequencer, select **Create a New Virtual Application Package**. Select **Create Package (default)**, and then select **Next**. -2. In the sequencer, click **Create a New Virtual Application Package**. Select **Create Package (default)**, and then click **Next**. +3. On the **Prepare Computer** page, review the issues that could cause the package creation to fail or could cause the package to contain unnecessary data. You should resolve all potential issues before you continue. After making any corrections, select **Refresh** to display the updated information. After you have resolved all potential issues, select **Next**. -3. On the **Prepare Computer** page, review the issues that could cause the package creation to fail or could cause the package to contain unnecessary data. You should resolve all potential issues before you continue. After making any corrections, click **Refresh** to display the updated information. After you have resolved all potential issues, click **Next**. - - >[!IMPORTANT] + >[!IMPORTANT] >If you are required to disable virus scanning software, you should first scan the computer that runs the sequencer in order to ensure that no unwanted or malicious files could be added to the package. -4. On the **Type of Application** page, click the **Standard Application (default)** check box, and then click **Next**. +4. On the **Type of Application** page, select the **Standard Application (default)** check box, and then select **Next**. -5. On the **Select Installer** page, click **Browse** and specify the installation file for the application. +5. On the **Select Installer** page, select **Browse** and specify the installation file for the application. - >[!NOTE] + >[!NOTE] >If the specified application installer modifies security access to a file or directory, existing or new, the associated changes will not be captured into the package. - - If the application does not have an associated installer file and you plan to run all installation steps manually, select the **Perform a Custom Installation** check box, and then click **Next**. -6. On the **Package Name** page, type a name that will be associated with the package. Use a name that helps identify the purpose and version of the application that will be added to the package. The package name is displayed in the App-V Management Console. + If the application does not have an associated installer file and you plan to run all installation steps manually, select the **Perform a Custom Installation** check box, and then select **Next**. - Click **Next**. +6. On the **Package Name** page, specify a name for the package. Use a name that helps identify the purpose and version of the application that will be added to the package. The package name is displayed in the App-V Management Console. Once you're done, select **Next**. -7. On the **Installation** page, when the sequencer and application installer are ready you can proceed to install the application so that the sequencer can monitor the installation process. +7. On the **Installation** page, when the sequencer and application installer are ready, you can install the application so that the sequencer can monitor the installation process. - >[!IMPORTANT] + >[!IMPORTANT] >You should always install applications to a secure location and make sure no other users are logged on to the computer running the sequencer during monitoring. - - Use the application's installation process to perform the installation. If additional installation files must be run as part of the installation, click **Run** to locate and run the additional installation files. When you are finished with the installation, select **I am finished installing**. Click **Next**. -8. On the **Installation** page, wait while the sequencer configures the virtualized application package. + Use the application's installation process to perform the installation. If additional installation files must be run as part of the installation, select **Run** to locate and run the additional installation files. When you are finished with the installation, select **I am finished installing**, then select **Next**. -9. On the **Configure Software** page, optionally run the programs contained in the package. This step allows you to complete any necessary license or configuration tasks before you deploy and run the package on target computers. To run all the programs at one time, select at least one program, and then click **Run All**. To run specific programs, select the program or programs, and then click **Run Selected**. Complete the required configuration tasks and then close the applications. You may need to wait several minutes for all programs to run. +8. On the **Installation** page, wait while the sequencer configures the virtualized application package. - >[!NOTE] +9. On the **Configure Software** page, optionally run the programs contained in the package. This step allows you to complete any necessary license or configuration tasks before you deploy and run the package on target computers. To run all the programs at one time, select at least one program, and then select **Run All**. To run specific programs, select the program or programs, and then select **Run Selected**. Complete the required configuration tasks and then close the applications. You may need to wait several minutes for all programs to run. + + >[!NOTE] >To run first-use tasks for any application that is not available in the list, open the application. The associated information will be captured during this step. - - Click **Next**. -10. On the **Installation Report** page, you can review information about the virtualized application package you have just sequenced. In **Additional Information**, double-click an event to obtain more detailed information. To proceed, click **Next**. + Select **Next**. -11. The **Customize** page is displayed. If you are finished installing and configuring the virtual application, select **Stop now** and skip to step 14 of this procedure. To perform either of the following customizations, select **Customize**. +10. On the **Installation Report** page, you can review information about the virtualized application package you have just sequenced. In **Additional Information**, double-click an event to obtain more detailed information. To proceed, select **Next**. - - Prepare the virtual package for streaming. Streaming improves the experience when the virtual application package is run on target computers. +11. The **Customize** page is displayed. If you've finished installing and configuring the virtual application, select **Stop now** and skip to step 14 of this procedure. To perform either of the following customizations, select **Customize**. - - Specify the operating systems that can run this package. + - Prepare the virtual package for streaming. Streaming improves the experience when the virtual application package is run on target computers. + - Specify the operating systems that can run this package. - Click **Next**. + Once you're ready, select **Next**. -12. On the **Streaming** page, run each program so that it can be optimized and run more efficiently on target computers. It can take several minutes for all the applications to run. After all applications have run, close each of the applications, and then click **Next**. +12. On the **Streaming** page, run each program so that it can be optimized and run more efficiently on target computers. It can take several minutes for all the applications to run. After all applications have run, close each of the applications, and then select **Next**. - >[!NOTE] - >If you do not open any applications during this step, the default streaming method is on-demand streaming delivery. This means applications will be downloaded bit by bit until it can be opened, and then depending on how the background loading is configured, will load the rest of the application. + >[!NOTE] + >If you do not open any applications during this step, the default streaming method is on-demand streaming delivery. This means applications will be downloaded bit by bit until it can be opened. After that, depending on how the background loading is configured, it will load the rest of the application. -13. On the **Target OS** page, specify the operating systems that can run this package. To allow all supported operating systems in your environment to run this package, select **Allow this package to run on any operating system**. To configure this package to run only on specific operating systems, select **Allow this package to run only on the following operating systems** and select the operating systems that can run this package. Click **Next**. +13. On the **Target OS** page, specify the operating systems that can run this package. To allow all supported operating systems in your environment to run this package, select **Allow this package to run on any operating system**. To configure this package to run only on specific operating systems, select **Allow this package to run only on the following operating systems** and select the operating systems that can run this package. After that, select **Next**. - >[!IMPORTANT] + >[!IMPORTANT] >Make sure that the operating systems you specify here are supported by the application you are sequencing. - -14. The **Create Package** page is displayed. To modify the package without saving it, select **Continue to modify package without saving using the package editor**. This option opens the package in the sequencer console so that you can modify the package before it is saved. Click **Next**. +14. The **Create Package** page is displayed. To modify the package without saving it, select **Continue to modify package without saving using the package editor**. This option opens the package in the sequencer console so that you can modify the package before saving it. Select **Next**. To save the package immediately, select **Save the package now** (default). Add optional **Comments** to be associated with the package. Comments are useful for identifying the program version and other information about the package. - >[!IMPORTANT] + >[!IMPORTANT] >The system does not support non-printable characters in **Comments** and **Descriptions**. - - The default **Save Location** is also displayed on this page. To change the default location, click **Browse** and specify the new location. Click **Create**. -15. The **Completion** page is displayed. Review the information in the **Virtual Application Package Report** pane as needed, then click **Close**. This information is also available in the **Report.xml** file that is located in the directory where the package was created. + The default **Save Location** is also displayed on this page. To change the default location, select **Browse** and specify the new location. After that, select **Create**. - The package is now available in the sequencer. +15. The **Completion** page is displayed. Review the information in the **Virtual Application Package Report** pane as needed, then select **Close**. This information is also available in the **Report.xml** file located in the directory where the package was created. - >[!IMPORTANT] - >After you have successfully created a virtual application package, you cannot run the virtual application package on the computer that is running the sequencer. - + Your package should now be available in the sequencer. -**To sequence an add-on or plug-in application** + >[!IMPORTANT] + >After you have successfully created a virtual application package, you can't run the virtual application package on the computer that is running the sequencer. ->[!NOTE] +## Sequence an add-on or plug-in application + +>[!NOTE] >Before performing the following procedure, install the parent application locally on the computer that is running the sequencer. Or if you have the parent application virtualized, you can follow the steps in the add-on or plug-in workflow to unpack the parent application on the computer. +>For example, if you are sequencing a plug-in for Microsoft Excel, install Microsoft Excel locally on the computer that's running the sequencer. You should also install the parent application in the same directory where the application is installed on target computers. If the plug-in or add-on is going to be used with an existing virtual application package, install the application on the same virtual application drive that was used when you created the parent virtual application package. ->For example, if you are sequencing a plug-in for Microsoft Excel, install Microsoft Excel locally on the computer that is running the sequencer. Also install the parent application in the same directory where the application is installed on target computers. If the plug-in or add-on is going to be used with an existing virtual application package, install the application on the same virtual application drive that was used when you created the parent virtual application package. +1. On the computer that runs the sequencer, first, select **All Programs**, then select **Microsoft Application Virtualization**, and then select **Microsoft Application Virtualization Sequencer**. -1. On the computer that runs the sequencer, click **All Programs**, and then Click **Microsoft Application Virtualization**, and then click **Microsoft Application Virtualization Sequencer**. +2. In the sequencer, select **Create a New Virtual Application Package**, select **Create Package (default)**, and then select **Next**. -2. In the sequencer, click **Create a New Virtual Application Package**, select **Create Package (default)**, and then click **Next**. +3. On the **Prepare Computer** page, review the issues that might cause the package creation to fail or could cause the package to contain unnecessary data. You should resolve all potential issues before you continue. After making any corrections, select **Refresh** to display the updated information. After you have resolved all potential issues, select **Next**. -3. On the **Prepare Computer** page, review the issues that might cause the package creation to fail or could cause the package to contain unnecessary data. You should resolve all potential issues before you continue. After making any corrections, click **Refresh** to display the updated information. After you have resolved all potential issues, click **Next**. - - >[!IMPORTANT] + >[!IMPORTANT] >If you are required to disable virus scanning software, you should first scan the computer that runs the sequencer in order to ensure that no unwanted or malicious files could be added to the package. -4. On the **Type of Application** page, select **Add-on or Plug-in**, and then click **Next**. +4. On the **Type of Application** page, select **Add-on or Plug-in**, and then select **Next**. -5. On the **Select Installer** page, click **Browse** and specify the installation file for the add-on or plug-in. If the add-on or plug-in does not have an associated installer file and you plan to run all installation steps manually, select the **Select this option to perform a custom installation** check box, and then click **Next**. +5. On the **Select Installer** page, select **Browse** and specify the installation file for the add-on or plug-in. If the add-on or plug-in does not have an associated installer file and you plan to run all installation steps manually, select the **Select this option to perform a custom installation** check box, then select **Next**. -6. On the **Install Primary** page, ensure that the primary application is installed on the computer that runs the sequencer. Alternatively, you can expand an existing package that has been saved locally on the computer that runs the sequencer. To do this, click **Expand Package**, and then select the package. After you have expanded or installed the parent program, select **I have installed the primary parent program**. +6. On the **Install Primary** page, ensure that the primary application is installed on the computer that runs the sequencer. Alternatively, you can expand an existing package that has been saved locally on the computer that runs the sequencer. To do this, select **Expand Package**, and then select the package. After you have expanded or installed the parent program, select **I have installed the primary parent program**. -7. Click **Next**. +7. Select **Next**. -8. On the **Package Name** page, type a name that will be associated with the package. Use a name that helps identify the purpose and version of the application that will be added to the package. The package name will be displayed in the App-V Management Console. +8. On the **Package Name** page, type a name that will be associated with the package. Use a name that helps identify the purpose and version of the application that will be added to the package. The package name will be displayed in the App-V Management Console. -9. Click **Next**. +9. Select **Next**. -10. On the **Installation** page, when the sequencer and application installer are ready you can proceed to install the plug-in or add-in application so the sequencer can monitor the installation process. Use the application's installation process to perform the installation. If additional installation files must be run as part of the installation, click **Run** and locate and run the additional installation files. When you are finished with the installation, select **I am finished installing**, and then click **Next**. +10. On the **Installation** page, when the sequencer and application installer are ready you can proceed to install the plug-in or add-in application so the sequencer can monitor the installation process. Use the application's installation process to perform the installation. If additional installation files must be run as part of the installation, select **Run** and locate and run the additional installation files. When you are finished with the installation, select **I am finished installing**, and then select **Next**. -11. On the **Installation Report** page, you can review information about the virtual application package that you just sequenced. For a more detailed explanation about the information displayed in **Additional Information**, double-click the event. After you have reviewed the information, click **Next**. +11. On the **Installation Report** page, you can review information about the virtual application package that you just sequenced. For a more detailed explanation about the information displayed in **Additional Information**, double-click the event. After you have reviewed the information, select **Next**. 12. The **Customize** page is displayed. If you are finished installing and configuring the virtual application, select **Stop now** and skip to step 12 of this procedure. To perform either of the following customizations, select **Customize**. - - Optimize how the package will run across a slow or unreliable network. + - Optimize how the package will run across a slow or unreliable network. + - Specify the operating systems that can run this package. - - Specify the operating systems that can run this package. + When you're finished, select **Next**. - Click **Next**. +13. On the **Streaming** page, run each program so that it can be optimized and run more efficiently on target computers. Streaming improves the experience when the virtual application package is run on target computers on high-latency networks. It can take several minutes for all applications to run. After all applications have run, close each application. You can also configure the package to be required to be fully downloaded before opening by selecting the **Force applications to be downloaded** check-box. Select **Next**. -13. On the **Streaming** page, run each program so that it can be optimized and run more efficiently on target computers. Streaming improves the experience when the virtual application package is run on target computers on high-latency networks. It can take several minutes for all the applications to run. After all applications have run, close each of the applications. You can also configure the package to be required to be fully downloaded before opening by selecting the **Force applications to be downloaded** check-box. Click **Next**. + >[!NOTE] + >If necessary, you can stop an application from loading during this step. In the **Application Launch** dialog box, select **Stop** and select one of the check boxes: **Stop all applications** or **Stop this application only**. - >[!NOTE] - >If necessary, you can stop an application from loading during this step. In the **Application Launch** dialog box, click **Stop** and select one of the check boxes: **Stop all applications** or **Stop this application only**. +14. On the **Target OS** page, specify the operating systems that can run this package. To allow all supported operating systems in your environment to run this package, select the **Allow this package to run on any operating system** check box. To configure this package to run only on specific operating systems, select the **Allow this package to run only on the following operating systems** check box, and then select the operating systems that can run this package. Select **Next**. -12. On the **Target OS** page, specify the operating systems that can run this package. To allow all supported operating systems in your environment to run this package, select the **Allow this package to run on any operating system** check box. To configure this package to run only on specific operating systems, select the **Allow this package to run only on the following operating systems** check box, and then select the operating systems that can run this package. Click **Next**. +15. The **Create Package** page is displayed. To modify the package without saving it, select **Continue to modify package without saving using the package editor** check box. This option opens the package in the sequencer console so that you can modify the package before it is saved. Select **Next**. -13. The **Create Package** page is displayed. To modify the package without saving it, select **Continue to modify package without saving using the package editor** check box. This option opens the package in the sequencer console so that you can modify the package before it is saved. Click **Next**. + To save the package immediately, select **Save the package now**. Optionally, add a **Description** for the package. Descriptions are useful for identifying the version and other important information about the package. - To save the package immediately, select **Save the package now**. Optionally, add a **Description** that will be associated with the package. Descriptions are useful for identifying the version and other information about the package. - - >[!IMPORTANT] + >[!IMPORTANT] >The system does not support non-printable characters in Comments and Descriptions. - - The default **Save Location** is also displayed on this page. To change the default location, click **Browse** and specify the new location. Click **Create**. -**To sequence a middleware application** + The default **Save Location** is also displayed on this page. To change the default location, select **Browse** and specify the new location. Select **Create**. -1. On the computer that runs the sequencer, click **All Programs**, and then Click **Microsoft Application Virtualization**, and then click **Microsoft Application Virtualization Sequencer**. +### Sequence a middleware application -2. In the sequencer, click **Create a New Virtual Application Package**, select **Create Package (default)**, and then click **Next**. +1. On the computer that runs the sequencer, select **All Programs**, then select **Microsoft Application Virtualization**, and then select **Microsoft Application Virtualization Sequencer**. -3. On the **Prepare Computer** page, review the issues that could cause the package creation to fail or could cause the package to contain unnecessary data. You should resolve all potential issues before you continue. After making any corrections, click **Refresh** to display the updated information. After you have resolved all potential issues, click **Next**. +2. In the sequencer, select **Create a New Virtual Application Package**, select **Create Package (default)**, and then select **Next**. - >[!IMPORTANT] +3. On the **Prepare Computer** page, review the issues that could cause the package creation to fail or could cause the package to contain unnecessary data. You should resolve all potential issues before you continue. After making any corrections, select **Refresh** to display the updated information. After you have resolved all potential issues, select **Next**. + + >[!IMPORTANT] >If you are required to disable virus scanning software, you should first scan the computer that runs the App-V Sequencer in order to ensure that no unwanted or malicious files can be added to the package. -4. On the **Type of Application** page, select **Middleware**, and then click **Next**. +4. On the **Type of Application** page, select **Middleware**, and then select **Next**. -5. On the **Select Installer** page, click **Browse** and specify the installation file for the application. If the application does not have an associated installer file and you plan to run all installation steps manually, select the **Select this option to perform a custom installation** check box, and then click **Next**. +5. On the **Select Installer** page, select **Browse** and specify the installation file for the application. If the application does not have an associated installer file and you plan to run all installation steps manually, select the **Select this option to perform a custom installation** check box, then select **Next**. -6. On the **Package Name** page, type a name that will be associated with the package. Use a name that helps identify the purpose and version of the application that will be added to the package. The package name is displayed in the App-V Management Console. +6. On the **Package Name** page, type a name that will be associated with the package. Use a name that helps identify the purpose and version of the application that will be added to the package. The package name is displayed in the App-V Management Console. -7. Click **Next**. +7. Select **Next**. -8. On the **Installation** page, when the sequencer and middleware application installer are ready you can proceed to install the application so that the sequencer can monitor the installation process. Use the application's installation process to perform the installation. If additional installation files must be run as part of the installation, click **Run**, to locate and run the additional installation files. When you are finished with the installation, select the **I am finished installing** check box, and then click **Next**. +8. On the **Installation** page, when the sequencer and middleware application installer are ready you can proceed to install the application so that the sequencer can monitor the installation process. Use the application's installation process to perform the installation. If additional installation files must be run as part of the installation, select **Run**, to locate and run the additional installation files. When you are finished with the installation, select the **I am finished installing** check box, and then select **Next**. 9. On the **Installation** page, wait while the sequencer configures the virtual application package. -10. On the **Installation Report** page, you can review information about the virtual application package that you have just sequenced. In **Additional Information**, double-click an event to obtain more detailed information. To proceed, click **Next**. +10. On the **Installation Report** page, you can review information about the virtual application package that you have just sequenced. In **Additional Information**, double-click an event to obtain more detailed information. To proceed, select **Next**. -11. On the **Target OS** page, specify the operating systems that can run this package. To enable all supported operating systems in your environment to run this package, select the **Allow this package to run on any operating system** check box. To configure this package to run only on specific operating systems, select the **Allow this package to run only on the following operating systems** check box and select the operating systems that can run this package. Click **Next**. +11. On the **Target OS** page, specify the operating systems that can run this package. To enable all supported operating systems in your environment to run this package, select the **Allow this package to run on any operating system** check box. To configure this package to run only on specific operating systems, select the **Allow this package to run only on the following operating systems** check box and select the operating systems that can run this package. Once you're done, select **Next**. -12. On the **Create Package** page is displayed. To modify the package without saving it, select **Continue to modify package without saving using the package editor**. This option opens the package in the sequencer console so that you can modify the package before it is saved. Click **Next**. +12. On the **Create Package** page is displayed. To modify the package without saving it, select **Continue to modify package without saving using the package editor**. This option opens the package in the sequencer console so that you can modify the package before it is saved. Select **Next**. To save the package immediately, select **Save the package now**. Optionally, add a **Description** to be associated with the package. Descriptions are useful for identifying the program version and other information about the package. - >[!IMPORTANT] - >The system does not support non-printable characters in Comments and Descriptions. - - The default **Save Location** is also displayed on this page. To change the default location, click **Browse** and specify the new location. Click **Create**. + >[!IMPORTANT] + >The system does not support non-printable characters in comments and descriptions. -13. The **Completion** page is displayed. Review the information in the **Virtual Application Package Report** pane as needed, then click **Close**. This information is also available in the **Report.xml** file that is located in the directory specified in step 11 of this procedure. + The default **Save Location** is also displayed on this page. To change the default location, select **Browse** and specify the new location. Select **Create**. - The package is now available in the sequencer. To edit the package properties, click **Edit \[Package Name\]**. +13. The **Completion** page is displayed. Review the information in the **Virtual Application Package Report** pane as needed, then select **Close**. This information is also available in the **Report.xml** file that is located in the directory specified in step 11 of this procedure. - >[!IMPORTANT] - >After you have successfully created a virtual application package, you cannot run the virtual application package on the computer that is running the sequencer. + The package is now available in the sequencer. To edit the package properties, select **Edit \[Package Name\]**. + + >[!IMPORTANT] + >After you have successfully created a virtual application package, you can't run the virtual application package on the computer that is running the sequencer. ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization). ## Related topics + - [Install the App-V Sequencer](appv-install-the-sequencer.md) - [Operations for App-V](appv-operations.md) diff --git a/windows/application-management/app-v/appv-sequence-a-package-with-powershell.md b/windows/application-management/app-v/appv-sequence-a-package-with-powershell.md index 8d8eb13511..8a03631883 100644 --- a/windows/application-management/app-v/appv-sequence-a-package-with-powershell.md +++ b/windows/application-management/app-v/appv-sequence-a-package-with-powershell.md @@ -71,4 +71,4 @@ In Windows 10, version 1703, running the new-appvsequencerpackage or the update- ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). \ No newline at end of file +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). \ No newline at end of file diff --git a/windows/application-management/app-v/appv-supported-configurations.md b/windows/application-management/app-v/appv-supported-configurations.md index e1e458b316..3a0c6514b4 100644 --- a/windows/application-management/app-v/appv-supported-configurations.md +++ b/windows/application-management/app-v/appv-supported-configurations.md @@ -6,158 +6,87 @@ ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 04/19/2017 +ms.date: 04/16/2018 --- - - # App-V Supported Configurations -**Applies to** -- Windows 10, version 1607; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; and Windows Server 2008 R2 +>Applies to: Windows 10, version 1607; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 -This topic specifies the requirements to install and run App-V in your Windows 10 environment. For information about prerequisite software such as the .NET Framework, see [App-V Prerequisites](appv-prerequisites.md). +This topic specifies the requirements to install and run App-V in your Windows 10 environment. For information about prerequisite software such as the .NET Framework, see [App-V prerequisites](appv-prerequisites.md). ## App-V Server system requirements -This section lists the operating system and hardware requirements for all of the App-V server components. +This section lists the operating system and hardware requirements for all App-V server components. ### Unsupported App-V server scenarios The App-V server does not support the following scenarios: -- Deployment to a computer that runs the Server Core installation option. - -- Deployment to a computer that runs a previous version of the App-V server components. You can install App-V side by side with the App-V 4.5 Lightweight Streaming Server (LWS) server only. Deployment of App-V side by side with the Application Virtualization Management Service (HWS) 4.x is not supported. - -- Deployment to a computer that runs Microsoft SQL Server Express edition. - -- Deployment to a domain controller. - -- Short paths. If you plan to use a short path, you must create a new volume. +* Deployment to a computer that runs the Server Core installation option. +* Deployment to a computer that runs a previous version of the App-V server components. You can only install App-V side-by-side with the App-V 4.5 Lightweight Streaming Server (LWS) server. This scenario doesn't support side-by-side deployment of App-V and the Application Virtualization Management Service (HWS) 4.x. +* Deployment to a computer running Microsoft SQL Server Express edition. +* Deployment to a domain controller. +* Short paths. If you plan to use a short path, you must create a new volume. ### Management server operating system requirements -The App-V Management server can be installed on a server that runs Windows Server 2008 R2 with SP1 or later. +You can install the App-V Management server on a server running Windows Server 2008 R2 with SP1 or later. -> [!IMPORTANT] -> Deployment of the Management server role to a computer with Remote Desktop Services enabled is not supported. - - +>[!IMPORTANT] +>Deploying a Management server role to a computer with Remote Desktop Services enabled is not supported. ### Management server hardware requirements -- Processor—1.4 GHz or faster, 64-bit (x64) processor - -- RAM—1 GB RAM (64-bit) - -- Disk space—200 MB available hard disk space, not including the content directory +* A 64-bit (x64) processor that runs at 1.4 GHz or faster. +* 1 GB RAM (64-bit). +* 200 MB of available hard disk space, not including the content directory. ### Management server database requirements -The following table lists the SQL Server versions that are supported for the App-V Management database installation. +The following table lists the SQL Server versions that the App-V Management database installation supports. -
| SQL Server version | -Service pack | -System architecture | -
|---|---|---|
Microsoft SQL Server 2014 |
-- | 32-bit or 64-bit |
-
Microsoft SQL Server 2012 |
-SP2 |
-32-bit or 64-bit |
-
Microsoft SQL Server 2008 R2 |
-SP3 |
-32-bit or 64-bit |
-
| SQL Server version | -Service pack | -System architecture | -
|---|---|---|
Microsoft SQL Server 2014 |
-- | 32-bit or 64-bit |
-
Microsoft SQL Server 2012 |
-SP2 |
-32-bit or 64-bit |
-
Microsoft SQL Server 2008 R2 |
-SP3 |
-32-bit or 64-bit |
-
| Operating system | -Service pack | -System architecture | -
|---|---|---|
Microsoft Windows Server 2012 R2 |
-- | 64-bit |
-
Microsoft Windows Server 2012 |
-- | 64-bit |
-
Microsoft Windows Server 2008 R2 |
-SP1 |
-64-bit |
-
Microsoft Windows 10 |
-- | 32-bit and 64-bit |
-
Microsoft Windows 8.1 |
-- | 32-bit and 64-bit |
-
Microsoft Windows 8 |
-- | 32-bit and 64-bit |
-
Microsoft Windows 7 |
-SP1 |
-32-bit and 64-bit |
-
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). - ## Related topics -- [Planning to Deploy App-V](appv-planning-to-deploy-appv.md) -- [App-V Prerequisites](appv-prerequisites.md) +* [Planning to deploy App-V](appv-planning-to-deploy-appv.md) +* [App-V prerequisites](appv-prerequisites.md) \ No newline at end of file diff --git a/windows/application-management/app-v/appv-technical-reference.md b/windows/application-management/app-v/appv-technical-reference.md index f93b0e90ca..81b431ddac 100644 --- a/windows/application-management/app-v/appv-technical-reference.md +++ b/windows/application-management/app-v/appv-technical-reference.md @@ -39,7 +39,7 @@ This section provides reference information related to managing App-V. ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/application-management/app-v/appv-transfer-access-and-configurations-to-another-version-of-a-package-with-the-management-console.md b/windows/application-management/app-v/appv-transfer-access-and-configurations-to-another-version-of-a-package-with-the-management-console.md index 3fbc1956ed..242fdc9cf7 100644 --- a/windows/application-management/app-v/appv-transfer-access-and-configurations-to-another-version-of-a-package-with-the-management-console.md +++ b/windows/application-management/app-v/appv-transfer-access-and-configurations-to-another-version-of-a-package-with-the-management-console.md @@ -29,7 +29,7 @@ Use the following procedure to transfer the access and default package configura ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/application-management/app-v/appv-troubleshooting.md b/windows/application-management/app-v/appv-troubleshooting.md index c1e0968b82..c3011b5f88 100644 --- a/windows/application-management/app-v/appv-troubleshooting.md +++ b/windows/application-management/app-v/appv-troubleshooting.md @@ -17,7 +17,7 @@ ms.date: 04/19/2017 For information that can help with troubleshooting App-V for Windows 10, see: -- [Application Virtualization (App-V): List of Microsoft Support Knowledge Base Articles](http://social.technet.microsoft.com/wiki/contents/articles/14272.app-v-v5-x-list-of-microsoft-support-knowledge-base-articles.aspx) +- [Application Virtualization (App-V): List of Microsoft Support Knowledge Base Articles](https://social.technet.microsoft.com/wiki/contents/articles/14272.app-v-v5-x-list-of-microsoft-support-knowledge-base-articles.aspx) - [Microsoft App-V Team Blog](https://blogs.technet.microsoft.com/appv/) @@ -42,4 +42,4 @@ For information that can help with troubleshooting App-V for Windows 10, see: ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). diff --git a/windows/application-management/app-v/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md b/windows/application-management/app-v/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md index 2cd95ea922..9331c1584b 100644 --- a/windows/application-management/app-v/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md +++ b/windows/application-management/app-v/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md @@ -72,7 +72,7 @@ Once you’ve enabled the in-box App-V client, you need to configure it to point Type the following cmdlet in a Windows PowerShell window: -`Add-AppvPublishingServer -Name AppVServer -URL http:// appvserver:2222` +`Add-AppvPublishingServer -Name AppVServer -URL https:// appvserver:2222` **To modify client settings to point to an existing App-V publishing server with Group Policy** @@ -96,4 +96,4 @@ Type the following cmdlet in a Windows PowerShell window: ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). \ No newline at end of file +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). \ No newline at end of file diff --git a/windows/application-management/app-v/appv-using-the-client-management-console.md b/windows/application-management/app-v/appv-using-the-client-management-console.md index 1372c4e630..54b1306b2e 100644 --- a/windows/application-management/app-v/appv-using-the-client-management-console.md +++ b/windows/application-management/app-v/appv-using-the-client-management-console.md @@ -82,7 +82,7 @@ The client management console contains the following described main tabs. ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/application-management/app-v/appv-view-and-configure-applications-and-default-virtual-application-extensions-with-the-management-console.md b/windows/application-management/app-v/appv-view-and-configure-applications-and-default-virtual-application-extensions-with-the-management-console.md index ffb8290ae7..fdf7299db8 100644 --- a/windows/application-management/app-v/appv-view-and-configure-applications-and-default-virtual-application-extensions-with-the-management-console.md +++ b/windows/application-management/app-v/appv-view-and-configure-applications-and-default-virtual-application-extensions-with-the-management-console.md @@ -33,7 +33,7 @@ Use the following procedure to view and configure default package extensions. ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/application-management/app-v/appv-viewing-appv-server-publishing-metadata.md b/windows/application-management/app-v/appv-viewing-appv-server-publishing-metadata.md index 60f321a711..46b0feb4f1 100644 --- a/windows/application-management/app-v/appv-viewing-appv-server-publishing-metadata.md +++ b/windows/application-management/app-v/appv-viewing-appv-server-publishing-metadata.md @@ -154,7 +154,7 @@ In your publishing metadata query, enter the string values that correspond to th ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/application-management/apps-in-windows-10.md b/windows/application-management/apps-in-windows-10.md index 08850b0417..67ceafd469 100644 --- a/windows/application-management/apps-in-windows-10.md +++ b/windows/application-management/apps-in-windows-10.md @@ -8,7 +8,7 @@ ms.pagetype: mobile ms.author: elizapo author: lizap ms.localizationpriority: low -ms.date: 01/24/2018 +ms.date: 04/30/2018 --- # Understand the different apps included in Windows 10 @@ -23,7 +23,7 @@ Digging into the Windows apps, there are two categories: - Provisioned: Installed the first time you sign into Windows. You'll see a tile or Start menu item for these apps, but they aren't installed until the first sign-in. - Installed: Installed as part of the OS. -The following tables list the system apps, installed Windows apps, and provisioned Windows apps in a standard Windows 10 Enterprise installation. (If you have a custom image, your specific apps might differ.) The tables list the app, the full name, show the app's status in Windows 10 version 1607, 1703, and 1709, and indicate whether an app can be uninstalled through the UI. +The following tables list the system apps, installed Windows apps, and provisioned Windows apps in a standard Windows 10 Enterprise installation. (If you have a custom image, your specific apps might differ.) The tables list the app, the full name, show the app's status in Windows 10 version 1607, 1703, and 1709, and indicate whether an app can be uninstalled through the UI. Some of the apps show up in multiple tables - that's because their status changed between versions. Make sure to check the version column for the version you are currently running. @@ -32,115 +32,143 @@ Some of the apps show up in multiple tables - that's because their status change > ```powershell > Get-AppxPackage |Select Name,PackageFamilyName > Get-AppxProvisionedPackage -Online | select DisplayName,PackageName -> ``` - +> ``` ## System apps -System apps are integral to the operating system. Here are the typical system apps in Windows 10 versions 1607, 1703, and 1709. -| Name | Full name | 1607 | 1703 | 1709 |Uninstall through UI? | -|------------------|-------------------------------------------|------|------|------|-------------------------------------------------------| -| Cortana UI | CortanaListenUIApp | | x | | No | -| | Desktop Learning | | x | | No | -| | DesktopView | | x | | No | -| | EnvironmentsApp | | x | | No | -| Mixed Reality + | HoloCamera | | x | | No | -| Mixed Reality + | HoloItemPlayerApp | | x | | No | -| Mixed Reality + | HoloShell | | x | | No | -| | InputApp | | | x | No | -| | Microsoft.AAD.Broker.Plugin | x | x | x | No | -| | Microsoft.AccountsControl | x | x | x | No | -| Hello setup UI | Microsoft.BioEnrollment | x | x | x | No | -| | Microsoft.CredDialogHost | | x | x | No | -| | Microsoft.ECApp | | | x | No | -| | Microsoft.LockApp | x | x | x | No | -| Microsoft Edge | Microsoft.Microsoft.Edge | x | x | x | No | -| | Microsoft.PPIProjection | x | x | x | No | -| | Microsoft.Windows. Apprep.ChxApp | x | x | x | No | -| | Microsoft.Windows. AssignedAccessLockApp | x | x | x | No | -| | Microsoft.Windows. CloudExperienceHost | x | x | x | No | -| | Microsoft.Windows. ContentDeliveryManager | x | x | x | No | -| Cortana | Microsoft.Windows.Cortana | x | x | x | No | -| | Microsoft.Windows. Holographic.FirstRun | | x | x | No | -| | Microsoft.Windows. ModalSharePickerHost | | x | | No | -| | Microsoft.Windows. OOBENetworkCaptivePort | | x | x | No | -| | Microsoft.Windows. OOBENetworkConnectionFlow | | x | x | No | -| | Microsoft.Windows. ParentalControls | x | x | x | No | -| People Hub | Microsoft.Windows. PeopleExperienceHost | | | x | No | -| | Microsoft.Windows. PinningConfirmationDialog | | | x | No | -| | Microsoft.Windows. SecHealthUI | | x | x | No | -| | Microsoft.Windows. SecondaryTileExperience | x | x | x | No | -| | Microsoft.Windows. SecureAssessmentBrowser | | x | x | No | -| Start | Microsoft.Windows. ShellExperienceHost | x | x | x | No | -| Windows Feedback | Microsoft.WindowsFeedback | * | * | * | No | -| | Microsoft.XboxGameCallableUI | x | x | x | No | -| Contact Support* | Windows.ContactSupport | x | x | * | Through the Optional Features app | -| Settings | Windows.ImmersiveControlPanel | x | x | x | No | -| Connect | Windows.MiracastView | x | x | | No | -| Print 3D | Windows.Print3D | | | x | Yes | -| Print UI | Windows.PrintDialog | x | x | x | No | +System apps are integral to the operating system. Here are the typical system apps in Windows 10 versions 1703, 1709, and 1803. -> [!NOTE] -> - The Windows Feedback app changed to the Feedback Hub in version 1607. It's listed in the provisioned apps table below. +| Name | Full name |1703 | 1709 | 1803 |Uninstall through UI? | +|------------------|-------------------------------------------|:------:|:------:|:------:|-------------------------------------------------------| +| Cortana UI | CortanaListenUIApp | x | | |No | +| | Desktop Learning | x | | |No | +| | DesktopView | x | | |No | +| | EnvironmentsApp | x | | |No | +| Mixed Reality + | HoloCamera | x | | |No | +| Mixed Reality + | HoloItemPlayerApp | x | | |No | +| Mixed Reality + | HoloShell | x | | |No | +| | InputApp | | x | x |No | +| | Microsoft.AAD.Broker.Plugin | x | x | x |No | +| | Microsoft.AccountsControl | x | x | x |No | +| Hello setup UI | Microsoft.BioEnrollment | x | x | x |No | +| | Microsoft.CredDialogHost | x | x | x |No | +| | Microsoft.ECApp | | x | x |No | +| | Microsoft.LockApp | x | x | x |No | +| Microsoft Edge | Microsoft.Microsoft.Edge | x | x | x |No | +| | Microsoft.PPIProjection | x | x | x |No | +| | Microsoft.Windows. Apprep.ChxApp | x | x | x |No | +| | Microsoft.Windows. AssignedAccessLockApp | x | x | x |No | +| | Microsoft.Windows. CloudExperienceHost | x | x | x |No | +| | Microsoft.Windows. ContentDeliveryManager | x | x | x |No | +| Cortana | Microsoft.Windows.Cortana | x | x | x |No | +| | Microsoft.Windows. Holographic.FirstRun | x | x | x |No | +| | Microsoft.Windows. ModalSharePickerHost | x | | |No | +| | Microsoft.Windows. OOBENetworkCaptivePort | x | x | x |No | +| | Microsoft.Windows. OOBENetworkConnectionFlow | x | x | x |No | +| | Microsoft.Windows. ParentalControls | x | x | x |No | +| People Hub | Microsoft.Windows. PeopleExperienceHost | | x | x |No | +| | Microsoft.Windows. PinningConfirmationDialog | | x | x |No | +| | Microsoft.Windows. SecHealthUI | x | x | x |No | +| | Microsoft.Windows. SecondaryTileExperience | x | x | |No | +| | Microsoft.Windows. SecureAssessmentBrowser | x | x | x |No | +| Start | Microsoft.Windows. ShellExperienceHost | x | x | x |No | +| Windows Feedback | Microsoft.WindowsFeedback | * | * | |No | +| | Microsoft.XboxGameCallableUI | x | x | x |No | +| Contact Support* | Windows.ContactSupport | x | * | |Through the Optional Features app | +| Settings | Windows.ImmersiveControlPanel | x | x | |No | +| Connect | Windows.MiracastView | x | | |No | +| Print 3D | Windows.Print3D | | x | |Yes | +| Print UI | Windows.PrintDialog | x | x | x |No | +| Purchase UI | Windows.PurchaseDialog | | | x |No | +| | Microsoft.AsyncTextService | | | x |No | +| | Microsoft.MicrosoftEdgeDevToolsClient | | | x |No | +| | Microsoft.Win32WebViewHost | | | x |No | +| | Microsoft.Windows.CapturePicker | | | x |No | +| | Windows.CBSPreview | | | x |No | +|File Picker | 1527c705-839a-4832-9118-54d4Bd6a0c89 | | | x |No | +|File Explorer | c5e2524a-ea46-4f67-841f-6a9465d9d515 | | | x |No | +|App Resolver | E2A4F912-2574-4A75-9BB0-0D023378592B | | | x |No | +|Add Suggested folder Dialog box| F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE|| | x |No | + +> [!NOTE] > - The Contact Support app changed to Get Help in version 1709. Get Help is a provisioned app (instead of system app like Contact Support). -> - As of Windows 10 version 1607, you can use the Optional Features app to uninstall the Contact Support app. ## Installed Windows apps -Here are the typical installed Windows apps in Windows 10 versions 1607, 1703, and 1709. - -| Name | Full name | 1607 | 1703 | 1709 |Uninstall through UI? | -|--------------------|-----------------------------------------|------|------|------|----------------------| -| Remote Desktop | Microsoft.RemoteDesktop | x | x | x | Yes | -| PowerBI | Microsoft.Microsoft PowerBIforWindows | x | x | | Yes | -| Code Writer | ActiproSoftwareLLC.562882FEEB491 | x | x | x | Yes | -| Eclipse Manager | 46928bounde.EclipseManager | x | x | x | Yes | -| Pandora | PandoraMediaInc.29680B314EFC2 | x | x | x | Yes | -| Photoshop Express | AdobeSystemIncorporated. AdobePhotoshop | x | x | x | Yes | -| Duolingo | D5EA27B7.Duolingo- LearnLanguagesforFree | | x | x | Yes | -| Network Speed Test | Microsoft.NetworkSpeedTest | x | x | x | Yes | -| Paid Wi-FI | | | x | | Yes | +Here are the typical installed Windows apps in Windows 10 versions 1703, 1709, and 1803. +| Name | Full name | 1703 | 1709 | 1803 |Uninstall through UI? | +|--------------------|------------------------------------------|:------:|:------:|:------:|----------------------| +| Remote Desktop | Microsoft.RemoteDesktop | x | x | | Yes | +| PowerBI | Microsoft.Microsoft PowerBIforWindows | x | | | Yes | +| Code Writer | ActiproSoftwareLLC.562882FEEB491 | x | x | x | Yes | +| Eclipse Manager | 46928bounde.EclipseManager | x | x | x | Yes | +| Pandora | PandoraMediaInc.29680B314EFC2 | x | x | x | Yes | +| Photoshop Express | AdobeSystemIncorporated. AdobePhotoshop | x | x | x | Yes | +| Duolingo | D5EA27B7.Duolingo- LearnLanguagesforFree | x | x | x | Yes | +| Network Speed Test | Microsoft.NetworkSpeedTest | x | x | x | Yes | +| News | Microsoft.BingNews | x | x | x | Yes | +| Flipboard | | | | | Yes | +| | Microsoft.Advertising.Xaml | x | x | x | Yes | +| | Microsoft.NET.Native.Framework.1.2 | x | x | x | Yes | +| | Microsoft.NET.Native.Framework.1.3 | x | x | x | Yes | +| | Microsoft.NET.Native.Framework.1.6 | | x | x | Yes | +| | Microsoft.NET.Native.Framework.1.7 | | | x | Yes | +| | Microsoft.NET.Native.Framework.2.0 | | x | x | Yes | +| | Microsoft.NET.Native.Runtime.1.1 | | x | x | Yes | +| | Microsoft.NET.Native.Runtime.1.3 | x | x | | Yes | +| | Microsoft.NET.Native.Runtime.1.4 | x | x | x | Yes | +| | Microsoft.NET.Native.Runtime.1.6 | | x | x | Yes | +| | Microsoft.NET.Native.Runtime.1.7 | | | x | Yes | +| | Microsoft.NET.Native.Runtime.2.0 | | x | x | Yes | +| | Microsoft.Services.Store.Engagement | | x | x | Yes | +| | Microsoft.VCLibs.120.00 | x | x | x | Yes | +| | Microsoft.VCLibs.140.00 | x | x | x | Yes | +| | Microsoft.VCLibs.120.00.Universal | | x | | Yes | +| | Microsoft.VCLibs.140.00.UWPDesktop | | | x | Yes | +| | Microsoft.WinJS.2.0 | x | | | Yes | ## Provisioned Windows apps -Here are the typical provisioned Windows apps in Windows 10 versions 1607, 1703, and 1709. -| Name | Full name | 1607 | 1703 | 1709 | Uninstall through UI? | -|---------------------------------|----------------------------------------|------|------|------|---------------------| -| 3D Builder | Microsoft.3DBuilder | | x | | Yes | -| Alarms & Clock | Microsoft.WindowsAlarms | x | x | x | No | -| App Installer | Microsoft.DesktopAppInstaller | x | x | x | No | -| Calculator | Microsoft.WindowsCalculator | x | x | x | No | -| Camera | Microsoft.WindowsCamera | x | x | x | No | -| Feedback Hub | Microsoft.WindowsFeedbackHub | x | x | x | Yes | -| Get Help | Microsoft.GetHelp | | | x | No | -| Get Office/My Office | Microsoft.Microsoft OfficeHub | x | x | x | Yes | -| Get Skype/Skype (preview)/Skype | Microsoft.SkypeApp | x | x | x | Yes | -| Get Started/Tips | Microsoft.Getstarted | x | x | x | Yes | -| Groove | Microsoft.ZuneMusic | x | x | x | No | -| Mail and Calendar | microsoft.windowscommunicationsapps | x | x | x | No | -| Maps | Microsoft.WindowsMaps | x | x | x | No | -| Messaging | Microsoft.Messaging | x | x | x | No | -| Microsoft 3D Viewer | Microsoft.Microsoft3DViewer | | x | x | No | -| Movies & TV | Microsoft.ZuneVideo | x | x | x | No | -| News | Microsoft.BingNews | x | x | x | Yes | -| OneNote | Microsoft.Office.OneNote | x | x | x | Yes | -| Paint 3D | Microsoft.MSPaint | | x | x | No | -| People | Microsoft.People | x | x | x | No | -| Photos | Microsoft.Windows.Photos | x | x | x | No | -| Print 3D | Microsoft.Print3D | | | x | No | -| Solitaire | Microsoft.MicrosoftSolitaireCollection | x | x | x | Yes | -| Sticky Notes | Microsoft.MicrosoftStickyNotes | x | x | x | No | -| Store | Microsoft.WindowsStore | x | x | x | No | -| Sway | Microsoft.Office.Sway | * | * | x | Yes | -| Voice Recorder | Microsoft.WindowsSoundRecorder | x | x | x | No | -| Wallet | Microsoft.Wallet | | x | x | No | -| Weather | Microsoft.BingWeather | x | x | x | Yes | -| Xbox | Microsoft.XboxApp | x | x | x | No | -| | Microsoft.OneConnect | x | x | x | No | -| | Microsoft.StorePurchaseApp | x | x | x | No | -| | Microsoft.Xbox.TCUI | | | x | No | -| | Microsoft.XboxGameOverlay | | x | x | No | -| | Microsoft.XboxIdentityProvider | x | x | * | No | -| | Microsoft.XboxSpeech ToTextOverlay | | x | x | No | +Here are the typical provisioned Windows apps in Windows 10 versions 1703, 1709, and 1803. -\* moved from "provisioned" to "installed" in this version. +| Name | Full name | 1703 | 1709 | 1803 | Uninstall through UI? | +|---------------------------------|----------------------------------------|:------:|:------:|:------:|---------------------------| +| 3D Builder | Microsoft.3DBuilder | x | | | Yes | +| Alarms & Clock | Microsoft.WindowsAlarms | x | x | x | No | +| App Installer | Microsoft.DesktopAppInstaller | x | x | x | Via Settings App | +| Calculator | Microsoft.WindowsCalculator | x | x | x | No | +| Camera | Microsoft.WindowsCamera | x | x | x | No | +| Feedback Hub | Microsoft.WindowsFeedbackHub | x | x | x | Yes | +| Get Help | Microsoft.GetHelp | | x | x | No | +| Get Office/My Office | Microsoft.Microsoft OfficeHub | x | x | x | Yes | +| Get Skype/Skype (preview)/Skype | Microsoft.SkypeApp | x | x | x | Yes | +| Get Started/Tips | Microsoft.Getstarted | x | x | x | Yes | +| Groove | Microsoft.ZuneMusic | x | x | x | No | +| Mail and Calendar | Microsoft.windows communicationsapps | x | x | x | No | +| Maps | Microsoft.WindowsMaps | x | x | x | No | +| Messaging | Microsoft.Messaging | x | x | x | No | +| Microsoft 3D Viewer | Microsoft.Microsoft3DViewer | x | x | x | No | +| Movies & TV | Microsoft.ZuneVideo | x | x | x | No | +| OneNote | Microsoft.Office.OneNote | x | x | x | Yes | +| Paid Wi-FI | Microsoft.OneConnect | x | x | x | Yes | +| Paint 3D | Microsoft.MSPaint | x | x | x | No | +| People | Microsoft.People | x | x | x | No | +| Photos | Microsoft.Windows.Photos | x | x | x | No | +| Print 3D | Microsoft.Print3D | | x | x | No | +| Solitaire | Microsoft.Microsoft SolitaireCollection| x | x | x | Yes | +| Sticky Notes | Microsoft.MicrosoftStickyNotes | x | x | x | No | +| Store | Microsoft.WindowsStore | x | x | x | No | +| Sway | Microsoft.Office.Sway | * | x | x | Yes | +| Voice Recorder | Microsoft.SoundRecorder | x | x | x | No | +| Wallet | Microsoft.Wallet | x | x | x | No | +| Weather | Microsoft.BingWeather | x | x | x | Yes | +| Xbox | Microsoft.XboxApp | x | x | x | No | +| | Microsoft.OneConnect | x | x | x | No | +| | Microsoft.DesktopAppInstaller | | | x | No | +| | Microsoft.StorePurchaseApp | x | x | x | No | +| | Microsoft.WebMediaExtensions | | | x | No | +| | Microsoft.Xbox.TCUI | | x | x | No | +| | Microsoft.XboxGameOverlay | x | x | x | No | +| | Microsoft.XboxGamingOverlay | | | x | No | +| | Microsoft.XboxIdentityProvider | x | x | x | No | +| | Microsoft.XboxSpeech ToTextOverlay | x | x | x | No | \ No newline at end of file diff --git a/windows/application-management/change-history-for-application-management.md b/windows/application-management/change-history-for-application-management.md index ed841489c6..933bf0e0ab 100644 --- a/windows/application-management/change-history-for-application-management.md +++ b/windows/application-management/change-history-for-application-management.md @@ -15,6 +15,10 @@ ms.date: 10/24/2017 This topic lists new and updated topics in the [Configure Windows 10](index.md) documentation for Windows 10 and Windows 10 Mobile. +## RELEASE: Windows 10, version 1803 + +The topics in this library have been updated for Windows 10, version 1803. + ## October 2017 New or changed topic | Description diff --git a/windows/application-management/index.md b/windows/application-management/index.md index fdd42c35b8..23490f9d99 100644 --- a/windows/application-management/index.md +++ b/windows/application-management/index.md @@ -24,8 +24,8 @@ Learn about managing applications in Windows 10 and Windows 10 Mobile clients. | [Enable or block Windows Mixed Reality apps in the enterprise](manage-windows-mixed-reality.md) | Learn how to enable or block Windows Mixed Reality apps. | |[App-V](app-v/appv-getting-started.md)| Microsoft Application Virtualization (App-V) for Windows 10 enables organizations to deliver Win32 applications to users as virtual applications| | [Service Host process refactoring](svchost-service-refactoring.md) | Changes to Service Host grouping in Windows 10 | -|[Per User services in Windows 10](sideload-apps-in-windows-10.md)| Overview of per user services and instructions for viewing and disabling them in Windows 10 and Windows 2016| +|[Per User services in Windows 10](per-user-services-in-windows.md)| Overview of per user services and instructions for viewing and disabling them in Windows 10 and Windows 2016| [Disabling System Services in Windows Server](https://docs.microsoft.com/windows-server/security/windows-services/security-guidelines-for-disabling-system-services-in-windows-server) | Security guidelines for disabling services in Windows Server 2016 with Desktop Experience |[Understand apps in Windows 10](apps-in-windows-10.md)| Overview of the different apps included by default in Windows 10 Enterprise| -| [Deploy app updgrades on Windows 10 Mobile](deploy-app-upgrades-windows-10-mobile.md) | How to upgrade apps on Windows 10 Mobile | +| [Deploy app upgrades on Windows 10 Mobile](deploy-app-upgrades-windows-10-mobile.md) | How to upgrade apps on Windows 10 Mobile | [Change history for Application management](change-history-for-application-management.md) | This topic lists new and updated topics in the Application management documentation for Windows 10 and Windows 10 Mobile. diff --git a/windows/application-management/manage-windows-mixed-reality.md b/windows/application-management/manage-windows-mixed-reality.md index 4d6181abe1..d00670af75 100644 --- a/windows/application-management/manage-windows-mixed-reality.md +++ b/windows/application-management/manage-windows-mixed-reality.md @@ -8,7 +8,7 @@ ms.sitesec: library ms.localizationpriority: medium author: jdeckerms ms.author: jdecker -ms.date: 11/09/2017 +ms.date: 04/30/2018 --- # Enable or block Windows Mixed Reality apps in the enterprise @@ -17,27 +17,39 @@ ms.date: 11/09/2017 - Windows 10 -Windows 10, version 1709 (also known as the Fall Creators Update), introduces [Windows Mixed Reality](https://blogs.windows.com/windowsexperience/2017/10/03/the-era-of-windows-mixed-reality-begins-october-17/). Organizations that use Windows Server Update Services (WSUS) must take action to [enable Windows Mixed Reality](#enable). Any organization that wants to prohibit use of Windows Mixed Reality can [block the installation of the Mixed Reality Portal](#block). + +[Windows Mixed Reality](https://blogs.windows.com/windowsexperience/2017/10/03/the-era-of-windows-mixed-reality-begins-october-17/) was introduced in Windows 10, version 1709 (also known as the Fall Creators Update), as a [Windows 10 Feature on Demand (FOD)](https://docs.microsoft.com/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities). Features on Demand are Windows feature packages that can be added at any time. When a Windows 10 PC needs a new feature, it can request the feature package from Windows Update. + +Organizations that use Windows Server Update Services (WSUS) must take action to [enable Windows Mixed Reality](#enable). Any organization that wants to prohibit use of Windows Mixed Reality can [block the installation of the Mixed Reality Portal](#block). ## Enable Windows Mixed Reality in WSUS -To enable users to download the Windows Mixed Reality software for devices running Windows 10, version 1703, enterprises using WSUS can approve Windows Mixed Reality package by unblocking **KB4016509: FeatureOnDemandOasis - Windows 10 version 1703 for x64-based Systems**. - -Enterprises devices running Windows 10, version 1709, will not be able to install Windows Mixed Reality Feature on Demand (FOD) directly from WSUS. Instead, use one of the following options to install Windows Mixed Reality software: +1. [Check your version of Windows 10.](https://support.microsoft.com/help/13443/windows-which-operating-system) -- Manually install the Mixed Reality software - - - [Download the Microsoft Windows Holographic Desktop Feature on Demand package.](http://download.microsoft.com/download/6/F/8/6F816172-AC7D-4F45-B967-D573FB450CB7/Microsoft-Windows-Holographic-Desktop-FOD-Package.cab) - - - Open a command prompt as administrator and run the following command to install the package: - - `dism /online /add-package /packagepath:"path to the cab file"` - - - Go to **Settings** > **Update & Security** > **Windows Update** and **Check for updates**. - -- IT admin can create [Side by side feature store (shared folder)](https://technet.microsoft.com/library/jj127275.aspx) + >[!NOTE] + >You must be on at least Windows 10, version 1709, to run Windows Mixed Reality. + +2. Windows Mixed Reality Feature on Demand (FOD) is downloaded from Windows Update. If access to Windows Update is blocked, you must manually install the Windows Mixed Reality FOD. + + a. Download [the FOD .cab file for Windows 10, version 1803](http://download.microsoft.com/download/9/9/3/9934B163-FA01-4108-A38A-851B4ACD1244/Microsoft-Windows-Holographic-Desktop-FOD-Package~31bf3856ad364e35~amd64~~.cab) or [the FOD .cab file for Windows 10, version 1709] + (http://download.microsoft.com/download/6/F/8/6F816172-AC7D-4F45-B967-D573FB450CB7/Microsoft-Windows-Holographic-Desktop-FOD-Package.cab). + + >[!NOTE] + >You must download the FOD .cab file that matches your operating system version. + + b. Use `Add-Package` to add Windows Mixed Reality FOD to the image. + + ``` + Add-Package + Dism /Image:C:\test\offline /Add-Package /PackagePath:*path to the cab file* + ``` + + c. In **Settings** > **Update & Security** > **Windows Update**, select **Check for updates**. + + +IT admins can also create [Side by side feature store (shared folder)](https://technet.microsoft.com/library/jj127275.aspx) to allow access to the Windows Mixed Reality FOD. diff --git a/windows/client-management/TOC.md b/windows/client-management/TOC.md index ffe541cc15..a01dc76b8c 100644 --- a/windows/client-management/TOC.md +++ b/windows/client-management/TOC.md @@ -6,6 +6,7 @@ ## [New policies for Windows 10](new-policies-for-windows-10.md) ## [Group Policies that apply only to Windows 10 Enterprise and Windows 10 Education](group-policies-for-enterprise-and-education-editions.md) ## [Manage the Settings app with Group Policy](manage-settings-app-with-group-policy.md) +## [What version of Windows am I running](windows-version-search.md) ## [Reset a Windows 10 Mobile device](reset-a-windows-10-mobile-device.md) ## [Transitioning to modern management](manage-windows-10-in-your-organization-modern-management.md) ## [Windows 10 Mobile deployment and management guide](windows-10-mobile-and-mdm.md) diff --git a/windows/client-management/images/WinVer.PNG b/windows/client-management/images/WinVer.PNG new file mode 100644 index 0000000000..3cb598ad04 Binary files /dev/null and b/windows/client-management/images/WinVer.PNG differ diff --git a/windows/client-management/images/msinfo32.png b/windows/client-management/images/msinfo32.png new file mode 100644 index 0000000000..9a8d125b7a Binary files /dev/null and b/windows/client-management/images/msinfo32.png differ diff --git a/windows/client-management/images/msinfosnip.jpg b/windows/client-management/images/msinfosnip.jpg new file mode 100644 index 0000000000..67c65eec3c Binary files /dev/null and b/windows/client-management/images/msinfosnip.jpg differ diff --git a/windows/client-management/images/refcmd.png b/windows/client-management/images/refcmd.png new file mode 100644 index 0000000000..5e08df408e Binary files /dev/null and b/windows/client-management/images/refcmd.png differ diff --git a/windows/client-management/images/slmgr_dlv.png b/windows/client-management/images/slmgr_dlv.png new file mode 100644 index 0000000000..096a2b1859 Binary files /dev/null and b/windows/client-management/images/slmgr_dlv.png differ diff --git a/windows/client-management/images/systemcollage.png b/windows/client-management/images/systemcollage.png new file mode 100644 index 0000000000..d1400e19f4 Binary files /dev/null and b/windows/client-management/images/systemcollage.png differ diff --git a/windows/client-management/images/systeminfo.png b/windows/client-management/images/systeminfo.png new file mode 100644 index 0000000000..4c70bed782 Binary files /dev/null and b/windows/client-management/images/systeminfo.png differ diff --git a/windows/client-management/images/systemproperties.png b/windows/client-management/images/systemproperties.png new file mode 100644 index 0000000000..e6e6d5677b Binary files /dev/null and b/windows/client-management/images/systemproperties.png differ diff --git a/windows/client-management/images/systemprops.jpg b/windows/client-management/images/systemprops.jpg new file mode 100644 index 0000000000..dfff3fb5d0 Binary files /dev/null and b/windows/client-management/images/systemprops.jpg differ diff --git a/windows/client-management/images/winsearchbar.jpg b/windows/client-management/images/winsearchbar.jpg new file mode 100644 index 0000000000..7f27bd8805 Binary files /dev/null and b/windows/client-management/images/winsearchbar.jpg differ diff --git a/windows/client-management/images/winversnip.jpg b/windows/client-management/images/winversnip.jpg new file mode 100644 index 0000000000..c2f2be1bb2 Binary files /dev/null and b/windows/client-management/images/winversnip.jpg differ diff --git a/windows/client-management/manage-windows-10-in-your-organization-modern-management.md b/windows/client-management/manage-windows-10-in-your-organization-modern-management.md index d3eaf1a5ca..4e93c9b375 100644 --- a/windows/client-management/manage-windows-10-in-your-organization-modern-management.md +++ b/windows/client-management/manage-windows-10-in-your-organization-modern-management.md @@ -6,9 +6,9 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: devices -author: jdeckerms +author: MariciaAlforque ms.localizationpriority: high -ms.date: 12/04/2017 +ms.date: 04/26/2018 --- # Manage Windows 10 in your organization - transitioning to modern management @@ -21,10 +21,10 @@ Your organization can support various operating systems across a wide range of d This six-minute video demonstrates how users can bring in a new retail device and be up and working with their personalized settings and a managed experience in a few minutes, without being on the corporate network. It also demonstrates how IT can apply policies and configurations to ensure device compliance. - +> [!VIDEO https://www.youtube.com/embed/g1rIcBhhxpA] >[!NOTE] - >The video demonstrates the configuration process using the classic Azure portal, which will be retired January 08, 2018. Customers should use the new Azure portal. [Learn how use the new Azure portal to perform tasks that you used to do in the classic Azure portal.](https://docs.microsoft.com/information-protection/deploy-use/migrate-portal) + >The video demonstrates the configuration process using the classic Azure portal, which is retired. Customers should use the new Azure portal. [Learn how use the new Azure portal to perform tasks that you used to do in the classic Azure portal.](https://docs.microsoft.com/information-protection/deploy-use/migrate-portal) This topic offers guidance on strategies for deploying and managing Windows 10, including deploying Windows 10 in a mixed environment. The topic covers [management options](#reviewing-the-management-options-with-windows-10) plus the four stages of the device lifecycle: @@ -94,17 +94,14 @@ As you review the roles in your organization, you can use the following generali Your configuration requirements are defined by multiple factors, including the level of management needed, the devices and data managed, and your industry requirements. Meanwhile, employees are frequently concerned about IT applying strict policies to their personal devices, but they still want access to corporate email and documents. With Windows 10, you can create a consistent set of configurations across PCs, tablets, and phones through the common MDM layer. -**MDM**: [MDM](https://www.microsoft.com/en-us/cloud-platform/mobile-device-management) gives you a way to configure settings that achieve your administrative intent without exposing every possible setting. (In contrast, Group Policy exposes fine-grained settings that you control individually.) One benefit of MDM is that it enables you to apply broader privacy, security, and application management settings through lighter and more efficient tools. This makes MDM the best choice for devices that are constantly on the go. +**MDM**: [MDM](https://www.microsoft.com/en-us/cloud-platform/mobile-device-management) gives you a way to configure settings that achieve your administrative intent without exposing every possible setting. (In contrast, Group Policy exposes fine-grained settings that you control individually.) One benefit of MDM is that it enables you to apply broader privacy, security, and application management settings through lighter and more efficient tools. MDM also allows you to target Internet-connected devices to manage policies without using GP that requires on-premise domain joined devices. This makes MDM the best choice for devices that are constantly on the go. -**Group Policy** and **System Center Configuration Manager**: Your organization might still need to manage domain joined computers at a granular level such as Internet Explorer’s 1,500 configurable Group Policy settings, or very specific Windows Firewall rules. If so, Group Policy and System Center Configuration Manager continue to be excellent management choices: +**Group Policy** and **System Center Configuration Manager**: Your organization might still need to manage domain joined computers at a granular level such as Internet Explorer’s 1,500 configurable Group Policy settings. If so, Group Policy and System Center Configuration Manager continue to be excellent management choices: - Group Policy is the best way to granularly configure domain joined Windows PCs and tablets connected to the corporate network using Windows-based tools. Microsoft continues to add Group Policy settings with each new version of Windows. - Configuration Manager remains the recommended solution for granular configuration with robust software deployment, Windows updates, and OS deployment. -You can use the following generalized decision tree to review the management choices for devices in your organization: - - ## Updating and Servicing @@ -116,12 +113,24 @@ MDM with Intune provide tools for applying Windows updates to client computers i There are a variety of steps you can take to begin the process of modernizing device management in your organization: -- **Assess current management practices, and look for investments you might make today.** Which of your current practices need to stay the same, and which can you change? Specifically, what elements of traditional management do you need to retain and where can you modernize? Whether you take steps to minimize custom imaging, re-evaluate settings management, or reassesses authentication and compliance, the benefits can be immediate. +**Assess current management practices, and look for investments you might make today.** Which of your current practices need to stay the same, and which can you change? Specifically, what elements of traditional management do you need to retain and where can you modernize? Whether you take steps to minimize custom imaging, re-evaluate settings management, or reassesses authentication and compliance, the benefits can be immediate. You can use the [MDM Migration Analysis Tool (MMAT)](http://aka.ms/mmat) to help determine which Group Policies are set for a target user/computer and cross-reference them against the list of available MDM policies. -- **Assess the different use cases and management needs in your environment.** Are there groups of devices that could benefit from lighter, simplified management? BYOD devices, for example, are natural candidates for cloud-based management. Users or devices handling more highly regulated data might require an on-premises Active Directory domain for authentication. Configuration Manager and EMS provide you the flexibility to stage implementation of modern management scenarios while targeting different devices the way that best suits your business needs. +**Assess the different use cases and management needs in your environment.** Are there groups of devices that could benefit from lighter, simplified management? BYOD devices, for example, are natural candidates for cloud-based management. Users or devices handling more highly regulated data might require an on-premises Active Directory domain for authentication. Configuration Manager and EMS provide you the flexibility to stage implementation of modern management scenarios while targeting different devices the way that best suits your business needs. -- **Review the decision trees in this article.** With the different options in Windows 10, plus Configuration Manager and Enterprise Mobility + Security, you have the flexibility to handle imaging, authentication, settings, and management tools for any scenario. +**Review the decision trees in this article.** With the different options in Windows 10, plus Configuration Manager and Enterprise Mobility + Security, you have the flexibility to handle imaging, authentication, settings, and management tools for any scenario. -- **Take incremental steps.** Moving towards modern device management doesn’t have to be an overnight transformation. New operating systems and devices can be brought in while older ones remain. With this “managed diversity,” users can benefit from productivity enhancements on new Windows 10 devices, while you continue to maintain older devices according to your standards for security and manageability. +**Take incremental steps.** Moving towards modern device management doesn’t have to be an overnight transformation. New operating systems and devices can be brought in while older ones remain. With this “managed diversity,” users can benefit from productivity enhancements on new Windows 10 devices, while you continue to maintain older devices according to your standards for security and manageability. Starting with Windows 10, version 1803, the new policy [MDMWinsOverGP](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-controlpolicyconflict#controlpolicyconflict-mdmwinsovergp) was added to allow MDM policies to take precedence over GP when both GP and its equivalent MDM policies are set on the device. You can start implementing MDM policies while keeping your GP environment. Here is the list of MDM policies with equivalent GP - [Policies supported by GP](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-configuration-service-provider#policies-supported-by-gp) -- **Optimize your existing investments**. On the road from traditional on-premises management to modern cloud-based management, take advantage of the flexible, hybrid architecture of Configuration Manager and Intune. As additional capabilities become available in the cloud-identity/MDM model, Microsoft is committed to providing a clear path from traditional to modern management. + +**Optimize your existing investments**. On the road from traditional on-premises management to modern cloud-based management, take advantage of the flexible, hybrid architecture of Configuration Manager and Intune. Starting with Configuration Manager 1710, co-management enables you to concurrently manage Windows 10 devices by using both Configuration Manager and Intune. See these topics for details: + +- [Co-management for Windows 10 devices](https://docs.microsoft.com/en-us/sccm/core/clients/manage/co-management-overview) +- [Prepare Windows 10 devices for co-management](https://docs.microsoft.com/en-us/sccm/core/clients/manage/co-management-prepare) +- [Switch Configuration Manager workloads to Intune](https://docs.microsoft.com/en-us/sccm/core/clients/manage/co-management-switch-workloads) +- [Co-management dashboard in System Center Configuration Manager](https://docs.microsoft.com/en-us/sccm/core/clients/manage/co-management-dashboard) + +## Related topics + +- [What is Intune?](https://docs.microsoft.com/en-us/intune/introduction-intune) +- [Windows 10 Policy CSP](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-configuration-service-provider) +- [Windows 10 Configuration service Providers](https://docs.microsoft.com/en-us/windows/client-management/mdm/configuration-service-provider-reference) diff --git a/windows/client-management/mdm/TOC.md b/windows/client-management/mdm/TOC.md index b0b0610178..659b090224 100644 --- a/windows/client-management/mdm/TOC.md +++ b/windows/client-management/mdm/TOC.md @@ -70,6 +70,8 @@ ## [Configuration service provider reference](configuration-service-provider-reference.md) ### [AccountManagement CSP](accountmanagement-csp.md) #### [AccountManagement DDF file](accountmanagement-ddf.md) +### [Accounts CSP](accounts-csp.md) +#### [Accounts DDF file](accounts-ddf-file.md) ### [ActiveSync CSP](activesync-csp.md) #### [ActiveSync DDF file](activesync-ddf-file.md) ### [AllJoynManagement CSP](alljoynmanagement-csp.md) diff --git a/windows/client-management/mdm/accountmanagement-csp.md b/windows/client-management/mdm/accountmanagement-csp.md index f43068ab86..0575027aa8 100644 --- a/windows/client-management/mdm/accountmanagement-csp.md +++ b/windows/client-management/mdm/accountmanagement-csp.md @@ -11,8 +11,6 @@ ms.date: 03/23/2018 # AccountManagement CSP -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. AccountManagement CSP is used to configure setting in the Account Manager service in Windows Holographic for Business edition. Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/accountmanagement-ddf.md b/windows/client-management/mdm/accountmanagement-ddf.md index eddb5ce0ba..a7703a14e8 100644 --- a/windows/client-management/mdm/accountmanagement-ddf.md +++ b/windows/client-management/mdm/accountmanagement-ddf.md @@ -11,9 +11,6 @@ ms.date: 03/23/2018 # AccountManagement DDF file -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - This topic shows the OMA DM device description framework (DDF) for the **AccountManagement** configuration service provider. diff --git a/windows/client-management/mdm/accounts-csp.md b/windows/client-management/mdm/accounts-csp.md new file mode 100644 index 0000000000..a5bb5e5ab5 --- /dev/null +++ b/windows/client-management/mdm/accounts-csp.md @@ -0,0 +1,49 @@ +--- +title: Accounts CSP +description: The Accounts configuration service provider (CSP) is used by the enterprise (1) to rename a device, (2) to create a new local Windows account and joint it to a local user group. +ms.author: maricia +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: nickbrower +ms.date: 04/17/2018 +--- + +# Accounts CSP + + +The Accounts configuration service provider (CSP) is used by the enterprise (1) to rename a device, (2) to create a new local Windows account and joint it to a local user group. This CSP was added in Windows 10, version 1803. + + +The following diagram shows the Accounts configuration service provider in tree format. + + + +**./Device/Vendor/MSFT/Accounts** +Root node. + +**Domain** +Interior node for the account domain information. + +**Domain/ComputerName** +This node specifies the name for a device. This setting can be managed remotely. A couple of macros can be embedded within the value for dynamic substitution: %RAND:<# of digits>% and %SERIAL%. + +Examples: (a) "Test%RAND:6%" will generate a name "Test" followed by 6 random digits (e.g., "Test123456"). (b) "Foo%SERIAL%", will generate a name "Foo" followed by the serial number derived from device's ID. The server must explicitly reboot the device for this value to take effect. + +Supported operation is Add. + +**Users** +Interior node for the user account information. + +**Users/_UserName_** +This node specifies the username for a new local user account. This setting can be managed remotely. + +**Users/_UserName_/Password** +This node specifies the password for a new local user account. This setting can be managed remotely. + +Supported operation is Add. + +**Users/_UserName_/LocalUserGroup** +This optional node specifies the local user group that a local user account should be joined to. If the node is not set, the new local user account is joined just to the Standard Users group. Set the value to 2 for Administrators group. This setting can be managed remotely. + +Supported operation is Add. \ No newline at end of file diff --git a/windows/client-management/mdm/accounts-ddf-file.md b/windows/client-management/mdm/accounts-ddf-file.md new file mode 100644 index 0000000000..0153899c28 --- /dev/null +++ b/windows/client-management/mdm/accounts-ddf-file.md @@ -0,0 +1,177 @@ +--- +title: Accounts DDF file +description: XML file containing the device description framework +ms.author: maricia +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: nickbrower +ms.date: 04/17/2018 +--- + +# Accounts CSP + + +This topic shows the OMA DM device description framework (DDF) for the **Accounts** configuration service provider. + +The XML below is for Windows 10, version 1803. + +``` syntax + +]> +
Here is a sample certutil invocation:
``` -certutil -encode WinSiPolicy.p7b WinSiPolicy.txt +certutil -encode WinSiPolicy.p7b WinSiPolicy.cer ``` -Use only the data enclosed in the BEGIN CERTIFIFCATE and END CERTIFICATE section. Ensure that you have removed all line breaks before passing the data to the CSP node.
An alternative to using certutil would be to use the following PowerShell invocation:
``` [Convert]::ToBase64String($(Get-Content -Encoding Byte -ReadCount 0 -PathIf you are using Hybrid MDM management with System Center Configuration Manager please ensure that you are using Base64 as the Data type when using Custom OMA-URI functionality to apply the Code Integrity policy.
+If you are using hybrid MDM management with System Center Configuration Manager or using Intune, ensure that you are using Base64 as the Data type when using Custom OMA-URI functionality to apply the Code Integrity policy.
Data type is string. Supported operations are Get, Add, Delete, and Replace.
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
 |
+  4 |
+ |
+ 4 |
+ 4 |
+ |
+ |
+
Added in Windows 10, version 1703. Used to remove packages. +
Added in Windows 10, version 1703. Used to remove packages. Not supported for ./User/Vendor/MSFT.
Parameters:
-
@@ -121,34 +118,18 @@ The following image shows the EnterpriseModernAppManagement configuration servic
- Name: Specifies the PackageFullName of the particular package to remove.
- RemoveForAllUsers:
-
-
- 0 (default) – Package will be un-provisioned so that new users do not receive the package. The package will remain installed for current users. -
- 1 – Package will be removed for all users. +
- 0 (default) – Package will be un-provisioned so that new users do not receive the package. The package will remain installed for current users. This is not currently supported. +
- 1 – Package will be removed for all users only if it is a provisioned package.
Supported operation is Execute. -
The following example removes a package for the specified user:
-
-```XML
-
The following example removes a package for all users: ````XML @@ -307,7 +288,12 @@ The following image shows the EnterpriseModernAppManagement configuration servic
Supported operation is Get. **.../*PackageFamilyName*/*PackageFullName*/Users** -
Required. Registered users of the app. If the query is at the device level, it returns all the registered users of the device. If you query the user context, it will only return the current user. Value type is string. +
Required. Registered users of the app and the package install state. If the query is at the device level, it returns all the registered users of the device. If you query the user context, it will only return the current user. Value type is string. + +- Not Installed = 0 +- Staged = 1 +- Installed = 2 +- Paused = 6
Supported operation is Get. diff --git a/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md b/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md index 7c3c1c855b..12cb46b485 100644 --- a/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md +++ b/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md @@ -13,9 +13,6 @@ ms.date: 03/01/2018 # EnterpriseModernAppManagement DDF -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - This topic shows the OMA DM device description framework (DDF) for the **EnterpriseModernAppManagement** configuration service provider. DDF files are used only with OMA DM provisioning XML. Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download). diff --git a/windows/client-management/mdm/images/provisioning-csp-accounts.png b/windows/client-management/mdm/images/provisioning-csp-accounts.png new file mode 100644 index 0000000000..ceb90aff58 Binary files /dev/null and b/windows/client-management/mdm/images/provisioning-csp-accounts.png differ diff --git a/windows/client-management/mdm/images/provisioning-csp-networkproxy.png b/windows/client-management/mdm/images/provisioning-csp-networkproxy.png index e46232fa42..23671d20f1 100644 Binary files a/windows/client-management/mdm/images/provisioning-csp-networkproxy.png and b/windows/client-management/mdm/images/provisioning-csp-networkproxy.png differ diff --git a/windows/client-management/mdm/images/provisioning-csp-vpn.png b/windows/client-management/mdm/images/provisioning-csp-vpn.png index 15e907a16c..f46b884641 100644 Binary files a/windows/client-management/mdm/images/provisioning-csp-vpn.png and b/windows/client-management/mdm/images/provisioning-csp-vpn.png differ diff --git a/windows/client-management/mdm/images/provisioning-csp-wifi.png b/windows/client-management/mdm/images/provisioning-csp-wifi.png index c3f21cb31d..463a784f95 100644 Binary files a/windows/client-management/mdm/images/provisioning-csp-wifi.png and b/windows/client-management/mdm/images/provisioning-csp-wifi.png differ diff --git a/windows/client-management/mdm/images/provisioning-csp-windowsdefenderapplicationguard.png b/windows/client-management/mdm/images/provisioning-csp-windowsdefenderapplicationguard.png index 8e18128149..c8f2721143 100644 Binary files a/windows/client-management/mdm/images/provisioning-csp-windowsdefenderapplicationguard.png and b/windows/client-management/mdm/images/provisioning-csp-windowsdefenderapplicationguard.png differ diff --git a/windows/client-management/mdm/mdm-enrollment-of-windows-devices.md b/windows/client-management/mdm/mdm-enrollment-of-windows-devices.md index 4fe82b932b..72566a2607 100644 --- a/windows/client-management/mdm/mdm-enrollment-of-windows-devices.md +++ b/windows/client-management/mdm/mdm-enrollment-of-windows-devices.md @@ -110,7 +110,7 @@ All Windows devices can be connected to an Azure AD domain. These devices can be 3. Type in your Azure AD username. This is the email address you use to log into Microsoft Office 365 and similar services. - If the tenant is a cloud-only tenant, this page will change to show the organization's custom branding, and you will be able to enter your password directly on this page. If the tenant is part of a federated domain, you will be redirected to the organization's on-premises federation server, such as Active Directory Federation Services (AD FS) for authentication. + If the tenant is a cloud-only, password hash sync, or pass-through authentication tenant, this page will change to show the organization's custom branding, and you will be able to enter your password directly on this page. If the tenant is part of a federated domain, you will be redirected to the organization's on-premises federation server, such as Active Directory Federation Services (AD FS) for authentication. Based on IT policy, you may also be prompted to provide a second factor of authentication at this point. If your Azure AD tenant has auto-enrollment configured, your device will also be enrolled into MDM during this flow. For more information, see [these steps](azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md). If your tenant is not configured for auto-enrollment, you will have to go through the enrollment flow a second time to connect your device to MDM. After you complete the flow, your device will be connected to your organization’s Azure AD domain. @@ -142,7 +142,7 @@ All Windows devices can be connected to an Azure AD domain. These devices can be  -7. If the tenant is a cloud only tenant, this page will change to show the organization's custom branding, and you will be able to enter your password directly on this page. If the tenant is part of a federated domain, you will be redirected to the organization's on-premises federation server, such as AD FS, for authentication. +7. If the tenant is a cloud only, password hash sync, or pass-through authentication tenant, this page will change to show the organization's custom branding, and you will be able to enter your password directly on this page. If the tenant is part of a federated domain, you will be redirected to the organization's on-premises federation server, such as AD FS, for authentication. Based on IT policy, you may also be prompted to provide a second factor of authentication at this point. @@ -194,7 +194,7 @@ All Windows 10-based devices can be connected to a work or school account. You  -5. If the tenant is a cloud only tenant, this page will change to show the organization's custom branding, and you will be able to enter your password directly into the page. If the tenant is part of a federated domain, you will be redirected to the organization's on-premises federation server, such as AD FS, for authentication. +5. If the tenant is a cloud only, password hash sync, or pass-through authentication tenant, this page will change to show the organization's custom branding, and you will be able to enter your password directly into the page. If the tenant is part of a federated domain, you will be redirected to the organization's on-premises federation server, such as AD FS, for authentication. Based on IT policy, you may also be prompted to provide a second factor of authentication at this point. diff --git a/windows/client-management/mdm/multisim-csp.md b/windows/client-management/mdm/multisim-csp.md index 5453323c70..3b07d6a98c 100644 --- a/windows/client-management/mdm/multisim-csp.md +++ b/windows/client-management/mdm/multisim-csp.md @@ -11,8 +11,6 @@ ms.date: 03/22/2018 # MultiSIM CSP -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. The MultiSIM configuration service provider (CSP) is used by the enterprise to manage devices with dual SIM single active configuration. An enterprise can set policies on whether that user can switch between SIM slots, specify which slot is the default, and whether the slot is embedded. This CSP was added in Windows 10, version 1803. @@ -24,49 +22,49 @@ The following diagram shows the MultiSIM configuration service provider in tree **./Device/Vendor/MSFT/MultiSIM** Root node. -**_ModemID_** +**_ModemID_** Node representing a Mobile Broadband Modem. The node name is the modem ID. Modem ID is a GUID without curly braces, with exception of "Embedded" which represents the embedded modem. -**_ModemID_/Identifier** +**_ModemID_/Identifier** Modem ID. Supported operation is Get. Value type is string. -**_ModemID_/IsEmbedded** +**_ModemID_/IsEmbedded** Indicates whether this modem is embedded or external. Supported operation is Get. Value type is bool. -**_ModemID_/Slots** +**_ModemID_/Slots** Represents all SIM slots in the Modem. -**_ModemID_/Slots/_SlotID_** +**_ModemID_/Slots/_SlotID_** Node representing a SIM Slot. The node name is the Slot ID. SIM Slot ID format is "0", "1", etc., with exception of "Embedded" which represents the embedded Slot. -**_ModemID_/Slots/_SlotID_/Identifier** +**_ModemID_/Slots/_SlotID_/Identifier** Slot ID. Supported operation is Get. Value type is integer. -**_ModemID_/Slots/_SlotID_/IsEmbedded** +**_ModemID_/Slots/_SlotID_/IsEmbedded** Indicates whether this Slot is embedded or a physical SIM slot. Supported operation is Get. Value type is bool. -**_ModemID_/Slots/_SlotID_/IsSelected** +**_ModemID_/Slots/_SlotID_/IsSelected** Indicates whether this Slot is selected or not. Supported operation is Get and Replace. Value type is bool. -**_ModemID_/Slots/_SlotID_/State** +**_ModemID_/Slots/_SlotID_/State** Slot state (Unknown = 0, OffEmpty = 1, Off = 2, Empty = 3, NotReady = 4, Active = 5, Error = 6, ActiveEsim = 7, ActiveEsimNoProfile = 8) Supported operation is Get. Value type is integer. -**_ModemID_/Policies** +**_ModemID_/Policies** Policies associated with the Modem. -**_ModemID_/Policies/SlotSelectionEnabled** +**_ModemID_/Policies/SlotSelectionEnabled** Determines whether the user is allowed to change slots in the Cellular settings UI. Default is true. Supported operation is Get and Replace. Value type is bool. diff --git a/windows/client-management/mdm/multisim-ddf.md b/windows/client-management/mdm/multisim-ddf.md index ccdbecbaee..b75b123630 100644 --- a/windows/client-management/mdm/multisim-ddf.md +++ b/windows/client-management/mdm/multisim-ddf.md @@ -11,8 +11,6 @@ ms.date: 02/27/2018 # MultiSIM CSP -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. This topic shows the OMA DM device description framework (DDF) for the **MultiSIM** configuration service provider. diff --git a/windows/client-management/mdm/networkproxy-csp.md b/windows/client-management/mdm/networkproxy-csp.md index 74bed4f1aa..6348228427 100644 --- a/windows/client-management/mdm/networkproxy-csp.md +++ b/windows/client-management/mdm/networkproxy-csp.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 06/26/2017 +ms.date: 04/12/2018 --- # NetworkProxy CSP @@ -31,38 +31,41 @@ The following diagram shows the NetworkProxy configuration service provider in t  **./Vendor/MSFT/NetworkProxy** -
The root node for the NetworkProxy configuration service provider..
+The root node for the NetworkProxy configuration service provider.. + +**ProxySettingsPerUser** +Added in Windows 10, version 1803. When set to 0, it enables proxy configuration as global, machine wide; set to 1 for proxy configuratio per user. **AutoDetect** -Automatically detect settings. If enabled, the system tries to find the path to a PAC script.
-Valid values:
+Automatically detect settings. If enabled, the system tries to find the path to a PAC script. +Valid values:- 0 - Disabled
- 1 (default) - Enabled
The data type is int. Supported operations are Get and Replace.
+The data type is int. Supported operations are Get and Replace. **SetupScriptUrl** -Address to the PAC script you want to use.
-The data type is string. Supported operations are Get and Replace.
+Address to the PAC script you want to use. +The data type is string. Supported operations are Get and Replace. **ProxyServer** -Node for configuring a static proxy for Ethernet and Wi-Fi connections. The same proxy server is used for all protocols - including HTTP, HTTPS, FTP, and SOCKS. These settings do not apply to VPN connections.
-Supported operation is Get.
+Node for configuring a static proxy for Ethernet and Wi-Fi connections. The same proxy server is used for all protocols - including HTTP, HTTPS, FTP, and SOCKS. These settings do not apply to VPN connections. +Supported operation is Get. **ProxyAddress** -Address to the proxy server. Specify an address in the format <server>[“:”<port>].
-The data type is string. Supported operations are Get and Replace.
+Address to the proxy server. Specify an address in the format <server>[“:”<port>]. +The data type is string. Supported operations are Get and Replace. **Exceptions** -Addresses that should not use the proxy server. The system will not use the proxy server for addresses beginning with what is specified in this node. Use semicolons (;) to separate entries.
-The data type is string. Supported operations are Get and Replace.
+Addresses that should not use the proxy server. The system will not use the proxy server for addresses beginning with what is specified in this node. Use semicolons (;) to separate entries. +The data type is string. Supported operations are Get and Replace. **UseProxyForLocalAddresses** -Specifies whether the proxy server should be used for local (intranet) addresses.
-Valid values:
+Specifies whether the proxy server should be used for local (intranet) addresses. +Valid values:- 0 (default) - Do not use proxy server for local addresses
- 1 - Use proxy server for local addresses
The data type is int. Supported operations are Get and Replace.
+The data type is int. Supported operations are Get and Replace. diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index 80b89c5326..e8314d26e5 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -10,16 +10,12 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/23/2018 +ms.date: 04/26/2018 --- # What's new in MDM enrollment and management -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - - This topic provides information about what's new and breaking changes in Windows 10 mobile device management (MDM) enrollment and management experience across all Windows 10 devices. For details about Microsoft mobile device management protocols for Windows 10 see [\[MS-MDM\]: Mobile Device Management Protocol](http://go.microsoft.com/fwlink/p/?LinkId=619346) and [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2]( http://go.microsoft.com/fwlink/p/?LinkId=619347). @@ -1149,6 +1145,7 @@ For details about Microsoft mobile device management protocols for Windows 10 sUpdated the AssigneAccessConfiguration schema.
+Updated the AssigneAccessConfiguration schema. Starting in Windows 10, version 1803 AssignedAccess CSP is supported in Windows Holographic for Business edition. Added example for Windows Holographic for Business edition.
Added a new CSP in Windows 10, version 1803.
-======= +Added the following node in Windows 10, version 1803:
- UntrustedCertificates
Added the following node in Windows 10, version 1803:
+-
+
- ProxySettingsPerUser +
Added a new CSP in Windows 10, version 1803.
+Updated version available. MMAT is a tool you can use to determine which Group Policies are set on a target user/computer and cross-reference them against the list of supported MDM policies.
+Added the DDF download of Windows 10, version 1803 configuration service providers.
| New or updated topic | +Description | +
|---|---|
| [WindowsDefenderApplicationGuard CSP](windowsdefenderapplicationguard-csp.md) | +Added the following node in Windows 10, version 1803: +
|
| [NetworkProxy CSP](\networkproxy--csp.md) | +Added the following node in Windows 10, version 1803: +
|
| [Accounts CSP](accounts-csp.md) | +Added a new CSP in Windows 10, version 1803. + |
| [MDM Migration Analysis Too (MMAT)](http://aka.ms/mmat) | +Updated version available. MMAT is a tool you can use to determine which Group Policies are set on a target user/computer and cross-reference them against the list of supported MDM policies. + |
| [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download) | +Added the DDF download of Windows 10, version 1803 configuration service providers. + |
| [Policy CSP](policy-configuration-service-provider.md) | +Added the following new policies for Windows 10, version 1803: +
|
| [MultiSIM CSP](multisim-csp.md) | @@ -1797,7 +1880,6 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ |
+ |
+ |
+ |
+ |
+
@@ -28,6 +27,9 @@ ms.date: 03/12/2018
+ +**Bluetooth/AllowPromptedProximalConnections** + + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ 4 |
+ 4 |
+ 4 |
+ |
+ |
+ |
+
+ + + +Added in Windows 10, version 1803. This policy allows the IT admin to block users on these managed devices from using Quick Pair and other proximity based scenarios. + + + +The following list shows the supported values: + +- 0 - Disallow. Block users on these managed devices from using Quick Pair and other proximity based scenarios +- 1 - Allow. Allow users on these managed devices to use Quick Pair and other proximity based scenarios + + + + + + + + + + +
+ **Bluetooth/LocalDeviceName** diff --git a/windows/client-management/mdm/policy-csp-browser.md b/windows/client-management/mdm/policy-csp-browser.md index 79d91ff2dc..ab3d44948e 100644 --- a/windows/client-management/mdm/policy-csp-browser.md +++ b/windows/client-management/mdm/policy-csp-browser.md @@ -6,14 +6,11 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/13/2018 +ms.date: 04/16/2018 --- # Policy CSP - Browser -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -
@@ -445,8 +442,9 @@ ADMX Info: The following list shows the supported values: -- 0 – Not allowed. -- 1 (default) – Allowed. +- 0 – Block all cookies +- 1 – Block only third party cookies +- 2 - Allow cookies @@ -2190,10 +2188,17 @@ The following list shows the supported values: -Added in Windows 10, version 1803. This is only a placeholder. Do not use in production code. +Added in Windows 10, version 1803. This is only a placeholder. Do not use in production code. + +ADMX Info: +- GP English name: *Prevent Microsoft Edge from starting and loading the Start and New Tab page at Windows startup and each time Microsoft Edge is closed* +- GP name: *PreventTabPreloading* +- GP path: *Windows Components/Microsoft Edge* +- GP ADMX file name: *MicrosoftEdge.admx* + The following list shows the supported values: diff --git a/windows/client-management/mdm/policy-csp-cellular.md b/windows/client-management/mdm/policy-csp-cellular.md index 431c59baa4..9c86945186 100644 --- a/windows/client-management/mdm/policy-csp-cellular.md +++ b/windows/client-management/mdm/policy-csp-cellular.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/12/2018 +ms.date: 04/16/2018 --- # Policy CSP - Cellular @@ -92,8 +92,10 @@ If an app is open when this Group Policy object is applied on a device, employee ADMX Info: +- GP English name: *Let Windows apps access cellular data* - GP name: *LetAppsAccessCellularData* - GP element: *LetAppsAccessCellularData_Enum* +- GP path: *Network/WWAN Service/Cellular Data Access* - GP ADMX file name: *wwansvc.admx* @@ -150,8 +152,10 @@ Added in Windows 10, version 1709. List of semi-colon delimited Package Family N ADMX Info: +- GP English name: *Let Windows apps access cellular data* - GP name: *LetAppsAccessCellularData* - GP element: *LetAppsAccessCellularData_ForceAllowTheseApps_List* +- GP path: *Network/WWAN Service/Cellular Data Access* - GP ADMX file name: *wwansvc.admx* @@ -200,8 +204,10 @@ Added in Windows 10, version 1709. List of semi-colon delimited Package Family N ADMX Info: +- GP English name: *Let Windows apps access cellular data* - GP name: *LetAppsAccessCellularData* - GP element: *LetAppsAccessCellularData_ForceDenyTheseApps_List* +- GP path: *Network/WWAN Service/Cellular Data Access* - GP ADMX file name: *wwansvc.admx* @@ -250,8 +256,10 @@ Added in Windows 10, version 1709. List of semi-colon delimited Package Family N ADMX Info: +- GP English name: *Let Windows apps access cellular data* - GP name: *LetAppsAccessCellularData* - GP element: *LetAppsAccessCellularData_UserInControlOfTheseApps_List* +- GP path: *Network/WWAN Service/Cellular Data Access* - GP ADMX file name: *wwansvc.admx* diff --git a/windows/client-management/mdm/policy-csp-connectivity.md b/windows/client-management/mdm/policy-csp-connectivity.md index e07d5f9e02..bfd371ead5 100644 --- a/windows/client-management/mdm/policy-csp-connectivity.md +++ b/windows/client-management/mdm/policy-csp-connectivity.md @@ -11,9 +11,6 @@ ms.date: 03/14/2018 # Policy CSP - Connectivity -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -
diff --git a/windows/client-management/mdm/policy-csp-controlpolicyconflict.md b/windows/client-management/mdm/policy-csp-controlpolicyconflict.md index b606419501..b777062185 100644 --- a/windows/client-management/mdm/policy-csp-controlpolicyconflict.md +++ b/windows/client-management/mdm/policy-csp-controlpolicyconflict.md @@ -11,9 +11,6 @@ ms.date: 03/12/2018 # Policy CSP - ControlPolicyConflict -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -
@@ -65,15 +62,35 @@ ms.date: 03/12/2018 -Added in Windows 10, version 1803. This policy allows the IT admin to control which policy will be used whenever both the MDM policy and its equivalent Group Policy are set on the device. +Added in Windows 10, version 1803. This policy allows the IT admin to control which policy will be used whenever both the MDM policy and its equivalent Group Policy (GP) are set on the device. + +> [!Note] +> MDMWinsOverGP only applies to policies in Policy CSP. It does not apply to other MDM settings with equivalent GP settings that are defined on other configuration service providers. This policy is used to ensure that MDM policy wins over GP when same setting is set by both GP and MDM channel. This policy doesn’t support Delete command. This policy doesn’t support setting the value to be 0 again after it was previously set 1. The default value is 0. The MDM policies in Policy CSP will behave as described if this policy value is set 1. +The following list shows the supported values: + +- 0 (default) +- 1 - The MDM policy is used and the GP policy is blocked. + The policy should be set at every sync to ensure the device removes any settings that conflict with MDM just as it does on the very first set of the policy. This ensures that: -- GP settings that correspond to MDM applied settings are not conflicting -- The current Policy Manager policies are refreshed from what MDM has set -- Any values set by scripts/user outside of GP that conflict with MDM are removed +- GP settings that correspond to MDM applied settings are not conflicting +- The current Policy Manager policies are refreshed from what MDM has set +- Any values set by scripts/user outside of GP that conflict with MDM are removed + +The [Policy DDF](policy-ddf-file.md) contains the following tags to identify the policies with equivalent GP: + +- \
@@ -32,6 +29,29 @@ ms.date: 03/12/2018 **CredentialsDelegation/RemoteHostAllowsDelegationOfNonExportableCredentials** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ |
+ |
+ |
+ |
+ |
+
33333333@@ -509,7 +506,7 @@ If you set this policy, the GroupID policy will be ignored. The options set in this policy only apply to Group (2) download mode. If Group (2) isn't set as Download mode, this policy will be ignored. -For option 4 - DHCP Option ID, the client will query DHCP Option ID 234 and use the returned GUID value as the Group ID. +For option 3 - DHCP Option ID, the client will query DHCP Option ID 234 and use the returned GUID value as the Group ID. @@ -1219,8 +1216,10 @@ Note that downloads from LAN peers will not be throttled even when this policy i ADMX Info: +- GP English name: *Maximum Background Download Bandwidth (percentage)* - GP name: *PercentageMaxBackgroundBandwidth* - GP element: *PercentageMaxBackgroundBandwidth* +- GP path: *Windows Components/Delivery Optimization* - GP ADMX file name: *DeliveryOptimization.admx* @@ -1231,6 +1230,15 @@ ADMX Info: **DeliveryOptimization/DOPercentageMaxDownloadBandwidth** + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + This policy is deprecated. Use [DOPercentageMaxForegroundBandwidth](#deliveryoptimization-dopercentagemaxforegroundbandwidth) and [DOPercentageMaxBackgroundBandwidth](#deliveryoptimization-dopercentagemaxbackgroundbandwidth) policies instead. @@ -1282,8 +1290,10 @@ Note that downloads from LAN peers will not be throttled even when this policy i ADMX Info: +- GP English name: *Maximum Foreground Download Bandwidth (percentage)* - GP name: *PercentageMaxForegroundBandwidth* - GP element: *PercentageMaxForegroundBandwidth* +- GP path: *Windows Components/Delivery Optimization* - GP ADMX file name: *DeliveryOptimization.admx* @@ -1388,7 +1398,7 @@ The following list shows the supported values: -Added in Windows 10, version 1803. Specifies the maximum background download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth. +Added in Windows 10, version 1803. Specifies the maximum background download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth. > [!TIP] @@ -1454,7 +1464,7 @@ This policy allows an IT Admin to define the following: -Added in Windows 10, version 1803. Specifies the maximum foreground download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth. +Added in Windows 10, version 1803. Specifies the maximum foreground download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth. > [!TIP] diff --git a/windows/client-management/mdm/policy-csp-devicelock.md b/windows/client-management/mdm/policy-csp-devicelock.md index 1a791a7b71..98974c6cb0 100644 --- a/windows/client-management/mdm/policy-csp-devicelock.md +++ b/windows/client-management/mdm/policy-csp-devicelock.md @@ -6,14 +6,11 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/12/2018 +ms.date: 04/16/2018 --- # Policy CSP - DeviceLock -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -
@@ -547,7 +544,7 @@ The following list shows the supported values:
111| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ |
+ |
+ |
+ |
+ |
+
diff --git a/windows/client-management/mdm/policy-csp-eventlogservice.md b/windows/client-management/mdm/policy-csp-eventlogservice.md index 835be83eb0..6c9a23cd61 100644 --- a/windows/client-management/mdm/policy-csp-eventlogservice.md +++ b/windows/client-management/mdm/policy-csp-eventlogservice.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/12/2018 +ms.date: 04/16/2018 --- # Policy CSP - EventLogService diff --git a/windows/client-management/mdm/policy-csp-experience.md b/windows/client-management/mdm/policy-csp-experience.md index 3f96460055..528d2b70fb 100644 --- a/windows/client-management/mdm/policy-csp-experience.md +++ b/windows/client-management/mdm/policy-csp-experience.md @@ -6,14 +6,11 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/12/2018 +ms.date: 04/16/2018 --- # Policy CSP - Experience -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -
@@ -359,7 +356,7 @@ The following list shows the supported values: -Specifies whether to allow the user to delete the workplace account using the workplace control panel. If the device is Azure Active Directory joined and MDM enrolled (e.g. auto-enrolled), which is majority of the case for Intune, then disabling the MDM unenrollment has no effect. +Specifies whether to allow the user to delete the workplace account using the workplace control panel. If the device is Azure Active Directory joined and MDM enrolled (e.g. auto-enrolled), then disabling the MDM unenrollment has no effect. > [!NOTE] > The MDM server can always remotely delete the account. @@ -436,6 +433,15 @@ The following list shows the supported values: **Experience/AllowSaveAsOfOfficeFiles** + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + This policy is deprecated. @@ -503,6 +509,15 @@ The following list shows the supported values: **Experience/AllowSharingOfOfficeFiles** + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + This policy is deprecated. @@ -1027,7 +1042,7 @@ The following list shows the supported values: -Added in Windows 10, version 1083. This policy allows IT admins to turn off Suggestions in Settings app. These suggestions from Microsoft may show after each OS clean install, upgrade or an on-going basis to help users discover apps/features on Windows or across devices, to make thier experience productive. +Added in Windows 10, version 1803. This policy allows IT admins to turn off Suggestions in Settings app. These suggestions from Microsoft may show after each OS clean install, upgrade or an on-going basis to help users discover apps/features on Windows or across devices, to make thier experience productive. - User setting is under Settings -> Privacy -> General -> Show me suggested content in Settings app. - User Setting is changeable on a per user basis. diff --git a/windows/client-management/mdm/policy-csp-fileexplorer.md b/windows/client-management/mdm/policy-csp-fileexplorer.md index 9216df0e67..91fe973551 100644 --- a/windows/client-management/mdm/policy-csp-fileexplorer.md +++ b/windows/client-management/mdm/policy-csp-fileexplorer.md @@ -6,14 +6,11 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/12/2018 +ms.date: 04/16/2018 --- # Policy CSP - FileExplorer -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -
@@ -35,6 +32,29 @@ ms.date: 03/12/2018 **FileExplorer/TurnOffDataExecutionPreventionForExplorer** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ |
+ |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ |
+ |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ |
+ |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ |
+ |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ |
+ |
+ |
+ |
+ |
+
@@ -30,6 +30,9 @@ ms.date: 03/12/2018
@@ -83,6 +85,9 @@ ms.date: 03/12/2018 Added in Windows 10, version 1803. List of exceptions to the blocked website URLs (with wildcard support). This is used to configure URLs kiosk browsers are allowed to navigate to, which are a subset of the blocked URLs. +> [!Note] +> This policy only applies to the Kiosk Browser app in Microsoft Store. + @@ -118,7 +123,6 @@ Added in Windows 10, version 1803. List of exceptions to the blocked website URL [Scope](./policy-configuration-service-provider.md#policy-scope): > [!div class = "checklist"] -> * User > * Device
@@ -127,6 +131,9 @@ Added in Windows 10, version 1803. List of exceptions to the blocked website URL Added in Windows 10, version 1803. List of blocked website URLs (with wildcard support). This is used to configure blocked URLs kiosk browsers cannot navigate to. +> [!Note] +> This policy only applies to the Kiosk Browser app in Microsoft Store. + @@ -162,7 +169,6 @@ Added in Windows 10, version 1803. List of blocked website URLs (with wildcard s [Scope](./policy-configuration-service-provider.md#policy-scope): > [!div class = "checklist"] -> * User > * Device
@@ -171,11 +177,66 @@ Added in Windows 10, version 1803. List of blocked website URLs (with wildcard s Added in Windows 10, version 1803. Configures the default URL kiosk browsers to navigate on launch and restart. +> [!Note] +> This policy only applies to the Kiosk Browser app in Microsoft Store. +
+ +**KioskBrowser/EnableEndSessionButton** + + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ 4 |
+ 4 |
+ 4 |
+ 4 |
+ |
+ |
+
+ + + +Shows the Kiosk Browser's end session button. When the policy is enabled, the Kiosk Browser app shows a button to reset the browser. When the user clicks on the button, the app will prompt the user for confirmation to end the session. When the user confirms, the Kiosk broswser will clear all browsing data (cache, cookies, etc.) and navigate back to the default URL. + + + + + + + + + + + + + +
+ **KioskBrowser/EnableHomeButton** @@ -206,7 +267,6 @@ Added in Windows 10, version 1803. Configures the default URL kiosk browsers to [Scope](./policy-configuration-service-provider.md#policy-scope): > [!div class = "checklist"] -> * User > * Device
@@ -215,6 +275,9 @@ Added in Windows 10, version 1803. Configures the default URL kiosk browsers to Added in Windows 10, version 1803. Enable/disable kiosk browser's home button. +> [!Note] +> This policy only applies to the Kiosk Browser app in Microsoft Store. + @@ -250,7 +313,6 @@ Added in Windows 10, version 1803. Enable/disable kiosk browser's home button. [Scope](./policy-configuration-service-provider.md#policy-scope): > [!div class = "checklist"] -> * User > * Device
@@ -259,6 +321,9 @@ Added in Windows 10, version 1803. Enable/disable kiosk browser's home button. Added in Windows 10, version 1803. Enable/disable kiosk browser's navigation buttons (forward/back). +> [!Note] +> This policy only applies to the Kiosk Browser app in Microsoft Store. + @@ -294,7 +359,6 @@ Added in Windows 10, version 1803. Enable/disable kiosk browser's navigation but [Scope](./policy-configuration-service-provider.md#policy-scope): > [!div class = "checklist"] -> * User > * Device
@@ -305,6 +369,9 @@ Added in Windows 10, version 1803. Amount of time in minutes the session is idle The value is an int 1-1440 that specifies the amount of minutes the session is idle until the kiosk browser restarts in a fresh state. The default value is empty which means there is no idle timeout within the kiosk browser. +> [!Note] +> This policy only applies to the Kiosk Browser app in Microsoft Store. +
diff --git a/windows/client-management/mdm/policy-csp-lanmanworkstation.md b/windows/client-management/mdm/policy-csp-lanmanworkstation.md index 5c860249fc..13e2299224 100644 --- a/windows/client-management/mdm/policy-csp-lanmanworkstation.md +++ b/windows/client-management/mdm/policy-csp-lanmanworkstation.md @@ -6,14 +6,11 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/16/2018 +ms.date: 04/16/2018 --- # Policy CSP - LanmanWorkstation -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -
@@ -78,20 +75,14 @@ Insecure guest logons are used by file servers to allow unauthenticated access t ADMX Info: - GP English name: *Enable insecure guest logons* - GP name: *Pol_EnableInsecureGuestLogons* +- GP path: *Network/Lanman Workstation* - GP ADMX file name: *LanmanWorkstation.admx* This setting supports a range of values between 0 and 1. - - - - - - -
diff --git a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md index 327397bc54..1daf3d8ae0 100644 --- a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md +++ b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md @@ -6,14 +6,11 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/16/2018 +ms.date: 04/06/2018 --- # Policy CSP - LocalPoliciesSecurityOptions -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -
@@ -51,6 +48,15 @@ ms.date: 03/16/2018
+ +**LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways** + + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ 4 |
+ 4 |
+ 4 |
+ 4 |
+ |
+ |
+
+ + + +Domain member: Digitally encrypt or sign secure channel data (always) + +This security setting determines whether all secure channel traffic initiated by the domain member must be signed or encrypted. + +When a computer joins a domain, a computer account is created. After that, when the system starts, it uses the computer account password to create a secure channel with a domain controller for its domain. This secure channel is used to perform operations such as NTLM pass through authentication, LSA SID/name Lookup etc. + +This setting determines whether or not all secure channel traffic initiated by the domain member meets minimum security requirements. Specifically it determines whether all secure channel traffic initiated by the domain member must be signed or encrypted. If this policy is enabled, then the secure channel will not be established unless either signing or encryption of all secure channel traffic is negotiated. If this policy is disabled, then encryption and signing of all secure channel traffic is negotiated with the Domain Controller in which case the level of signing and encryption depends on the version of the Domain Controller and the settings of the following two policies: + +Domain member: Digitally encrypt secure channel data (when possible) +Domain member: Digitally sign secure channel data (when possible) + +Default: Enabled. + +Notes: + +If this policy is enabled, the policy Domain member: Digitally sign secure channel data (when possible) is assumed to be enabled regardless of its current setting. This ensures that the domain member attempts to negotiate at least signing of the secure channel traffic. +If this policy is enabled, the policy Domain member: Digitally sign secure channel data (when possible) is assumed to be enabled regardless of its current setting. This ensures that the domain member attempts to negotiate at least signing of the secure channel traffic. +Logon information transmitted over the secure channel is always encrypted regardless of whether encryption of ALL other secure channel traffic is negotiated or not. + + + +GP Info: +- GP English name: *Domain member: Digitally encrypt or sign secure channel data (always)* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + + + + + + + + + + + + + +
+ + +**LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptSecureChannelDataWhenPossible** + + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ 4 |
+ 4 |
+ 4 |
+ 4 |
+ |
+ |
+
+ + + +Domain member: Digitally encrypt secure channel data (when possible) + +This security setting determines whether a domain member attempts to negotiate encryption for all secure channel traffic that it initiates. + +When a computer joins a domain, a computer account is created. After that, when the system starts, it uses the computer account password to create a secure channel with a domain controller for its domain. This secure channel is used to perform operations such as NTLM pass-through authentication, LSA SID/name Lookup etc. + +This setting determines whether or not the domain member attempts to negotiate encryption for all secure channel traffic that it initiates. If enabled, the domain member will request encryption of all secure channel traffic. If the domain controller supports encryption of all secure channel traffic, then all secure channel traffic will be encrypted. Otherwise only logon information transmitted over the secure channel will be encrypted. If this setting is disabled, then the domain member will not attempt to negotiate secure channel encryption. + +Default: Enabled. + +Important + +There is no known reason for disabling this setting. Besides unnecessarily reducing the potential confidentiality level of the secure channel, disabling this setting may unnecessarily reduce secure channel throughput, because concurrent API calls that use the secure channel are only possible when the secure channel is signed or encrypted. + +Note: Domain controllers are also domain members and establish secure channels with other domain controllers in the same domain as well as domain controllers in trusted domains. + + + +GP Info: +- GP English name: *Domain member: Digitally encrypt secure channel data (when possible)* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + + + + + + + + + + + + + +
+ + +**LocalPoliciesSecurityOptions/DomainMember_DisableMachineAccountPasswordChanges** + + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ 4 |
+ 4 |
+ 4 |
+ 4 |
+ |
+ |
+
+ + + +Domain member: Disable machine account password changes + +Determines whether a domain member periodically changes its computer account password. If this setting is enabled, the domain member does not attempt to change its computer account password. If this setting is disabled, the domain member attempts to change its computer account password as specified by the setting for Domain Member: Maximum age for machine account password, which by default is every 30 days. + +Default: Disabled. + +Notes + +This security setting should not be enabled. Computer account passwords are used to establish secure channel communications between members and domain controllers and, within the domain, between the domain controllers themselves. Once it is established, the secure channel is used to transmit sensitive information that is necessary for making authentication and authorization decisions. +This setting should not be used in an attempt to support dual-boot scenarios that use the same computer account. If you want to dual-boot two installations that are joined to the same domain, give the two installations different computer names. + + + +GP Info: +- GP English name: *Domain member: Disable machine account password changes* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + + + + + + + + + + + + + +
+ **LocalPoliciesSecurityOptions/InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked** @@ -1377,63 +1606,6 @@ GP Info:
- -**LocalPoliciesSecurityOptions/MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession** - - -
| Home | -Pro | -Business | -Enterprise | -Education | -Mobile | -Mobile Enterprise | -
|---|---|---|---|---|---|---|
|
- 4 |
- 4 |
- 4 |
- 4 |
- |
- |
-
- - - -Microsoft network server: Amount of idle time required before suspending a session - -This security setting determines the amount of continuous idle time that must pass in a Server Message Block (SMB) session before the session is suspended due to inactivity. - -Administrators can use this policy to control when a computer suspends an inactive SMB session. If client activity resumes, the session is automatically reestablished. - -For this policy setting, a value of 0 means to disconnect an idle session as quickly as is reasonably possible. The maximum value is 99999, which is 208 days; in effect, this value disables the policy. - -Default:This policy is not defined, which means that the system treats it as 15 minutes for servers and undefined for workstations. - - - -GP Info: -- GP English name: *Microsoft network server: Amount of idle time required before suspending session* -- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* - - - - -
- **LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsAlways** @@ -2122,6 +2294,282 @@ GP Info:
+ +**LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AddRemoteServerExceptionsForNTLMAuthentication** + + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ 4 |
+ 4 |
+ 4 |
+ 4 |
+ |
+ |
+
+ + + +Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication + +This policy setting allows you to create an exception list of remote servers to which clients are allowed to use NTLM authentication if the "Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers" policy setting is configured. + +If you configure this policy setting, you can define a list of remote servers to which clients are allowed to use NTLM authentication. + +If you do not configure this policy setting, no exceptions will be applied. + +The naming format for servers on this exception list is the fully qualified domain name (FQDN) or NetBIOS server name used by the application, listed one per line. To ensure exceptions the name used by all applications needs to be in the list, and to ensure an exception is accurate, the server name should be listed in both naming formats . A single asterisk (*) can be used anywhere in the string as a wildcard character. + + + +GP Info: +- GP English name: *Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + + + + + + + + + + + + + +
+ + +**LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic** + + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ 4 |
+ 4 |
+ 4 |
+ 4 |
+ |
+ |
+
+ + + +Network security: Restrict NTLM: Audit Incoming NTLM Traffic + +This policy setting allows you to audit incoming NTLM traffic. + +If you select "Disable", or do not configure this policy setting, the server will not log events for incoming NTLM traffic. + +If you select "Enable auditing for domain accounts", the server will log events for NTLM pass-through authentication requests that would be blocked when the "Network Security: Restrict NTLM: Incoming NTLM traffic" policy setting is set to the "Deny all domain accounts" option. + +If you select "Enable auditing for all accounts", the server will log events for all NTLM authentication requests that would be blocked when the "Network Security: Restrict NTLM: Incoming NTLM traffic" policy setting is set to the "Deny all accounts" option. + +This policy is supported on at least Windows 7 or Windows Server 2008 R2. + +Note: Audit events are recorded on this computer in the "Operational" Log located under the Applications and Services Log/Microsoft/Windows/NTLM. + + + +GP Info: +- GP English name: *Network security: Restrict NTLM: Audit Incoming NTLM Traffic* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + + + + + + + + + + + + + +
+ + +**LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_IncomingNTLMTraffic** + + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ 4 |
+ 4 |
+ 4 |
+ 4 |
+ |
+ |
+
+ + + +Network security: Restrict NTLM: Incoming NTLM traffic + +This policy setting allows you to deny or allow incoming NTLM traffic. + +If you select "Allow all" or do not configure this policy setting, the server will allow all NTLM authentication requests. + +If you select "Deny all domain accounts," the server will deny NTLM authentication requests for domain logon and display an NTLM blocked error, but allow local account logon. + +If you select "Deny all accounts," the server will deny NTLM authentication requests from incoming traffic and display an NTLM blocked error. + +This policy is supported on at least Windows 7 or Windows Server 2008 R2. + +Note: Block events are recorded on this computer in the "Operational" Log located under the Applications and Services Log/Microsoft/Windows/NTLM. + + + +GP Info: +- GP English name: *Network security: Restrict NTLM: Incoming NTLM traffic* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + + + + + + + + + + + + + +
+ + +**LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers** + + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ 4 |
+ 4 |
+ 4 |
+ 4 |
+ |
+ |
+
+ + + +Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers + +This policy setting allows you to deny or audit outgoing NTLM traffic from this Windows 7 or this Windows Server 2008 R2 computer to any Windows remote server. + +If you select "Allow all" or do not configure this policy setting, the client computer can authenticate identities to a remote server by using NTLM authentication. + +If you select "Audit all," the client computer logs an event for each NTLM authentication request to a remote server. This allows you to identify those servers receiving NTLM authentication requests from the client computer. + +If you select "Deny all," the client computer cannot authenticate identities to a remote server by using NTLM authentication. You can use the "Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication" policy setting to define a list of remote servers to which clients are allowed to use NTLM authentication. + +This policy is supported on at least Windows 7 or Windows Server 2008 R2. + +Note: Audit and block events are recorded on this computer in the "Operational" Log located under the Applications and Services Log/Microsoft/Windows/NTLM. + + + +GP Info: +- GP English name: *Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + + + + + + + + + + + + + +
+ **LocalPoliciesSecurityOptions/RecoveryConsole_AllowAutomaticAdministrativeLogon** diff --git a/windows/client-management/mdm/policy-csp-mssecurityguide.md b/windows/client-management/mdm/policy-csp-mssecurityguide.md index 8759b6d49a..f20149e9f0 100644 --- a/windows/client-management/mdm/policy-csp-mssecurityguide.md +++ b/windows/client-management/mdm/policy-csp-mssecurityguide.md @@ -6,14 +6,11 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/12/2018 +ms.date: 04/16/2018 --- # Policy CSP - MSSecurityGuide -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -
@@ -47,6 +44,29 @@ ms.date: 03/12/2018 **MSSecurityGuide/ApplyUACRestrictionsToLocalAccountsOnNetworkLogon** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ |
+ |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ |
+ |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ |
+ |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ |
+ |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ |
+ |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ |
+ |
+ |
+ |
+ |
+
@@ -41,6 +38,29 @@ ms.date: 03/12/2018 **MSSLegacy/AllowICMPRedirectsToOverrideOSPFGeneratedRoutes** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ |
+ |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ |
+ |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ |
+ |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ |
+ |
+ |
+ |
+ |
+
## Notifications policies
-
+
- + Notifications/DisallowCloudNotification +
- Notifications/DisallowNotificationMirroring +
- + Notifications/DisallowTileNotification +
+ + +**Notifications/DisallowCloudNotification** + + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ 4 |
+ 4 |
+ 4 |
+ 4 |
+ + | + |
+ + + +Added in Windows 10, version 1803. This policy setting blocks applications from using the network to send tile, badge, toast, and raw notifications. Specifically, this policy setting turns off the connection between Windows and the Windows Push Notification Service (WNS). This policy setting also stops applications from being able to use [periodic (polling) notifications](https://docs.microsoft.com/windows/uwp/design/shell/tiles-and-notifications/periodic-notification-overview). + +If you enable this policy setting, applications and system features will not be able receive notifications from the network from WNS or via notification polling APIs. + +If you enable this policy setting, notifications can still be raised by applications running on the machine via local API calls from within the application. + +If you disable or do not configure this policy setting, the client computer will connect to WNS at user login and applications will be allowed to use periodic (polling) notifications. + +No reboots or service restarts are required for this policy setting to take effect. + + + +ADMX Info: +- GP English name: *Turn off notifications network usage* +- GP name: *NoCloudNotification* +- GP path: *Start Menu and Taskbar/Notifications* +- GP ADMX file name: *WPN.admx* + + + +This setting supports a range of values between 0 and 1. + + + +Validation: +1. Enable policy +2. Reboot machine +3. Ensure that you can't receive a notification from Facebook app while FB app isn't running + + + + +
@@ -86,6 +162,74 @@ The following list shows the supported values: + +
+ + +**Notifications/DisallowTileNotification** + + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ 4 |
+ 4 |
+ 4 |
+ 4 |
+ + | + |
+ + + +Added in Windows 10, version 1803. This policy setting turns off tile notifications. + +If you enable this policy setting, applications and system features will not be able to update their tiles and tile badges in the Start screen. + +If you disable or do not configure this policy setting, tile and badge notifications are enabled and can be turned off by the administrator or user. + +No reboots or service restarts are required for this policy setting to take effect. + + + +ADMX Info: +- GP English name: *Turn off tile notifications* +- GP name: *NoTileNotification* +- GP path: *Start Menu and Taskbar/Notifications* +- GP ADMX file name: *WPN.admx* + + + +This setting supports a range of values between 0 and 1. + + + +Validation: +1. Enable policy +2. Reboot machine +3. Ensure that all tiles are default (no live tile content showing, like no weather forecast on the Weather tile) + + +
Footnote: diff --git a/windows/client-management/mdm/policy-csp-power.md b/windows/client-management/mdm/policy-csp-power.md index 5bee576aca..9b6886930d 100644 --- a/windows/client-management/mdm/policy-csp-power.md +++ b/windows/client-management/mdm/policy-csp-power.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/12/2018 +ms.date: 04/16/2018 --- # Policy CSP - Power @@ -57,6 +57,29 @@ ms.date: 03/12/2018 **Power/AllowStandbyStatesWhenSleepingOnBattery** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ |
+ |
+ |
+ |
+ |
+
3333333333333333333333331111112222222111111222222211111122222221111112222222diff --git a/windows/client-management/mdm/policy-csp-search.md b/windows/client-management/mdm/policy-csp-search.md index dfdf82afa1..aea6133ba1 100644 --- a/windows/client-management/mdm/policy-csp-search.md +++ b/windows/client-management/mdm/policy-csp-search.md @@ -11,9 +11,6 @@ ms.date: 03/12/2018 # Policy CSP - Search -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -
@@ -834,7 +831,7 @@ The following list shows the supported values: > [!NOTE] -> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop. +> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop. Desktop users should use Search/DoNotUseWebResults. Specifies what level of safe search (filtering adult content) is required. diff --git a/windows/client-management/mdm/policy-csp-security.md b/windows/client-management/mdm/policy-csp-security.md index b03abc2582..1549210b82 100644 --- a/windows/client-management/mdm/policy-csp-security.md +++ b/windows/client-management/mdm/policy-csp-security.md @@ -11,9 +11,6 @@ ms.date: 03/12/2018 # Policy CSP - Security -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -
diff --git a/windows/client-management/mdm/policy-csp-settings.md b/windows/client-management/mdm/policy-csp-settings.md index 5773e32200..1c445ea4d5 100644 --- a/windows/client-management/mdm/policy-csp-settings.md +++ b/windows/client-management/mdm/policy-csp-settings.md @@ -11,9 +11,6 @@ ms.date: 03/12/2018 # Policy CSP - Settings -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -
diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index 6c6ed3c4c9..5aa3adb08a 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -11,9 +11,6 @@ ms.date: 03/12/2018 # Policy CSP - System -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -
diff --git a/windows/client-management/mdm/policy-csp-systemservices.md b/windows/client-management/mdm/policy-csp-systemservices.md index 9dd4ebd067..800090eaf1 100644 --- a/windows/client-management/mdm/policy-csp-systemservices.md +++ b/windows/client-management/mdm/policy-csp-systemservices.md @@ -11,9 +11,6 @@ ms.date: 03/12/2018 # Policy CSP - SystemServices -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -
@@ -80,7 +77,7 @@ ms.date: 03/12/2018 -Added in Windows 10, version 1803. This setting determines whether the service's start type is Automaic(2), Manual(3), Disabled(4). Default: Manual. +Added in Windows 10, version 1803. This setting determines whether the service's start type is Automatic(2), Manual(3), Disabled(4). Default: Manual. @@ -129,7 +126,7 @@ GP Info: -Added in Windows 10, version 1803. This setting determines whether the service's start type is Automaic(2), Manual(3), Disabled(4). Default: Manual. +Added in Windows 10, version 1803. This setting determines whether the service's start type is Automatic(2), Manual(3), Disabled(4). Default: Manual. @@ -178,7 +175,7 @@ GP Info: -Added in Windows 10, version 1803. This setting determines whether the service's start type is Automaic(2), Manual(3), Disabled(4). Default: Manual. +Added in Windows 10, version 1803. This setting determines whether the service's start type is Automatic(2), Manual(3), Disabled(4). Default: Manual. @@ -227,7 +224,7 @@ GP Info: -Added in Windows 10, version 1803. This setting determines whether the service's start type is Automaic(2), Manual(3), Disabled(4). Default: Manual. +Added in Windows 10, version 1803. This setting determines whether the service's start type is Automatic(2), Manual(3), Disabled(4). Default: Manual. @@ -276,7 +273,7 @@ GP Info: -Added in Windows 10, version 1803. This setting determines whether the service's start type is Automaic(2), Manual(3), Disabled(4). Default: Manual. +Added in Windows 10, version 1803. This setting determines whether the service's start type is Automatic(2), Manual(3), Disabled(4). Default: Manual. @@ -325,7 +322,7 @@ GP Info: -Added in Windows 10, version 1803. This setting determines whether the service's start type is Automaic(2), Manual(3), Disabled(4). Default: Manual. +Added in Windows 10, version 1803. This setting determines whether the service's start type is Automatic(2), Manual(3), Disabled(4). Default: Manual. diff --git a/windows/client-management/mdm/policy-csp-taskscheduler.md b/windows/client-management/mdm/policy-csp-taskscheduler.md index 7fee0be3b0..7a05f84ffc 100644 --- a/windows/client-management/mdm/policy-csp-taskscheduler.md +++ b/windows/client-management/mdm/policy-csp-taskscheduler.md @@ -11,9 +11,6 @@ ms.date: 03/12/2018 # Policy CSP - TaskScheduler -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -
@@ -65,7 +62,7 @@ ms.date: 03/12/2018 -Added in Windows 10, version 1803. This setting determines whether the specific task is enabled (1) or disabled (0). Default: Enabled. +Added in Windows 10, version 1803. This setting determines whether the specific task is enabled (1) or disabled (0). Default: Disabled. diff --git a/windows/client-management/mdm/policy-csp-textinput.md b/windows/client-management/mdm/policy-csp-textinput.md index 07ba3d94de..affd6a36ac 100644 --- a/windows/client-management/mdm/policy-csp-textinput.md +++ b/windows/client-management/mdm/policy-csp-textinput.md @@ -6,14 +6,11 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/12/2018 +ms.date: 04/16/2018 --- # Policy CSP - TextInput -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -
@@ -114,10 +111,10 @@ ms.date: 03/12/2018
4444| Home | -Pro | -Business | -Enterprise | -Education | -Mobile | -Mobile Enterprise | -
|---|---|---|---|---|---|---|
| - | - | - | - | - | - | - |
diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md index 70198e988d..9d34d6f2cc 100644 --- a/windows/client-management/mdm/policy-csp-update.md +++ b/windows/client-management/mdm/policy-csp-update.md @@ -6,14 +6,11 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/12/2018 +ms.date: 04/16/2018 --- # Policy CSP - Update -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -
@@ -917,6 +914,15 @@ The following list shows the supported values: + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + Added in Windows 10, version 1803. Enable IT admin to configure feature update uninstall period. Values range 2 - 60 days. Default is 10 days. @@ -2138,6 +2144,15 @@ ADMX Info: **Update/PhoneUpdateRestrictions** + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + This policy is deprecated. Use [Update/RequireUpdateApproval](#update-requireupdateapproval) instead. diff --git a/windows/client-management/mdm/policy-csp-userrights.md b/windows/client-management/mdm/policy-csp-userrights.md index 3584468818..e8f878d742 100644 --- a/windows/client-management/mdm/policy-csp-userrights.md +++ b/windows/client-management/mdm/policy-csp-userrights.md @@ -11,9 +11,6 @@ ms.date: 03/12/2018 # Policy CSP - UserRights -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -
diff --git a/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md b/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md index c5ac238f1d..0dfb797f32 100644 --- a/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md +++ b/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md @@ -6,14 +6,11 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/12/2018 +ms.date: 04/16/2018 --- # Policy CSP - WindowsConnectionManager -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -
@@ -32,6 +29,29 @@ ms.date: 03/12/2018 **WindowsConnectionManager/ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ |
+ |
+ |
+ |
+ |
+
diff --git a/windows/client-management/mdm/policy-csp-windowslogon.md b/windows/client-management/mdm/policy-csp-windowslogon.md index 16e39d3e9c..5029554ef7 100644 --- a/windows/client-management/mdm/policy-csp-windowslogon.md +++ b/windows/client-management/mdm/policy-csp-windowslogon.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/12/2018 +ms.date: 04/16/2018 --- # Policy CSP - WindowsLogon @@ -166,6 +166,29 @@ ADMX Info: **WindowsLogon/EnumerateLocalUsersOnDomainJoinedComputers** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ |
+ |
+ |
+ |
+ |
+
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ |
+ |
+ |
+ |
+ |
+
@@ -32,6 +29,29 @@ ms.date: 03/12/2018 **WindowsPowerShell/TurnOnPowerShellScriptBlockLogging** + +
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ |
+ |
+ |
+ |
+ |
+ |
+
Returns status on Application Guard installation and pre-requisites. Value type is integer. Supported operation is Get.
+Returns bitmask that indicates status of Application Guard installation and pre-requisites on the device. Value type is integer. Supported operation is Get. + +Bit 0 - Set to 1 when WDAG is enabled into enterprise manage mode +Bit 1 - Set to 1 when the client machine is Hyper-V capable +Bit 2 - Set to 1 when the client machine has a valid OS license and SKU +Bit 3 - Set to 1 when WDAG installed on the client machine +Bit 4 - Set to 1 when required Network Isolation Policies are configured +Bit 5 - Set to 1 when the client machine meets minimum hardware requirements + +
**InstallWindowsDefenderApplicationGuard**Initiates remote installation of Application Guard feature. Supported operations are Get and Execute.
diff --git a/windows/client-management/mdm/windowsdefenderapplicationguard-ddf-file.md b/windows/client-management/mdm/windowsdefenderapplicationguard-ddf-file.md index 4cc13ab9e8..a5571745b5 100644 --- a/windows/client-management/mdm/windowsdefenderapplicationguard-ddf-file.md +++ b/windows/client-management/mdm/windowsdefenderapplicationguard-ddf-file.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 12/05/2017 +ms.date: 03/22/2018 --- # WindowsDefenderApplicationGuard DDF file @@ -16,6 +16,8 @@ This topic shows the OMA DM device description framework (DDF) for the **Windows Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download). +This XML is for Windows 10, version 1803. + ``` syntax 1.2settings-win.data.microsoft.com | | [Windows Error Reporting](http://msdn.microsoft.com/library/windows/desktop/bb513641.aspx) | watson.telemetry.microsoft.com | | [Online Crash Analysis](http://msdn.microsoft.com/library/windows/desktop/ee416349.aspx) | oca.telemetry.microsoft.com | | OneDrive app for Windows 10 | vortex.data.microsoft.com/collect/v1 | @@ -167,7 +176,7 @@ The diagnostic data data is categorized into four levels: - **Security**. Information that’s required to help keep Windows, Windows Server, and System Center secure, including data about the Connected User Experiences and Telemetry component settings, the Malicious Software Removal Tool, and Windows Defender. -- **Basic**. Basic device info, including: quality-related data, app compatibility, app usage data, and data from the **Security** level. +- **Basic**. Basic device info, including: quality-related data, app compatibility, and data from the **Security** level. - **Enhanced**. Additional insights, including: how Windows, Windows Server, System Center, and apps are used, how they perform, advanced reliability data, and data from both the **Basic** and the **Security** levels. @@ -188,7 +197,7 @@ Windows Server Update Services (WSUS) and System Center Configuration Manager fu The data gathered at this level includes: -- **Connected User Experiences and Telemetry component settings**. If general diagnostic data data has been gathered and is queued, it is sent to Microsoft. Along with this diagnostic data, the Connected User Experiences and Telemetry component may download a configuration settings file from Microsoft’s servers. This file is used to configure the Connected User Experiences and Telemetry component itself. The data gathered by the client for this request includes OS information, device id (used to identify what specific device is requesting settings) and device class (for example, whether the device is server or desktop). +- **Connected User Experiences and Telemetry component settings**. If general diagnostic data has been gathered and is queued, it is sent to Microsoft. Along with this diagnostic data, the Connected User Experiences and Telemetry component may download a configuration settings file from Microsoft’s servers. This file is used to configure the Connected User Experiences and Telemetry component itself. The data gathered by the client for this request includes OS information, device id (used to identify what specific device is requesting settings) and device class (for example, whether the device is server or desktop). - **Malicious Software Removal Tool (MSRT)** The MSRT infection report contains information, including device info and IP address. @@ -240,8 +249,6 @@ The data gathered at this level includes: - **General app data and app data for Internet Explorer add-ons**. Includes a list of apps that are installed on a native or virtualized instance of the OS and whether these apps function correctly after an upgrade. This app data includes the app name, publisher, version, and basic details about which files have been blocked from usage. - - **App usage data**. Includes how an app is used, including how long an app is used, when the app has focus, and when the app is started - - **Internet Explorer add-ons**. Includes a list of Internet Explorer add-ons that are installed on a device and whether these apps will work after an upgrade. - **System data**. Helps provide an understanding about whether a device meets the minimum requirements to upgrade to the next version of the operating system. System information includes the amount of memory, as well as information about the processor and BIOS. @@ -304,7 +311,7 @@ In Windows 10, version 1709, we introduce the **Limit Enhanced diagnostic data t ### Full level -The **Full** level gathers data necessary to identify and to help fix problems, following the approval process described below. This level also includes data from the **Basic**, **Enhanced**, and **Security** levels. +The **Full** level gathers data necessary to identify and to help fix problems, following the approval process described below. This level also includes data from the **Basic**, **Enhanced**, and **Security** levels. This is the default level for Windows 10 Pro. Additionally, at this level, devices opted in to the [Windows Insider Program](http://insider.windows.com) will send events, such as reliability and app responsiveness. that can show Microsoft how pre-release binaries and features are performing. These events help us make decisions on which builds are flighted. All devices in the [Windows Insider Program](http://insider.windows.com) are automatically set to this level. @@ -322,9 +329,9 @@ However, before more data is gathered, Microsoft’s privacy governance team, in Sharing diagnostic data data with Microsoft provides many benefits to enterprises, so we do not recommend turning it off. For most enterprise customers, simply adjusting the diagnostic data level and managing specific components is the best option. -Customers can set the diagnostic data level in both the user interface and with existing management tools. Users can change the diagnostic data level in the **Diagnostic data** setting. In the **Settings** app, it is in **Privacy\Feedback & diagnostics**. They can choose between Basic, Enhanced, and Full. The Security level is not available. +Customers can set the diagnostic data level in both the user interface and with existing management tools. Users can change the diagnostic data level in the **Diagnostic data** setting. In the **Settings** app, it is in **Privacy\Feedback & diagnostics**. They can choose between Basic and Full. The Enhanced level will only be displayed as an option when Group Policy or Mobile Device Management (MDM) are invoked with this level. The Security level is not available. -IT pros can use various methods, including Group Policy and Mobile Device Management (MDM), to choose a diagnostic data level. If you’re using Windows 10 Enterprise, Windows 10 Education, or Windows Server 2016, the Security diagnostic data level is available when managing the policy. Setting the diagnostic data level through policy overrides users’ choices. The remainder of this section describes how to do that. +IT pros can use various methods, including Group Policy and Mobile Device Management (MDM), to choose a diagnostic data level. If you’re using Windows 10 Enterprise, Windows 10 Education, or Windows Server 2016, the Security diagnostic data level is available when managing the policy. Setting the diagnostic data level through policy sets the upper boundary for the users’ choices. To disable user choice after setting the level with the policy, you will need to use the "Configure telemetry opt-in setting user interface" group policy. The remainder of this section describes how to use group policy to configure levels and settings interface. ### Manage your diagnostic data settings @@ -340,7 +347,7 @@ The lowest diagnostic data setting level supported through management policies i ### Configure the operating system diagnostic data level -You can configure your operating system diagnostic data settings using the management tools you’re already using, such as Group Policy, MDM, or Windows Provisioning. You can also manually change your settings using Registry Editor. Setting your diagnostic data levels through a management policy overrides any device level settings. +You can configure your operating system diagnostic data settings using the management tools you’re already using, such as Group Policy, MDM, or Windows Provisioning. You can also manually change your settings using Registry Editor. Setting your diagnostic data levels through a management policy sets the upper level for diagnostic data on the device. Use the appropriate value in the table below when you configure the management policy. @@ -351,6 +358,8 @@ Use the appropriate value in the table below when you configure the management p | Enhanced | Security data, basic system and quality data, and enhanced insights and advanced reliability data. | **2** | | Full | Security data, basic system and quality data, enhanced insights and advanced reliability data, and full diagnostics data. | **3** | + > [!NOTE] + > When the User Configuration policy is set for Diagnostic Data, this will override the Computer Configuration setting. ### Use Group Policy to set the diagnostic data level @@ -433,4 +442,4 @@ Web Pages - [Privacy at Microsoft](http://privacy.microsoft.com) - \ No newline at end of file + diff --git a/windows/configuration/cortana-at-work/cortana-at-work-policy-settings.md b/windows/configuration/cortana-at-work/cortana-at-work-policy-settings.md index f411b5bc5e..7e48ef64a7 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-policy-settings.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-policy-settings.md @@ -26,7 +26,7 @@ ms.date: 10/05/2017 |None|System/AllowLocation|Specifies whether to allow app access to the Location service.
**In Windows 10, version 1511**
Cortana won’t work if this setting is turned off (disabled).
**In Windows 10, version 1607 and later**
Cortana still works if this setting is turned off (disabled).|
|None|Accounts/AllowMicrosoftAccountConnection|Specifies whether to allow employees to sign in using a Microsoft account (MSA) from Windows apps.
Use this setting if you only want to support Azure AD in your organization.| |Computer Configuration\Administrative Templates\Windows Components\Search\Allow search and Cortana to use location|Search/AllowSearchToUseLocation|Specifies whether Cortana can use your current location during searches and for location reminders.| -|Computer Configuration\Administrative Templates\Windows Components\Search\Set the SafeSearch setting for Search|Search/SafeSearchPermissions|Specifies what level of safe search (filtering adult content) is required.
**Note**
This setting only applies to Windows 10 Mobile.|
+|Computer Configuration\Administrative Templates\Windows Components\Search\Set the SafeSearch setting for Search|Search/SafeSearchPermissions|Specifies what level of safe search (filtering adult content) is required.
**Note**
This setting only applies to Windows 10 Mobile. Other versions of Windows should use Don't search the web or display web results. |
|User Configuration\Administrative Templates\Windows Components\File Explorer\Turn off display of recent search entries in the File Explorer search box|None|Specifies whether the search box can suggest recent queries and prevent entries from being stored in the registry for future reference.|
|Computer Configuration\Administrative Templates\Windows Components\Search\Don't search the web or display web results|None|Specifies whether search can perform queries on the web and if the web results are displayed in search.
**In Windows 10 Pro edition**
This setting can’t be managed.
**In Windows 10 Enterprise edition**
Cortana won't work if this setting is turned off (disabled).|
|Computer Configuration\Administrative Templates\Windows Components\Search\Allow Cortana|Experience/AllowCortana|Specifies whether employees can use Cortana.
**Important** Lock down applications that run on a device C:\Program Files\Woodgrove\Teller.exe File is signed; create a publisher condition Allow Tellers-AppLockerTellerRules Tellers-WDACTellerRules Web help C:\Program Files\Woodgrove\HR\Checkcut.exe File is signed; create a publisher condition Allow HR-AppLockerHRRules HR-WDACHRRules Web help Bank Tellers Forwarded to: AppLocker Event Repository on srvBT093 Forwarded to: WDAC Event Repository on srvBT093 Standard None Standard C:\Program Files\Woodgrove\Teller.exe File is signed; create a publisher condition Allow Tellers-AppLockerTellerRules Tellers-WDACTellerRules Web help C:\Program Files\Woodgrove\HR\Checkcut.exe File is signed; create a publisher condition Allow HR-AppLockerHRRules HR-WDACHRRules Web help Bank Tellers Forwarded to: AppLocker Event Repository on srvBT093 Forwarded to: CodeIntegrity Event Repository on srvBT093 Standard None Standard
+>Group Policy settings that disable local administrator list merging will override Controlled folder access settings. They also override protected folders and allowed apps set by the local administrator through Controlled folder access. These policies include:
+>- Windows Defender Antivirus **Configure local administrator merge behavior for lists**
+>- System Center Endpoint Protection **Allow users to add exclusions and overrides**
+>For more information about disabling local list merging, see [Prevent or allow users to locally modify Windows Defender AV policy settings](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/configure-local-policy-overrides-windows-defender-antivirus#configure-how-locally-and-globally-defined-threat-remediation-and-exclusions-lists-are-merged).
### Use the Windows Defender Security app to enable Controlled folder access
1. Open the Windows Defender Security Center by clicking the shield icon in the task bar or searching the start menu for **Defender**.
-2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then the **Virus & threat protection settings** label:
+2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then click **Ransomware protection**.
- 
-
-3. Set the switch for the feature to **On**
+3. Set the switch for **Controlled folder access** to **On**.
- 
### Use Group Policy to enable Controlled folder access
1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
-3. In the **Group Policy Management Editor** go to **Computer configuration**.
-
-4. Click **Policies** then **Administrative templates**.
+3. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
5. Expand the tree to **Windows components > Windows Defender Antivirus > Windows Defender Exploit Guard > Controlled folder access**.
diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/enable-exploit-protection.md b/windows/security/threat-protection/windows-defender-exploit-guard/enable-exploit-protection.md
index 1f24f048fe..aa0862bcbc 100644
--- a/windows/security/threat-protection/windows-defender-exploit-guard/enable-exploit-protection.md
+++ b/windows/security/threat-protection/windows-defender-exploit-guard/enable-exploit-protection.md
@@ -9,9 +9,9 @@ ms.mktglfcycl: manage
ms.sitesec: library
ms.pagetype: security
localizationpriority: medium
-author: iaanw
-ms.author: iawilt
-ms.date: 12/12/2017
+author: andreabichsel
+ms.author: v-anbic
+ms.date: 04/30/2018
---
@@ -21,7 +21,7 @@ ms.date: 12/12/2017
**Applies to:**
-- Windows 10, version 1709
+- Windows 10, version 1709 and later
diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/enable-network-protection.md b/windows/security/threat-protection/windows-defender-exploit-guard/enable-network-protection.md
index 2f89ddd49a..307b9220b4 100644
--- a/windows/security/threat-protection/windows-defender-exploit-guard/enable-network-protection.md
+++ b/windows/security/threat-protection/windows-defender-exploit-guard/enable-network-protection.md
@@ -9,9 +9,9 @@ ms.mktglfcycl: manage
ms.sitesec: library
ms.pagetype: security
localizationpriority: medium
-author: iaanw
-ms.author: iawilt
-ms.date: 10/16/2017
+author: andreabichsel
+ms.author: v-anbic
+ms.date: 04/30/2018
---
@@ -20,7 +20,7 @@ ms.date: 10/16/2017
**Applies to:**
-- Windows 10, version 1709
+- Windows 10, version 1709 and later
@@ -53,9 +53,7 @@ For background information on how audit mode works, and when you might want to u
1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
-3. In the **Group Policy Management Editor** go to **Computer configuration**.
-
-4. Click **Policies** then **Administrative templates**.
+3. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
5. Expand the tree to **Windows components > Windows Defender Antivirus > Windows Defender Exploit Guard > Network protection**.
diff --git a/windows/security/threat-protection/device-guard/deploy-device-guard-enable-virtualization-based-security.md b/windows/security/threat-protection/windows-defender-exploit-guard/enable-virtualization-based-protection-of-code-integrity.md
similarity index 54%
rename from windows/security/threat-protection/device-guard/deploy-device-guard-enable-virtualization-based-security.md
rename to windows/security/threat-protection/windows-defender-exploit-guard/enable-virtualization-based-protection-of-code-integrity.md
index ab3baf28eb..354c6831e1 100644
--- a/windows/security/threat-protection/device-guard/deploy-device-guard-enable-virtualization-based-security.md
+++ b/windows/security/threat-protection/windows-defender-exploit-guard/enable-virtualization-based-protection-of-code-integrity.md
@@ -1,90 +1,50 @@
---
-title: Deploy Windows Defender Device Guard - enable virtualization-based security (Windows 10)
-description: This article describes how to enable virtualization-based security, one of the main features that are part of Windows Defender Device Guard in Windows 10.
-keywords: virtualization, security, malware
+title: Enable virtualization-based protection of code integrity
+description: This article explains the steps to opt in to using HVCI on Windows devices.
ms.prod: w10
ms.mktglfcycl: deploy
ms.localizationpriority: high
+ms.author: justinha
author: brianlic-msft
-ms.date: 10/20/2017
+ms.date: 04/19/2018
---
-# Enable virtualization-based protection of code integrity
+# Enable virtualization-based protection of code integrity
-**Applies to**
-- Windows 10
-- Windows Server 2016
+**Applies to**
-Virtualization-based protection of code integrity (herein referred to as Hypervisor-protected Code Integrity, or HVCI) is a powerful system mitigation that leverages hardware virtualization and the Windows Hyper-V hypervisor to protect Windows kernel-mode processes against the injection and execution of malicious or unverified code. Code integrity validation is performed in a secure environment that is resistant to attack from malicious software, and page permissions for kernel mode are set and maintained by the Hyper-V hypervisor. When used with Windows Defender Application Control (WDAC), HVCI helps achieve a locked down configuration state known as Windows Defender Device Guard that can block many types of malware from running on computers running Windows 10 and Windows Server 2016.
+- Windows 10
+- Windows Server 2016
-> [!NOTE]
-> Some applications, including device drivers, may be incompatible with HVCI. This can cause devices or software to malfunction and in rare cases may result in a Blue Screen. Such issues may occur after HVCI has been turned on or during the enablement process itself. We recommend testing thoroughly before enabling HVCI on production systems.
+This topic covers different ways to enable Hypervisor-protected code integrity (HVCI) on Windows 10.
+Some applications, including device drivers, may be incompatible with HVCI.
+This can cause devices or software to malfunction and in rare cases may result in a Blue Screen. Such issues may occur after HVCI has been turned on or during the enablement process itself.
+If this happens, see [Troubleshooting](#troubleshooting) for remediation steps.
-Use the following procedure to enable virtualization-based protection of code integrity:
+## How to turn on HVCI in Windows 10
-1. **Decide whether to use the procedures in this topic, or to use the Windows Defender Device Guard readiness tool**. To enable HVCI, you can use [the Device Guard and Credential Guard hardware readiness tool](https://www.microsoft.com/en-us/download/details.aspx?id=53337) or follow the procedures in this topic.
+To enable HVCI on Windows 10 devices with supporting hardware throughout an enterprise, use any of these options:
+- [Microsoft Intune (or another MDM provider)](#enable-hvci-using-intune)
+- [Group Policy](#enable-hvci-using-group-policy)
+- [System Center Configuration Manager](https://cloudblogs.microsoft.com/enterprisemobility/2015/10/30/managing-windows-10-device-guard-with-configuration-manager/)
+- [Registry](#use-registry-keys-to-enable-virtualization-based-protection-of-code-integrity)
-2. **Verify that hardware and firmware requirements are met**. Verify that your client computers have the hardware and firmware to run HVCI. For a list of requirements, see [Hardware, firmware, and software requirements for Windows Defender Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-windows-defender-device-guard).
+### Enable HVCI using Intune
-3. **Enable the necessary Windows features**. You can use the [hardware readiness tool](https://www.microsoft.com/en-us/download/details.aspx?id=53337) or see [Windows feature requirements for virtualization-based security](#windows-feature-requirements-for-virtualization-based-protection-of-code-integrity).
+Enabling in Intune requires using the Code Integrity node in the [AppLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/applocker-csp).
-4. **Enable additional features as desired**. You can use the [hardware readiness tool](https://www.microsoft.com/en-us/download/details.aspx?id=53337) or see [Enable virtualization-based protection of code integrity](#enable-virtualization-based-protection-of-code-integrity).
+### Enable HVCI using Group Policy
-## Windows feature requirements for virtualization-based protection of code integrity
+1. Use Group Policy Editor (gpedit.msc) to either edit an existing GPO or create a new one.
+2. Navigate to **Computer Configuration** > **Administrative Templates** > **System** > **Device Guard**.
+3. Double-click **Turn on Virtualization Based Security**.
+4. Click **Enabled** and under **Virtualization Based Protection of Code Integrity**, select **Enabled with UEFI lock** to ensure HVCI cannot be enabled remotely or select **Enabled without UEFI lock**.
-Make sure these operating system features are enabled before you can enable HVCI:
+ 
-- Beginning with Windows 10, version 1607 or Windows Server 2016: Important: Notes:
Cortana won’t work if this setting is turned off (disabled). However, employees can still perform local searches even with Cortana turned off.|
diff --git a/windows/configuration/customize-and-export-start-layout.md b/windows/configuration/customize-and-export-start-layout.md
index 7d84bee306..2b16353cf8 100644
--- a/windows/configuration/customize-and-export-start-layout.md
+++ b/windows/configuration/customize-and-export-start-layout.md
@@ -89,11 +89,11 @@ When you have the Start layout that you want your users to see, use the [Export-
**To export the Start layout to an .xml file**
-1. From Start, open **Windows PowerShell**.
+1. Right Click Start, select **Windows PowerShell (Admin)**.
-2. At the Windows PowerShell command prompt, enter the following command:
+2. At the Administrator: Windows PowerShell command prompt, enter the following command:
- `export-startlayout –path
REG_DWORD: 0|
-| Allow search and Cortana to use location | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search!AllowSearchToUseLocation
REG_DWORD: 0 |
-| Do not allow web search | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search!DisableWebSearch
REG_DWORD: 1 |
-| Don't search the web or display web results in Search| HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search!ConnectedSearchUseWeb
REG_DWORD: 0 |
-| Set what information is shared in Search | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search!ConnectedSearchPrivacy
REG_DWORD: 3 |
+| Allow Cortana | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search
REG_DWORD: AllowCortana
Value: 0|
+| Allow search and Cortana to use location | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search
REG_DWORD: AllowSearchToUseLocation
Value: 0 |
+| Do not allow web search | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search
REG_DWORD: DisableWebSearch
Value: 1 |
+| Don't search the web or display web results in Search| HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search
REG_DWORD: ConnectedSearchUseWeb
Value: 0 |
+| Set what information is shared in Search | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search
REG_DWORD: ConnectedSearchPrivacy
Value: 3 |
In Windows 10, version 1507 and Windows 10, version 1511, when you enable the **Don't search the web or display web results in Search** Group Policy, you can control the behavior of whether Cortana searches the web to display web results. However, this policy only covers whether or not web search is performed. There could still be a small amount of network traffic to Bing.com to evaluate if certain Cortana components are up-to-date or not. In order to turn off that network activity completely, you can create a Windows Firewall rule to prevent outbound traffic.
@@ -319,14 +328,14 @@ After that, configure the following:
-or -
-- Create a new REG\_DWORD registry setting **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\W32time\\TimeProviders\\NtpClient!Enabled** and set it to 0 (zero).
+- Create a new REG\_DWORD registry setting named **Enabled** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\W32time\\TimeProviders\\NtpClient** and set it to 0 (zero).
### 4. Device metadata retrieval
To prevent Windows from retrieving device metadata from the Internet, apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Device Installation** > **Prevent device metadata retrieval from the Internet**.
-You can also create a new REG\_DWORD registry setting **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Device Metadata!PreventDeviceMetadataFromNetwork** to 1 (one).
+You can also create a new REG\_DWORD registry setting named **PreventDeviceMetadataFromNetwork** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Device Metadata** and set it to 1 (one).
### 5. Find My Device
@@ -356,7 +365,7 @@ If you're running Windows 10, version 1607, Windows Server 2016, or later:
- **true**. Font streaming is enabled.
-If you're running Windows 10, version 1507 or Windows 10, version 1511, create a REG\_DWORD registry setting called **DisableFontProviders** in **HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Services\\FontCache\\Parameters**, with a value of 1.
+If you're running Windows 10, version 1507 or Windows 10, version 1511, create a REG\_DWORD registry setting named **DisableFontProviders** in **HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Services\\FontCache\\Parameters** with a value of 1.
> [!NOTE]
> After you apply this policy, you must restart the device for it to take effect.
@@ -389,7 +398,7 @@ To turn off Insider Preview builds for Windows 10:
-or -
-- Create a new REG\_DWORD registry setting **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\PreviewBuilds!AllowBuildPreview** to 0 (zero)
+- Create a new REG\_DWORD registry setting named **AllowBuildPreview** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\PreviewBuilds** with a vlue of 0 (zero)
-or-
@@ -418,8 +427,8 @@ Use Group Policy to manage settings for Internet Explorer. You can find the Int
| Policy | Description |
|------------------------------------------------------|-----------------------------------------------------------------------------------------------------|
| Turn on Suggested Sites| Choose whether an employee can configure Suggested Sites.
Default: Enabled
You can also turn this off in the UI by clearing the **Internet Options** > **Advanced** > **Enable Suggested Sites** check box.|
-| Allow Microsoft services to provide enhanced suggestions as the user types in the Address Bar | Choose whether an employee can configure enhanced suggestions, which are presented to the employee as they type in the address bar.
Default: Enabled|
-| Turn off the auto-complete feature for web addresses | Choose whether auto-complete suggests possible matches when employees are typing web address in the address bar.
Default: Disabled You can also turn this off in the UI by clearing the Internet Options > **Advanced** > **Use inline AutoComplete in the Internet Explorer Address Bar and Open Dialog** check box.|
+| Allow Microsoft services to provide enhanced suggestions as the user types in the Address Bar | Choose whether an employee can configure enhanced suggestions, which are presented to the employee as they type in the Address Bar.
Default: Enabled|
+| Turn off the auto-complete feature for web addresses | Choose whether auto-complete suggests possible matches when employees are typing web address in the Address Bar.
Default: Disabled You can also turn this off in the UI by clearing the Internet Options > **Advanced** > **Use inline AutoComplete in the Internet Explorer Address Bar and Open Dialog** check box.|
| Turn off browser geolocation | Choose whether websites can request location data from Internet Explorer.
Default: Disabled|
| Prevent managing SmartScreen filter | Choose whether employees can manage the SmartScreen Filter in Internet Explorer.
Default: Disabled |
@@ -427,11 +436,11 @@ Alternatively, you could use the registry to set the Group Policies.
| Policy | Registry path |
|------------------------------------------------------|-----------------------------------------------------------------------------------------------------|
-| Turn on Suggested Sites| HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Suggested Sites!Enabled
REG_DWORD: 0|
-| Allow Microsoft services to provide enhanced suggestions as the user types in the Address Bar | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\AllowServicePoweredQSA
REG_DWORD: 0|
-| Turn off the auto-complete feature for web addresses | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Explorer\\AutoComplete!AutoSuggest
REG_SZ: **No** |
-| Turn off browser geolocation | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Geolocation!PolicyDisableGeolocation
REG_DWORD: 1 |
-| Prevent managing SmartScreen filter | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\ Internet Explorer\\PhishingFilter!EnabledV9
REG_DWORD: 0 |
+| Turn on Suggested Sites| HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Suggested Sites
REG_DWORD: Enabled
Value: 0|
+| Allow Microsoft services to provide enhanced suggestions as the user types in the Address Bar | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer
REG_DWORD: AllowServicePoweredQSA
Value: 0|
+| Turn off the auto-complete feature for web addresses | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\AutoComplete
REG_SZ: AutoSuggest
Value: **No** |
+| Turn off browser geolocation | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Geolocation
REG_DWORD: PolicyDisableGeolocation
Value: 1 |
+| Prevent managing SmartScreen filter | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\PhishingFilter
REG_DWORD: EnabledV9
Value: 0 |
There are three more Group Policy objects that are used by Internet Explorer:
@@ -445,9 +454,9 @@ You can also use registry entries to set these Group Policies.
| Policy | Registry path |
|------------------------------------------------------|-----------------------------------------------------------------------------------------------------|
-| Choose whether employees can configure Compatibility View. | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\BrowserEmulation!MSCompatibilityMode
REG_DWORD: 0|
-| Turn off the flip ahead with page prediction feature | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\FlipAhead!Enabled
REG_DWORD: 0|
-| Turn off background synchronization for feeds and Web Slices | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Feeds!BackgroundSyncStatus
REG_DWORD:0 |
+| Choose whether employees can configure Compatibility View. | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\BrowserEmulation
REG_DWORD: MSCompatibilityMode
Value: 0|
+| Turn off the flip ahead with page prediction feature | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\FlipAhead
REG_DWORD: Enabled
Value: 0|
+| Turn off background synchronization for feeds and Web Slices | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Feeds
REG_DWORD: BackgroundSyncStatus
Value: 0|
To turn off the home page, enable the Group Policy: **User Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer** > **Disable changing home page settings**, and set it to **about:blank**.
@@ -477,7 +486,7 @@ To turn off Live Tiles:
-or-
-- Create a REG\_DWORD registry setting called **HKEY\_CURRENT\_USER\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\PushNotifications!NoCloudApplicationNotification**, with a value of 1 (one).
+- Create a REG\_DWORD registry setting named **NoCloudApplicationNotification** in **HKEY\_CURRENT\_USER\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\PushNotifications** with a value of 1 (one).
In Windows 10 Mobile, you must also unpin all tiles that are pinned to Start.
@@ -501,7 +510,7 @@ To turn off the Windows Mail app:
-or-
-- Create a REG\_DWORD registry setting called **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Mail!ManualLaunchAllowed**, with a value of 0 (zero).
+- Create a REG\_DWORD registry setting named **ManualLaunchAllowed** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Mail** with a value of 0 (zero).
### 11. Microsoft Account
@@ -511,7 +520,7 @@ To prevent communication to the Microsoft Account cloud authentication service.
-or-
-- Create a REG\_DWORD registry setting called **HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System!NoConnectedUser**, with a value of 3.
+- Create a REG\_DWORD registry setting named **NoConnectedUser** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System** with a value of 3.
To disable the Microsoft Account Sign-In Assistant:
- Apply the Accounts/AllowMicrosoftAccountSignInAssistant MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where 0 is turned off and 1 is turned on.
@@ -530,11 +539,11 @@ Find the Microsoft Edge Group Policy objects under **Computer Configuration** &g
| Policy | Description |
|------------------------------------------------------|-----------------------------------------------------------------------------------------------------|
-| Allow configuration updates for the Books Library | Choose whether configuration updates are done for the Books Library.
Default: Not configured |
+| Allow configuration updates for the Books Library | Choose whether configuration updates are done for the Books Library.
Default: Disabled |
| Configure Autofill | Choose whether employees can use autofill on websites.
Default: Enabled |
| Configure Do Not Track | Choose whether employees can send Do Not Track headers.
Default: Disabled |
| Configure Password Manager | Choose whether employees can save passwords locally on their devices.
Default: Enabled |
-| Configure search suggestions in Address bar | Choose whether the address bar shows search suggestions.
Default: Enabled |
+| Configure search suggestions in Address Bar | Choose whether the Address Bar shows search suggestions.
Default: Enabled |
| Configure Windows Defender SmartScreen Filter (Windows 10, version 1703)
Configure SmartScreen Filter (Windows Server 2016) | Choose whether Windows Defender SmartScreen is turned on or off.
Default: Enabled |
| Allow web content on New Tab page | Choose whether a new tab page appears.
Default: Enabled |
| Configure Start pages | Choose the Start page for domain-joined devices.
Set this to **\
Default: Disabled |
| Turn off autofill | Choose whether employees can use autofill on websites.
Default: Enabled |
| Allow employees to send Do Not Track headers | Choose whether employees can send Do Not Track headers.
Default: Disabled |
| Turn off password manager | Choose whether employees can save passwords locally on their devices.
Default: Enabled |
-| Turn off address bar search suggestions | Choose whether the address bar shows search suggestions.
Default: Enabled |
+| Turn off Address Bar search suggestions | Choose whether the Address Bar shows search suggestions.
Default: Enabled |
| Turn off the SmartScreen Filter | Choose whether SmartScreen is turned on or off.
Default: Enabled |
| Open a new tab with an empty tab | Choose whether a new tab page appears.
Default: Enabled |
| Configure corporate Home pages | Choose the corporate Home page for domain-joined devices.
Set this to **about:blank** |
@@ -557,14 +567,15 @@ Alternatively, you can configure the Microsoft Group Policies using the followin
| Policy | Registry path |
| - | - |
-| Allow configuration updates for the Books Library | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\BooksLibrary!AllowConfigurationUpdateForBooksLibrary
REG_DWORD: **0** |
-| Configure Autofill | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Main!Use FormSuggest
REG_SZ: **no** |
-| Configure Do Not Track | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Main!DoNotTrack
REG_DWORD: 1 |
-| Configure Password Manager | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Main!FormSuggest Passwords
REG_SZ: **no** |
-| Configure search suggestions in Address bar | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\SearchScopes!ShowSearchSuggestionsGlobal
REG_DWORD: 0|
-| Configure Windows Defender SmartScreen Filter (Windows 10, version 1703) | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\PhishingFilter!EnabledV9
REG_DWORD: 0 |
-| Allow web content on New Tab page | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\SearchScopes!AllowWebContentOnNewTabPage
REG_DWORD: 0 |
-| Configure corporate Home pages | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\ServiceUI!ProvisionedHomePages
REG_DWORD: 0|
+| Allow Address Bar drop-down list suggestions | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\ServiceUI
REG_DWORD name: ShowOneBox
Value: 0|
+| Allow configuration updates for the Books Library | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\BooksLibrary
REG_DWORD name: AllowConfigurationUpdateForBooksLibrary
Value: 0|
+| Configure Autofill | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Main
REG_SZ name: Use FormSuggest
Value : **no** |
+| Configure Do Not Track | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Main
REG_DWORD name: DoNotTrack
REG_DWORD: 1 |
+| Configure Password Manager | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Main
REG_SZ name: FormSuggest Passwords
REG_SZ: **no** |
+| Configure search suggestions in Address Bar | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\SearchScopes
REG_DWORD name: ShowSearchSuggestionsGlobal
Value: 0|
+| Configure Windows Defender SmartScreen Filter (Windows 10, version 1703) | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\PhishingFilter
REG_DWORD name: EnabledV9
Value: 0 |
+| Allow web content on New Tab page | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\SearchScopes
REG_DWORD name: AllowWebContentOnNewTabPage
Value: 0 |
+| Configure corporate Home pages | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\ServiceUI
REG_DWORD name: ProvisionedHomePages
Value: 0|
### 12.2 Microsoft Edge MDM policies
@@ -577,7 +588,7 @@ The following Microsoft Edge MDM policies are available in the [Policy CSP](http
| Browser/AllowDoNotTrack | Choose whether employees can send Do Not Track headers.
Default: Not allowed |
| Browser/AllowMicrosoftCompatbilityList | Specify the Microsoft compatibility list in Microsoft Edge.
Default: Enabled |
| Browser/AllowPasswordManager | Choose whether employees can save passwords locally on their devices.
Default: Allowed |
-| Browser/AllowSearchSuggestionsinAddressBar | Choose whether the address bar shows search suggestions..
Default: Allowed |
+| Browser/AllowSearchSuggestionsinAddressBar | Choose whether the Address Bar shows search suggestions..
Default: Allowed |
| Browser/AllowSmartScreen | Choose whether SmartScreen is turned on or off.
Default: Allowed |
| Browser/FirstRunURL | Choose the home page for Microsoft Edge on Windows Mobile 10.
Default: blank |
@@ -601,7 +612,7 @@ You can turn off NCSI by doing one of the following:
-or-
-- Create a REG\_DWORD registry setting called **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\NetworkConnectivityStatusIndicator!NoActiveProbe**, with a value of 1 (one).
+- Create a REG\_DWORD registry setting named **NoActiveProbe** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\NetworkConnectivityStatusIndicator** with a value of 1 (one).
### 14. Offline maps
@@ -611,7 +622,7 @@ You can turn off the ability to download and update offline maps.
-or-
-- Create a REG\_DWORD registry setting called **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Maps!AutoDownloadAndUpdateMapData**, with a value of 0 (zero).
+- Create a REG\_DWORD registry setting named **AutoDownloadAndUpdateMapData** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Maps** with a value of 0 (zero).
-and-
@@ -619,7 +630,7 @@ You can turn off the ability to download and update offline maps.
-or-
-- Create a REG\_DWORD registry setting called **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Maps!AllowUntriggeredNetworkTrafficOnSettingsPage**, with a value of 0 (zero).
+- Create a REG\_DWORD registry setting named **AllowUntriggeredNetworkTrafficOnSettingsPage** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Maps** with a value of 0 (zero).
### 15. OneDrive
@@ -629,11 +640,11 @@ To turn off OneDrive in your organization:
-or-
-- Create a REG\_DWORD registry setting called **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\OneDrive!DisableFileSyncNGSC**, with a value of 1 (one).
+- Create a REG\_DWORD registry setting named **DisableFileSyncNGSC** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\OneDrive** with a value of 1 (one).
-and-
-- Create a REG\_DWORD registry setting called **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\OneDrive\\PreventNetworkTrafficPreUserSignIn**, with a value of 1 (one).
+- Create a REG\_DWORD registry setting named **PreventNetworkTrafficPreUserSignIn** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\OneDrive** with a value of 1 (one).
### 16. Preinstalled apps
@@ -816,11 +827,11 @@ To turn off **Let apps use advertising ID to make ads more interesting to you ba
-or-
-- Create a REG\_DWORD registry setting called **Enabled** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AdvertisingInfo**, with a value of 0 (zero).
+- Create a REG\_DWORD registry setting named **Enabled** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AdvertisingInfo** with a value of 0 (zero).
-or-
-- Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\AdvertisingInfo!DisabledByGroupPolicy**, with a value of 1 (one).
+- Create a REG\_DWORD registry setting named **DisabledByGroupPolicy** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\AdvertisingInfo** with a value of 1 (one).
To turn off **Let websites provide locally relevant content by accessing my language list**:
@@ -828,7 +839,7 @@ To turn off **Let websites provide locally relevant content by accessing my lang
-or-
-- Create a new REG\_DWORD registry setting called **HttpAcceptLanguageOptOut** in **HKEY\_CURRENT\_USER\\Control Panel\\International\\User Profile**, with a value of 1.
+- Create a new REG\_DWORD registry setting named **HttpAcceptLanguageOptOut** in **HKEY\_CURRENT\_USER\\Control Panel\\International\\User Profile** with a value of 1.
To turn off **Let Windows track app launches to improve Start and search results**:
@@ -836,7 +847,7 @@ To turn off **Let Windows track app launches to improve Start and search results
-or-
-- Create a REG_DWORD registry setting called **Start_TrackProgs** with value of 0 (zero) in **HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced**
+- Create a REG_DWORD registry setting named **Start_TrackProgs** in **HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced** with value of 0 (zero).
#### Windows Server 2016 and Windows 10, version 1607 and earlier options
@@ -853,11 +864,11 @@ To turn off **Let apps use my advertising ID for experiences across apps (turnin
-or-
-- Create a REG\_DWORD registry setting called **Enabled** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AdvertisingInfo**, with a value of 0 (zero).
+- Create a REG\_DWORD registry setting named **Enabled** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AdvertisingInfo** with a value of 0 (zero).
-or-
-- Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\AdvertisingInfo!DisabledByGroupPolicy**, with a value of 1 (one).
+- Create a REG\_DWORD registry setting named **DisabledByGroupPolicy** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\AdvertisingInfo** with a value of 1 (one).
To turn off **Turn on SmartScreen Filter to check web content (URLs) that Microsoft Store apps use**:
@@ -885,11 +896,11 @@ To turn off **Turn on SmartScreen Filter to check web content (URLs) that Micros
-or-
-- Create a REG\_DWORD registry setting called **EnableWebContentEvaluation** in **HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppHost**, with a value of 0 (zero).
+- Create a REG\_DWORD registry setting named **EnableWebContentEvaluation** in **HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppHost** with a value of 0 (zero).
-or-
-- Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\Sofware\\Policies\\Microsoft\\Windows\\System!EnableSmartScreen**, with a value of 0 (zero).
+- Create a REG\_DWORD registry setting named **EnableSmartScreen** in **HKEY\_LOCAL\_MACHINE\\Sofware\\Policies\\Microsoft\\Windows\\System** with a value of 0 (zero).
To turn off **Send Microsoft info about how I write to help us improve typing and writing in the future**:
@@ -914,7 +925,7 @@ To turn off **Let websites provide locally relevant content by accessing my lang
-or-
-- Create a new REG\_DWORD registry setting called **HttpAcceptLanguageOptOut** in **HKEY\_CURRENT\_USER\\Control Panel\\International\\User Profile**, with a value of 1.
+- Create a new REG\_DWORD registry setting named **HttpAcceptLanguageOptOut** in **HKEY\_CURRENT\_USER\\Control Panel\\International\\User Profile** with a value of 1.
To turn off **Let apps on my other devices open apps and continue experiences on this devices**:
@@ -926,13 +937,12 @@ To turn off **Let apps on my other devices open apps and continue experiences on
-or-
-- Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\System!EnableCdp**, with a value of 0 (zero).
+- Create a REG\_DWORD registry setting named **EnableCdp** in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\System** with a value of 0 (zero).
To turn off **Let apps on my other devices use Bluetooth to open apps and continue experiences on this device**:
- Turn off the feature in the UI.
-
### 17.2 Location
In the **Location** area, you choose whether devices have access to location-specific sensors and which apps have access to the device's location.
@@ -947,7 +957,7 @@ To turn off **Location for this device**:
-or-
-- Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\AppPrivacy!LetAppsAccessLocation**, with a value of 2 (two).
+- Create a REG\_DWORD registry setting named **LetAppsAccessLocation** in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two).
-or-
@@ -980,7 +990,7 @@ To turn off **Location**:
-or-
-- Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\LocationAndSensors!DisableLocation**, with a value of 1 (one).
+- Create a REG\_DWORD registry setting named **DisableLocation** in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\LocationAndSensors** with a value of 1 (one).
-or-
@@ -1008,7 +1018,7 @@ To turn off **Let apps use my camera**:
-or-
-- Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\AppPrivacy!LetAppsAccessCamera**, with a value of 2 (two).
+- Create a REG\_DWORD registry setting named **LetAppsAccessCamera** in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two).
-or-
@@ -1057,7 +1067,7 @@ To turn off **Let apps use my microphone**:
-or-
-- Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\AppPrivacy!LetAppsAccessMicrophone**, with a value of 2 (two)
+- Create a REG\_DWORD registry setting named **LetAppsAccessMicrophone** in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two)
To turn off **Choose apps that can use your microphone**:
@@ -1071,10 +1081,18 @@ To turn off notifications network usage:
- Set to **Enabled**.
- -or-
+ -or-
-- Create a REG\_DWORD registry setting in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\PushNotifications!NoCloudApplicationNotification**, with a value of 1 (one)
+- Create a REG\_DWORD registry setting named **NoCloudApplicationNotification** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\PushNotifications** with a value of 1 (one)
+ -or-
+
+
+- Apply the Notifications/DisallowCloudNotification MDM policy from the [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-notifications#notifications-disallowcloudnotification), where:
+
+ - **0**. WNS notifications allowed
+ - **1**. No WNS notifications allowed
+
In the **Notifications** area, you can also choose which apps have access to notifications.
To turn off **Let apps access my notifications**:
@@ -1097,7 +1115,7 @@ To turn off **Let apps access my notifications**:
-or-
-- Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\AppPrivacy!LetAppsAccessNotifications**, with a value of 2 (two)
+- Create a REG\_DWORD registry setting named **LetAppsAccessNotifications** in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two)
### 17.6 Speech, inking, & typing
@@ -1116,15 +1134,15 @@ To turn off the functionality:
-or-
-- Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\InputPersonalization!RestrictImplicitInkCollection**, with a value of 1 (one).
+- Create a REG\_DWORD registry setting named **RestrictImplicitInkCollection** in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\InputPersonalization** with a value of 1 (one).
-or-
-- Create a REG\_DWORD registry setting called **AcceptedPrivacyPolicy** in **HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\Personalization\\Settings**, with a value of 0 (zero).
+- Create a REG\_DWORD registry setting named **AcceptedPrivacyPolicy** in **HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\Personalization\\Settings** with a value of 0 (zero).
-and-
-- Create a REG\_DWORD registry setting called **HarvestContacts** in **HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\InputPersonalization\\TrainedDataStore**, with a value of 0 (zero).
+- Create a REG\_DWORD registry setting named **HarvestContacts** in **HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\InputPersonalization\\TrainedDataStore** with a value of 0 (zero).
If you're running at least Windows 10, version 1703, you can turn off updates to the speech recognition and speech synthesis models:
@@ -1139,7 +1157,7 @@ Apply the Speech/AllowSpeechModelUpdate MDM policy from the [Policy CSP](https:/
-or-
-- Create a REG\_DWORD registry setting called **ModelDownloadAllowed** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\Preferences**, with a value of 0 (zero).
+- Create a REG\_DWORD registry setting named **ModelDownloadAllowed** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\Preferences** with a value of 0 (zero).
### 17.7 Account info
@@ -1165,7 +1183,7 @@ To turn off **Let apps access my name, picture, and other account info**:
-or-
-- Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\AppPrivacy!LetAppsAccessAccountInfo**, with a value of 2 (two).
+- Create a REG\_DWORD registry setting named **LetAppsAccessAccountInfo** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two).
To turn off **Choose the apps that can access your account info**:
@@ -1193,6 +1211,10 @@ To turn off **Choose apps that can access contacts**:
- **1**. Force allow
- **2**. Force deny
+ -or-
+
+- Create a REG\_DWORD registry setting named **LetAppsAccessContacts** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two).
+
### 17.9 Calendar
In the **Calendar** area, you can choose which apps have access to an employee's calendar.
@@ -1217,7 +1239,7 @@ To turn off **Let apps access my calendar**:
-or-
-- Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\AppPrivacy!LetAppsAccessCalendar**, with a value of 2 (two).
+- Create a REG\_DWORD registry setting named **LetAppsAccessCalendar** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two).
To turn off **Choose apps that can access calendar**:
@@ -1247,7 +1269,7 @@ To turn off **Let apps access my call history**:
-or-
-- Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\AppPrivacy!LetAppsAccessCallHistory**, with a value of 2 (two).
+- Create a REG\_DWORD registry setting named **LetAppsAccessCallHistory** in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two).
### 17.11 Email
@@ -1273,7 +1295,7 @@ To turn off **Let apps access and send email**:
-or-
-- Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\AppPrivacy!LetAppsAccessEmail**, with a value of 2 (two).
+- Create a REG\_DWORD registry setting named **LetAppsAccessEmail** in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two).
### 17.12 Messaging
@@ -1299,7 +1321,7 @@ To turn off **Let apps read or send messages (text or MMS)**:
-or-
-- Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy!LetAppsAccessMessaging**, with a value of 2 (two).
+- Create a REG\_DWORD registry setting named **LetAppsAccessMessaging** in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two).
To turn off **Choose apps that can read or send messages**:
@@ -1329,7 +1351,7 @@ To turn off **Let apps make phone calls**:
-or-
-- Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\AppPrivacy!LetAppsAccessPhone**, with a value of 2 (two).
+- Create a REG\_DWORD registry setting named **LetAppsAccessPhone** in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two).
To turn off **Choose apps that can make phone calls**:
@@ -1360,7 +1382,7 @@ To turn off **Let apps control radios**:
-or-
-- Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\AppPrivacy!LetAppsAccessRadios**, with a value of 2 (two).
+- Create a REG\_DWORD registry setting named **LetAppsAccessRadios** in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two).
To turn off **Choose apps that can control radios**:
@@ -1389,7 +1411,7 @@ To turn off **Let apps automatically share and sync info with wireless devices t
-or-
-- Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\AppPrivacy!LetAppsSyncWithDevices**, with a value of 2 (two).
+- Create a REG\_DWORD registry setting named **LetAppsSyncWithDevices** in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two).
To turn off **Let your apps use your trusted devices (hardware you've already connected, or comes with your PC, tablet, or phone)**:
@@ -1420,7 +1442,7 @@ To change how frequently **Windows should ask for my feedback**:
-or-
-- Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\DataCollection!DoNotShowFeedbackNotifications**, with a value of 1 (one).
+- Create a REG\_DWORD registry setting named **DoNotShowFeedbackNotifications** in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\DataCollection** with a value of 1 (one).
-or-
@@ -1441,7 +1463,6 @@ To change how frequently **Windows should ask for my feedback**:
| Once a week | 6048000000000 | 1 |
-
To change the level of diagnostic and usage data sent when you **Send your device data to Microsoft**:
- Click either the **Basic** or **Full** options.
@@ -1452,7 +1473,7 @@ To change the level of diagnostic and usage data sent when you **Send your devic
-or-
-- Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry**, with a value of 0-3, as appropriate for your deployment (see below for the values for each level).
+- Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry** with a value of 0-3, as appropriate for your deployment (see below for the values for each level).
> [!NOTE]
> If the **Security** option is configured by using Group Policy or the Registry, the value will not be reflected in the UI. The **Security** option is only available in Windows 10 Enterprise edition.
@@ -1540,7 +1561,7 @@ To turn off **Let Windows and your apps use your motion data and collect motion
-or-
-- Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\AppPrivacy!LetAppsAccessMotion**, with a value of 2 (two).
+- Create a REG\_DWORD registry setting named **LetAppsAccessMotion** in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two).
### 17.19 Tasks
@@ -1593,21 +1614,21 @@ For Windows 10:
- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Software Protection Platform** > **Turn off KMS Client Online AVS Validation**
- -or-
-
-- Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\AppPrivacy!LetAppsAccessContacts**, with a value of 2 (two).
-
-or-
- Apply the Licensing/DisallowKMSClientOnlineAVSValidation MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where 0 is disabled (default) and 1 is enabled.
+ -or-
+
+- Create a REG\_DWORD registry setting named **NoGenTicket** in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows NT\\CurrentVersion\\Software Protection Platform** with a value of 1 (one).
+
For Windows Server 2016 with Desktop Experience or Windows Server 2016 Server Core:
- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Software Protection Platform** > **Turn off KMS Client Online AVS Validation**
-or-
-- Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows NT\\CurrentVersion\\Software Protection Platform!NoGenTicket**, with a value of 1 (one).
+- Create a REG\_DWORD registry setting named **NoGenTicket** in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows NT\\CurrentVersion\\Software Protection Platform** with a value of 1 (one).
The Windows activation status will be valid for a rolling period of 180 days with weekly activation status checks to the KMS.
@@ -1631,7 +1652,7 @@ You can control if your settings are synchronized:
-or-
-- Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\SettingSync!DisableSettingSync**, with a value of 2 (two) and **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\SettingSync!DisableSettingSyncUserOverride**, with a value of 1 (one).
+- Create a REG\_DWORD registry setting named **DisableSettingSync** in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\SettingSync** with a value of 2 (two) and another named **DisableSettingSyncUserOverride** in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\SettingSync** with a value of 1 (one).
-or-
@@ -1647,7 +1668,7 @@ You can control if your settings are synchronized:
To turn off Messaging cloud sync:
-- Create a REG\_DWORD registry setting called **CloudServiceSyncEnabled** in **HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\Messaging**, with a value of 0 (zero).
+- Create a REG\_DWORD registry setting named **CloudServiceSyncEnabled** in **HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\Messaging** with a value of 0 (zero).
### 21. Teredo
@@ -1660,7 +1681,7 @@ You can disable Teredo by using Group Policy or by using the netsh.exe command.
-or-
-- Create a new REG\_SZ registry setting called in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\TCPIP\\v6Transition!Teredo_State**, with a value of **Disabled**.
+- Create a new REG\_SZ registry setting named **Teredo_State** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\TCPIP\\v6Transition** with a value of **Disabled**.
-or-
@@ -1680,7 +1701,7 @@ To turn off **Connect to suggested open hotspots** and **Connect to networks sha
-or-
-- Create a new REG\_DWORD registry setting called **AutoConnectAllowedOEM** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\WcmSvc\\wifinetworkmanager\\config**, with a value of 0 (zero).
+- Create a new REG\_DWORD registry setting named **AutoConnectAllowedOEM** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\WcmSvc\\wifinetworkmanager\\config** with a value of 0 (zero).
-or-
@@ -1700,7 +1721,7 @@ You can disconnect from the Microsoft Antimalware Protection Service.
-or-
-- Delete the registry setting **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\Updates!DefinitionUpdateFileSharesSources**.
+- Delete the registry setting **named** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\Updates**.
-or-
@@ -1714,8 +1735,6 @@ You can disconnect from the Microsoft Antimalware Protection Service.
From an elevated Windows PowerShell prompt, run **set-mppreference -Mapsreporting 0**
-
-
You can stop sending file samples back to Microsoft.
- Set the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender Antivirus** > **MAPS** > **Send file samples when further analysis is required** to **Always Prompt** or **Never Send**.
@@ -1746,7 +1765,7 @@ You can stop downloading definition updates:
-or-
-- Create a new REG\_SZ registry setting in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\Updates!FallbackOrder**, with a value of **FileShares**.
+- Create a new REG\_SZ registry setting named **FallbackOrder** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\Updates** with a value of **FileShares**.
For Windows 10 only, you can stop Enhanced Notifications:
@@ -1785,7 +1804,7 @@ If you're running Windows 10, version 1607 or later, you only need to enable the
-or-
-- Create a new REG\_DWORD registry setting in **HKEY\_CURRENT\_USER\\SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent!DisableWindowsSpotlightFeatures**, with a value of 1 (one).
+- Create a new REG\_DWORD registry setting named **DisableWindowsSpotlightFeatures** in **HKEY\_CURRENT\_USER\\SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent** with a value of 1 (one).
If you're not running Windows 10, version 1607 or later, you can use the other options in this section.
@@ -1794,7 +1813,7 @@ If you're not running Windows 10, version 1607 or later, you can use the other o
- **Personalization** > **Lock screen** > **Background** > **Windows spotlight**, select a different background, and turn off **Get fun facts, tips, tricks and more on your lock screen**.
> [!NOTE]
- > In Windows 10, version 1507 and Windows 10, version 1511, this setting was called **Show me tips, tricks, and more on the lock screen**.
+ > In Windows 10, version 1507 and Windows 10, version 1511, this setting was named **Show me tips, tricks, and more on the lock screen**.
- **Personalization** > **Start** > **Occasionally show suggestions in Start**.
@@ -1810,20 +1829,20 @@ If you're not running Windows 10, version 1607 or later, you can use the other o
- Set the **Turn off fun facts, tips, tricks, and more on lock screen** check box.
> [!NOTE]
- > This will only take effect if the policy is applied before the first logon. If you cannot apply the **Force a specific default lock screen image** policy before the first logon to the device, you can apply this policy: **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Personalization** > **Do not display the lock screen**. Alternatively, you can create a new REG\_SZ registry setting in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Personalization!LockScreenImage**, with a value of **C:\\windows\\web\\screen\\lockscreen.jpg** and create a new REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Personalization!LockScreenOverlaysDisabled**, with a value of 1 (one).
+ > This will only take effect if the policy is applied before the first logon. If you cannot apply the **Force a specific default lock screen image** policy before the first logon to the device, you can apply this policy: **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Personalization** > **Do not display the lock screen**. Alternatively, you can create a new REG\_SZ registry setting nameed **LockScreenImage** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Personalization** with a value of **C:\\windows\\web\\screen\\lockscreen.jpg** and create a new REG\_DWORD registry setting named **LockScreenOverlaysDisabled** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Personalization** with a value of 1 (one).
- **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Do not show Windows tips**.
-or-
- - Create a new REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent!DisableSoftLanding**, with a value of 1 (one).
+ - Create a new REG\_DWORD registry setting named **DisableSoftLanding** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent** with a value of 1 (one).
- **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Turn off Microsoft consumer experiences**.
-or-
- - Create a new REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent!DisableWindowsConsumerFeatures**, with a value of 1 (one).
+ - Create a new REG\_DWORD registry setting named **DisableWindowsConsumerFeatures** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent** with a value of 1 (one).
For more info, see [Windows Spotlight on the lock screen](windows-spotlight.md).
@@ -1838,13 +1857,13 @@ On Windows Server 2016, this will block Microsoft Store calls from Universal Win
-or-
- - Create a new REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\WindowsStore!DisableStoreApps**, with a value of 1 (one).
+ - Create a new REG\_DWORD registry setting named **DisableStoreApps** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\WindowsStore** with a value of 1 (one).
- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Store** > **Turn off Automatic Download and Install of updates**.
-or-
- - Create a new REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\WindowsStore!AutoDownload**, with a value of 2 (two).
+ - Create a new REG\_DWORD registry setting named **AutoDownload** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\WindowsStore** with a value of 2 (two).
### 26.1 Apps for websites
@@ -1880,7 +1899,7 @@ You can find the Delivery Optimization Group Policy objects under **Computer Con
| Max Cache Size | Lets you specify the maximum cache size as a percentage of disk size.
The default value is 20, which represents 20% of the disk.|
| Max Upload Bandwidth | Lets you specify the maximum upload bandwidth (in KB/second) that a device uses across all concurrent upload activity.
The default value is 0, which means unlimited possible bandwidth.|
-You can also set the **Download Mode** policy by creating a new REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DeliveryOptimization!DODownloadMode**, with a value of 100 (one hundred).
+You can also set the **Download Mode** policy by creating a new REG\_DWORD registry setting named **DODownloadMode** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DeliveryOptimization** with a value of 100 (one hundred).
### 27.3 Delivery Optimization MDM policies
@@ -1915,15 +1934,15 @@ For more info about Delivery Optimization in general, see [Windows Update Delive
You can turn off Windows Update by setting the following registry entries:
-- Add a REG\_DWORD value called **DoNotConnectToWindowsUpdateInternetLocations** to **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate** and set the value to 1.
+- Add a REG\_DWORD value named **DoNotConnectToWindowsUpdateInternetLocations** to **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate** and set the value to 1.
-and-
-- Add a REG\_DWORD value called **DisableWindowsUpdateAccess** to **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate** and set the value to 1.
+- Add a REG\_DWORD value named **DisableWindowsUpdateAccess** to **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate** and set the value to 1.
-and-
-- Add a REG\_DWORD value called **UseWUServer** to **HKEY\_LOCAL\_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU** and set the value to 1.
+- Add a REG\_DWORD value named **UseWUServer** to **HKEY\_LOCAL\_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU** and set the value to 1.
-or-
@@ -1940,7 +1959,7 @@ You can turn off Windows Update by setting the following registry entries:
You can turn off automatic updates by doing one of the following. This is not recommended.
-- Add a REG\_DWORD value called **AutoDownload** to **HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsStore\\WindowsUpdate** and set the value to 5.
+- Add a REG\_DWORD value named **AutoDownload** to **HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsStore\\WindowsUpdate** and set the value to 5.
-or-
diff --git a/windows/configuration/manage-wifi-sense-in-enterprise.md b/windows/configuration/manage-wifi-sense-in-enterprise.md
index 9cb8223eed..068422a836 100644
--- a/windows/configuration/manage-wifi-sense-in-enterprise.md
+++ b/windows/configuration/manage-wifi-sense-in-enterprise.md
@@ -9,7 +9,7 @@ ms.sitesec: library
ms.pagetype: mobile
author: eross-msft
ms.localizationpriority: medium
-ms.date: 07/27/2017
+ms.date: 05/02/2018
---
# Manage Wi-Fi Sense in your company
@@ -18,7 +18,8 @@ ms.date: 07/27/2017
- Windows 10
- Windows 10 Mobile
->Learn more about what features and functionality are supported in each Windows edition at [Compare Windows 10 Editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare).
+>[!IMPORTANT]
+>Beginning with Windows 10, version 1803, Wifi-Sense is no longer available. The following information only applies to Windows 10, version 1709 and prior. Please see [Connecting to open Wi-Fi hotspots in Windows 10](https://privacy.microsoft.com/windows-10-open-wi-fi-hotspots) for more details.
Wi-Fi Sense learns about open Wi-Fi hotspots your Windows PC or Windows phone connects to by collecting information about the network, like whether the open Wi-Fi network has a high-quality connection to the Internet. By using that information from your device and from other Wi-Fi Sense customers' devices too, Wi-Fi Sense builds a database of these high-quality networks. When you’re in range of one of these Wi-Fi hotspots, you automatically get connected to it.
diff --git a/windows/configuration/mobile-devices/provisioning-nfc.md b/windows/configuration/mobile-devices/provisioning-nfc.md
index fc11afb5d6..68d77e21b8 100644
--- a/windows/configuration/mobile-devices/provisioning-nfc.md
+++ b/windows/configuration/mobile-devices/provisioning-nfc.md
@@ -16,6 +16,7 @@ ms.date: 07/27/2017
- Windows 10 Mobile
+
Near field communication (NFC) enables Windows 10 Mobile Enterprise and Windows 10 Mobile devices to communicate with an NFC tag or another NFC-enabled transmitting device. Enterprises that do bulk provisioning can use NFC-based device provisioning to provide a provisioning package to the device that's being provisioned. NFC provisioning is simple and convenient and it can easily store an entire provisioning package.
The NFC provisioning option enables the administrator to provide a provisioning package during initial device setup (the out-of-box experience or OOBE phase). Administrators can use the NFC provisioning option to transfer provisioning information to persistent storage by tapping an unprovisioned mobile device to an NFC tag or NFC-enabled device. To use NFC for pre-provisioning a device, you must either prepare your own NFC tags by storing your provisioning package to a tag as described in this section, or build the infrastructure needed to transmit a provisioning package between an NFC-enabled device and a mobile device during OOBE.
diff --git a/windows/configuration/multi-app-kiosk-xml.md b/windows/configuration/multi-app-kiosk-xml.md
deleted file mode 100644
index 8babcdefec..0000000000
--- a/windows/configuration/multi-app-kiosk-xml.md
+++ /dev/null
@@ -1,175 +0,0 @@
----
-title: Multi-app kiosk XML reference (Windows 10)
-description: XML and XSD for multi-app kiosk device configuration.
-ms.assetid: 14DDDC96-88C7-4181-8415-B371F25726C8
-keywords: ["lockdown", "app restrictions", "applocker"]
-ms.prod: w10
-ms.mktglfcycl: manage
-ms.sitesec: library
-ms.pagetype: edu, security
-author: jdeckerms
-ms.localizationpriority: medium
-ms.date: 08/14/2017
-ms.author: jdecker
----
-
-# Multi-app kiosk XML reference
-
-
-**Applies to**
-
-- Windows 10
-
-## Full XML sample
-
-```xml
-
-
+
+**Step** **Description** **Desktopwizard** **Mobilewizard** **Kioskwizard** Set up device Assign device name,enter product key to upgrade Windows,configure shared used,remove pre-installed software  (Only device name and upgrade key)  Set up network Connect to a Wi-Fi network    Account management Enroll device in Active Directory,enroll device in Azure Active Directory,or create a local administrator account    Bulk Enrollment in Azure AD Enroll device in Azure Active DirectoryBefore you use a Windows Configuration Designer wizard to configure bulk Azure AD enrollment, [set up Azure AD join in your organization](https://docs.microsoft.com/azure/active-directory/active-directory-azureadjoin-setup).    Add applications Install applications using the provisioning package.    Add certificates Include a certificate file in the provisioning package.    Configure kiosk account and app Create local account to run the kiosk mode app,specify the app to run in kiosk mode    Configure kiosk common settings Set tablet mode,configure welcome and shutdown screens,turn off timeout settings   
- [Instructions for the desktop wizard](provision-pcs-for-initial-deployment.md)
- [Instructions for the mobile wizard](../mobile-devices/provisioning-configure-mobile.md)
- [Instructions for the kiosk wizard](../setup-kiosk-digital-signage.md#wizard)
-
+- [Instructions for the HoloLens wizard](https://docs.microsoft.com/hololens/hololens-provisioning#wizard)
>[!NOTE]
diff --git a/windows/configuration/set-up-shared-or-guest-pc.md b/windows/configuration/set-up-shared-or-guest-pc.md
index 196d95eb81..81445be3ff 100644
--- a/windows/configuration/set-up-shared-or-guest-pc.md
+++ b/windows/configuration/set-up-shared-or-guest-pc.md
@@ -111,20 +111,14 @@ Get-CimInstance -Namespace $namespaceName -ClassName $MDM_SharedPCClass
### Create a provisioning package for shared use
-1. [install Windows Configuration Designer](provisioning-packages/provisioning-install-icd.md)
+1. [Install Windows Configuration Designer](provisioning-packages/provisioning-install-icd.md)
1. Open Windows Configuration Designer.
-
2. On the **Start page**, select **Advanced provisioning**.
-
3. Enter a name and (optionally) a description for the project, and click **Next**.
-
4. Select **All Windows desktop editions**, and click **Next**.
-
5. Click **Finish**. Your project opens in Windows Configuration Designer.
-
6. Go to **Runtime settings** > **SharedPC**. [Select the desired settings for shared PC mode.](#customization)
-
7. On the **File** menu, select **Save.**
8. On the **Export** menu, select **Provisioning package**.
9. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next.**
diff --git a/windows/configuration/setup-kiosk-digital-signage.md b/windows/configuration/setup-kiosk-digital-signage.md
index 1d0f5bbcc6..42ce7ef57b 100644
--- a/windows/configuration/setup-kiosk-digital-signage.md
+++ b/windows/configuration/setup-kiosk-digital-signage.md
@@ -8,7 +8,7 @@ ms.mktglfcycl: manage
ms.sitesec: library
author: jdeckerms
ms.localizationpriority: high
-ms.date: 03/23/2018
+ms.date: 04/30/2018
---
# Set up a kiosk or digital signage on Windows 10 Pro, Enterprise, or Education
@@ -16,7 +16,7 @@ ms.date: 03/23/2018
**Applies to**
-- Windows 10
+- Windows 10 Pro, Enterprise, and Education
@@ -29,7 +29,7 @@ Some desktop devices in an enterprise serve a special purpose, such as a PC in t
**Which type of app will your kiosk run?** Your kiosk can run a Universal Windows Platform (UWP) app or a Classic Windows desktop application. When the kiosk account signs in, the kiosk app will launch automatically. If the kiosk app is closed, it will automatically restart.
>[!TIP]
->For **digital signage**, simply select a digital sign player as your kiosk app.
+>For **digital signage**, simply select a digital sign player as your kiosk app. You can also use the **Kiosk Browser** app ([new in Windows 10, version 1803)](guidelines-for-assigned-access-app.md#guidelines-for-web-browsers) and configure it to show your online content.
**Which type of user account will be the kiosk account?** The kiosk account can be a local standard user account, a local administrator account, a domain account, or an Azure Active Directory (Azure AD) account, depending on the method that you use to configure the kiosk.
@@ -142,8 +142,7 @@ If you do not want the kiosk account signed in automatically when the device res
To remove assigned access, choose **Turn off assigned access and sign out of the selected account**.
->[!NOTE]
->Single-app kiosk configuration using assigned access does not work on a device that is connected to more than one monitor.
+
@@ -201,10 +200,13 @@ Clear-AssignedAccess
>
>Account type: Local standard user
+>[!IMPORTANT]
+>When Exchange Active Sync (EAS) password restrictions are active on the device, the autologon feature does not work. This behavior is by design. For more informations, see [How to turn on automatic logon in Windows](https://support.microsoft.com/help/324737/how-to-turn-on-automatic-logon-in-windows).
+
+
When you use the **Provision kiosk devices** wizard in Windows Configuration Designer, you can configure the kiosk to run either a Universal Windows app or a Classic Windows application.
->[!IMPORTANT]
->When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed.
+
[Install Windows Configuration Designer](provisioning-packages/provisioning-install-icd.md), then open Windows Configuration Designer and select **Provision kiosk devices**. After you name your project, and click **Next**, configure the settings as shown in the following table.
@@ -226,7 +228,11 @@ When you use the **Provision kiosk devices** wizard in Windows Configuration Des
>[!NOTE]
>If you want to use [the advanced editor in Windows Configuration Designer](provisioning-packages/provisioning-create-package.md#configure-settings), specify the user account and app (by AUMID) in **Runtime settings** > **AssignedAccess** > **AssignedAccessSettings**
+>[!TIP]
+>You can also use [an XML file to configure both multi-app and single-app kiosks.](lock-down-windows-10-to-specific-apps.md)
+>[!IMPORTANT]
+>When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed.
@@ -281,10 +287,13 @@ The following steps explain how to configure a kiosk in Microsoft Intune. For ot
Using Shell Launcher, you can configure a kiosk device that runs a Classic Windows application as the user interface. The application that you specify replaces the default shell (explorer.exe) that usually runs when a user logs on.
>[!NOTE]
+>In Windows 10, version 1803, you can configure Shell Launcher using the **ShellLauncher** node of the [Assigned Access CSP](https://docs.microsoft.com/en-us/windows/client-management/mdm/assignedaccess-csp).
+>
>You can also configure a kiosk device that runs a Classic Windows application by using the [Provision kiosk devices wizard](#wizard).
>[!WARNING]
->Shell Launcher doesn't support a custom shell with an application that launches a different process and exits. For example, you cannot specify **write.exe** in Shell Launcher. Shell Launcher launches a custom shell and monitors the process to identify when the custom shell exits. **Write.exe** creates a 32-bit wordpad.exe process and exits. Because Shell Launcher is not aware of the newly created wordpad.exe process, Shell Launcher will take action based on the exit code of **Write.exe**, such as restarting the custom shell.
+>- Windows 10 doesn’t support setting a custom shell prior to OOBE. If you do, you won’t be able to deploy the resulting image.
+>- Shell Launcher doesn't support a custom shell with an application that launches a different process and exits. For example, you cannot specify **write.exe** in Shell Launcher. Shell Launcher launches a custom shell and monitors the process to identify when the custom shell exits. **Write.exe** creates a 32-bit wordpad.exe process and exits. Because Shell Launcher is not aware of the newly created wordpad.exe process, Shell Launcher will take action based on the exit code of **Write.exe**, such as restarting the custom shell.
### Requirements
diff --git a/windows/configuration/start-layout-xml-desktop.md b/windows/configuration/start-layout-xml-desktop.md
index c02424cee9..e8fae90b09 100644
--- a/windows/configuration/start-layout-xml-desktop.md
+++ b/windows/configuration/start-layout-xml-desktop.md
@@ -59,7 +59,7 @@ The following table lists the supported elements and attributes for the LayoutMo
| TopMFUAppsParent:LayoutModificationTemplate | n/a | Use to add up to 3 default apps to the frequently used apps section in the system area.**Note**: Only applies to versions of Windows 10 earlier than version 1709. In Windows 10, version 1709, you can no longer pin apps to the Most Frequently Used apps list in Start. |
| TileParent:TopMFUApps | AppUserModelID | Use with the TopMFUApps tags to specify an app with a known AppUserModelID. **Note**: Only applies to versions of Windows 10 earlier than version 1709. In Windows 10, version 1709, you can no longer pin apps to the Most Frequently Used apps list in Start. |
| DesktopApplicationTileParent:TopMFUApps | LinkFilePath | Use with the TopMFUApps tags to specify an app without a known AppUserModelID.**Note**: Only applies to versions of Windows 10 earlier than version 1709. In Windows 10, version 1709, you can no longer pin apps to the Most Frequently Used apps list in Start. |
-| AppendOfficeSuiteParent:LayoutModificationTemplate | n/a | Use to add the in-box installed Office suite to StartDo not use this tag with AppendDownloadOfficeTile |
+| AppendOfficeSuiteParent:LayoutModificationTemplate | n/a | Use to add the in-box installed Office suite to Start. For more information, see [Customize the Office suite of tiles](https://docs.microsoft.com/windows-hardware/customize/desktop/customize-start-layout#customize-the-office-suite-of-tiles).Do not use this tag with AppendDownloadOfficeTile |
| AppendDownloadOfficeTileParent:LayoutModificationTemplate | n/a | Use to add a specific **Download Office** tile to a specific location in StartDo not use this tag with AppendOfficeSuite |
### LayoutOptions
@@ -304,9 +304,23 @@ The following example shows how to add the **AppendOfficeSuite** tag to your Lay
```
+#### AppendOfficeSuiteChoice
+
+This tag is added in Windows 10, version 1803. You have two options in this tag:
+
+- `**Step** **Description** **Desktop wizard** **Mobile wizard** **Kiosk wizard** **HoloLens wizard** Set up device Assign device name,enter product key to upgrade Windows,configure shared used,remove pre-installed software  (Only device name and upgrade key)   Set up network Connect to a Wi-Fi network     Account management Enroll device in Active Directory,enroll device in Azure Active Directory,or create a local administrator account     Bulk Enrollment in Azure AD Enroll device in Azure Active DirectoryBefore you use a Windows Configuration Designer wizard to configure bulk Azure AD enrollment, [set up Azure AD join in your organization](https://docs.microsoft.com/azure/active-directory/active-directory-azureadjoin-setup).     Add applications Install applications using the provisioning package.     Add certificates Include a certificate file in the provisioning package.     Configure kiosk account and app Create local account to run the kiosk mode app,specify the app to run in kiosk mode     Configure kiosk common settings Set tablet mode,configure welcome and shutdown screens,turn off timeout settings     Developer Setup Enable Developer Mode.    
Topic Description [Overview of Windows AutoPilot](windows-autopilot/windows-10-autopilot.md) Windows AutoPilot deployment is a new cloud service from Microsoft that provides a zero touch experience for deploying Windows 10 devices.
+ [Overview of Windows Autopilot](windows-autopilot/windows-10-autopilot.md) Windows Autopilot deployment is a new cloud service from Microsoft that provides a zero touch experience for deploying Windows 10 devices.
[Windows 10 upgrade paths](upgrade/windows-10-upgrade-paths.md) This topic provides information about support for upgrading directly to Windows 10 from a previous operating system.
[Windows 10 edition upgrade](upgrade/windows-10-edition-upgrades.md) This topic provides information about support for upgrading from one edition of Windows 10 to another.
[Windows 10 volume license media](windows-10-media.md) This topic provides information about media available in the Microsoft Volume Licensing Service Center.
diff --git a/windows/deployment/planning/TOC.md b/windows/deployment/planning/TOC.md
index 72286c9cd2..7c0ba92950 100644
--- a/windows/deployment/planning/TOC.md
+++ b/windows/deployment/planning/TOC.md
@@ -3,8 +3,9 @@
## [Windows 10 deployment considerations](windows-10-deployment-considerations.md)
## [Windows 10 compatibility](windows-10-compatibility.md)
## [Windows 10 infrastructure requirements](windows-10-infrastructure-requirements.md)
-## [Creators update (version 1703) - deprecated features](windows-10-creators-update-deprecation.md)
+## [Windows 10, version 1803 - Features removed or planned for replacement](windows-10-1803-removed-features.md)
## [Fall Creators update (version 1709) - deprecated features](windows-10-fall-creators-deprecation.md)
+## [Creators update (version 1703) - deprecated features](windows-10-creators-update-deprecation.md)
## [Windows To Go: feature overview](windows-to-go-overview.md)
### [Best practice recommendations for Windows To Go](best-practice-recommendations-for-windows-to-go.md)
diff --git a/windows/deployment/planning/windows-10-1803-removed-features.md b/windows/deployment/planning/windows-10-1803-removed-features.md
new file mode 100644
index 0000000000..4abd1377b7
--- /dev/null
+++ b/windows/deployment/planning/windows-10-1803-removed-features.md
@@ -0,0 +1,52 @@
+---
+title: Windows 10, version 1803 - Features that have been removed
+description: Learn about features that will be removed or deprecated in Windows 10, version 1803, or a future release
+ms.prod: w10
+ms.mktglfcycl: plan
+ms.localizationpriority: high
+ms.sitesec: library
+author: lizap
+ms.author: elizapo
+ms.date: 04/27/2018
+---
+# Features removed or planned for replacement starting with Windows 10, version 1803
+
+> Applies to: Windows 10, version 1803
+
+Each release of Windows 10 adds new features and functionality; we also occasionally remove features and functionality, usually because we've added a better option. Here are the details about the features and functionalities that we removed in Windows 10, version 1803 (also called Windows 10 April 2018 Update).
+
+> [!TIP]
+> - You can get early access to Windows 10 builds by joining the [Windows Insider program](https://insider.windows.com) - this is a great way to test feature changes.
+> - Have questions about other releases? Check out the information for [Windows 10, version 1703](windows-10-creators-update-deprecation.md), and [Windows 10, version 1709](windows-10-fall-creators-deprecation.md).
+
+**The list is subject to change and might not include every affected feature or functionality.**
+
+## Features we removed in this release
+
+We've removed the following features and functionalities from the installed product image in Windows 10, version 1803. Applications or code that depend on these features won't function in this release unless you use an alternate method.
+
+|Feature |Instead you can use...|
+|-----------|--------------------
+|Groove Music Pass|[We ended the Groove streaming music service and music track sales through the Microsoft Store in 2017](https://support.microsoft.com/en-us/help/4046109/groove-music-and-spotify-faq). The Groove app is being updated to reflect this change. You can still use Groove Music to play the music on your PC or to stream music from OneDrive. You can use Spotify or other music services to stream music on Windows 10, or to buy music to own.|
+|People - Suggestions will no longer include unsaved contacts for non-Microsoft accounts|Manually save the contact details for people you send mail to or get mail from.|
+|Language control in the Control Panel| Use the Settings app to change your language settings.|
+|HomeGroup|We are removing [HomeGroup](https://support.microsoft.com/help/17145) but not your ability to share printers, files, and folders.
When you update to Windows 10, version 1803, you won't see HomeGroup in File Explorer, the Control Panel, or Troubleshoot (**Settings > Update & Security > Troubleshoot**). Any printers, files, and folders that you shared using HomeGroup **will continue to be shared**.
Instead of using HomeGroup, you can now share printers, files and folders by using features that are built into Windows 10:
- [Share your network printer](https://www.bing.com/search?q=share+printer+windows+10)
- [Share files in File Explorer](https://support.microsoft.com/help/4027674/windows-10-share-files-in-file-explorer) |
+|**Connect to suggested open hotspots** option in Wi-Fi settings |We previously [disabled the **Connect to suggested open hotspots** option](https://privacy.microsoft.com/windows-10-open-wi-fi-hotspots) and are now removing it from the Wi-Fi settings page. You can manually connect to free wireless hotspots with **Network & Internet** settings, from the taskbar or Control Panel, or by using Wi-Fi Settings (for mobile devices).|
+|**Conversations** in the People app when you're offline or if you're using a non-Office 365 mail account|In Windows 10, the People app shows mail from Office 365 contacts and contacts from your school or work organization under **Conversations**. After you update to Windows 10, version 1803, in order to see new mail in the People app from these specific contacts, you need to be online, and you need to have signed in with either an Office 365 account or, for work or school organization accounts, through the [Mail](https://support.microsoft.com/help/17198/windows-10-set-up-email), [People](https://support.microsoft.com/help/14103/windows-people-app-help), or [Calendar](https://support.office.com/article/Mail-and-Calendar-for-Windows-10-FAQ-4ebe0864-260f-4d3a-a607-7b9899a98edc) apps. Please be aware that you’ll only see mail for work and school organization accounts and some Office 365 accounts.|
+|XPS Viewer|We're changing the way you get XPS Viewer. In Windows 10, version 1709 and earlier versions, the app is included in the installation image. If you have XPS Viewer and you update to Windows 10, version 1803, there's no action required. You'll still have XPS Viewer.
However, if you install Windows 10, version 1803, on a new device (or as a clean installation), you may need to [install XPS Viewer from **Apps and Features** in the Settings app](https://docs.microsoft.com/windows/application-management/add-apps-and-features) or through [Features on Demand](https://docs.microsoft.com/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities). If you had XPS Viewer in Windows 10, version 1709, but manually removed it before updating, you'll need to manually reinstall it.
+
+## Features we’re no longer developing
+
+We are no longer actively developing these features and may remove them from a future update. Some features have been replaced with other features or functionality, while others are now available from different sources.
+
+If you have feedback about the proposed replacement of any of these features, you can use the [Feedback Hub app](https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app).
+
+|Feature |Instead you can use...|
+|-----------|---------------------|
+|[Software Restriction Policies](https://docs.microsoft.com/windows-server/identity/software-restriction-policies/software-restriction-policies) in Group Policy|Instead of using the Software Restriction Policies through Group Policy, you can use [AppLocker](https://docs.microsoft.com/windows/security/threat-protection/applocker/applocker-overview) or [Windows Defender Application Control](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control) to control which apps users can access and what code can run in the kernel.|
+|[Offline symbol packages](https://docs.microsoft.com/windows-hardware/drivers/debugger/debugger-download-symbols) (Debug symbol MSIs)|We're no longer making the symbol packages available as a downloadable MSI. Instead, the [Microsoft Symbol Server is moving to be an Azure-based symbol store](https://blogs.msdn.microsoft.com/windbg/2017/10/18/update-on-microsofts-symbol-server/). If you need the Windows symbols, connect to the Microsoft Symbol Server to cache your symbols locally or use a manifest file with SymChk.exe on a computer with internet access.|
+|Windows Help Viewer (WinHlp32.exe)|All Windows help information is [available online](https://support.microsoft.com/products/windows?os=windows-10). The Windows Help Viewer is no longer supported in Windows 10. If for any reason you see an error message about "help not supported," possibly when using a non-Microsoft application, read [this support article](https://support.microsoft.com/help/917607/error-opening-help-in-windows-based-programs-feature-not-included-or-h) for additional information and any next steps.|
+|Contacts feature in File Explorer|We're no longer developing the Contacts feature or the corresponding [Windows Contacts API](https://msdn.microsoft.com/library/ff800913.aspx). Instead, you can use the People app in Windows 10 to maintain your contacts.|
+|Phone Companion|Use the **Phone** page in the Settings app. In Windows 10, version 1709, we added the new **Phone** page to help you sync your mobile phone with your PC. It includes all the Phone Companion features.|
+|IPv4/6 Transition Technologies (6to4, ISATAP, and Direct Tunnels)|6to4 has been disabled by default since Windows 10, version 1607 (the Anniversary Update), ISATAP has been disabled by default since Windows 10, version 1703 (the Creators Update), and Direct Tunnels has always been disabled by default. Please use native IPv6 support instead.|
+|[Layered Service Providers](https://msdn.microsoft.com/library/windows/desktop/bb513664)|Layered Service Providers have been deprecated since Windows 8 and Windows Server 2012. Use the [Windows Filtering Platform](https://msdn.microsoft.com/library/windows/desktop/aa366510) instead. Installed Layered Service Providers are not migrated when you upgrade to Windows 10, version 1803; you'll need to re-install them after upgrading.|
diff --git a/windows/deployment/update/device-health-using.md b/windows/deployment/update/device-health-using.md
index 3526ae3850..19e2365401 100644
--- a/windows/deployment/update/device-health-using.md
+++ b/windows/deployment/update/device-health-using.md
@@ -4,7 +4,7 @@ description: Explains how to begin usihg Device Health.
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
-ms.date: 10/10/2017
+ms.date: 03/30/2018
ms.pagetype: deploy
author: jaimeo
---
@@ -90,6 +90,144 @@ Clicking a listed driver on the Driver-Induced OS Crashes blade opens a driver p
The driver version table can help you determine whether deploying a newer version of the driver might help you reduce the crash rate. In the example shown above, the most commonly installed driver version (19.15.1.5) has a crash rate of about one-half of one percent--this is low, so this driver is probably fine. However, driver version 19.40.0.3 has a crash rate of almost 20%. If that driver had been widely deployed, updating it would substantially reduce the overal number of crashes in your organization.
+## App Reliability
+
+The App Reliability report shows you useful data on app usage and behavior so that you can identify apps that are misbehaving and then take steps to resolve the problem.
+
+### App reliability events
+
+The default view includes the **Devices with events** count, which shows the number of devices in your organization that have logged a reliability event for a given app over the last 14 days. A "reliability event" occurs when an app either exits unexpectedly or stops responding. The table also includes a **Devices with Usage** count. This enables you to see how widely used the app was over the same period to put the Devices with Events count into perspective.
+
+
+
+When you click a particular app, the detailed **App reliability** view opens. The first element in the view is the App Information summary:
+
+
+
+This table contains:
+
+- App name
+- Publisher
+- Devices with usage: the number of unique devices that logged any usage of the app
+- Devices with events: the number of unique devices that logged any reliability event for the app
+- % with events: the ratio of "devices with events" to "devices with usage"
+- % with events (commercial average): the ratio of "devices with events" to "devices with usage" in data collected from deployments with a mix of operating system versions and device models that is similar to yours. This can help you decide if a given app is having problems specifically in your environment or more generally in many environments.
+
+#### Trend section
+Following the App Information summary is the trend section:
+
+
+
+With these trend graphs you can more easily detect if an issue is growing, shrinking, or steady. The trend graph on the left shows the number of devices that logged any reliability event for the app. The trend graph on the right shows the ratio of "devices with events" to "devices with usage."
+
+Each graph displays two lines:
+
+- Trailing window: in this line, each day’s value reflects reliability events that occurred in the 14 days leading up to that day. This is useful for gauging the long-term trend with reduced volatility due to weekends and small populations.
+- Single day: Each day’s value reflects reliability events that occurred in a single day. This is useful if an issue is quickly emerging (or being resolved).
+
+#### App and OS versions table
+The next element in the view is the App and OS versions table:
+
+
+
+
+This table breaks out the metrics by combinations of App and OS version. This enables you to identify patterns in that might indicate devices needing an update or configuration change.
+
+For example, if the table shows that a later version of an app is more reliable than an earlier version in your environment, then prioritizing deployment of the later version is likely the best path forward. If you are already running the latest version of the app, but reliability events are increasing, then you might need to do some troubleshooting, or seek support from Microsoft or the app vendor.
+
+By default the table is limited to the most-used version combinations in your environment. To see all version combinations click anywhere in the table.
+
+
+#### Reliability event history table
+
+The next element in the view is the reliability event history table:
+
+
+
+This table shows the most detailed information. Although Device Health is not a debugging tool, the details available in this table can help with troubleshooting by providing the specific devices, versions, and dates of the reliability events.
+
+This view also includes the **Diagnostic Signature** column. This value can be helpful when you are working with product support or troubleshooting on your own. The value (also known as Failure ID or Failure Name) is the same identifier used to summarize crash statistics for Microsoft and partner developers.
+
+The Diagnostic Signature value contains the type of reliability event, error code, DLL name, and function name involved. You can use this information to narrow the scope of troubleshooting. For example, a value like *APPLICATION_HANG_ThreadHang_Contoso-Add-In.dll!GetRegistryValue()* implies that the app stopped responding when Contoso-Add-In was trying to read a registry value. In this case you might prioritize updating or disabling the add-in, or using Process Monitor to identify the registry value it was trying to read, which could lead to a resolution through antivirus exclusions, fixing missing keys, or similar remedies.
+
+
+By default the table is limited to a few recent rows. To see all rows click anywhere in the table.
+
+
+### FAQs and limitations
+
+#### Why does a particular app not appear in the views?
+When we allow reliability events from all processes, the list of apps fills with noisy processes which don't feel like meaningful end-user apps (for example, taskhost.exe or odd-test-thing.exe). In order to draw focus to the apps which matter most to users, App Reliability uses a series of filters to limit what appears in the list. The filter criteria include the following:
+
+- Filter out background processes which have no detected user interaction.
+- Filter out operating system processes which, despite having user interaction, do not feel like apps (for example, Logonui.exe, Winlogon.exe). **Known limitation:** Some processes which may feel like apps are not currently detected as such (and are therefore filtered out as OS processes). These include Explorer.exe, Iexplore.exe, Microsoftedge.exe, and several others.
+- Remove apps which are not widely used in your environment. **Known limitation:** This might result in an app that you consider important being filtered out when that app is not among the 30 most widely used in your environment.
+
+
+We welcome your suggestions and feedback on this filtering process at the [Device Health Tech Community](https://aka.ms/community/DeviceHealth).
+
+#### Why are there multiple names and entries for the same app?
+For example, you might see *Skype for Business*, *‘skype for business’*, and *Lync* listed separately, but you only use *Skype for Business*. Or you might see *MyApp Pro* and *MyApp Professional* listed separately, even though they feel like the same thing.
+
+Apps have many elements of metadata which describe them. These include an Add/Remove programs title (“Contoso Suite 12”), executable file names (“ContosoCRM.exe”), executable display name (“Contoso CRM”), and others. App publishers (and in some cases app re-packagers) set these values. For the most part we leave the data as set by the publisher which can lead to some report splitting. In certain cases we apply transformations to reduce splitting, for example we (by design) convert many values to lower case so that incoming data such as "Contoso CRM" and "CONTOSO CRM" become the same app name for reporting.
+
+
+
+#### Clicking an app in the App Reliability Events blade sometimes results a List view of records instead of the App Reliability view
+To work around this, click the **App Reliability** tab above the results to see the expected view.
+
+
+
+
+#### Clicking "See all…" from the App Reliability Events blade followed by clicking an app from the expanded list results in raw records instead of the App Reliability view
+To work around this, replace all of the text in the Log Search query box with the following:
+
+*DHAppReliability | where AppFileDisplayName == "
-
- 26 - The operating system is Server or LTSB SKU.
- The script does not support Server or LTSB SKUs.
-
+
diff --git a/windows/deployment/upgrade/upgrade-readiness-requirements.md b/windows/deployment/upgrade/upgrade-readiness-requirements.md
index 252ed481b1..9d83376ce5 100644
--- a/windows/deployment/upgrade/upgrade-readiness-requirements.md
+++ b/windows/deployment/upgrade/upgrade-readiness-requirements.md
@@ -31,7 +31,7 @@ See [Windows 10 Specifications](http://www.microsoft.com/en-US/windows/windows-1
Keeping Windows 10 up to date involves deploying a feature update, and Upgrade Readiness tools help you prepare and plan for these Windows updates.
The latest cumulative updates must be installed on Windows 10 computers to make sure that the required compatibility updates are installed. You can find the latest cumulative update on the [Microsoft Update Catalog](https://catalog.update.microsoft.com).
-Windows 10 LTSB is not supported by Upgrade Readiness. The Long-Term Servicing Channel of Windows 10 is not intended for general deployment, and does not receive feature updates, therefore it is not compatible with Upgrade Readiness. See [Windows as a service overview](../update/waas-overview.md#long-term-servicing-channel) to understand more about LTSB.
+While Upgrade Readiness can be used to assist with updating devices from Windows 10 Long-Term Servicing Channel (LTSC) to Windows 10 Semi-Annual Channel, Upgrade Readiness does not support updates to Windows 10 LTSC. The Long-Term Servicing Channel of Windows 10 is not intended for general deployment, and does not receive feature updates, therefore it is not a supported target with Upgrade Readiness. See [Windows as a service overview](../update/waas-overview.md#long-term-servicing-channel) to understand more about LTSC.
## Operations Management Suite
diff --git a/windows/deployment/upgrade/windows-10-edition-upgrades.md b/windows/deployment/upgrade/windows-10-edition-upgrades.md
index f46f0eb146..453db50ca3 100644
--- a/windows/deployment/upgrade/windows-10-edition-upgrades.md
+++ b/windows/deployment/upgrade/windows-10-edition-upgrades.md
@@ -8,7 +8,7 @@ ms.localizationpriority: high
ms.sitesec: library
ms.pagetype: mobile
author: greg-lindsay
-ms.date: 02/9/2018
+ms.date: 04/30/2018
---
# Windows 10 edition upgrade
@@ -46,11 +46,11 @@ X = unsupported 27 - The script is not running under **System** account.
The Upgrade Readiness configuration script must be run as **System**.
| **Home > Pro for Workstations** |  |  |  |  |  |  |
| **Home > Pro Education** |  |  |  |  |  |  |
| **Home > Education** |  |  |  |  |  |  |
-| **S > Pro** | 
(1709) | 
(1709) |  |  | 
(1709) | 
(1709) |
+
| **Pro > Pro for Workstations** |  |  |  | 
(MSfB) |  |  |
| **Pro > Pro Education** |  |  |  | 
(MSfB) |  |  |
| **Pro > Education** |  |  |  | 
(MSfB) |  |  |
@@ -65,9 +65,10 @@ X = unsupported
| **Mobile > Mobile Enterprise** |  | |  |  |  |  |
> [!NOTE]
-> Each desktop edition in the table also has an N and KN SKU. These editions have had media-related functionality removed. Devices with N or KN SKUs installed can be upgraded to corresponding N or KN SKUs using the same methods.
+> - For information about upgrade paths in Windows 10 in S mode (for Pro or Education), check out [Windows 10 Pro/Enterprise in S mode](../windows-10-pro-in-s-mode.md)
+> - Each desktop edition in the table also has an N and KN SKU. These editions have had media-related functionality removed. Devices with N or KN SKUs installed can be upgraded to corresponding N or KN SKUs using the same methods.
>
->
Due to [naming changes](https://docs.microsoft.com/en-us/windows/deployment/update/waas-overview#naming-changes) the term LTSB might still be displayed in some products. This name will change to LTSC with subsequent feature updates.
+> - Due to [naming changes](https://docs.microsoft.com/en-us/windows/deployment/update/waas-overview#naming-changes) the term LTSB might still be displayed in some products. This name will change to LTSC with subsequent feature updates.
## Upgrade using mobile device management (MDM)
- To upgrade desktop editions of Windows 10 using MDM, you'll need to enter the product key for the upgraded edition in the **UpgradeEditionWithProductKey** policy setting of the **WindowsLicensing** CSP. For more info, see [WindowsLicensing CSP](https://go.microsoft.com/fwlink/p/?LinkID=690907).
diff --git a/windows/deployment/upgrade/windows-error-reporting.md b/windows/deployment/upgrade/windows-error-reporting.md
new file mode 100644
index 0000000000..e8c3251320
--- /dev/null
+++ b/windows/deployment/upgrade/windows-error-reporting.md
@@ -0,0 +1,66 @@
+---
+title: Windows error reporting - Windows IT Pro
+description: Resolve Windows 10 upgrade errors for ITPros. Technical information for IT professionals to help diagnose Windows setup errors.
+keywords: deploy, error, troubleshoot, windows, 10, upgrade, code, rollback, ITPro
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: deploy
+author: greg-lindsay
+ms.date: 03/30/2018
+ms.localizationpriority: high
+---
+
+# Windows error reporting
+
+**Applies to**
+- Windows 10
+
+>[!NOTE]
+>This is a 300 level topic (moderately advanced).
+>See [Resolve Windows 10 upgrade errors](resolve-windows-10-upgrade-errors.md) for a full list of topics in this article.
+
+
+When Windows Setup fails, the result and extend code are recorded as an informational event in the Application log by Windows Error Reporting as event 1001. The event name is **WinSetupDiag02**. You can use Event Viewer to review this event, or you can use Windows PowerShell.
+
+To use Windows PowerShell, type the following commands from an elevated Windows PowerShell prompt:
+
+```
+$events = Get-WinEvent -FilterHashtable @{LogName="Application";ID="1001";Data="WinSetupDiag02"}
+$event = [xml]$events[0].ToXml()
+$event.Event.EventData.Data
+```
+
+To use Event Viewer:
+1. Open Event Viewer and navigate to **Windows Logs\Application**.
+2. Click **Find**, and then search for **winsetupdiag02**.
+3. Double-click the event that is highlighted.
+
+Note: For legacy operating systems, the Event Name was WinSetupDiag01.
+
+Ten parameters are listed in the event:
+
+
+
+
+The event will also contain links to log files that can be used to perform a detailed diagnosis of the error. An example of this event from a successful upgrade is shown below.
+
+
+
+## Related topics
+
+[Windows 10 FAQ for IT professionals](https://technet.microsoft.com/en-us/windows/dn798755.aspx)
+P1: The Setup Scenario (1=Media,5=WindowsUpdate,7=Media Creation Tool) P2: Setup Mode (x=default,1=Downlevel,5=Rollback) P3: New OS Architecture (x=default,0=X86,9=AMD64) P4: Install Result (x=default,0=Success,1=Failure,2=Cancel,3=Blocked) P5: Result Error Code (Ex: 0xc1900101) P6: Extend Error Code (Ex: 0x20017) P7: Source OS build (Ex: 9600) P8: Source OS branch (not typically available) P9: New OS build (Ex: 16299} P10: New OS branch (Ex: rs3_release}
[Windows 10 Enterprise system requirements](https://technet.microsoft.com/en-us/windows/dn798752.aspx)
+
[Windows 10 Specifications](https://www.microsoft.com/en-us/windows/Windows-10-specifications)
+
[Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro)
+
[Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821)
diff --git a/windows/deployment/volume-activation/install-vamt.md b/windows/deployment/volume-activation/install-vamt.md
index 1fb488e7ea..a6feddf84d 100644
--- a/windows/deployment/volume-activation/install-vamt.md
+++ b/windows/deployment/volume-activation/install-vamt.md
@@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: activation
author: jdeckerms
ms.localizationpriority: high
-ms.date: 07/27/2017
+ms.date: 04/25/2018
---
# Install VAMT
@@ -19,23 +19,20 @@ This topic describes how to install the Volume Activation Management Tool (VAMT)
You can install VAMT as part of the [Windows Assessment and Deployment Kit (ADK)](https://go.microsoft.com/fwlink/p/?LinkId=526740) for Windows 10.
-**Important**
-VAMT requires local administrator privileges on all managed computers in order to deposit confirmation IDs (CIDs), get the client products’ license status, and install product keys. If VAMT is being used to manage products and product keys on the local host computer and you do not have administrator privileges, start VAMT with elevated privileges. For Active Directory-Based Activation use, for best results we recommend running VAMT while logged on as a domain administrator.
+>[!IMPORTANT]
+>VAMT requires local administrator privileges on all managed computers in order to deposit confirmation IDs (CIDs), get the client products’ license status, and install product keys. If VAMT is being used to manage products and product keys on the local host computer and you do not have administrator privileges, start VAMT with elevated privileges. For Active Directory-Based Activation use, for best results we recommend running VAMT while logged on as a domain administrator.
-**Note**
-The VAMT Microsoft Management Console snap-in ships as an x86 package.
+>[!NOTE]
+>The VAMT Microsoft Management Console snap-in ships as an x86 package.
-After you install VAMT, if you have a computer information list (CIL) that was created in a previous version of VAMT, you must import the list into a SQL database. If you do not have SQL installed, you can download a free copy of Microsoft SQL Server Express and create a new database into which you can import the CIL. To install SQL Server Express:
+To install SQL Server Express:
1. Install the Windows ADK.
-2. Ensure that **Volume Activation Management Tool** and **Microsoft® SQL Server® 2012 Express** are selected to be installed.
+2. Ensure that **Volume Activation Management Tool** is selected to be installed.
3. Click **Install**.
## Select a Database
-**Using a SQL database installed during ADK setup**
-If SQL Server 2012 Express was installed during ADK setup, the default database name will be **ADK**.By default, VAMT is configure to use a SQL database that is installed on the local machine during ADK setup and displays the server name as **.\\ADK**. If the SQL database was installed on another machine, you must configure the database to allow remote connections and you must provide the corresponding server name. If a new VAMT database needs to be created, provide a name for the new database.
-
-**Using a SQL database installed outside of ADK setup**
+VAMT requires a SQL database. After you install VAMT, if you have a computer information list (CIL) that was created in a previous version of VAMT, you must import the list into a SQL database. If you do not have SQL installed, you can [download a free copy of Microsoft SQL Server Express](https://www.microsoft.com/sql-server/sql-server-editions-express) and create a new database into which you can import the CIL.
You must configure SQL installation to allow remote connections and you must provide the corresponding server name in the format: *Machine Name\\SQL Server Name*. If a new VAMT database needs to be created, provide a name for the new database.
diff --git a/windows/deployment/volume-activation/plan-for-volume-activation-client.md b/windows/deployment/volume-activation/plan-for-volume-activation-client.md
index a1e9503aee..a937437e02 100644
--- a/windows/deployment/volume-activation/plan-for-volume-activation-client.md
+++ b/windows/deployment/volume-activation/plan-for-volume-activation-client.md
@@ -31,8 +31,8 @@ ms.date: 09/27/2017
During the activation process, information about the specific installation is examined. In the case of online activations, this information is sent to a server at Microsoft. This information may include the software version, the product key, the IP address of the computer, and information about the device. The activation methods that Microsoft uses are designed to help protect user privacy, and they cannot be used to track back to the computer or user. The gathered data confirms that the software is a legally licensed copy, and this data is used for statistical analysis. Microsoft does not use this information to identify or contact the user or the organization.
-**Note**
-The IP address is used only to verify the location of the request, because some editions of Windows (such as “Starter” editions) can only be activated within certain geographical target markets.
+>[!NOTE]
+>The IP address is used only to verify the location of the request, because some editions of Windows (such as “Starter” editions) can only be activated within certain geographical target markets.
## Distribution channels and activation
@@ -185,7 +185,7 @@ When you know which keys you need, you must obtain them. Generally speaking, vol
### KMS host keys
-A KMS host needs a key that activates, or authenticates, the KMS host with Microsoft. This key is usually referred to as the *KMS host key*, but it is formally known as a *Microsoft Customer Support Volume License Key* (CSVLK). Most documentation and Internet references earlier than Windows 8.1 use the term KMS key, but CSVLK is becoming more common in current documentation and management tools.
+A KMS host needs a key that activates, or authenticates, the KMS host with Microsoft. This key is usually referred to as the *KMS host key*, but it is formally known as a *Microsoft Customer Specific Volume License Key* (CSVLK). Most documentation and Internet references earlier than Windows 8.1 use the term KMS key, but CSVLK is becoming more common in current documentation and management tools.
A KMS host running Windows Server 2012 R2, Windows Server 2012, or Windows Server 2008 R2 can activate both Windows Server and Windows client operating systems. A KMS host key is also needed to create the activation objects in AD DS, as described later in this guide. You will need a KMS host key for any KMS that you want to set up and if you are going to use Active Directory-based activation.
diff --git a/windows/deployment/windows-10-architecture-posters.md b/windows/deployment/windows-10-architecture-posters.md
index 9e30d5461e..fe08fd1129 100644
--- a/windows/deployment/windows-10-architecture-posters.md
+++ b/windows/deployment/windows-10-architecture-posters.md
@@ -17,7 +17,7 @@ You can download the following posters for architectural information about deplo
Learn about the options and steps for a new installation of Windows 10.
- [Deploy Windows 10 - In-place upgrade](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/master/windows/media/ModernSecureDeployment/Deploy-InplaceUpgrade.pdf)
Learn about the steps to upgrade from a previous version of Windows.
-- [Deploy Windows 10 - Windows AutoPilot](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/master/windows/media/ModernSecureDeployment/Deploy-WindowsAutoPilot.pdf)
+- [Deploy Windows 10 - Windows Autopilot](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/master/windows/media/ModernSecureDeployment/Deploy-WindowsAutopilot.pdf)
Learn how you can set up and pre-configure Windows 10 devices.
- [Deploy Windows 10 - Windows servicing](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/master/windows/media/ModernSecureDeployment/WindowsServicing.pdf)
Learn how to keep Windows up to date.
diff --git a/windows/deployment/windows-10-deployment-scenarios.md b/windows/deployment/windows-10-deployment-scenarios.md
index 51a8bd92fe..d12e6d29d6 100644
--- a/windows/deployment/windows-10-deployment-scenarios.md
+++ b/windows/deployment/windows-10-deployment-scenarios.md
@@ -7,7 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.localizationpriority: high
ms.sitesec: library
-ms.date: 03/16/2018
+ms.date: 04/03/2018
author: greg-lindsay
---
@@ -23,7 +23,7 @@ The following table summarizes various Windows 10 deployment scenarios. The scen
- Dynamic deployment methods enable you to configure applications and settings for specific use cases.
- Traditional deployment methods use tools such as Microsoft Deployment Toolkit (MDT) and System Center Configuration Manager.
-
+
Category
Scenario
Description
@@ -31,12 +31,12 @@ The following table summarizes various Windows 10 deployment scenarios. The scen
Modern
-[Windows AutoPilot](#windows-autopilot)
+[Windows Autopilot](#windows-autopilot)
Customize the out-of-box-experience (OOBE) for your organization, and deploy a new system with apps and settings already configured.
-Overview of Windows AutoPilot
+Overview of Windows Autopilot
@@ -136,18 +136,18 @@ The following table summarizes various Windows 10 deployment scenarios. The scen
>[!IMPORTANT]
->The Windows AutoPilot and Subscription Activation scenarios require that the beginning OS be Windows 10 version 1703, or later.
->Except for clean install scenarios such as traditional bare metal and Windows AutoPilot, all the methods described can optionally migrate apps and settings to the new OS.
+>The Windows Autopilot and Subscription Activation scenarios require that the beginning OS be Windows 10 version 1703, or later.
+>Except for clean install scenarios such as traditional bare metal and Windows Autopilot, all the methods described can optionally migrate apps and settings to the new OS.
## Modern deployment methods
Modern deployment methods embrace both traditional on-prem and cloud services to deliver a simple, streamlined, cost effective deployment experience.
-### Windows AutoPilot
+### Windows Autopilot
-Windows AutoPilot is a new suite of capabilities designed to simplify and modernize the deployment and management of new Windows 10 PCs. Windows AutoPilot enables IT professionals to customize the Out of Box Experience (OOBE) for Windows 10 PCs and provide end users with a fully configured new Windows 10 device after just a few clicks. There are no images to deploy, no drivers to inject, and no infrastructure to manage. Users can go through the deployment process independently, without the need consult their IT administrator.
+Windows Autopilot is a new suite of capabilities designed to simplify and modernize the deployment and management of new Windows 10 PCs. Windows Autopilot enables IT professionals to customize the Out of Box Experience (OOBE) for Windows 10 PCs and provide end users with a fully configured new Windows 10 device after just a few clicks. There are no images to deploy, no drivers to inject, and no infrastructure to manage. Users can go through the deployment process independently, without the need consult their IT administrator.
-For more information about Windows AutoPilot, see [Overview of Windows AutoPilot](https://docs.microsoft.com/en-us/windows/deployment/windows-10-auto-pilot) and [Modernizing Windows deployment with Windows AutoPilot](https://blogs.technet.microsoft.com/windowsitpro/2017/06/29/modernizing-windows-deployment-with-windows-autopilot/).
+For more information about Windows Autopilot, see [Overview of Windows Autopilot](https://docs.microsoft.com/en-us/windows/deployment/windows-10-auto-pilot) and [Modernizing Windows deployment with Windows Autopilot](https://blogs.technet.microsoft.com/windowsitpro/2017/06/29/modernizing-windows-deployment-with-windows-autopilot/).
### In-place upgrade
diff --git a/windows/deployment/windows-10-deployment-workflow.md b/windows/deployment/windows-10-deployment-workflow.md
deleted file mode 100644
index 5ac7695ecb..0000000000
--- a/windows/deployment/windows-10-deployment-workflow.md
+++ /dev/null
@@ -1,14 +0,0 @@
----
-title: Windows 10 deployment workflow
-description: Scenarios, methods, tools, and requirements for deploying Windows 10.
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.localizationpriority: high
-ms.pagetype: deploy
-ms.sitesec: library
-author: greg-lindsay
-ms.date: 12/4/2017
----
-
-# Windows 10 deployment workflow
-
diff --git a/windows/deployment/windows-10-enterprise-subscription-activation.md b/windows/deployment/windows-10-enterprise-subscription-activation.md
index de3ae148a3..e455be3daf 100644
--- a/windows/deployment/windows-10-enterprise-subscription-activation.md
+++ b/windows/deployment/windows-10-enterprise-subscription-activation.md
@@ -23,6 +23,7 @@ With Windows 10 version 1703 (also known as the Creator’s Update), both Window
Organizations that have an Enterprise agreement can also benefit from the new service, using traditional Active Directory-joined devices. In this scenario, the Active Directory user that signs in on their device must be synchronized with Azure AD using [Azure AD Connect Sync](https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnectsync-whatis).
See the following topics in this article:
+- [Inherited Activation](#inherited-activation): Description of a new feature available in Windows 10, version 1803 and later.
- [The evolution of Windows 10 deployment](#the-evolution-of-deployment): A short history of Windows deployment.
- [Requirements](#requirements): Prerequisites to use the Windows 10 Enterprise subscription model.
- [Benefits](#benefits): Advantages of Windows 10 Enterprise + subscription-based licensing.
@@ -31,6 +32,14 @@ See the following topics in this article:
For information on how to deploy Windows 10 Enterprise licenses, see [Deploy Windows 10 Enterprise licenses](deploy-enterprise-licenses.md).
+## Inherited Activation
+
+Inherited Activation is a new feature available in Windows 10, version 1803 that allows Windows 10 virtual machines to inherit activation state from their Windows 10 host.
+
+When a user with Windows 10 E3 or E5 license assigned creates a new Windows 10 virtual machine (VM) using a Windows 10 local host, the VM inherits the activation state from a host machine independent of whether user signs on with a local account or using an Azure Active Directory (AAD) account on a VM.
+
+To support Inherited Activation, both the host computer and the VM must be running Windows 10, version 1803 or later.
+
## The evolution of deployment
>The original version of this section can be found at [Changing between Windows SKUs](https://blogs.technet.microsoft.com/mniehaus/2017/10/09/changing-between-windows-skus/).
diff --git a/windows/deployment/windows-10-poc.md b/windows/deployment/windows-10-poc.md
index 4ac1cc5a28..108816df6c 100644
--- a/windows/deployment/windows-10-poc.md
+++ b/windows/deployment/windows-10-poc.md
@@ -730,7 +730,7 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to
Ignore any warnings that are displayed. The computer will automatically reboot upon completion.
-9. When the reboot has completed, reconnect to DC1, sign in using the CONTOSO\Administrator account, open an elevated Windows PowerShell prompt, and use the following commands to add a reverse lookup zone for the PoC network, add the DHCP Server role, authorize DHCP in Active Directory, and supress the post-DHCP-install alert:
+9. When the reboot has completed, reconnect to DC1, sign in using the CONTOSO\Administrator account, open an elevated Windows PowerShell prompt, and use the following commands to add a reverse lookup zone for the PoC network, add the DHCP Server role, authorize DHCP in Active Directory, and suppress the post-DHCP-install alert:
Add-DnsServerPrimaryZone -NetworkID "192.168.0.0/24" -ReplicationScope Forest
diff --git a/windows/deployment/windows-10-pro-in-s-mode.md b/windows/deployment/windows-10-pro-in-s-mode.md
new file mode 100644
index 0000000000..bab515eeed
--- /dev/null
+++ b/windows/deployment/windows-10-pro-in-s-mode.md
@@ -0,0 +1,66 @@
+---
+title: Windows 10 Pro in S mode
+description: Overview of Windows 10 Pro in S mode, switching options, and system requirements
+keywords: Windows 10 S, S-mode, system requirements, Overview, Windows 10 Pro in S mode, Windows 10 Pro in S mode
+ms.mktglfcycl: deploy
+ms.localizationpriority: high
+ms.prod: w10
+ms.sitesec: library
+ms.pagetype: deploy
+ms.date: 04/30/2018
+author: Mikeblodge
+---
+
+# Windows 10 Pro/Enterprise in S mode
+
+S mode is an enhanced security mode of Windows 10. Windows 10 Pro and Enterprise in S mode powers affordable, cloud-ready devices that are simple, secure, and efficient. Users can get started quickly, thanks to self-service deployment and a familiar Windows experience. Low-price S mode devices offer tailored solutions for kiosks, digital signs, and task work. If your device is running Windows 10, version 1709, or Windows 10, version 1803, you can switch from Windows 10 in S mode to Windows 10 Pro.
+
+## Benefits of Windows 10 Pro in S mode:
+
+- **Microsoft-verified security** - It reduces risk of malware and exploitations because only Microsoft-verified apps can be installed including Windows Defender Antivirus.
+- **Performance that lasts** - Provides all-day battery life to keep workers on task and not tripping over cords. Also, verified apps won’t degrade device performance over time.
+- **Streamlined for speed** - Offers faster log-in times with Windows Hello. Plus, workers get all the exclusive Windows innovations including Cortana and Windows Ink.
+
+| |Home |S mode |Pro/Pro Education |Enterprise/Education |
+|---------|:---:|:---:|:---:|:---:|
+|Start Menu/Hello/Cortana/
Windows Ink/Microsoft Edge | X | X | X | X |
+|Store apps (including Windows
desktop bridge apps) | X | X | X | X |
+|Windows Update | X | X | X | X |
+|Device Encryption | X | X | X | X |
+|BitLocker | | X | X | X |
+|Windows Update for Business | | X | X | X |
+|Microsoft Store for Education | | X | X | X |
+|Mobile Device Management
and Azure AD join | | X | X | X |
+|Group Policy management and
Active Directory Domain Services | | | X | X |
+|Desktop (Windows 32) Apps | X | | X | X |
+|Change App Defaults
Search/Browser/Photos/etc. | X | | X | X |
+|Credential Guard | | | | X |
+|Device Guard | | | | X |
+
+## Keep Line of Business apps functioning with Desktop Bridge
+Worried about your LOB apps not working in S mode? Using Desktop Bridge will enable you to convert your Line of Business apps to a packaged app with UWP manifest. After testing and validating you can distribute the app through the Windows Store or existing channels.
+
+[Explore Desktop Bridge](https://docs.microsoft.com/en-us/windows/uwp/porting/desktop-to-uwp-root)
+
+>[!NOTE]
+>The only way to revert to Windows 10 in S mode is to perform a BMR factory reset. This will allow you to reimage a device.
+
+### Windows 10 in S mode is safe, secure, and fast.
+We recommend staying in S mode. However, in some limited scenarios, you might need to switch to Windows 10 Pro. You can switch devices running Windows 10, version 1709 or later. Use the following information to switch to Windows 10 Pro through the Microsoft Store.
+
+## How to switch
+If you’re running Windows 10, version 1709 or version 1803, you can switch to Windows 10 Pro through the Microsoft Store. Devices running version 1803 will only be able to switch through the Store one device at a time.
+
+1. Sign into the Microsoft Store using your Microsoft account.
+2. Search for "Switch to Windows 10 Pro."
+3. In the offer, click **Buy** or **Get**.
+You'll be prompted to save your files before the switch starts. Follow the prompts to switch to Windows 10 Pro.
+
+> [!IMPORTANT]
+> While it’s free to switch to Windows 10 Pro, it’s not reversible. The only way to rollback this kind of switch is through a BMR factory reset.
+
+## Related topics
+
+[Compare Windows 10 editions](https://www.microsoft.com/WindowsForBusiness/Compare)
+[Windows 10 Pro Education](https://docs.microsoft.com/education/windows/test-windows10s-for-edu)
+[Introdiction to Microsoft Intune in the Azure portal](https://docs.microsoft.com/en-us/intune/what-is-intune)
diff --git a/windows/deployment/windows-autopilot/TOC.md b/windows/deployment/windows-autopilot/TOC.md
index 865fa18cce..3bdaf3e0ba 100644
--- a/windows/deployment/windows-autopilot/TOC.md
+++ b/windows/deployment/windows-autopilot/TOC.md
@@ -1,8 +1,8 @@
-# [Overview of Windows AutoPilot](windows-10-autopilot.md)
+# [Overview of Windows Autopilot](windows-10-autopilot.md)
-## [The Windows AutoPilot Deployment Program in Microsoft Store for Business](https://docs.microsoft.com/microsoft-store/add-profile-to-devices#manage-autopilot-deployment-profiles)
-## [The Windows AutoPilot Deployment Program in Microsoft Intune](https://docs.microsoft.com/intune/enrollment-autopilot)
-## [The Windows AutoPilot Deployment Program in Microsoft 365 Business & Office 365 Admin portal](https://support.office.com/article/Create-and-edit-AutoPilot-profiles-5cf7139e-cfa1-4765-8aad-001af1c74faa)
-## [The Windows AutoPilot Deployment Program in Partner Center](https://msdn.microsoft.com/partner-center/autopilot)
-## [Demo the Windows AutoPilot Deployment Program on a Virtual Machine](windows-10-autopilot-demo-vm.md)
+## [The Windows Autopilot Deployment Program in Microsoft Store for Business](https://docs.microsoft.com/microsoft-store/add-profile-to-devices#manage-autopilot-deployment-profiles)
+## [The Windows Autopilot Deployment Program in Microsoft Intune](https://docs.microsoft.com/intune/enrollment-autopilot)
+## [The Windows Autopilot Deployment Program in Microsoft 365 Business & Office 365 Admin portal](https://support.office.com/article/Create-and-edit-Autopilot-profiles-5cf7139e-cfa1-4765-8aad-001af1c74faa)
+## [The Windows Autopilot Deployment Program in Partner Center](https://msdn.microsoft.com/partner-center/autopilot)
+## [Demo the Windows Autopilot Deployment Program on a Virtual Machine](windows-10-autopilot-demo-vm.md)
diff --git a/windows/deployment/windows-autopilot/windows-10-autopilot-demo-vm.md b/windows/deployment/windows-autopilot/windows-10-autopilot-demo-vm.md
index 505982b0d1..9efe482c59 100644
--- a/windows/deployment/windows-autopilot/windows-10-autopilot-demo-vm.md
+++ b/windows/deployment/windows-autopilot/windows-10-autopilot-demo-vm.md
@@ -1,6 +1,6 @@
---
-title: Demo the Windows AutoPilot Deployment Program on a Virtual Machine
-description: Step-by-step instructions on how to set-up a Virtual Machine with a Windows AutoPilot deployment
+title: Demo the Windows Autopilot Deployment Program on a Virtual Machine
+description: Step-by-step instructions on how to set-up a Virtual Machine with a Windows Autopilot deployment
keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune
ms.prod: w10
ms.mktglfcycl: deploy
@@ -12,13 +12,13 @@ ms.author: daniha
ms.date: 12/21/2017
---
-# Demo the Windows AutoPilot Deployment Program on a Virtual Machine
+# Demo the Windows Autopilot Deployment Program on a Virtual Machine
**Applies to**
- Windows 10
-In this topic you'll learn how to set-up a Windows AutoPilot deployment for a Virtual Machine using Hyper-V.
+In this topic you'll learn how to set-up a Windows Autopilot deployment for a Virtual Machine using Hyper-V.
## Prerequisites
@@ -27,7 +27,7 @@ These are the thing you'll need on your device to get started:
* Internet access (see [Network connectivity requirements](windows-10-autopilot.md#network-connectivity-requirements))
* Hypervisor needs to be unoccupied, or used by Hyper-V, as we will be using Hyper-V to create the Virtual Machine
-See additional prerequisites in the [Windows AutoPilot overview topic](windows-10-autopilot.md#prerequisites).
+See additional prerequisites in the [Windows Autopilot overview topic](windows-10-autopilot.md#prerequisites).
## Create your Virtual Machine
@@ -49,10 +49,10 @@ Now that Hyper-V is enabled, proceed to create your Virtual Machine.
Open a PowerShell prompt **as an administrator** and run the following:
```powershell
-New-VMSwitch -Name AutoPilotExternal -NetAdapterName
+>[!TIP]
+> Looking for information about older versions of Windows? Check out our other [Windows libraries](/previous-versions/windows/) on docs.microsoft.com. You can also search this site to find specific information, like this [Windows 8.1 content](https://docs.microsoft.com/search/index?search=Windows+8.1&dataSource=previousVersions).
+
## Get to know Windows as a Service (WaaS)
diff --git a/windows/security/hardware-protection/tpm/trusted-platform-module-services-group-policy-settings.md b/windows/security/hardware-protection/tpm/trusted-platform-module-services-group-policy-settings.md
index ea9f6e17a8..bcb246ccb6 100644
--- a/windows/security/hardware-protection/tpm/trusted-platform-module-services-group-policy-settings.md
+++ b/windows/security/hardware-protection/tpm/trusted-platform-module-services-group-policy-settings.md
@@ -22,7 +22,7 @@ The Group Policy settings for TPM services are located at:
**Computer Configuration\\Administrative Templates\\System\\Trusted Platform Module Services\\**
-The following Group Policy settings were introduced in Window 10:
+The following Group Policy settings were introduced in Window 10.
## Configure the list of blocked TPM commands
@@ -36,17 +36,11 @@ If you disable or do not configure this policy setting, only those TPM commands
- The local list of blocked TPM commands is configured outside of Group Policy by running the TPM Management Console or scripting using the **Win32\_Tpm** interface.
-For information how to enforce or ignore the default and local lists of blocked TPM commands, see
-
-- [Ignore the default list of blocked TPM commands](#ignore-the-default-list-of-blocked-tpm-commands)
-
-- [Ignore the local list of blocked TPM commands](#ignore-the-local-list-of-blocked-tpm-commands)
-
## Ignore the default list of blocked TPM commands
This policy setting allows you to enforce or ignore the computer's default list of blocked Trusted Platform Module (TPM) commands.
-The default list of blocked TPM commands is preconfigured by Windows. You can view the default list by typing **tpm.msc** at the command prompt to open the TPM Management Console, navigating to the **Command Management** section, and exposing the **On Default Block List** column. Also see the related policy setting, [Configure the list of blocked TPM commands](#configure-the-list-of-blocked-tpm-commands).
+The default list of blocked TPM commands is preconfigured by Windows. You can view the default list by typing **tpm.msc** at the command prompt to open the TPM Management Console, navigating to the **Command Management** section, and exposing the **On Default Block List** column.
If you enable this policy setting, the Windows operating system will ignore the computer's default list of blocked TPM commands, and it will block only those TPM commands that are specified by Group Policy or the local list.
@@ -56,7 +50,8 @@ If you disable or do not configure this policy setting, Windows will block the T
This policy setting allows you to enforce or ignore the computer's local list of blocked Trusted Platform Module (TPM) commands.
-The local list of blocked TPM commands is configured outside of Group Policy by typing **tpm.msc** at the command prompt to open the TPM Management Console, or scripting using the **Win32\_Tpm** interface. (The default list of blocked TPM commands is preconfigured by Windows.) Also see the related policy setting, [Configure the list of blocked TPM commands](#configure-the-list-of-blocked-tpm-commands).
+The local list of blocked TPM commands is configured outside of Group Policy by typing **tpm.msc** at the command prompt to open the TPM Management Console, or scripting using the **Win32\_Tpm** interface. (The default list of blocked TPM commands is preconfigured by Windows.)
+
If you enable this policy setting, the Windows operating system will ignore the computer's local list of blocked TPM commands, and it will block only those TPM commands that are specified by Group Policy or the default list.
@@ -64,10 +59,9 @@ If you disable or do not configure this policy setting, Windows will block the T
## Configure the level of TPM owner authorization information available to the operating system
-This policy setting configures how much of the TPM owner authorization information is stored in the registry of the local computer. Depending on the amount of TPM owner authorization information that is stored locally, the Windows operating system and TPM-based applications can perform certain actions in the TPM that require TPM owner authorization without requiring the user to enter the TPM owner password.
+Beginning with Windows 10 version 1607 and Windows Server 2016, this policy setting is no longer used by Windows, but it continues to appear in GPEdit.msc for compatibility with previous versions.
-> [!IMPORTANT]
-> This policy setting is not available in the Windows 10, version 1607 and Windows Server 2016 and later versions of the ADMX files.
+This policy setting configures how much of the TPM owner authorization information is stored in the registry of the local computer. Depending on the amount of TPM owner authorization information that is stored locally, the Windows operating system and TPM-based applications can perform certain actions in the TPM that require TPM owner authorization without requiring the user to enter the TPM owner password.
There are three TPM owner authentication settings that are managed by the Windows operating system. You can choose a value of **Full**, **Delegate**, or **None**.
@@ -143,13 +137,6 @@ An administrator with the TPM owner password can fully reset the TPM's hardware
If you do not configure this policy setting, a default value of 9 is used. A value of zero means that the operating system will not allow standard users to send commands to the TPM, which might cause an authorization failure.
-> [!IMPORTANT]
-> The **Turn on TPM backup to Active Directory Domain Services** is not available in the Windows 10, version 1607 and Windows Server 2016 and later versions of the ADMX files.
-
-If you enable this policy setting, TPM owner information will be automatically and silently backed up to AD DS when you use Windows to set or change a TPM owner password. When this policy setting is enabled, a TPM owner password cannot be set or changed unless the computer is connected to the domain and the AD DS backup succeeds.
-
-If you disable or do not configure this policy setting, TPM owner information will not be backed up to AD DS.
-
## Configure the system to use legacy Dictionary Attack Prevention Parameters setting for TPM 2.0
Introduced in Windows 10, version 1703, this policy setting configures the TPM to use the Dictionary Attack Prevention Parameters (lockout threshold and recovery time) to the values that were used for Windows 10 Version 1607 and below.
@@ -167,6 +154,6 @@ Introduced in Windows 10, version 1703, this policy setting configures the TPM t
## Related topics
-- [Trusted Platform Module](trusted-platform-module-top-node.md) (list of topics)
-- [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx)
-- [Prepare your organization for BitLocker: Planning and Policies - TPM configurations](https://technet.microsoft.com/itpro/windows/keep-secure/prepare-your-organization-for-bitlocker-planning-and-policies#bkmk-tpmconfigurations)
\ No newline at end of file
+- [Trusted Platform Module](trusted-platform-module-top-node.md)
+- [TPM Cmdlets in Windows PowerShell](https://docs.microsoft.com/powershell/module/trustedplatformmodule/?view=win10-ps)
+- [Prepare your organization for BitLocker: Planning and Policies - TPM configurations](https://docs.microsoft.com/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies#bkmk-tpmconfigurations)
\ No newline at end of file
diff --git a/windows/security/identity-protection/credential-guard/credential-guard-considerations.md b/windows/security/identity-protection/credential-guard/credential-guard-considerations.md
index 01dbef4001..8457313a96 100644
--- a/windows/security/identity-protection/credential-guard/credential-guard-considerations.md
+++ b/windows/security/identity-protection/credential-guard/credential-guard-considerations.md
@@ -24,7 +24,7 @@ Passwords are still weak. We recommend that in addition to deploying Windows Def
Windows Defender Credential Guard uses hardware security, so some features such as Windows To Go, are not supported.
## Wi-fi and VPN Considerations
-When you enable Windows Defender Credential Guard, you can no longer use NTLM classic deployment model authentication. If you are using WiFi and VPN endpoints that are based on MS-CHAPv2, they are subject to similar attacks as for NTLMv1. For WiFi and VPN connections, Microsoft recommends that organizations move from MSCHAPv2-based connections such as PEAP-MSCHAPv2 and EAP-MSCHAPv2, to certificate-based authentication such as PEAP-TLS or EAP-TLS.
+When you enable Windows Defender Credential Guard, you can no longer use NTLM classic authentication for Single Sign-On. You will be forced to enter your credentials to use these protocols and cannot save the credentials for future use. If you are using WiFi and VPN endpoints that are based on MS-CHAPv2, they are subject to similar attacks as for NTLMv1. For WiFi and VPN connections, Microsoft recommends that organizations move from MSCHAPv2-based connections such as PEAP-MSCHAPv2 and EAP-MSCHAPv2, to certificate-based authentication such as PEAP-TLS or EAP-TLS.
## Kerberos Considerations
diff --git a/windows/security/identity-protection/credential-guard/credential-guard-requirements.md b/windows/security/identity-protection/credential-guard/credential-guard-requirements.md
index d3be3e2ba8..0e81b79e6d 100644
--- a/windows/security/identity-protection/credential-guard/credential-guard-requirements.md
+++ b/windows/security/identity-protection/credential-guard/credential-guard-requirements.md
@@ -20,7 +20,7 @@ Prefer video? See
[Windows Defender Credential Guard Deployment](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=sRcyvLJyC_3304300474)
in the Deep Dive into Windows Defender Credential Guard video series.
-For Windows Defender Credential Guard to provide protections, the computers you are protecting must meet certain baseline hardware, firmware, and software requirements which we will refer to as [Hardware and software requirements](#hardware-and-software-requirements). Additionally, Windows Defender Credential Guard blocks specific authentication capabilities, so applications that require such capabilities will break. We will refer to this as [Application requirements](#application-requirements). Beyond that, computers can meet additional hardware and firmware qualifications, and receive additional protections. Those computers will be more hardened against certain threats. For detailed information on baseline protections, plus protections for improved security that are associated with hardware and firmware options available in 2015, 2016, and 2017, refer to the tables in [Security Considerations](#security-considerations).
+For Windows Defender Credential Guard to provide protection, the computers you are protecting must meet certain baseline hardware, firmware, and software requirements which we will refer to as [Hardware and software requirements](#hardware-and-software-requirements). Additionally, Windows Defender Credential Guard blocks specific authentication capabilities, so applications that require such capabilities will break. We will refer to this as [Application requirements](#application-requirements). Beyond that, computers can meet additional hardware and firmware qualifications, and receive additional protections. Those computers will be more hardened against certain threats. For detailed information on baseline protections, plus protections for improved security that are associated with hardware and firmware options available in 2015, 2016, and 2017, refer to the tables in [Security Considerations](#security-considerations).
## Hardware and software requirements
diff --git a/windows/security/identity-protection/hello-for-business/hello-features.md b/windows/security/identity-protection/hello-for-business/hello-features.md
index b53fb11810..2cff590539 100644
--- a/windows/security/identity-protection/hello-for-business/hello-features.md
+++ b/windows/security/identity-protection/hello-for-business/hello-features.md
@@ -112,7 +112,7 @@ To configure PIN reset on Windows devices you manage, use an [Intune Windows 10
Set the value for this CSP to **True**.
-Read the [Steps to reset the passcode](https://docs.microsoft.com/en-us/intune/device-windows-pin-reset#steps-to-reset-the-passcode) section to removely reset a PIN on an Intune managed device.
+Read the [Steps to reset the passcode](https://docs.microsoft.com/en-us/intune/device-windows-pin-reset#steps-to-reset-the-passcode) section to remotely reset a PIN on an Intune managed device.
### On-premises Deployments
@@ -122,7 +122,7 @@ Read the [Steps to reset the passcode](https://docs.microsoft.com/en-us/intune/d
* Reset from settings - Windows 10, version 1703
* Reset above Lock - Windows 10, version 1709
-On-premises deployments provide users with the ability to reset forgotton PINs either through the settings page or from above the user's lock screen. Users must know or be provider their password for authentication, must perform a second factor of authentication, and then reprovision Windows Hello for Business.
+On-premises deployments provide users with the ability to reset forgotton PINs either through the settings page or from above the user's lock screen. Users must know or be provided their password for authentication, must perform a second factor of authentication, and then reprovision Windows Hello for Business.
>[!IMPORTANT]
>Users must have corporate network connectivity to domain controllers and the AD FS server to reset their PINs.
@@ -145,10 +145,10 @@ On-premises deployments provide users with the ability to reset forgotton PINs e
**Requirements**
* Hybrid and On-premises Windows Hello for Business deployments
-* Domain Joined or Hybird Azure joined devices
+* Domain Joined or Hybrid Azure joined devices
* Windows 10, version 1709
-The privileged credentials scenario enables administrators to perform elevated, admistrative funcions by enrolling both their non-privileged and privileged credentials on their device.
+The privileged credentials scenario enables administrators to perform elevated, administrative functions by enrolling both their non-privileged and privileged credentials on their device.
By design, Windows 10 does not enumerate all Windows Hello for Business users from within a user's session. Using the computer Group Policy setting, Allow enumeration of emulated smart card for all users, you can configure a device to all this enumeration on selected devices.
diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md
index 43ce0a6db5..645efb6bee 100644
--- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md
+++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md
@@ -1,5 +1,5 @@
---
-title: Hybrid Key trust Windows Hello for Business Prerequistes (Windows Hello for Business)
+title: Hybrid Key trust Windows Hello for Business Prerequisites (Windows Hello for Business)
description: Prerequisites for Hybrid Windows Hello for Business Deployments
keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, key-trust
ms.prod: w10
diff --git a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md
index c8fbfbe290..29fcf7faee 100644
--- a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md
+++ b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md
@@ -72,7 +72,7 @@ The table shows the minimum requirements for each deployment.
## Frequently Asked Questions
### Can I deploy Windows Hello for Business using System Center Configuration Manager?
-Windows Hello for Business deployments using System Center Configuration Manager need to move to the hybrid deploymnet model that uses Active Directory Federation Services. Deployments using System Center Configuration Manager wil no long be supported after November 2018.
+Windows Hello for Business deployments using System Center Configuration Manager need to move to the hybrid deployment model that uses Active Directory Federation Services. Deployments using System Center Configuration Manager will no long be supported after November 2018.
### What is the password-less strategy?
diff --git a/windows/security/identity-protection/hello-for-business/hello-planning-guide.md b/windows/security/identity-protection/hello-for-business/hello-planning-guide.md
index 61dc742a69..880d8394b1 100644
--- a/windows/security/identity-protection/hello-for-business/hello-planning-guide.md
+++ b/windows/security/identity-protection/hello-for-business/hello-planning-guide.md
@@ -284,7 +284,7 @@ If box **2a** reads **GP** and box **2b** reads **modern management**, write **A
| Web Server | NDES |
| CEP Encryption | NDES |
-If box **2a** reads **GP** and box **2b** reads **N/A**, write **AD FA RA** in box **5b** and write the following certificate template names and issuances in box **5c** on your planning worksheet.
+If box **2a** reads **GP** and box **2b** reads **N/A**, write **AD FS RA** in box **5b** and write the following certificate template names and issuances in box **5c** on your planning worksheet.
| Certificate Template Name | Issued To |
| --- | --- |
diff --git a/windows/security/identity-protection/hello-for-business/toc.md b/windows/security/identity-protection/hello-for-business/toc.md
index 86c01a544c..ae838d1fcc 100644
--- a/windows/security/identity-protection/hello-for-business/toc.md
+++ b/windows/security/identity-protection/hello-for-business/toc.md
@@ -22,7 +22,7 @@
#### [Sign-in and Provision](hello-hybrid-key-whfb-provision.md)
### [Hybrid Azure AD Joined Certificate Trust Deployment](hello-hybrid-cert-trust.md)
-#### [Prerequistes](hello-hybrid-cert-trust-prereqs.md)
+#### [Prerequisites](hello-hybrid-cert-trust-prereqs.md)
#### [New Installation Baseline](hello-hybrid-cert-new-install.md)
#### [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md)
#### [Configure Windows Hello for Business policy settings](hello-hybrid-cert-whfb-settings.md)
diff --git a/windows/security/identity-protection/vpn/vpn-conditional-access.md b/windows/security/identity-protection/vpn/vpn-conditional-access.md
index 829934ef39..7d22c3efb9 100644
--- a/windows/security/identity-protection/vpn/vpn-conditional-access.md
+++ b/windows/security/identity-protection/vpn/vpn-conditional-access.md
@@ -1,20 +1,21 @@
---
title: VPN and conditional access (Windows 10)
-description: tbd
+description: The VPN client is now able to integrate with the cloud-based Conditional Access Platform to provide a device compliance option for remote clients. Conditional Access is a policy-based evaluation engine that lets you create access rules for any Azure Active Directory (Azure AD) connected application.
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security, networking
-author: jdeckerms
+author: shortpatti
+ms.author: pashort
+manager: elizapo
+ms.reviewer:
ms.localizationpriority: high
-ms.date: 07/27/2017
+ms.date: 04/20/2018
---
# VPN and conditional access
-**Applies to**
-- Windows 10
-- Windows 10 Mobile
+>Applies to: Windows 10 and Windows 10 Mobile
The VPN client is now able to integrate with the cloud-based Conditional Access Platform to provide a device compliance option for remote clients. Conditional Access is a policy-based evaluation engine that lets you create access rules for any Azure Active Directory (Azure AD) connected application.
@@ -44,13 +45,13 @@ Conditional Access Platform components used for Device Compliance include the fo
- Encryption compliance
- Device health attestation state (validated against attestation service after query)
-
The following client-side components are also required:
- [HealthAttestation Configuration Service Provider (CSP)](https://msdn.microsoft.com/library/windows/hardware/dn934876.aspx)
- [VPNv2 CSP](https://msdn.microsoft.com/library/windows/hardware/dn914776.aspx) DeviceCompliance node settings
- Trusted Platform Module (TPM)
## VPN device compliance
+According to the VPNv2 CSP, these settings options are **Optional**. If you want your users to access on-premises resources, such as files on a network share, based on the credential of a certificate that was issued by an on-premises CA, and not the Cloud CA certificate, you add these settings to the VPNv2 profile. Alternatively, if you add the cloud root certificates to the NTAuth store in on-prem AD, your user's cloud certificate will chain and KDC will issue TGT and TGS tickets to them.
Server-side infrastructure requirements to support VPN device compliance include:
@@ -65,9 +66,9 @@ After the server side is set up, VPN admins can add the policy settings for cond
Two client-side configuration service providers are leveraged for VPN device compliance.
- VPNv2 CSP DeviceCompliance settings
- - **Enabled**: enables the Device Compliance flow from the client. If marked as **true**, the VPN client will attempt to communicate with Azure AD to get a certificate to use for authentication. The VPN should be set up to use certificate authentication and the VPN server must trust the server returned by Azure AD.
- - **Sso**: nodes under SSO can be used to choose a certificate different from the VPN authentication certificate for Kerberos authentication in the case of device compliance.
- - **Sso/Enabled**: if this field is set to **true**, the VPN client will look for a separate certificate for Kerberos authentication.
+ - **Enabled**: enables the Device Compliance flow from the client. If marked as **true**, the VPN client attempts to communicate with Azure AD to get a certificate to use for authentication. The VPN should be set up to use certificate authentication and the VPN server must trust the server returned by Azure AD.
+ - **Sso**: nodes under SSO can be used to choose a certificate different from the VPN authentication certificate for Kerberos authentication in the case of device compliance.
+ - **Sso/Enabled**: if this field is set to **true**, the VPN client looks for a separate certificate for Kerberos authentication.
- **Sso/IssuerHash**: hashes for the VPN client to look for the correct certificate for Kerberos authentication.
- **Sso/Eku**: comma-separated list of Enhanced Key Usage (EKU) extensions for the VPN client to look for the correct certificate for Kerberos authentication.
- HealthAttestation CSP (not a requirement) - functions performed by the HealthAttestation CSP include:
@@ -76,14 +77,16 @@ Two client-side configuration service providers are leveraged for VPN device com
- Provisions the Health Attestation Certificate received from the HAS
- Upon request, forwards the Health Attestation Certificate (received from HAS) and related runtime information to the MDM server for verification
+>[!NOTE]
+>Enabling SSO is not necessarily required unless you want VPN users to be issued Kerberos tickets to access on-premises resources using a certificate issued by the on-premises CA; not the cloud certificate issued by AAD.
+
+
## Client connection flow
-
-
-The VPN client side connection flow works as follows:
+The VPN client side connection flow works as follows:
-When a Device Compliance-enabled VPN connection profile is triggered (either manually or automatically):
+When a VPNv2 Profile is configured with \
-
+
@@ -56,6 +58,9 @@ Find the latest how to and support content that IT pros need to evaluate, plan,
What's New?
Business group
Organizational unit
-Implement AppLocker?
+Implement WDAC?
Applications
Installation path
Use default rule or define new rule condition
@@ -226,7 +223,7 @@ You can use the following form to construct your own AppLocker planning document
@@ -249,7 +246,7 @@ You can use the following form to construct your own AppLocker planning document
@@ -302,7 +299,7 @@ You can use the following form to construct your own AppLocker planning document
Business group
-AppLocker event collection location
+WDAC event collection location
Archival policy
Analyzed?
Security policy
@@ -311,7 +308,7 @@ You can use the following form to construct your own AppLocker planning document
-The following two tables illustrate examples of documenting considerations to maintain and manage AppLocker policies.
+The following two tables illustrate examples of documenting considerations to maintain and manage WDAC policies.
**Event processing policy**
-One discovery method for app usage is to set the AppLocker enforcement mode to **Audit only**. This will write events to the AppLocker logs, which can be managed and analyzed like other Windows logs. After apps have been identified, you can begin to develop policies regarding the processing and access to AppLocker events.
+One discovery method for app usage is to use Audit mode. This will write events to the CodeIntegrity log, which can be managed and analyzed like other Windows logs.
The following table is an example of what to consider and record.
@@ -160,7 +157,7 @@ The following table is an example of what to consider and record.
Business group
Organizational unit
-Implement AppLocker?
+Implement WDAC?
Apps
Installation path
Use default rule or define new rule condition
@@ -78,7 +75,7 @@ The following table contains the added sample data that was collected when deter
@@ -101,7 +98,7 @@ The following table contains the added sample data that was collected when deter
@@ -141,11 +138,11 @@ The following table contains the added sample data that was collected when deter
Business group
-AppLocker event collection location
+WDAC event collection location
Archival policy
Analyzed?
Security policy
@@ -169,7 +166,7 @@ The following table is an example of what to consider and record.
diff --git a/windows/security/threat-protection/windows-defender-atp/configure-email-notifications-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/configure-email-notifications-windows-defender-advanced-threat-protection.md
index 9f0f626310..a6f16281b6 100644
--- a/windows/security/threat-protection/windows-defender-atp/configure-email-notifications-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/configure-email-notifications-windows-defender-advanced-threat-protection.md
@@ -1,5 +1,5 @@
---
-title: Configure email notifications in Windows Defender ATP
+title: Configure alert notifications in Windows Defender ATP
description: Send email notifications to specified recipients to receive new alerts based on severity with Windows Defender ATP on Windows 10 Enterprise, Pro, and Education editions.
keywords: email notifications, configure alert notifications, windows defender atp notifications, windows defender atp alerts, windows 10 enterprise, windows 10 education
search.product: eADQiWindows 10XVcnh
@@ -10,10 +10,10 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/16/2017
+ms.date: 05/01/2018
---
-# Configure email notifications in Windows Defender ATP
+# Configure alert notifications in Windows Defender ATP
**Applies to:**
@@ -23,7 +23,7 @@ ms.date: 10/16/2017
- Windows 10 Pro Education
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-
+[!include[Prerelease information](prerelease.md)]
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-emailconfig-abovefoldlink)
@@ -41,13 +41,13 @@ The email notification includes basic information about the alert and a link to
## Set up email notifications for alerts
The email notifications feature is turned off by default. Turn it on to start receiving email notifications.
-1. On the navigation pane, select **Preferences setup** > **Email Notifications**.
+1. On the navigation pane, select **Settings** > **Alert notifications**.
2. Toggle the setting between **On** and **Off**.
3. Select the alert severity level that you’d like your recipients to receive:
- - **High** – Select this level to send notifications for high-severity alerts.
- - **Medium** – Select this level to send notifications for medium-severity alerts.
- - **Low** - Select this level to send notifications for low-severity alerts.
- - **Informational** - Select this level to send notification for alerts that might not be considered harmful but good to keep track of.
+ - **High** – Select this level to send notifications for high-severity alerts.
+ - **Medium** – Select this level to send notifications for medium-severity alerts.
+ - **Low** - Select this level to send notifications for low-severity alerts.
+ - **Informational** - Select this level to send notification for alerts that might not be considered harmful but good to keep track of.
4. In **Email recipients to notify on new alerts**, type the email address then select the + sign.
5. Click **Save preferences** when you’ve completed adding all the recipients.
@@ -62,6 +62,7 @@ Here's an example email notification:
1. Select the trash bin icon beside the email address you’d like to remove.
2. Click **Save preferences**.
+
## Troubleshoot email notifications for alerts
This section lists various issues that you may encounter when using email notifications for alerts.
@@ -74,9 +75,7 @@ This section lists various issues that you may encounter when using email notifi
3. Check your email application rules that might be catching and moving your Windows Defender ATP email notifications.
## Related topics
-- [Update general settings in Windows Defender ATP](general-settings-windows-defender-advanced-threat-protection.md)
-- [Turn on advanced features in Windows Defender ATP](advanced-features-windows-defender-advanced-threat-protection.md)
-- [Turn on the preview experience in Windows Defender ATP](preview-settings-windows-defender-advanced-threat-protection.md)
-- [Enable SIEM integration in Windows Defender ATP](enable-siem-integration-windows-defender-advanced-threat-protection.md)
-- [Enable the custom threat intelligence API in Windows Defender ATP](enable-custom-ti-windows-defender-advanced-threat-protection.md)
-- [Create and build Power BI reports](powerbi-reports-windows-defender-advanced-threat-protection.md)
\ No newline at end of file
+- [Update data retention settings](data-retention-settings-windows-defender-advanced-threat-protection.md)
+- [Enable and create Power BI reports using Windows Defender ATP data](powerbi-reports-windows-defender-advanced-threat-protection.md)
+- [Enable Secure Score security controls](enable-secure-score-windows-defender-advanced-threat-protection.md)
+- [Configure advanced features](advanced-features-windows-defender-advanced-threat-protection.md)
\ No newline at end of file
diff --git a/windows/security/threat-protection/windows-defender-atp/configure-endpoints-gp-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/configure-endpoints-gp-windows-defender-advanced-threat-protection.md
index 05863a21ee..e3b7fb8022 100644
--- a/windows/security/threat-protection/windows-defender-atp/configure-endpoints-gp-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/configure-endpoints-gp-windows-defender-advanced-threat-protection.md
@@ -1,7 +1,7 @@
---
-title: Configure Windows Defender ATP endpoints using Group Policy
-description: Use Group Policy to deploy the configuration package on endpoints so that they are onboarded to the service.
-keywords: configure endpoints using group policy, endpoint management, configure Windows ATP endpoints, configure Windows Defender Advanced Threat Protection endpoints, group policy
+title: Onboard Windows 10 machines using Group Policy to Windows Defender ATP
+description: Use Group Policy to deploy the configuration package on Windows 10 machines so that they are onboarded to the service.
+keywords: configure machines using group policy, machine management, configure Windows ATP machines, onboard Windows Defender Advanced Threat Protection machines, group policy
search.product: eADQiWindows 10XVcnh
ms.prod: w10
ms.mktglfcycl: deploy
@@ -10,10 +10,10 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 11/06/2017
+ms.date: 04/24/2018
---
-# Configure endpoints using Group Policy
+# Onboard Windows 10 machines using Group Policy
**Applies to:**
@@ -25,7 +25,7 @@ ms.date: 11/06/2017
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-
+[!include[Prerelease information](prerelease.md)]
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpointsgp-abovefoldlink)
@@ -33,14 +33,18 @@ ms.date: 11/06/2017
> [!NOTE]
> To use Group Policy (GP) updates to deploy the package, you must be on Windows Server 2008 R2 or later.
-## Onboard endpoints
-1. Open the GP configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/):
+## Onboard machines using Group Policy
+1. Open the GP configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/):
+
+ a. In the navigation pane, select **Settings** > **Machine management** > **Onboarding**.
- a. Click **Endpoint management** > **Clients** on the **Navigation pane**.
+ b. Select Windows 10 as the operating system.
+
+ c. In the **Deployment method** field, select **Group policy**.
+
+ d. Click **Download package** and save the .zip file.
- b. Select **Group Policy**, click **Download package** and save the .zip file.
-
-2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the endpoints. You should have a folder called *OptionalParamsPolicy* and the file *WindowsDefenderATPOnboardingScript.cmd*.
+2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the machine. You should have a folder called *OptionalParamsPolicy* and the file *WindowsDefenderATPOnboardingScript.cmd*.
3. Open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx) (GPMC), right-click the Group Policy Object (GPO) you want to configure and click **Edit**.
@@ -57,10 +61,10 @@ ms.date: 11/06/2017
9. Click **OK** and close any open GPMC windows.
>[!TIP]
-> After onboarding the endpoint, you can choose to run a detection test to verify that an endpoint is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Windows Defender ATP endpoint](run-detection-test-windows-defender-advanced-threat-protection.md).
+> After onboarding the machine, you can choose to run a detection test to verify that the machine is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Windows Defender ATP machine](run-detection-test-windows-defender-advanced-threat-protection.md).
## Additional Windows Defender ATP configuration settings
-For each endpoint, you can state whether samples can be collected from the endpoint when a request is made through the Windows Defender ATP portal to submit a file for deep analysis.
+For each machine, you can state whether samples can be collected from the machine when a request is made through the Windows Defender ATP portal to submit a file for deep analysis.
You can use Group Policy (GP) to configure settings, such as settings for the sample sharing used in the deep analysis feature.
@@ -80,7 +84,7 @@ You can use Group Policy (GP) to configure settings, such as settings for the sa
5. Click **Windows components** and then **Windows Defender ATP**.
-6. Choose to enable or disable sample sharing from your endpoints.
+6. Choose to enable or disable sample sharing from your machines.
>[!NOTE]
> If you don't set a value, the default value is to enable sample collection.
@@ -93,7 +97,7 @@ In cases where high-value assets or machines are at high risk, you can configure
> [!NOTE]
> Using the Expedite mode might have an impact on the machine's battery usage and actual bandwidth used for sensor data. You should consider this when these measures are critical.
-For each endpoint, you can configure a registry key value that determines how frequent a machine reports sensor data to the portal.
+For each machine, you can configure a registry key value that determines how frequent a machine reports sensor data to the portal.
The configuration is set through the following registry key entry:
@@ -105,26 +109,28 @@ Value: Normal or Expedite
Where:
+
+|Name|Twitter|
+|---|---|
+|Casey Smith |@subTee|
+|Matt Graeber | @mattifestation|
+|Matt Nelson | @enigma0x3|
+|Oddvar Moe |@Oddvarmoe|
+|Alex Ionescu | @aionescu|
+|Lee Christensen|@tifkin_|
+|Vladas Bulavas | Kaspersky Lab |
+
+
+
+>[!Note]
+>This application list will be updated with the latest vendor information as application vulnerabilities are resolved and new issues are discovered.
+
+Certain software applications may allow additional code to run by design.
+These types of applications should be blocked by your Windows Defender Application Control policy.
+In addition, when an application version is upgraded to fix a security vulnerability or potential Windows Defender Application Control bypass, you should add deny rules to your WDAC policies for that application’s previous, less secure versions.
+
+Microsoft recommends that you install the latest security updates.
+The June 2017 Windows updates resolve several issues in PowerShell modules that allowed an attacker to bypass Windows Defender Application Control.
+These modules cannot be blocked by name or version, and therefore must be blocked by their corresponding hashes.
+
+For October 2017, we are announcing an update to system.management.automation.dll in which we are revoking older versions by hash values, instead of version rules.
+
+Microsoft recommends that you block the following Microsoft-signed applications and PowerShell files by merging the following policy into your existing policy to add these deny rules using the Merge-CIPolicy cmdlet:
+
+```
+
+-
+
diff --git a/windows/security/threat-protection/windows-defender-application-control/plan-windows-defender-application-control-management.md b/windows/security/threat-protection/windows-defender-application-control/plan-windows-defender-application-control-management.md
new file mode 100644
index 0000000000..239ebf291c
--- /dev/null
+++ b/windows/security/threat-protection/windows-defender-application-control/plan-windows-defender-application-control-management.md
@@ -0,0 +1,88 @@
+---
+title: Plan for Windows Defender Application Control policy management (Windows 10)
+description: Plan for Windows Defender Application Control policy management.
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+author: jsuther1974
+ms.date: 02/21/2018
+---
+
+# Plan for Windows Defender Application Control policy management
+
+**Applies to:**
+
+- Windows 10
+- Windows Server 2016
+
+This topic for describes the decisions you need to make to establish the processes for managing and maintaining Windows Defender Application Control (WDAC) policies.
+
+## Policy management
+
+Before you begin the deployment process, consider how the WDAC rules will be managed. Developing a process for managing WDAC rules helps assure that WDAC continues to effectively control how applications are allowed to run in your organization.
+
+### Application and user support policy
+
+Considerations include:
+
+- What type of end-user support is provided for blocked applications?
+- How are new rules added to the policy?
+- How are existing rules updated?
+- Are events forwarded for review?
+
+**Help desk support**
+
+If your organization has an established help desk support department in place, consider the following when deploying WDAC policies:
+
+- What documentation does your support department require for new policy deployments?
+- What are the critical processes in each business group both in work flow and timing that will be affected by application control policies and how could they affect your support department's workload?
+- Who are the contacts in the support department?
+- How will the support department resolve application control issues between the end user and those who maintain the WDAC rules?
+
+**End-user support**
+
+Because WDAC is preventing unapproved apps from running, it is important that your organization carefully plan how to provide end-user support. Considerations include:
+
+- Do you want to use an intranet site as a first line of support for users who have tried to run a blocked app?
+- How do you want to support exceptions to the policy? Will you allow users to run a script to temporarily allow access to a blocked app?
+
+**WDAC event management**
+
+Each time that a process requests permission to run, WDAC creates an event in the CodeIntegrity log. The event details which file tried to run, the attributes of that file, and the user that initiated the request.
+
+Collecting these events in a central location can help you maintain your WDAC policy and troubleshoot rule configuration problems. Event collection technologies such as those available in Windows allow administrators to subscribe to specific event channels and have the events from source computers aggregated into a forwarded event log on a Windows Server operating system collector. For more info about setting up an event subscription, see [Configure Computers to Collect and Forward Events](https://go.microsoft.com/fwlink/p/?LinkId=145012).
+
+### Policy maintenance
+
+As new apps are deployed or existing apps are updated by the software publisher, you will need to make revisions to your rule collections to ensure that the policy is current.
+
+To ensure version control when modifying an WDAC policy, use Group Policy management software that allows you to create versions of Group Policy Objects (GPOs). An example of this type of software is the Advanced Group Policy Management feature from the Microsoft Desktop Optimization Pack. For more info about Advanced Group Policy Management, see [Advanced Group Policy Management Overview](https://go.microsoft.com/fwlink/p/?LinkId=145013) (https://go.microsoft.com/fwlink/p/?LinkId=145013).
+
+**New version of a supported app**
+
+When a new version of an app is deployed in the organization, you need to determine whether to continue to support the previous version of that app. To add the new version, you might only need to create a new rule for each file that is associated with the app. If you are using publisher conditions and the version is not specified, then the existing rule or rules might be sufficient to allow the updated file to run. You must ensure, however, that the updated app has not altered the file names or added files to support new functionality. If so, then you must modify the existing rules or create new rules. To continue to reuse a publisher-based rule without a specific file version, you must also ensure that the file's digital signature is still identical to the previous version—the publisher, product name, and file name (if configured in your rule) must all match for the rule to be correctly applied.
+
+To determine whether a file has been modified during an app update, review the publisher's release details provided with the update package. You can also review the publisher's web page to retrieve this information. Each file can also be inspected to determine the version.
+
+For files that are allowed or denied with file hash conditions, you must retrieve the new file hash. To add support for a new version and maintain support for the older version, you can either create a new file hash rule for the new version or edit the existing rule and add the new file hash to the list of conditions.
+
+For files with path conditions, you should verify that the installation path has not changed from what is stated in the rule. If the path has changed, you need to update the rule before installing the new version of the app
+
+**Recently deployed app**
+
+To support a new app, you must add one or more rules to the existing WDAC policy.
+
+**App is no longer supported**
+
+If your organization has determined that it will no longer support an application that has WDAC rules associated with it, the easiest way to prevent users from running the app is to delete these rules.
+
+## Next steps
+
+After deciding how your organization will manage your WDAC policy, record your findings.
+
+- **End-user support policy.** Document the process that you will use for handling calls from users who have attempted to run a blocked app, and ensure that support personnel have clear escalation steps so that the administrator can update the WDAC policy, if necessary.
+- **Event processing.** Document whether events will be collected in a central location called a store, how that store will be archived, and whether the events will be processed for analysis.
+- **Policy maintenance.** Detail how rules will be added to the policy and in which GPO the rules are defined.
+
+For information and steps how to document your processes, see [Document your application control management processes](document-your-windows-defender-application-control-management-processes.md).
diff --git a/windows/security/threat-protection/device-guard/deploy-windows-defender-application-control-policy-rules-and-file-rules.md b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md
similarity index 66%
rename from windows/security/threat-protection/device-guard/deploy-windows-defender-application-control-policy-rules-and-file-rules.md
rename to windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md
index 891d33a3be..3ebdf18aaf 100644
--- a/windows/security/threat-protection/device-guard/deploy-windows-defender-application-control-policy-rules-and-file-rules.md
+++ b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md
@@ -1,48 +1,36 @@
---
-title: Deploy code integrity policies - policy rules and file rules (Windows 10)
-description: This article provides information about two elements in code integrity policies, called policy rules and file rules. Code integrity policies are part of Windows Defender Device Guard in Windows 10.
-keywords: virtualization, security, malware
+title: Select the types of rules to create (Windows 10)
+description: Select the types of rules to create.
ms.prod: w10
ms.mktglfcycl: deploy
-ms.localizationpriority: high
-author: brianlic-msft
-ms.date: 10/20/2017
+ms.sitesec: library
+ms.pagetype: security
+author: jsuther1974
+ms.date: 04/20/2018
---
-# Deploy Windows Defender Application Control: policy rules and file rules
+# Deploy Windows Defender Application Control policy rules and file rules
-**Applies to**
-- Windows 10
-- Windows Server 2016
+**Applies to:**
-Windows Defender Application Control (WDAC) provides control over a computer running Windows 10 by specifying whether a driver or application is trusted and can be run. For an overview of WDAC, see:
-- [How Windows Defender Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md#how-windows-defender-device-guard-features-help-protect-against-threats) in "Introduction to Windows Defender Device Guard: virtualization-based security and Windows Defender Application Control."
-- [Windows Defender Application Control policy formats and signing](requirements-and-deployment-planning-guidelines-for-device-guard.md#windows-defender-application-control-policy-formats-and-signing) in "Requirements and deployment planning guidelines for Windows Defender Device Guard."
+- Windows 10
+- Windows Server 2016
-If you already understand the basics of WDAC and want procedures for creating, auditing, and merging WDAC policies, see [Deploy Windows Defender Application Control: steps](steps-to-deploy-windows-defender-application-control.md).
-
-This topic includes the following sections:
-
-- [Overview of the process of creating Windows Defender Application Control policies](#overview-of-the-process-of-creating-windows-defender-application-control-policies): Helps familiarize you with the process described in this and related topics.
-- [Windows Defender Application Control policy rules](#windows-defender-application-control-policy-rules): Describes one key element you specify in a policy, the *policy rules*, which control options such as audit mode or whether user mode code integrity (UMCI) is enabled in a WDAC policy.
-- [Windows Defender Application Control file rule levels](#windows-defender-application-control-file-rule-levels): Describes the other key element you specify in a policy, the *file rules* (or *file rule levels*), which specify the level at which applications will be identified and trusted.
-- [Example of file rule levels in use](#example-of-file-rule-levels-in-use): Gives an example of how file rule levels can be applied.
+Windows Defender Application Control (WDAC) provides control over a computer running Windows 10 by using policies that specify whether a driver or application is trusted and can be run. A policy includes *policy rules* that control options such as audit mode or whether user mode code integrity (UMCI) is enabled in a WDAC policy, and *file rules* (or *file rule levels*) that specify the level at which applications will be identified and trusted.
## Overview of the process of creating Windows Defender Application Control policies
-A common system imaging practice in today’s IT organization is to establish a “golden” image as a reference for what an ideal system should look like, and then use that image to clone additional company assets. WDAC policies follow a similar methodology, that begins with the establishment of a golden computer. As with imaging, you can have multiple golden computers based on model, department, application set, and so on. Although the thought process around the creation of WDAC policies is similar to imaging, these policies should be maintained independently. Assess the necessity of additional WDAC policies based on what should be allowed to be installed and run and for whom. For more details on doing this assessment, see the planning steps in [Planning and getting started on the Windows Defender Device Guard deployment process](planning-and-getting-started-on-the-device-guard-deployment-process.md).
+A common system imaging practice in today’s IT organization is to establish a “golden” image as a reference for what an ideal system should look like, and then use that image to clone additional company assets. WDAC policies follow a similar methodology, that begins with the establishment of a golden computer. As with imaging, you can have multiple golden computers based on model, department, application set, and so on. Although the thought process around the creation of WDAC policies is similar to imaging, these policies should be maintained independently. Assess the necessity of additional WDAC policies based on what should be allowed to be installed and run and for whom. For more details on doing this assessment, see the [WDAC Design Guide](windows-defender-application-control-design-guide.md).
> **Note** Each computer can have only **one** WDAC policy at a time. Whichever way you deploy this policy, it is renamed to SIPolicy.p7b and copied to **C:\\Windows\\System32\\CodeIntegrity** and, for UEFI computers, **<EFI System Partition>\\Microsoft\\Boot**. Keep this in mind when you create your WDAC policies.
Optionally, WDAC can align with your software catalog as well as any IT department–approved applications. One straightforward method to implement WDAC is to use existing images to create one master WDAC policy. You do so by creating a WDAC policy from each image, and then by merging the policies. This way, what is installed on all of those images will be allowed to run, if the applications are installed on a computer based on a different image. Alternatively, you may choose to create a base applications policy and add policies based on the computer’s role or department. Organizations have a choice of how their policies are created, merged or serviced, and managed.
-If you plan to use an internal CA to sign catalog files or WDAC policies, see the steps in [Optional: Create a code signing certificate for Windows Defender Application Control](optional-create-a-code-signing-certificate-for-windows-defender-application-control.md).
+If you plan to use an internal CA to sign catalog files or WDAC policies, see the steps in [Optional: Create a code signing certificate for Windows Defender Application Control](create-code-signing-cert-for-windows-defender-application-control.md).
## Windows Defender Application Control policy rules
-WDAC policies include *policy rules*, which control options such as audit mode or whether UMCI is enabled in a WDAC policy. You can modify these options in a new or existing WDAC policy. (For information about *file rules*, which specify the level at which applications will be identified and trusted, see the next section, [Windows Defender Application Control file rule levels](#windows-defender-application-control-file-rule-levels).)
-
-To modify the policy rule options of an existing WDAC policy, use the [Set-RuleOption](https://technet.microsoft.com/library/mt634483.aspx) Windows PowerShell cmdlet. Note the following examples of how to use this cmdlet to add and remove a rule option on an existing WDAC policy:
+To modify the policy rule options of an existing WDAC policy, use [Set-RuleOption](https://docs.microsoft.com/powershell/module/configci/set-ruleoption). Note the following examples of how to use this cmdlet to add and remove a rule option on an existing WDAC policy:
- To ensure that UMCI is enabled for a WDAC policy that was created with the `-UserPEs` (user mode) option, add rule option 0 to an existing policy by running the following command:
@@ -54,12 +42,10 @@ To modify the policy rule options of an existing WDAC policy, use the [Set-RuleO
` Set-RuleOption -FilePath
Lists of approved applications rarely change.
Examples: kiosks, point-of-sale systems, call center computers. | WDAC can be deployed fully, and deployment and ongoing administration are relatively straightforward.
After WDAC deployment, only approved applications can run. This is because of protections offered by WDAC. |
+| **Fully managed devices**: Allowed software is restricted by IT department.
Users can request additional software, or install from a list of applications provided by IT department.
Examples: locked-down, company-owned desktops and laptops. | An initial baseline WDAC policy can be established and enforced. Whenever the IT department approves additional applications, it will update the WDAC policy and (for unsigned LOB applications) the catalog.
WDAC policies are supported by the HVCI service. |
+| **Lightly managed devices**: Company-owned, but users are free to install software.
Devices are required to run organization's antivirus solution and client management tools. | WDAC can be used to help protect the kernel, and to monitor (audit) for problem applications rather than limiting the applications that can be run. |
+| **Bring Your Own Device**: Employees are allowed to bring their own devices, and also use those devices away from work. | WDAC does not apply. Instead, you can explore other hardening and security features with MDM-based conditional access solutions, such as Microsoft Intune. |
+
+
+## Related topics
+
+- [Windows Defender Application Control Design Guide](windows-defender-application-control-design-guide.md)
+- [Windows Defender Application Control Deployment Guide](windows-defender-application-control-deployment-guide.md)
+
+
diff --git a/windows/security/threat-protection/windows-defender-application-control/understand-windows-defender-application-control-policy-design-decisions.md b/windows/security/threat-protection/windows-defender-application-control/understand-windows-defender-application-control-policy-design-decisions.md
new file mode 100644
index 0000000000..0148e43cae
--- /dev/null
+++ b/windows/security/threat-protection/windows-defender-application-control/understand-windows-defender-application-control-policy-design-decisions.md
@@ -0,0 +1,138 @@
+---
+title: Understand Windows Defender Application Control policy design decisions (Windows 10)
+description: Understand Windows Defender Application Control policy design decisions.
+ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+author: jsuther1974
+ms.date: 02/08/2018
+---
+
+# Understand Windows Defender Application Control policy design decisions
+
+**Applies to:**
+
+- Windows 10
+- Windows Server 2016
+
+This topic for the IT professional lists the design questions, possible answers, and ramifications of the decisions when you plan a deployment of application control policies by using Windows Defender Application Control (WDAC) within a Windows operating system environment.
+
+When you begin the design and planning process, you should consider the ramifications of your design choices. The resulting decisions will affect your policy deployment scheme and subsequent application control policy maintenance.
+
+You should consider using WDAC as part of your organization's application control policies if all the following are true:
+
+- You have deployed or plan to deploy the supported versions of Windows in your organization.
+- You need improved control over the access to your organization's applications and the data your users access.
+- The number of applications in your organization is known and manageable.
+- You have resources to test policies against the organization's requirements.
+- You have resources to involve Help Desk or to build a self-help process for end-user application access issues.
+- The group's requirements for productivity, manageability, and security can be controlled by restrictive policies.
+
+The following questions are not in priority or sequential order. They should be considered when you deploy application control policies (as appropriate for your targeted environment).
+
+### Which apps do you need to control in your organization?
+
+You might need to control a limited number of apps because they access sensitive data, or you might have to exclude all applications except those that are sanctioned for business purposes. There might be certain business groups that require strict control, and others that promote independent application usage.
+
+| Possible answers | Design considerations|
+| - | - |
+| Control all apps | WDAC policies control applications by creating an allowed list of applications. Exceptions are also possible. WDAC policies can only be applied to applications installed on computers running Windows 10 . |
+| Control specific apps | When you create WDAC rules, a list of allowed apps are created. All apps on that list will be allowed to run (except those on the exception list). Apps that are not on the list will be prevented from running. WDAC policies can only be applied to apps installed on computers running Windows 10 or Windows Server 2016. |
+|Control only Classic Windows applications, only Universal Windows apps, or both| WDAC policies control apps by creating an allowed list of apps based on code signing certificate and\or file hash information. Because Universal Windows apps are all signed by the Windows Store, Classic Windows applications and Universal Windows apps can be controlled together. WDAC policies for Universal Windows apps can be applied only to apps that are installed on PCs that support the Microsoft Store, but Classic Windows applications can be controlled with WDAC on Windows. The rules you currently have configured for Classic Windows applications can remain, and you can create new ones for Universal Windows apps.|
+| Control apps by business group | WDAC policies can be applied through a Group Policy Object (GPO) to computer objects within an organizational unit (OU). |
+| Control apps by computer, not user | WDAC is a computer-based policy implementation. If your domain or site organizational structure is not based on a logical user structure, such as an OU, you might want to set up that structure before you begin your WDAC planning. Otherwise, you will have to identify users, their computers, and their app access requirements.|
+|Understand app usage, but there is no need to control any apps yet | WDAC policies can be set to audit app usage to help you track which apps are used in your organization. You can then use teh CodeIntegrity log in Event Viewer to create WDAC policies.|
+
+### How do you currently control app usage in your organization?
+
+Most organizations have evolved app control policies and methods over time. With heightened security concerns and an emphasis on tighter IT control over desktop use, your organization might decide to consolidate app control practices or design a comprehensive application control scheme. WDAC includes improvements over AppLocker and SRP in the architecture and management of application control policies.
+
+| Possible answers | Design considerations |
+| - | - |
+| Security polices (locally set or through Mobile Device Management (MDM) or Group Policy) | Using WDAC requires increased effort in planning to create correct policies, but this results in a simpler distribution method.|
+| Non-Microsoft app control software | Using WDAC requires a complete app control policy evaluation and implementation.|
+| Managed usage by group or OU | Using WDAC requires a complete app control policy evaluation and implementation.|
+| Authorization Manager or other role-based access technologies | Using WDAC requires a complete app control policy evaluation and implementation.|
+| Other | Using WDAC requires a complete app control policy evaluation and implementation.|
+
+### Are there specific groups in your organization that need customized application control policies?
+
+Most business groups or departments have specific security requirements that pertain to data access and the applications used to access that data. You should consider the scope of the project for each group and the group’s priorities before you deploy application control policies for the entire organization.
+
+| Possible answers | Design considerations |
+| - | - |
+| Yes | For each group, you need to create a list that includes their application control requirements. Although this may increase the planning time, it will most likely result in a more effective deployment.
If your GPO structure is not currently configured so that you can apply different policies to specific groups, you can alternatively apply WDAC rules in a GPO to specific user groups.|
+| No | WDAC policies can be applied globally to applications that are installed on PCs running Windows 10. Depending on the number of apps you need to control, managing all the rules and exceptions might be challenging.|
+
+### Does your IT department have resources to analyze application usage, and to design and manage the policies?
+
+The time and resources that are available to you to perform the research and analysis can affect the detail of your plan and processes for continuing policy management and maintenance.
+
+| Possible answers | Design considerations |
+| - | - |
+| Yes | Invest the time to analyze your organization's application control requirements, and plan a complete deployment that uses rules that are as simply constructed as possible.|
+| No | Consider a focused and phased deployment for specific groups by using a small number of rules. As you apply controls to applications in a specific group, learn from that deployment to plan your next deployment. |
+
+### Does your organization have Help Desk support?
+
+Preventing your users from accessing known, deployed, or personal applications will initially cause an increase in end-user support. It will be necessary to address the various support issues in your organization so security policies are followed and business workflow is not hampered.
+
+| Possible answers | Design considerations |
+| - | - |
+| Yes | Involve the support department early in the planning phase because your users may inadvertently be blocked from using their applications, or they may seek exceptions to use specific applications. |
+| No | Invest time in developing online support processes and documentation before deployment. |
+
+
+### Do you know what applications require restrictive policies?
+Any successful application control policy implementation is based on your knowledge and understanding of app usage within the organization or business group. In addition, the application control design is dependent on the security requirements for data and the apps that access that data.
+
+| Possible answers | Design considerations |
+| - | - |
+| Yes | You should determine the application control priorities for a business group and then attempt to design the simplest scheme for their application control policies. |
+| No | You will have to perform an audit and requirements gathering project to discover the application usage. WDAC provides the means to deploy policies in audit mode.|
+
+### How do you deploy or sanction applications (upgraded or new) in your organization?
+
+Implementing a successful application control policy is based on your knowledge and understanding of application usage within the organization or business group. In addition, the application control design is dependent on the security requirements for data and the applications that access that data. Understanding the upgrade and deployment policy will help shape the construction of the application control policies.
+
+| Possible answers | Design considerations |
+| - | - |
+| Ad hoc | You need to gather requirements from each group. Some groups might want unrestricted access or installation, while other groups might want strict controls.|
+| Strict written policy or guidelines to follow | You need to develop WDAC rules that reflect those policies, and then test and maintain the rules. |
+| No process in place | You need to determine if you have the resources to develop an application control policy, and for which groups. |
+
+### What are your organization's priorities when implementing application control policies?
+
+Some organizations will benefit from application control policies as shown by an increase in productivity or conformance, while others will be hindered in performing their duties. Prioritize these aspects for each group to allow you to evaluate the effectiveness of WDAC.
+
+| Possible answers | Design considerations |
+| - | - |
+| Productivity: The organization assures that tools work and required applications can be installed. | To meet innovation and productivity goals, some groups require the ability to install and run a variety of software from different sources, including software that they developed. Therefore, if innovation and productivity is a high priority, managing application control policies through an allowed list might be time consuming and an impediment to progress. |
+| Management: The organization is aware of and controls the apps it supports. | In some business groups, application usage can be managed from a central point of control. WDAC policies can be built into a GPO for that purpose. This shifts the burden of app access to the IT department, but it also has the benefit of controlling the number of apps that can be run and controlling the versions of those apps|
+| Security: The organization must protect data in part by ensuring that only approved apps are used. | WDAC can help protect data by allowing a defined set of users access to apps that access the data. If security is the top priority, the application control policies will be the most restrictive.|
+
+### How are apps currently accessed in your organization?
+
+WDAC is very effective for organizations that have application restriction requirements if they have environments with a simple topography and application control policy goals that are straightforward. For example, WDAC can benefit an environment where non-employees have access to computers that are connected to the organizational network, such as a school or library. Large organizations also benefit from WDAC policy deployment when the goal is to achieve a detailed level of control on the desktop computers with a relatively small number of applications to manage, or when the applications are manageable with a small number of rules.
+
+| Possible answers | Design considerations |
+| - | - |
+| Users run without administrative rights. | Apps are installed by using an installation deployment technology.|
+| WDAC can help reduce the total cost of ownership for business groups that typically use a finite set of apps, such as human resources and finance departments. At the same time, these departments access highly sensitive information, much of which contains confidential and proprietary information. By using WDAC to create rules for specific apps that are allowed to run, you can help limit unauthorized applications from accessing this information.
**Note: **WDAC can also be effective in helping create standardized desktops in organizations where users run as administrators. | Users must be able to install applications as needed.
+| Users currently have administrator access, and it would be difficult to change this.|Enforcing WDAC rules is not suited for business groups that must be able to install apps as needed and without approval from the IT department. If one or more OUs in your organization has this requirement, you can choose not to enforce application rules in those OUs by using WDAC or to implement the audit only enforcement setting.|
+
+### Is the structure in Active Directory Domain Services based on the organization's hierarchy?
+
+Designing application control policies based on an organizational structure that is already built into Active Directory Domain Services (AD DS) is easier than converting the existing structure to an organizational structure.
+Because the effectiveness of application control policies is dependent on the ability to update policies, consider what organizational work needs to be accomplished before deployment begins.
+
+| Possible answers | Design considerations |
+| - | - |
+| Yes | WDAC rules can be developed and implemented through Group Policy, based on your AD DS structure.|
+| No | The IT department must create a scheme to identify how application control policies can be applied to the correct user or computer.|
+
+## Record your findings
+
+The next step in the process is to record and analyze your answers to the preceding questions. If WDAC is the right solution for your goals, you can set your application control policy objectives and plan your WDAC rules.
\ No newline at end of file
diff --git a/windows/security/threat-protection/windows-defender-application-control/use-code-signing-to-simplify-application-control-for-classic-windows-applications.md b/windows/security/threat-protection/windows-defender-application-control/use-code-signing-to-simplify-application-control-for-classic-windows-applications.md
new file mode 100644
index 0000000000..94fa8ec867
--- /dev/null
+++ b/windows/security/threat-protection/windows-defender-application-control/use-code-signing-to-simplify-application-control-for-classic-windows-applications.md
@@ -0,0 +1,62 @@
+---
+title: Use code signing to simplify application control for classic Windows applications (Windows 10)
+description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core.
+ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.localizationpriority: high
+author: jsuther1974
+ms.date: 02/27/2018
+---
+
+# Use code signing to simplify application control for classic Windows applications
+
+**Applies to:**
+
+- Windows 10
+- Windows Server 2016
+
+This topic covers guidelines for using code signing control classic Windows apps.
+
+## Reviewing your applications: application signing and catalog files
+
+Typically, WDAC policies are configured to use the application's signing certificate as part or all of what identifies the application as trusted. This means that applications must either use embedded signing—where the signature is part of the binary—or catalog signing, where you generate a “catalog file” from the applications, sign it, and through the signed catalog file, configure the WDAC policy to recognize the applications as signed.
+
+Catalog files can be very useful for unsigned LOB applications that cannot easily be given an embedded signature. However, catalogs need to be updated each time an application is updated. In contrast, with embedded signing, your WDAC policies typically do not have to be updated when an application is updated. For this reason, if code-signing is or can be included in your in-house application development process, it can simplify the management of WDAC (compared to using catalog signing).
+
+To obtain signed applications or embed signatures in your in-house applications, you can choose from a variety of methods:
+
+- Using the Microsoft Store publishing process. All apps that come out of the Microsoft Store are automatically signed with special signatures that can roll-up to our certificate authority (CA) or to your own.
+
+- Using your own digital certificate or public key infrastructure (PKI). ISV's and enterprises can sign their own Classic Windows applications themselves, adding themselves to the trusted list of signers.
+
+- Using a non-Microsoft signing authority. ISV's and enterprises can use a trusted non-Microsoft signing authority to sign all of their own Classic Windows applications.
+
+To use catalog signing, you can choose from the following options:
+
+- Use the Windows Defender Device Guard signing portal available in the Microsoft Store for Business and Education. The portal is a Microsoft web service that you can use to sign your Classic Windows applications. For more information, see [Device Guard signing](https://technet.microsoft.com/itpro/windows/manage/device-guard-signing-portal).
+
+- Create your own catalog files, which are described in the next section.
+
+### Catalog files
+
+Catalog files (which you can create in Windows 10 with a tool called Package Inspector) contain information about all deployed and executed binary files associated with your trusted but unsigned applications. When you create catalog files, you can also include signed applications for which you do not want to trust the signer but rather the specific application. After creating a catalog, you must sign the catalog file itself by using enterprise public key infrastructure (PKI), or a purchased code signing certificate. Then you can distribute the catalog, so that your trusted applications can be handled by WDAC in the same way as any other signed application.
+
+Catalog files are simply Secure Hash Algorithm 2 (SHA2) hash lists of discovered binaries. These binaries’ hash values are updated each time an application is updated, which requires the catalog file to be updated also.
+
+After you have created and signed your catalog files, you can configure your WDAC policies to trust the signer or signing certificate of those files.
+
+> [!NOTE]
+> Package Inspector only works on operating systems that support Windows Defender Device Guard, such as Windows 10 Enterprise, Windows 10 Education, Windows 2016 Server, or Windows Enterprise IoT.
+
+For procedures for working with catalog files, see [Deploy catalog files to support Windows Defender Application Control](deploy-catalog-files-to-support-windows-defender-application-control.md).
+
+## Windows Defender Application Control policy formats and signing
+
+When you generate a WDAC policy, you are generating a binary-encoded XML document that includes configuration settings for both the User and Kernel-modes of Windows 10 Enterprise, along with restrictions on Windows 10 script hosts. You can view your original XML document in a text editor, for example if you want to check the rule options that are present in the **<Rules>** section of the file.
+
+We recommend that you keep the original XML file for use when you need to merge the WDAC policy with another policy or update its rule options. For deployment purposes, the file is converted to a binary format, which can be done using a simple Windows PowerShell command.
+
+When the WDAC policy is deployed, it restricts the software that can run on a device. The XML document can be signed, helping to add additional protection against administrative users changing or removing the policy.
\ No newline at end of file
diff --git a/windows/security/threat-protection/windows-defender-application-control/use-device-guard-signing-portal-in-microsoft-store-for-business.md b/windows/security/threat-protection/windows-defender-application-control/use-device-guard-signing-portal-in-microsoft-store-for-business.md
new file mode 100644
index 0000000000..fd0fd8af09
--- /dev/null
+++ b/windows/security/threat-protection/windows-defender-application-control/use-device-guard-signing-portal-in-microsoft-store-for-business.md
@@ -0,0 +1,18 @@
+---
+title: Use the Device Guard Signing Portal in the Microsoft Store for Business (Windows 10)
+description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core.
+ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+author: jsuther1974
+ms.date: 02/28/2018
+---
+
+# Optional: Use the Device Guard Signing Portal in the Microsoft Store for Business
+
+**Applies to:**
+
+- Windows 10
+- Windows Server 2016
\ No newline at end of file
diff --git a/windows/security/threat-protection/windows-defender-application-control/use-signed-policies-to-protect-windows-defender-application-control-against-tampering.md b/windows/security/threat-protection/windows-defender-application-control/use-signed-policies-to-protect-windows-defender-application-control-against-tampering.md
new file mode 100644
index 0000000000..34188e138e
--- /dev/null
+++ b/windows/security/threat-protection/windows-defender-application-control/use-signed-policies-to-protect-windows-defender-application-control-against-tampering.md
@@ -0,0 +1,86 @@
+---
+title: Use signed policies to protect Windows Defender Application Control against tampering (Windows 10)
+description: Signed WDAC policies give organizations the highest level of malware protection available in Windows 10.
+ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.localizationpriority: high
+author: jsuther1974
+ms.date: 02/27/2018
+---
+
+# Use signed policies to protect Windows Defender Application Control against tampering
+
+**Applies to:**
+
+- Windows 10
+- Windows Server 2016
+
+
+Signed WDAC policies give organizations the highest level of malware protection available in Windows 10.
+In addition to their enforced policy rules, signed policies cannot be modified or deleted by a user or administrator on the computer.
+These policies are designed to prevent administrative tampering and kernel mode exploit access.
+With this in mind, it is much more difficult to remove signed WDAC policies.
+Before you sign and deploy a signed WDAC policy, we recommend that you [audit the policy](audit-windows-defender-application-control-policies.md) to discover any blocked applications that should be allowed to run.
+
+Signing WDAC policies by using an on-premises CA-generated certificate or a purchased code signing certificate is straightforward.
+If you do not currently have a code signing certificate exported in .pfx format (containing private keys, extensions, and root certificates), see [Optional: Create a code signing certificate for Windows Defender Application Control](create-code-signing-cert-for-windows-defender-application-control.md) to create one with your on-premises CA.
+
+Before signing WDAC policies for the first time, be sure to enable rule options 9 (“Advanced Boot Options Menu”) and 10 (“Boot Audit on Failure”) to leave troubleshooting options available to administrators. To ensure that a rule option is enabled, you can run a command such as `Set-RuleOption -FilePath
Deployment is simpler if everything is locked down in the same way, but meeting individual departments’ needs, and working with a wide variety of devices, may require a more complicated and flexible deployment.
+
+3. Review how much variety in software and hardware is needed by roles or departments. The following questions can help you clarify how many WDAC policies to create:
+
+ - How standardized is the hardware?
This can be relevant because of drivers. You could create a WDAC policy on hardware that uses a particular set of drivers, and if other drivers in your environment use the same signature, they would also be allowed to run. However, you might need to create several WDAC policies on different "reference" hardware, then merge the policies together, to ensure that the resulting policy recognizes all the drivers in your environment.
+
+ - What software does each department or role need? Should they be able to install and run other departments’ software?
If multiple departments are allowed to run the same list of software, you might be able to merge several WDAC policies to simplify management.
+
+ - Are there departments or roles where unique, restricted software is used?
If one department needs to run an application that no other department is allowed, it might require a separate WDAC policy. Similarly, if only one department must run an old version of an application (while other departments allow only the newer version), it might require a separate WDAC policy.
+
+ - Is there already a list of accepted applications?
A list of accepted applications can be used to help create a baseline WDAC policy.
As of Windows 10, version 1703, it might also be useful to have a list of plug-ins, add-ins, or modules that you want to allow only in a specific app (such as a line-of-business app). Similarly, it might be useful to have a list of plug-ins, add-ins, or modules that you want to block in a specific app (such as a browser).
+
+ - As part of a threat review process, have you reviewed systems for software that can load arbitrary DLLs or run code or scripts?
+ In day-to-day operations, your organization’s security policy may allow certain applications, code, or scripts to run on your systems depending on their role and the context. However, if your security policy requires that you run only trusted applications, code, and scripts on your systems, you may decide to lock these systems down securely with Windows Defender Application Control policies.
+
+ Legitimate applications from trusted vendors provide valid functionality. However, an attacker could also potentially use that same functionality to run malicious executable code that could bypass WDAC.
+
+ For operational scenarios that require elevated security, certain applications with known Code Integrity bypasses may represent a security risk if you whitelist them in your WDAC policies. Other applications where older versions of the application had vulnerabilities also represent a risk. Therefore, you may want to deny or block such applications from your WDAC policies. For applications with vulnerabilities, once the vulnerabilities are fixed you can create a rule that only allows the fixed or newer versions of that application. The decision to allow or block applications depends on the context and on how the reference system is being used.
+
+ Security professionals collaborate with Microsoft continuously to help protect customers. With the help of their valuable reports, Microsoft has identified a list of known applications that an attacker could potentially use to bypass Windows Defender Application Control. Depending on the context, you may want to block these applications. To view this list of applications and for use case examples, such as disabling msbuild.exe, see [Microsoft recommended block rules](microsoft-recommended-block-rules.md).
+
+4. Identify LOB applications that are currently unsigned. Although requiring signed code (through WDAC) protects against many threats, your organization might use unsigned LOB applications, for which the process of signing might be difficult. You might also have applications that are signed, but you want to add a secondary signature to them. If so, identify these applications, because you will need to create a catalog file for them.
+
+## Getting started on the deployment process
+
+1. Optionally, create a signing certificate for Windows Defender Application Control. As you deploy WDAC, you might need to sign catalog files or WDAC policies internally. To do this, you will either need a publicly issued code signing certificate (that you purchase) or an internal CA. If you choose to use an internal CA, you will need to [create a code signing certificate](create-code-signing-cert-for-windows-defender-application-control.md).
+
+2. Create WDAC policies from reference computers. In this respect, creating and managing WDAC policies to align with the needs of roles or departments can be similar to managing corporate images. From each reference computer, you can create a WDAC policy, and decide how to manage that policy. You can [merge](merge-windows-defender-application-control-policies.md) WDAC policies to create a broader policy or a master policy, or you can manage and deploy each policy individually.
+
+3. Audit the WDAC policy and capture information about applications that are outside the policy. We recommend that you use [audit mode](audit-windows-defender-application-control-policies.md) to carefully test each WDAC policy before you enforce it. With audit mode, no application is blocked—the policy just logs an event whenever an application outside the policy is started. Later, you can expand the policy to allow these applications, as needed.
+
+4. Create a [catalog file](deploy-catalog-files-to-support-windows-defender-application-control.md) for unsigned LOB applications. Use the Package Inspector tool to create and sign a catalog file for your unsigned LOB applications. In later steps, you can merge the catalog file's signature into your WDAC policy, so that applications in the catalog will be allowed by the policy.
+
+6. Capture needed policy information from the event log, and merge information into the existing policy as needed. After a WDAC policy has been running for a time in audit mode, the event log will contain information about applications that are outside the policy. To expand the policy so that it allows for these applications, use Windows PowerShell commands to capture the needed policy information from the event log, and then merge that information into the existing policy. You can merge WDAC policies from other sources also, for flexibility in how you create your final WDAC policies.
+
+7. Deploy WDAC policies and catalog files. After you confirm that you have completed all the preceding steps, you can begin deploying catalog files and taking WDAC policies out of auditing mode. We strongly recommend that you begin this process with a test group of users. This provides a final quality-control validation before you deploy the catalog files and WDAC policies more broadly.
+
+8. Enable desired virtualization-based security (VBS) features. Hardware-based security features—also called virtualization-based security (VBS) features—strengthen the protections offered by Windows Defender Application Control.
+
+ > [!WARNING]
+ > Virtualization-based protection of code integrity may be incompatible with some devices and applications. We strongly recommend testing this configuration in your lab before enabling virtualization-based protection of code integrity on production systems. Failure to do so may result in unexpected failures up to and including data loss or a blue screen error (also called a stop error).
diff --git a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-design-guide.md b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-design-guide.md
new file mode 100644
index 0000000000..06f9907511
--- /dev/null
+++ b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-design-guide.md
@@ -0,0 +1,31 @@
+---
+title: Windows Defender Application Control design guide (Windows 10)
+description: Microsoft Windows Defender Device Guard is a feature set that consists of both hardware and software system integrity hardening features that revolutionize the Windows operating system’s security.
+keywords: virtualization, security, malware
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.localizationpriority: high
+author: brianlic-msft
+ms.date: 02/20/2018
+---
+
+# Windows Defender Application Control design guide
+
+**Applies to**
+ - Windows 10
+ - Windows Server
+
+This guide covers design and planning for Windows Defender Application Control (WDAC). It is intended to help security architects, security administrators, and system administrators create a plan that addresses specific application control requirements for different departments or business groups within an organization.
+
+
+## In this section
+
+| Topic | Description |
+| - | - |
+| [Understand WDAC policy design decisions](understand-windows-defender-application-control-policy-design-decisions.md) | This topic lists the design questions, possible answers, and ramifications of the decisions when you plan a deployment of application control policies. |
+| [Select the types of rules to create](select-types-of-rules-to-create.md) | This topic lists resources you can use when selecting your application control policy rules by using WDAC. |
+| [Plan for WDAC policy management](plan-windows-defender-application-control-management.md) | This topic describes the decisions you need to make to establish the processes for managing and maintaining WDAC policies. |
+| [Create your WDAC planning document](create-your-windows-defender-application-control-planning-document.md) | This planning topic summarizes the information you need to research and include in your planning document. |
+
+After planning is complete, the next step is to deploy WDAC. The [Windows Defender Application Control Deployment Guide](windows-defender-application-control-deployment-guide.md) covers the creation and testing of policies, deploying the enforcement setting, and managing and maintaining the policies.
+
\ No newline at end of file
diff --git a/windows/security/threat-protection/windows-defender-application-control.md b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control.md
similarity index 95%
rename from windows/security/threat-protection/windows-defender-application-control.md
rename to windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control.md
index 74adeafb06..298f03c997 100644
--- a/windows/security/threat-protection/windows-defender-application-control.md
+++ b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control.md
@@ -6,8 +6,9 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: high
author: jsuther1974
-ms.date: 01/24/2018
+ms.date: 02/27/2018
---
# Windows Defender Application Control
@@ -36,7 +37,7 @@ WDAC policies also block unsigned scripts and MSIs, and Windows PowerShell runs
## WDAC System Requirements
WDAC policies can only be created on computers running Windows 10 Enterprise or Windows Server 2016.
-They can be applied to computers running any edition of Windows 10 and managed via Mobile Device Management (MDM), such as Microsoft Intune.
+They can be applied to computers running any edition of Windows 10 or Windows Server 2016 and managed via Mobile Device Management (MDM), such as Microsoft Intune.
Group Policy can also be used to distribute Group Policy Objects that contain WDAC policies on computers running Windows 10 Enterprise or Windows Server 2016.
## New and changed functionality
diff --git a/windows/security/threat-protection/windows-defender-application-guard/configure-wd-app-guard.md b/windows/security/threat-protection/windows-defender-application-guard/configure-wd-app-guard.md
index 5ed68d6744..872058c8f7 100644
--- a/windows/security/threat-protection/windows-defender-application-guard/configure-wd-app-guard.md
+++ b/windows/security/threat-protection/windows-defender-application-guard/configure-wd-app-guard.md
@@ -12,14 +12,15 @@ ms.date: 10/19/2017
# Configure Windows Defender Application Guard policy settings
-**Applies to:**
-- Windows 10 Enterpise edition, version 1709
-
Windows Defender Application Guard (Application Guard) works with Group Policy to help you manage your organization's computer settings. By using Group Policy, you can configure a setting once, and then copy it onto many computers. For example, you can set up multiple security settings in a GPO, which is linked to a domain, and then apply all those settings to every computer in the domain.
Application Guard uses both network isolation and application-specific settings.
### Network isolation settings
+
+**Applies to:**
+- Windows 10 Enterpise edition, version 1709 or higher
+
These settings, located at **Computer Configuration\Administrative Templates\Network\Network Isolation**, help you define and manage your company's network boundaries. Application Guard uses this information to automatically transfer any requests to access the non-corporate resources into the Application Guard container.
>[!NOTE]
@@ -30,17 +31,17 @@ These settings, located at **Computer Configuration\Administrative Templates\Net
|-----------|------------------|-----------|
|Private network ranges for apps|At least Windows Server 2012, Windows 8, or Windows RT|A comma-separated list of IP address ranges that are in your corporate network. Included endpoints or endpoints that are included within a specified IP address range, are rendered using Microsoft Edge and won't be accessible from the Application Guard environment.|
|Enterprise resource domains hosted in the cloud|At least Windows Server 2012, Windows 8, or Windows RT|A pipe-separated (\|) list of your domain cloud resources. Included endpoints are rendered using Microsoft Edge and won't be accessible from the Application Guard environment. Notes: 1) Please include a full domain name (www.contoso.com) in the configuration 2) You may optionally use "." as a wildcard character to automatically trust subdomains. Configuring ".constoso.com" will automatically trust "subdomain1.contoso.com", "subdomain2.contoso.com" etc. |
-|Domains categorized as both work and personal|At least Windows Server 2012, Windows 8, or Windows RT|A comma-separated list of domain names used as both work or personal resources. Included endpoints are rendered using Microsoft Edge and won't be accessible from the Application Guard environment.|
+|Domains categorized as both work and personal|At least Windows Server 2012, Windows 8, or Windows RT|A comma-separated list of domain names used as both work or personal resources. Included endpoints are rendered using Microsoft Edge and will be accessible from the Application Guard and regular Edge environment.|
### Application-specific settings
These settings, located at **Computer Configuration\Administrative Templates\Windows Components\Windows Defender Application Guard**, can help you to manage your company's implementation of Application Guard.
|Name|Supported versions|Description|Options|
|-----------|------------------|-----------|-------|
-|Configure Windows Defender Application Guard clipboard settings|At least Windows 10 Enterprise|Determines whether Application Guard can use the clipboard functionality.|**Enabled.** Turns On the clipboard functionality and lets you choose whether to additionally:
**Disabled or not configured.** Completely turns Off the clipboard functionality for Application Guard.|
-|Configure Windows Defender Application Guard print settings|At least Windows 10 Enterprise|Determines whether Application Guard can use the print functionality.|**Enabled.** Turns On the print functionality and lets you choose whether to additionally:
**Important**
Allowing copied content to go from Microsoft Edge into Application Guard can cause potential security risks and isn't recommended.
**Disabled or not configured.** Completely turns Off the print functionality for Application Guard.|
-|Block enterprise websites to load non-enterprise content in IE and Edge|At least Windows 10 Enterprise|Determines whether to allow Internet access for apps not included on the **Allowed Apps** list.|**Enabled.** Prevents network traffic from both Internet Explorer and Microsoft Edge to non-enterprise sites that can't render in the Application Guard container.**Note** This may also block assets cached by CDNs and references to analytics sites. Please add them to the trusted enterprise resources to avoid broken pages.
**Disabled or not configured.** Allows Microsoft Edge to render network traffic to non-enterprise sites that can't render in Application Guard. |
-|Allow Persistence|At least Windows 10 Enterprise|Determines whether data persists across different sessions in Windows Defender Application Guard.|**Enabled.** Application Guard saves user-downloaded files and other items (such as, cookies, Favorites, and so on) for use in future Application Guard sessions.
**Disabled or not configured.** All user data within Application Guard is reset between sessions.
**Note**
If you later decide to stop supporting data persistence for your employees, you can use our Windows-provided utility to reset the container and to discard any personal data.
**To reset the container:**
|
-|Turn on Windows Defender Application Guard in Enterprise Mode|At least Windows 10 Enterprise|Determines whether to turn on Application Guard for Microsoft Edge.|**Enabled.** Turns on Application Guard for Microsoft Edge, honoring the network isolation settings, rendering non-enterprise domains in the Application Guard container. Be aware that Application Guard won't actually be turned On unless the required prerequisites and network isolation settings are already set on the device.
The container environment is reset, retaining only the employee-generated data.
The container environment is reset, including discarding all employee-generated data.
**Disabled.** Turns Off Application Guard, allowing all apps to run in Microsoft Edge.|
-
-
+|Configure Windows Defender Application Guard clipboard settings|Windows 10 Enterprise, 1709 or higher
Windows 10 Professional, 1803|Determines whether Application Guard can use the clipboard functionality.|**Enabled.** Turns On the clipboard functionality and lets you choose whether to additionally:
**Disabled or not configured.** Completely turns Off the clipboard functionality for Application Guard.|
+|Configure Windows Defender Application Guard print settings|Windows 10 Enterprise, 1709 or higher
**Important**
Allowing copied content to go from Microsoft Edge into Application Guard can cause potential security risks and isn't recommended.
Windows 10 Professional, 1803|Determines whether Application Guard can use the print functionality.|**Enabled.** Turns On the print functionality and lets you choose whether to additionally:
**Disabled or not configured.** Completely turns Off the print functionality for Application Guard.|
+|Block enterprise websites to load non-enterprise content in IE and Edge|Windows 10 Enterprise, 1709 or higher
Windows 10 Professional, 1803|Determines whether to allow Internet access for apps not included on the **Allowed Apps** list.|**Enabled.** Prevents network traffic from both Internet Explorer and Microsoft Edge to non-enterprise sites that can't render in the Application Guard container.**Note** This may also block assets cached by CDNs and references to analytics sites. Please add them to the trusted enterprise resources to avoid broken pages.
**Disabled or not configured.** Allows Microsoft Edge to render network traffic to non-enterprise sites that can't render in Application Guard. |
+|Allow Persistence|Windows 10 Enterprise, 1709 or higher
Windows 10 Professional, 1803|Determines whether data persists across different sessions in Windows Defender Application Guard.|**Enabled.** Application Guard saves user-downloaded files and other items (such as, cookies, Favorites, and so on) for use in future Application Guard sessions.
**Disabled or not configured.** All user data within Application Guard is reset between sessions.
**Note**
If you later decide to stop supporting data persistence for your employees, you can use our Windows-provided utility to reset the container and to discard any personal data.
**To reset the container:**
|
+|Turn on Windows Defender Application Guard in Enterprise Mode|Windows 10 Enterprise, 1709 or higher|Determines whether to turn on Application Guard for Microsoft Edge.|**Enabled.** Turns on Application Guard for Microsoft Edge, honoring the network isolation settings, rendering non-enterprise domains in the Application Guard container. Be aware that Application Guard won't actually be turned On unless the required prerequisites and network isolation settings are already set on the device.
The container environment is reset, retaining only the employee-generated data.
The container environment is reset, including discarding all employee-generated data.
**Disabled.** Turns Off Application Guard, allowing all apps to run in Microsoft Edge.|
+|Allow files to download to host operating system|Windows 10 Enterprise, 1803|Determines whether to save downloaded files to the host operating system from the Windows Defender Application Guard container.|**Enabled.** Allows users to save downloaded files from the Windows Defender Application Guard container to the host operating system.
**Disabled or not configured.** Users are not able to saved downloaded files from Application Guard to the host operating system.|
+|Allow hardware-accelerated rendering for Windows Defender Application Guard|Windows 10 Enterprise, version 1803
(experimental only)|Determines whether Windows Defender Application Guard renders graphics using hardware or software acceleration.|**Enabled.** Windows Defender Application Guard uses Hyper-V to access supported, high-security rendering graphics hardware (GPUs). These GPUs improve rendering performance and battery life while using Windows Defender Application Guard, particularly for video playback and other graphics-intensive use cases. If this setting is enabled without connecting any high-security rendering graphics hardware, Windows Defender Application Guard will automatically revert to software-based (CPU) rendering.
**Important**
Be aware that enabling this setting with potentially compromised graphics devices or drivers might pose a risk to the host device.
**Disabled or not configured.** Windows Defender Application Guard uses software-based (CPU) rendering and won’t load any third-party graphics drivers or interact with any connected graphics hardware.|
diff --git a/windows/security/threat-protection/windows-defender-application-guard/faq-wd-app-guard.md b/windows/security/threat-protection/windows-defender-application-guard/faq-wd-app-guard.md
index 387b02dde9..d970e7206f 100644
--- a/windows/security/threat-protection/windows-defender-application-guard/faq-wd-app-guard.md
+++ b/windows/security/threat-protection/windows-defender-application-guard/faq-wd-app-guard.md
@@ -50,3 +50,10 @@ Answering frequently asked questions about Windows Defender Application Guard (A
|---|----------------------------|
|**Q:** |Why aren’t employees able to see their Extensions in the Application Guard Edge session?|
|**A:** |Currently, the Application Guard Edge session doesn't support Extensions. However, we're closely monitoring your feedback about this.|
+
+
+| | |
+|---|----------------------------|
+|**Q:** |How do I configure WDAG to work with my network proxy (IP-Literal Addresses)?|
+|**A:** |WDAG requires proxies to have a symbolic name, not just an IP address. IP-Literal proxy settings such as “192.168.1.4:81” can be annotated as “itproxy:81” or using a record such as “P19216810010” for a proxy with an IP address of 192.168.100.10. This applies to WDAG in RS3 (1709) and RS4 (1803).|
+
diff --git a/windows/security/threat-protection/windows-defender-application-guard/images/appguard-gp-download.png b/windows/security/threat-protection/windows-defender-application-guard/images/appguard-gp-download.png
new file mode 100644
index 0000000000..647fb7ab66
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-application-guard/images/appguard-gp-download.png differ
diff --git a/windows/security/threat-protection/windows-defender-application-guard/images/appguard-gp-vgpu.png b/windows/security/threat-protection/windows-defender-application-guard/images/appguard-gp-vgpu.png
new file mode 100644
index 0000000000..063275bdc2
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-application-guard/images/appguard-gp-vgpu.png differ
diff --git a/windows/security/threat-protection/windows-defender-application-guard/install-wd-app-guard.md b/windows/security/threat-protection/windows-defender-application-guard/install-wd-app-guard.md
index c6bf82932c..1d9426c339 100644
--- a/windows/security/threat-protection/windows-defender-application-guard/install-wd-app-guard.md
+++ b/windows/security/threat-protection/windows-defender-application-guard/install-wd-app-guard.md
@@ -10,17 +10,23 @@ ms.author: lizross
ms.date: 10/19/2017
---
-# Prepare and install Windows Defender Application Guard
-
-**Applies to:**
-- Windows 10 Enterprise edition, version 1709
-
## Prepare to install Windows Defender Application Guard
Before you can install and use Windows Defender Application Guard, you must determine which way you intend to use it in your enterprise. You can use Application Guard in either **Standalone** or **Enterprise-managed** mode.
-- **Standalone mode.** Employees can use hardware-isolated browsing sessions without any administrator or management policy configuration. In this mode, you must install Application Guard and then the employee must manually start Microsoft Edge in Application Guard while browsing untrusted sites. For an example of how this works, see the [Application Guard in standalone mode](test-scenarios-wd-app-guard.md) testing scenario.
+**Standalone mode**
-- **Enterprise-managed mode.** You and your security department can define your corporate boundaries by explicitly adding trusted domains and by customizing the Application Guard experience to meet and enforce your needs on employee devices. Enterprise-managed mode also automatically redirects any browser requests to load non-enterprise domain(s) in the container.
+Applies to:
+- Windows 10 Enterprise edition, version 1709 or higher
+- Windows 10 Professional edition, version 1803
+
+Employees can use hardware-isolated browsing sessions without any administrator or management policy configuration. In this mode, you must install Application Guard and then the employee must manually start Microsoft Edge in Application Guard while browsing untrusted sites. For an example of how this works, see the [Application Guard in standalone mode](test-scenarios-wd-app-guard.md) testing scenario.
+
+**Enterprise-managed mode**
+
+Applies to:
+- Windows 10 Enterprise edition, version 1709 or higher
+
+You and your security department can define your corporate boundaries by explicitly adding trusted domains and by customizing the Application Guard experience to meet and enforce your needs on employee devices. Enterprise-managed mode also automatically redirects any browser requests tooad non-enterprise domain(s) in the container.
The following diagram shows the flow between the host PC and the isolated container.
diff --git a/windows/security/threat-protection/windows-defender-application-guard/reqs-wd-app-guard.md b/windows/security/threat-protection/windows-defender-application-guard/reqs-wd-app-guard.md
index 7b79f26762..30f2490010 100644
--- a/windows/security/threat-protection/windows-defender-application-guard/reqs-wd-app-guard.md
+++ b/windows/security/threat-protection/windows-defender-application-guard/reqs-wd-app-guard.md
@@ -13,7 +13,8 @@ ms.date: 11/09/2017
# System requirements for Windows Defender Application Guard
**Applies to:**
-- Windows 10 Enterprise edition, version 1709
+- Windows 10 Enterprise edition, version 1709 or higher
+- Windows 10 Professional edition, version 1803
The threat landscape is continually evolving. While hackers are busy developing new techniques to breach enterprise networks by compromising workstations, phishing schemes remain one of the top ways to lure employees into social engineering attacks. Windows Defender Application Guard is designed to help prevent old, and newly emerging attacks, to help keep employees productive.
@@ -36,6 +37,6 @@ Your environment needs the following software to run Windows Defender Applicatio
|Software|Description|
|--------|-----------|
-|Operating system|Windows 10 Enterprise edition, version 1709|
+|Operating system|Windows 10 Enterprise edition, version 1709 or higher
Windows 10 Professional edition, version 1803|
|Browser|Microsoft Edge and Internet Explorer|
-|Management system|[Microsoft Intune](https://docs.microsoft.com/en-us/intune/)
**-OR-**
[System Center Configuration Manager](https://docs.microsoft.com/en-us/sccm/)
**-OR-**
[Group Policy](https://technet.microsoft.com/en-us/library/cc753298(v=ws.11).aspx)
**-OR-**
Your current company-wide 3rd party mobile device management (MDM) solution. For info about 3rd party MDM solutions, see the documentation that came with your product.|
+|Management system
(only for managed devices)|[Microsoft Intune](https://docs.microsoft.com/en-us/intune/)
**-OR-**
[System Center Configuration Manager](https://docs.microsoft.com/en-us/sccm/)
**-OR-**
[Group Policy](https://technet.microsoft.com/en-us/library/cc753298(v=ws.11).aspx)
**-OR-**
Your current company-wide 3rd party mobile device management (MDM) solution. For info about 3rd party MDM solutions, see the documentation that came with your product.|
diff --git a/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview.md b/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview.md
index a9148f2252..7e437ce4b1 100644
--- a/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview.md
+++ b/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview.md
@@ -13,7 +13,8 @@ ms.date: 10/23/2017
# Windows Defender Application Guard overview
**Applies to:**
-- Windows 10 Enterprise edition, version 1709
+- Windows 10 Enterprise edition, version 1709 or higher
+- Windows 10 Professional edition, version 1803
The threat landscape is continually evolving. While hackers are busy developing new techniques to breach enterprise networks by compromising workstations, phishing schemes remain one of the top ways to lure employees into social engineering attacks.
@@ -27,7 +28,7 @@ If an employee goes to an untrusted site through either Microsoft Edge or Intern
### What types of devices should use Application Guard?
-Application Guard has been created to target 3 types of enterprise systems:
+Application Guard has been created to target several types of systems:
- **Enterprise desktops.** These desktops are domain-joined and managed by your organization. Configuration management is primarily done through System Center Configuration Manager or Microsoft Intune. Employees typically have Standard User privileges and use a high-bandwidth, wired, corporate network.
@@ -35,6 +36,8 @@ Application Guard has been created to target 3 types of enterprise systems:
- **Bring your own device (BYOD) mobile laptops.** These personally-owned laptops are not domain-joined, but are managed by your organization through tools like Microsoft Intune. The employee is typically an admin on the device and uses a high-bandwidth wireless corporate network while at work and a comparable personal network while at home.
+- **Personal devices.** These personally-owned desktops or mobile laptops are not domain-joined or managed by an organization. The user is an admin on the device and uses a high-bandwidth wireless personal network while at home or a comparable public network while outside.
+
## In this section
|Topic |Description |
|------|------------|
@@ -42,4 +45,4 @@ Application Guard has been created to target 3 types of enterprise systems:
|[Prepare and install Windows Defender Application Guard](install-wd-app-guard.md) |Provides instructions about determining which mode to use, either Standalone or Enterprise-managed, and how to install Application Guard in your organization.|
|[Configure the Group Policy settings for Windows Defender Application Guard](configure-wd-app-guard.md) |Provides info about the available Group Policy and MDM settings.|
|[Testing scenarios using Windows Defender Application Guard in your business or organization](test-scenarios-wd-app-guard.md)|Provides a list of suggested testing scenarios that you can use to test Windows Defender Application Guard (Application Guard) in your organization.|
-|[Frequently Asked Questions - Windows Defender Application Guard](faq-wd-app-guard.md)|Common questions and answers around the features and functionality of Application Guard.|
\ No newline at end of file
+|[Frequently Asked Questions - Windows Defender Application Guard](faq-wd-app-guard.md)|Common questions and answers around the features and functionality of Application Guard.|
diff --git a/windows/security/threat-protection/windows-defender-atp/TOC.md b/windows/security/threat-protection/windows-defender-atp/TOC.md
new file mode 100644
index 0000000000..e69658d82e
--- /dev/null
+++ b/windows/security/threat-protection/windows-defender-atp/TOC.md
@@ -0,0 +1,200 @@
+# [Windows Defender Advanced Threat Protection](windows-defender-advanced-threat-protection.md)
+##Get started
+### [Minimum requirements](minimum-requirements-windows-defender-advanced-threat-protection.md)
+### [Validate licensing and complete setup](licensing-windows-defender-advanced-threat-protection.md)
+### [Troubleshoot subscription and portal access issues](troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md)
+### [Preview features](preview-windows-defender-advanced-threat-protection.md)
+### [Data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md)
+### [Assign user access to the portal](assign-portal-access-windows-defender-advanced-threat-protection.md)
+## [Onboard machines](onboard-configure-windows-defender-advanced-threat-protection.md)
+### [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md)
+#### [Onboard machines using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md)
+#### [Onboard machines using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md)
+#### [Onboard machines using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md)
+##### [Onboard machines using Microsoft Intune](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md#onboard-windows-10-machines-using-microsoft-intune)
+#### [Onboard machines using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md)
+#### [Onboard non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi-windows-defender-advanced-threat-protection.md)
+### [Onboard servers](configure-server-endpoints-windows-defender-advanced-threat-protection.md)
+### [Onboard non-Windows machines](configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md)
+### [Run a detection test on a newly onboarded machine](run-detection-test-windows-defender-advanced-threat-protection.md)
+### [Run simulated attacks on machines](attack-simulations-windows-defender-advanced-threat-protection.md)
+### [Configure proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md)
+### [Troubleshoot onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
+## [Understand the Windows Defender ATP portal](use-windows-defender-advanced-threat-protection.md)
+### [Portal overview](portal-overview-windows-defender-advanced-threat-protection.md)
+### [View the Security operations dashboard](security-operations-dashboard-windows-defender-advanced-threat-protection.md)
+### [View the Secure Score dashboard and improve your secure score](secure-score-dashboard-windows-defender-advanced-threat-protection.md)
+### [View the Threat analytics dashboard and take recommended mitigation actions](threat-analytics-dashboard-windows-defender-advanced-threat-protection.md)
+
+##Investigate and remediate threats
+###Alerts queue
+#### [View and organize the Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md)
+#### [Manage alerts](manage-alerts-windows-defender-advanced-threat-protection.md)
+#### [Investigate alerts](investigate-alerts-windows-defender-advanced-threat-protection.md)
+#### [Investigate files](investigate-files-windows-defender-advanced-threat-protection.md)
+#### [Investigate machines](investigate-machines-windows-defender-advanced-threat-protection.md)
+#### [Investigate an IP address](investigate-ip-windows-defender-advanced-threat-protection.md)
+#### [Investigate a domain](investigate-domain-windows-defender-advanced-threat-protection.md)
+#### [Investigate a user account](investigate-user-windows-defender-advanced-threat-protection.md)
+
+
+
+
+###Machines list
+#### [View and organize the Machines list](machines-view-overview-windows-defender-advanced-threat-protection.md)
+#### [Manage machine group and tags](investigate-machines-windows-defender-advanced-threat-protection.md#manage-machine-group-and-tags)
+#### [Alerts related to this machine](investigate-machines-windows-defender-advanced-threat-protection.md#alerts-related-to-this-machine)
+#### [Machine timeline](investigate-machines-windows-defender-advanced-threat-protection.md#machine-timeline)
+##### [Search for specific events](investigate-machines-windows-defender-advanced-threat-protection.md#search-for-specific-events)
+##### [Filter events from a specific date](investigate-machines-windows-defender-advanced-threat-protection.md#filter-events-from-a-specific-date)
+##### [Export machine timeline events](investigate-machines-windows-defender-advanced-threat-protection.md#export-machine-timeline-events)
+##### [Navigate between pages](investigate-machines-windows-defender-advanced-threat-protection.md#navigate-between-pages)
+
+
+### [Take response actions](response-actions-windows-defender-advanced-threat-protection.md)
+#### [Take response actions on a machine](respond-machine-alerts-windows-defender-advanced-threat-protection.md)
+##### [Collect investigation package](respond-machine-alerts-windows-defender-advanced-threat-protection.md#collect-investigation-package-from-machines)
+##### [Run antivirus scan](respond-machine-alerts-windows-defender-advanced-threat-protection.md#run-windows-defender-antivirus-scan-on-machines)
+##### [Restrict app execution](respond-machine-alerts-windows-defender-advanced-threat-protection.md#restrict-app-execution)
+##### [Remove app restriction](respond-machine-alerts-windows-defender-advanced-threat-protection.md#remove-app-restriction)
+##### [Isolate machines from the network](respond-machine-alerts-windows-defender-advanced-threat-protection.md#isolate-machines-from-the-network)
+##### [Release machine from isolation](respond-machine-alerts-windows-defender-advanced-threat-protection.md#release-machine-from-isolation)
+##### [Check activity details in Action center](respond-machine-alerts-windows-defender-advanced-threat-protection.md#check-activity-details-in-action-center)
+#### [Take response actions on a file](respond-file-alerts-windows-defender-advanced-threat-protection.md)
+##### [Stop and quarantine files in your network](respond-file-alerts-windows-defender-advanced-threat-protection.md#stop-and-quarantine-files-in-your-network)
+##### [Remove file from quarantine](respond-file-alerts-windows-defender-advanced-threat-protection.md#remove-file-from-quarantine)
+##### [Block files in your network](respond-file-alerts-windows-defender-advanced-threat-protection.md#block-files-in-your-network)
+##### [Remove file from blocked list](respond-file-alerts-windows-defender-advanced-threat-protection.md#remove-file-from-blocked-list)
+##### [Check activity details in Action center](respond-file-alerts-windows-defender-advanced-threat-protection.md#check-activity-details-in-action-center)
+##### [Deep analysis](respond-file-alerts-windows-defender-advanced-threat-protection.md#deep-analysis)
+###### [Submit files for analysis](respond-file-alerts-windows-defender-advanced-threat-protection.md#submit-files-for-analysis)
+###### [View deep analysis reports](respond-file-alerts-windows-defender-advanced-threat-protection.md#view-deep-analysis-reports)
+###### [Troubleshoot deep analysis](respond-file-alerts-windows-defender-advanced-threat-protection.md#troubleshoot-deep-analysis)
+
+### [Use Automated investigation to investigate and remediate threats](automated-investigations-windows-defender-advanced-threat-protection.md)
+### [Query data using Advanced hunting](advanced-hunting-windows-defender-advanced-threat-protection.md)
+#### [Advanced hunting reference](advanced-hunting-reference-windows-defender-advanced-threat-protection.md)
+#### [Advanced hunting query language best practices](advanced-hunting-best-practices-windows-defender-advanced-threat-protection.md)
+
+##API and SIEM support
+### [Pull alerts to your SIEM tools](configure-siem-windows-defender-advanced-threat-protection.md)
+#### [Enable SIEM integration](enable-siem-integration-windows-defender-advanced-threat-protection.md)
+#### [Configure Splunk to pull alerts](configure-splunk-windows-defender-advanced-threat-protection.md)
+#### [Configure HP ArcSight to pull alerts](configure-arcsight-windows-defender-advanced-threat-protection.md)
+#### [Windows Defender ATP alert API fields](api-portal-mapping-windows-defender-advanced-threat-protection.md)
+#### [Pull alerts using REST API](pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md)
+#### [Troubleshoot SIEM tool integration issues](troubleshoot-siem-windows-defender-advanced-threat-protection.md)
+
+### [Use the threat intelligence API to create custom alerts](use-custom-ti-windows-defender-advanced-threat-protection.md)
+#### [Understand threat intelligence concepts](threat-indicator-concepts-windows-defender-advanced-threat-protection.md)
+#### [Enable the custom threat intelligence application](enable-custom-ti-windows-defender-advanced-threat-protection.md)
+#### [Create custom threat intelligence alerts](custom-ti-api-windows-defender-advanced-threat-protection.md)
+#### [PowerShell code examples](powershell-example-code-windows-defender-advanced-threat-protection.md)
+#### [Python code examples](python-example-code-windows-defender-advanced-threat-protection.md)
+#### [Experiment with custom threat intelligence alerts](experiment-custom-ti-windows-defender-advanced-threat-protection.md)
+#### [Troubleshoot custom threat intelligence issues](troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md)
+### [Use the Windows Defender ATP exposed APIs](exposed-apis-windows-defender-advanced-threat-protection.md)
+#### [Supported Windows Defender ATP APIs](supported-apis-windows-defender-advanced-threat-protection.md)
+#####Actor
+###### [Get actor information](get-actor-information-windows-defender-advanced-threat-protection.md)
+###### [Get actor related alerts](get-actor-related-alerts-windows-defender-advanced-threat-protection.md)
+#####Alerts
+###### [Get alerts](get-alerts-windows-defender-advanced-threat-protection.md)
+###### [Get alert information by ID](get-alert-info-by-id-windows-defender-advanced-threat-protection.md)
+###### [Get alert related actor information](get-alert-related-actor-info-windows-defender-advanced-threat-protection.md)
+###### [Get alert related domain information](get-alert-related-domain-info-windows-defender-advanced-threat-protection.md)
+###### [Get alert related file information](get-alert-related-files-info-windows-defender-advanced-threat-protection.md)
+###### [Get alert related IP information](get-alert-related-ip-info-windows-defender-advanced-threat-protection.md)
+###### [Get alert related machine information](get-alert-related-machine-info-windows-defender-advanced-threat-protection.md)
+#####Domain
+###### [Get domain related alerts](get-domain-related-alerts-windows-defender-advanced-threat-protection.md)
+###### [Get domain related machines](get-domain-related-machines-windows-defender-advanced-threat-protection.md)
+###### [Get domain statistics](get-domain-statistics-windows-defender-advanced-threat-protection.md)
+###### [Is domain seen in organization](is-domain-seen-in-org-windows-defender-advanced-threat-protection.md)
+
+#####File
+###### [Block file API](block-file-windows-defender-advanced-threat-protection.md)
+###### [Get file information](get-file-information-windows-defender-advanced-threat-protection.md)
+###### [Get file related alerts](get-file-related-alerts-windows-defender-advanced-threat-protection.md)
+###### [Get file related machines](get-file-related-machines-windows-defender-advanced-threat-protection.md)
+###### [Get file statistics](get-file-statistics-windows-defender-advanced-threat-protection.md)
+###### [Get FileActions collection API](get-fileactions-collection-windows-defender-advanced-threat-protection.md)
+###### [Unblock file API](unblock-file-windows-defender-advanced-threat-protection.md)
+
+#####IP
+###### [Get IP related alerts](get-ip-related-alerts-windows-defender-advanced-threat-protection.md)
+###### [Get IP related machines](get-ip-related-machines-windows-defender-advanced-threat-protection.md)
+###### [Get IP statistics](get-ip-statistics-windows-defender-advanced-threat-protection.md)
+###### [Is IP seen in organization](is-ip-seen-org-windows-defender-advanced-threat-protection.md)
+#####Machines
+###### [Collect investigation package API](collect-investigation-package-windows-defender-advanced-threat-protection.md)
+###### [Find machine information by IP](find-machine-info-by-ip-windows-defender-advanced-threat-protection.md)
+###### [Get machines](get-machines-windows-defender-advanced-threat-protection.md)
+###### [Get FileMachineAction object API](get-filemachineaction-object-windows-defender-advanced-threat-protection.md)
+###### [Get FileMachineActions collection API](get-filemachineactions-collection-windows-defender-advanced-threat-protection.md)
+###### [Get machine by ID](get-machine-by-id-windows-defender-advanced-threat-protection.md)
+###### [Get machine log on users](get-machine-log-on-users-windows-defender-advanced-threat-protection.md)
+###### [Get machine related alerts](get-machine-related-alerts-windows-defender-advanced-threat-protection.md)
+###### [Get MachineAction object API](get-machineaction-object-windows-defender-advanced-threat-protection.md)
+###### [Get MachineActions collection API](get-machineactions-collection-windows-defender-advanced-threat-protection.md)
+###### [Get machines](get-machines-windows-defender-advanced-threat-protection.md)
+###### [Get package SAS URI API](get-package-sas-uri-windows-defender-advanced-threat-protection.md)
+###### [Isolate machine API](isolate-machine-windows-defender-advanced-threat-protection.md)
+###### [Release machine from isolation API](unisolate-machine-windows-defender-advanced-threat-protection.md)
+###### [Remove app restriction API](unrestrict-code-execution-windows-defender-advanced-threat-protection.md)
+###### [Request sample API](request-sample-windows-defender-advanced-threat-protection.md)
+###### [Restrict app execution API](restrict-code-execution-windows-defender-advanced-threat-protection.md)
+###### [Run antivirus scan API](run-av-scan-windows-defender-advanced-threat-protection.md)
+###### [Stop and quarantine file API](stop-quarantine-file-windows-defender-advanced-threat-protection.md)
+
+
+
+#####User
+###### [Get alert related user information](get-alert-related-user-info-windows-defender-advanced-threat-protection.md)
+###### [Get user information](get-user-information-windows-defender-advanced-threat-protection.md)
+###### [Get user related alerts](get-user-related-alerts-windows-defender-advanced-threat-protection.md)
+###### [Get user related machines](get-user-related-machines-windows-defender-advanced-threat-protection.md)
+
+##Reporting
+### [Create and build Power BI reports using Windows Defender ATP data](powerbi-reports-windows-defender-advanced-threat-protection.md)
+
+##Check service health and sensor state
+### [Check sensor state](check-sensor-status-windows-defender-advanced-threat-protection.md)
+### [Fix unhealthy sensors](fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md)
+### [Inactive machines](fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md#inactive-machines)
+### [Misconfigured machines](fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md#misconfigured-machines)
+### [Check service health](service-status-windows-defender-advanced-threat-protection.md)
+## [Configure Windows Defender ATP Settings](preferences-setup-windows-defender-advanced-threat-protection.md)
+
+###General
+#### [Update data retention settings](data-retention-settings-windows-defender-advanced-threat-protection.md)
+#### [Configure alert notifications](configure-email-notifications-windows-defender-advanced-threat-protection.md)
+#### [Enable and create Power BI reports using Windows Defender ATP data](powerbi-reports-windows-defender-advanced-threat-protection.md)
+#### [Enable Secure score security controls](enable-secure-score-windows-defender-advanced-threat-protection.md)
+#### [Configure advanced features](advanced-features-windows-defender-advanced-threat-protection.md)
+#### [Protect data with conditional access](conditional-access-windows-defender-advanced-threat-protection.md)
+
+###Permissions
+#### [Manage portal access using RBAC](rbac-windows-defender-advanced-threat-protection.md)
+#### [Create and manage machine groups](machine-groups-windows-defender-advanced-threat-protection.md)
+
+###APIs
+#### [Enable Threat intel](enable-custom-ti-windows-defender-advanced-threat-protection.md)
+#### [Enable SIEM integration](enable-siem-integration-windows-defender-advanced-threat-protection.md)
+
+###Rules
+#### [Manage suppression rules](manage-suppression-rules-windows-defender-advanced-threat-protection.md)
+#### [Manage automation allowed/blocked](manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md)
+#### [Manage automation file uploads](manage-automation-file-uploads-windows-defender-advanced-threat-protection.md)
+#### [Manage automation folder exclusions](manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md)
+
+###Machine management
+#### [Onboarding machines](onboard-configure-windows-defender-advanced-threat-protection.md)
+#### [Offboarding machines](offboard-machines-windows-defender-advanced-threat-protection.md)
+
+## [Configure Windows Defender ATP time zone settings](time-settings-windows-defender-advanced-threat-protection.md)
+
+## [Access the Windows Defender ATP Community Center](community-windows-defender-advanced-threat-protection.md)
+## [Troubleshoot Windows Defender ATP](troubleshoot-windows-defender-advanced-threat-protection.md)
+### [Review events and errors on machines with Event Viewer](event-error-codes-windows-defender-advanced-threat-protection.md)
+## [Windows Defender Antivirus compatibility with Windows Defender ATP](defender-compatibility-windows-defender-advanced-threat-protection.md)
diff --git a/windows/security/threat-protection/windows-defender-atp/advanced-features-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/advanced-features-windows-defender-advanced-threat-protection.md
index fee57495f2..d74d21d178 100644
--- a/windows/security/threat-protection/windows-defender-atp/advanced-features-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/advanced-features-windows-defender-advanced-threat-protection.md
@@ -1,7 +1,7 @@
---
-title: Turn on advanced features in Windows Defender ATP
+title: Configure advanced features in Windows Defender ATP
description: Turn on advanced features such as block file in Windows Defender Advanced Threat Protection.
-keywords: advanced features, preferences setup, block file
+keywords: advanced features, settings, block file
search.product: eADQiWindows 10XVcnh
ms.prod: w10
ms.mktglfcycl: deploy
@@ -10,10 +10,10 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/16/2017
+ms.date: 04/24/2018
---
-# Turn on advanced features in Windows Defender ATP
+# Configure advanced features in Windows Defender ATP
**Applies to:**
@@ -23,7 +23,7 @@ ms.date: 10/16/2017
- Windows 10 Pro Education
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-
+[!include[Prerelease information](prerelease.md)]
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedfeats-abovefoldlink)
@@ -31,6 +31,9 @@ Depending on the Microsoft security products that you use, some advanced feature
Turn on the following advanced features to get better protected from potentially malicious files and gain better insight during security investigations:
+## Automated investigation
+When you enable this feature, you'll be able to take advantage of the automated investigation and remediation features of the service. For more information, see [Automated investigations](automated-investigations-windows-defender-advanced-threat-protection.md).
+
## Block file
This feature is only available if your organization uses Windows Defender Antivirus as the active antimalware solution and that the cloud-based protection feature is enabled.
@@ -47,22 +50,50 @@ For more information, see [Investigate a user account](investigate-user-windows-
## Skype for Business integration
Enabling the Skype for Business integration gives you the ability to communicate with users using Skype for Business, email, or phone. This can be handy when you need to communicate with the user and mitigate risks.
+## Azure Advanced Threat Protection integration
+The integration with Azure Advanced Threat Protection allows you to pivot directly into another Microsoft Identity security product. Azure Advanced Threat Protection augments an investigation with additional insights about a suspected compromised account and related resources. By enabling this feature, you'll enrich the machine-based investigation capability by pivoting across the network from an identify point of view.
+
+
+>[!NOTE]
+>You'll need to have the appropriate license to enable this feature.
+
+### Enable the Windows Defender ATP integration from the Azure ATP portal
+To receive contextual machine integration in Azure ATP, you'll also need to enable the feature in the Azure ATP portal.
+
+1. Login to the [Azure portal](https://portal.atp.azure.com/) with a Global Administrator or Security Administrator role.
+
+2. Click **Create a workspace** or use your primary workspace.
+
+3. Toggle the Integration setting to **On** and click **Save**.
+
+When you complete the integration steps on both portals, you'll be able to see relevant alerts in the machine details or user details page.
+
## Office 365 Threat Intelligence connection
This feature is only available if you have an active Office 365 E5 or the Threat Intelligence add-on. For more information, see the Office 365 Enterprise E5 product page.
When you enable this feature, you'll be able to incorporate data from Office 365 Advanced Threat Protection into the Windows Defender ATP portal to conduct a holistic security investigation across Office 365 mailboxes and Windows machines.
+>[!NOTE]
+>You'll need to have the appropriate license to enable this feature.
+
To receive contextual machine integration in Office 365 Threat Intelligence, you'll need to enable the Windows Defender ATP settings in the Security & Compliance dashboard. For more information, see [Office 365 Threat Intelligence overview](https://support.office.com/en-us/article/Office-365-Threat-Intelligence-overview-32405DA5-BEE1-4A4B-82E5-8399DF94C512).
+## Microsoft Intune connection
+This feature is only available if you have an active Microsoft Intune (Intune) license.
+
+When you enable this feature, you'll be able to share Windows Defender ATP device information to Intune and enhance policy enforcement.
+
+>[!NOTE]
+>You'll need to enable the integration on both Intune and Windows Defender ATP to use this feature.
+
+
## Enable advanced features
1. In the navigation pane, select **Preferences setup** > **Advanced features**.
2. Select the advanced feature you want to configure and toggle the setting between **On** and **Off**.
3. Click **Save preferences**.
## Related topics
-- [Update general settings in Windows Defender ATP](general-settings-windows-defender-advanced-threat-protection.md)
-- [Turn on the preview experience in Windows Defender ATP](preview-settings-windows-defender-advanced-threat-protection.md)
-- [Configure email notifications in Windows Defender ATP](configure-email-notifications-windows-defender-advanced-threat-protection.md)
-- [Enable SIEM integration in Windows Defender ATP](enable-siem-integration-windows-defender-advanced-threat-protection.md)
-- [Enable the custom threat intelligence API in Windows Defender ATP](enable-custom-ti-windows-defender-advanced-threat-protection.md)
-- [Create and build Power BI reports](powerbi-reports-windows-defender-advanced-threat-protection.md)
\ No newline at end of file
+- [Update data retention settings](data-retention-settings-windows-defender-advanced-threat-protection.md)
+- [Configure alert notifications](configure-email-notifications-windows-defender-advanced-threat-protection.md)
+- [Enable and create Power BI reports using Windows Defender ATP data](powerbi-reports-windows-defender-advanced-threat-protection.md)
+- [Enable Secure Score security controls](enable-secure-score-windows-defender-advanced-threat-protection.md)
diff --git a/windows/security/threat-protection/windows-defender-atp/advanced-hunting-best-practices-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/advanced-hunting-best-practices-windows-defender-advanced-threat-protection.md
new file mode 100644
index 0000000000..f553f152fd
--- /dev/null
+++ b/windows/security/threat-protection/windows-defender-atp/advanced-hunting-best-practices-windows-defender-advanced-threat-protection.md
@@ -0,0 +1,96 @@
+---
+title: Advanced hunting best practices in Windows Defender ATP
+description: Learn about Advanced hunting best practices such as what filters and keywords to use to effectively query data.
+keywords: advanced hunting, best practices, keyword, filters, atp query, query atp data, intellisense, atp telemetry, events, events telemetry, azure log analytics
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: high
+ms.date: 04/24/2018
+---
+
+# Advanced hunting query best practices Windows Defender ATP
+
+**Applies to:**
+
+- Windows 10 Enterprise
+- Windows 10 Education
+- Windows 10 Pro
+- Windows 10 Pro Education
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
+>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-bestpractices-abovefoldlink)
+
+## Performance best practices
+The following best practices serve as a guideline of query performance best practices and for you to get faster results and be able to run complex queries.
+- Use time filters first. Azure Kusto is highly optimized to utilize time filters. For more information, see [Azure Kusto](https://docs.microsoft.com/connectors/kusto/).
+- Put filters that are expected to remove most of the data in the beginning of the query, following the time filter.
+- Use 'has' keyword over 'contains' when looking for full tokens.
+- Use looking in specific column rather than using full text search across all columns.
+- When joining between two tables - choose the table with less rows to be the first one (left-most).
+- When joining between two tables - project only needed columns from both sides of the join.
+
+## Query tips and pitfalls
+
+### Unique Process IDs
+Process IDs are recycled in Windows and reused for new processes and therefore can't serve as a unique identifier for a specific process.
+To address this issue, Windows Defender ATP created the time process. To get a unique identifier for a process on a specific machine, use the process ID together with the process creation time.
+
+
+So, when you join data based on a specific process or summarize data for each process, you'll need to use a machine identifier (either MachineId or ComputerName), a process ID (ProcessId or InitiatingProcessId) and the process creation time (ProcessCreationTime or InitiatingProcessCreationTime)
+
+The following example query is created to find processes that access more than 10 IP addresses over port 445 (SMB) - possibly scanning for file shares.
+
+Example query:
+```
+NetworkCommunicationEvents
+| where RemotePort == 445 and EventTime > ago(12h) and InitiatingProcessId !in (0, 4)
+| summarize RemoteIPCount=dcount(RemoteIP) by ComputerName, InitiatingProcessId, InitiatingProcessCreationTime, InitiatingProcessFileName
+| where RemoteIPCount > 10
+```
+
+The query summarizes by both InitiatingProcessId and InitiatingProcessCreationTime - to make sure the query looks at a single process, and not mixing multiple processes with the same process ID.
+
+### Using command line queries
+
+Command lines may vary - when applicable, filter on file names and do fuzzy matching.
+
+There are numerous ways to construct a command line to accomplish a task.
+
+For example, a malicious attacker could specify the process image file name without a path, with full path, without the file extension, using environment variables, add quotes, and others. In addition, the attacker can also change the order of some parameters, add multiple quotes or spaces, and much more.
+
+To create more durable queries using command lines, we recommended the following guidelines:
+- Identify the known processes (such as net.exe, psexec.exe, and others) by matching on the filename fields, instead of filtering on the command line field.
+- When querying for command line arguments, don't look for an exact match on multiple unrelated arguments in a certain order. Instead, use regular expressions or use multiple separate contains operators.
+- Use case insensitive matches. For example, use '=~', 'in~', 'contains' instead of '==', 'in' or 'contains_cs'
+- To mitigate DOS command line obfuscation techniques, consider removing quotes, replacing commas with spaces, and replacing multiple consecutive spaces with a single space. This is just the start of handling DOS obfuscation techniques, but it does mitigate the most common ones.
+
+The following example query shows various ways to construct a query that looks for the file *net.exe* to stop the Windows Defender Firewall service:
+
+```
+// Non-durable query - do not use
+ProcessCreationEvents
+| where ProcessCommandLine == "net stop MpsSvc"
+| limit 10
+
+// Better query - filters on filename, does case-insensitive matches
+ProcessCreationEvents
+| where EventTime > ago(7d) and FileName in~ ("net.exe", "net1.exe") and ProcessCommandLine contains "stop" and ProcessCommandLine contains "MpsSvc"
+
+// Best query also ignores quotes
+ProcessCreationEvents
+| where EventTime > ago(7d) and FileName in~ ("net.exe", "net1.exe")
+| extend CanonicalCommandLine=replace("\"", "", ProcessCommandLine)
+| where CanonicalCommandLine contains "stop" and CanonicalCommandLine contains "MpsSvc"
+```
+
+>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-bestpractices-belowfoldlink)
+
+
+
diff --git a/windows/security/threat-protection/windows-defender-atp/advanced-hunting-reference-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/advanced-hunting-reference-windows-defender-advanced-threat-protection.md
new file mode 100644
index 0000000000..77ffee9999
--- /dev/null
+++ b/windows/security/threat-protection/windows-defender-atp/advanced-hunting-reference-windows-defender-advanced-threat-protection.md
@@ -0,0 +1,107 @@
+---
+title: Advanced hunting reference in Windows Defender ATP
+description: Learn about Advanced hunting table reference such as column name, data type, and description
+keywords: advanced hunting, atp query, query atp data, intellisense, atp telemetry, events, events telemetry, azure log analytics, column name, data type, description
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: high
+ms.date: 04/24/2018
+---
+
+# Advanced hunting reference in Windows Defender ATP
+
+**Applies to:**
+
+- Windows 10 Enterprise
+- Windows 10 Education
+- Windows 10 Pro
+- Windows 10 Pro Education
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
+>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
+
+
+## Advanced hunting table reference
+When you run a query using Advanced hunting, a table with columns is returned as a result.
+
+Use the following table to understand what the columns represent, its data type, and their description.
+
+| Column name | Data type | Description
+:---|:--- |:---
+| AccountDomain | string | Domain of the account. |
+| AccountName | string | User name of the account. |
+| AccountSid | string | Security Identifier (SID) of the account. |
+| ActionType | string | Type of activity that triggered the event. |
+| AdditionalFields | string | Additional information about the event in JSON array format. |
+| AlertId | string | Unique identifier for the alert. |
+| ComputerName | string | Fully qualified domain name (FQDN) of the machine. |
+| EventId | int | Unique identifier used by Event Tracing for Windows (ETW) for the event type. |
+| EventTime | datetime | Date and time when the event was recorded. |
+| EventType | string | Table where the record is stored. |
+| FileName | string | Name of the file that the recorded action was applied to. |
+| FileOriginIp | string | IP address where the file was downloaded from. |
+| FileOriginReferrerUrl | string | URL of the web page that links to the downloaded file. |
+| FileOriginUrl | string | URL where the file was downloaded from. |
+| FolderPath | string | Folder containing the file that the recorded action was applied to. |
+| InitiatingProcessAccountDomain | string | Domain of the account that ran the process responsible for the event. |
+| InitiatingProcessAccountName | string | User name of the account that ran the process responsible for the event. |
+| InitiatingProcessAccountSid | string | Security Identifier (SID) of the account that ran the process responsible for the event. |
+| InitiatingProcessCommandLine | string | Command line used to run the process that initiated the event. |
+| InitiatingProcessCreationTime | datetime | Date and time when the process that initiated the event was started. |
+| InitiatingProcessFileName | string | Name of the process that initiated the event. |
+| InitiatingProcessFolderPath | string | Folder containing the process (image file) that initiated the event. |
+| InitiatingProcessId | int | Process ID (PID) of the process that initiated the event. |
+| InitiatingProcessIntegrityLevel | string | Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources. |
+| InitiatingProcessMd5 | string | MD5 hash of the process (image file) that initiated the event. |
+| InitiatingProcessParentCreationTime | datetime | Date and time when the parent of the process responsible for the event was started. |
+| InitiatingProcessParentId | int | Process ID (PID) of the parent process that spawned the process responsible for the event. |
+| InitiatingProcessParentName | string | Name of the parent process that spawned the process responsible for the event. |
+| InitiatingProcessSha1 | string | SHA-1 of the process (image file) that initiated the event. |
+| InitiatingProcessSha256 | string | SHA-256 of the process (image file) that initiated the event. This field is usually not populated—use the SHA1 column when available. |
+| InitiatingProcessTokenElevation | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event. |
+| IsAzureADJoined | boolean | Boolean indicator of whether machine is joined to the Azure Active Directory. |
+| LocalIP | string | IP address assigned to the local machine used during communication. |
+| LocalPort | int | TCP port on the local machine used during communication. |
+| LoggedOnUsers | string | List of all users that are logged on the machine at the time of the event in JSON array format. |
+| LogonType | string | Type of logon session, specifically:
- **Interactive** - User physically interacts with the machine using the local keyboard and screen.
- **Remote interactive (RDP) logons** - User interacts with the machine remotely using Remote Desktop, Terminal Services, Remote Assistance, or other RDP clients.
- **Network** - Session initiated when the machine is accessed using PsExec or when shared resources on the machine, such as printers and shared folders, are accessed.
- **Batch** - Session initiated by scheduled tasks.
- **Service** - Session initiated by services as they start.
+| MachineGroup | string | Machine group of the machine. This group is used by role-based access control to determine access to the machine. |
+| MachineId | string | Unique identifier for the machine in the service. |
+| MD5 | string | MD5 hash of the file that the recorded action was applied to. |
+| NetworkCardIPs | string | List of all network adapters on the machine, including their MAC addresses and assigned IP addresses, in JSON array format. |
+| OSArchitecture | string | Architecture of the operating system running on the machine. |
+| OSBuild | string | Build version of the operating system running on the machine. |
+| OSPlatform | string | Platform of the operating system running on the machine. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7. |
+| PreviousRegistryKey | string | Original registry key of the registry value before it was modified. |
+| PreviousRegistryValueData | string | Original data of the registry value before it was modified. |
+| PreviousRegistryValueName | string | Original name of the registry value before it was modified. |
+| PreviousRegistryValueType | string | Original data type of the registry value before it was modified. |
+| ProcessCommandline | string | Command line used to create the new process. |
+| ProcessCreationTime | datetime | Date and time the process was created. |
+| ProcessId | int | Process ID (PID) of the newly created process. |
+| ProcessIntegrityLevel | string | Integrity level of the newly created process. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet downloaded. These integrity levels influence permissions to resources. |
+| ProcessTokenElevation | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the newly created process. |
+| ProviderId | string | Unique identifier for the Event Tracing for Windows (ETW) provider that collected the event log. |
+| RegistryKey | string | Registry key that the recorded action was applied to. |
+| RegistryValueData | string | Data of the registry value that the recorded action was applied to. |
+| RegistryValueName | string | Name of the registry value that the recorded action was applied to. |
+| RegistryValueType | string | Data type, such as binary or string, of the registry value that the recorded action was applied to. |
+| RemoteIP | string | IP address that was being connected to. |
+| RemotePort | int | TCP port on the remote device that was being connected to. |
+| RemoteUrl | string | URL or fully qualified domain name (FQDN) that was being connected to. |
+| ReportIndex | long | Event identifier that is unique among the same event type. |
+| SHA1 | string | SHA-1 of the file that the recorded action was applied to. |
+| SHA256 | string | SHA-256 of the file that the recorded action was applied to. This field is usually not populated—use the SHA1 column when available.
+
+>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-belowfoldlink)
+
+## Related topic
+- [Query data using Advanced hunting](advanced-hunting-windows-defender-advanced-threat-protection.md)
+- [Advanced hunting query language best practices](/advanced-hunting-best-practices-windows-defender-advanced-threat-protection.md)
+
diff --git a/windows/security/threat-protection/windows-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection.md
new file mode 100644
index 0000000000..c5a0aa9147
--- /dev/null
+++ b/windows/security/threat-protection/windows-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection.md
@@ -0,0 +1,164 @@
+---
+title: Query data using Advanced hunting in Windows Defender ATP
+description: Learn about Advanced hunting in Windows Defender ATP and how to query ATP data.
+keywords: advanced hunting, atp query, query atp data, intellisense, atp telemetry, events, events telemetry, azure log analytics
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: high
+ms.date: 04/24/2018
+---
+
+# Query data using Advanced hunting in Windows Defender ATP
+
+**Applies to:**
+
+- Windows 10 Enterprise
+- Windows 10 Education
+- Windows 10 Pro
+- Windows 10 Pro Education
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
+
+>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhunting-abovefoldlink)
+
+Advanced hunting allows you to proactively hunt for possible threats across your organization using a powerful search and query tool. Take advantage of the following capabilities:
+
+- **Powerful query language with IntelliSense** - Built on top of a query language that gives you the flexibility you need to take hunting to the next level.
+- **Query the stored telemetry** - The telemetry data is accessible in tables for you to query. For example, you can query process creation, network communication, and many other event types.
+- **Links to portal** - Certain query results, such as machine names and file names are actually direct links to the portal, consolidating the Advanced hunting query experience and the existing portal investigation experience.
+- **Query examples** - A welcome page provides examples designed to get you started and get you familiar with the tables and the query language.
+
+To get you started in querying your data, you can use the basic or Advanced query examples that have some preloaded queries for you to understand the basic query syntax.
+
+
+
+## Use advanced hunting to query data
+
+A typical query starts with a table name followed by a series of operators separated by **|**.
+
+In the following example, we start with the table name **ProcessCreationEvents** and add piped elements as needed.
+
+
+
+First, we define a time filter to review only records from the previous seven days.
+
+We then add a filter on the _FileName_ to contain only instances of _powershell.exe_.
+
+Afterwards, we add a filter on the _ProcessCommandLine_
+Finally, we project only the columns we're interested in exploring and limit the results to 100 and click **Run query**.
+
+### Use operators
+The query language is very powerful and has a lot of available operators, some of them are -
+
+- **where** - Filter a table to the subset of rows that satisfy a predicate.
+- **summarize** - Produce a table that aggregates the content of the input table.
+- **join** - Merge the rows of two tables to form a new table by matching values of the specified column(s) from each table.
+- **count** - Return the number of records in the input record set.
+- **top** - Return the first N records sorted by the specified columns.
+- **limit** - Return up to the specified number of rows.
+- **project** - Select the columns to include, rename or drop, and insert new computed columns.
+- **extend** - Create calculated columns and append them to the result set.
+- **makeset** - Return a dynamic (JSON) array of the set of distinct values that Expr takes in the group
+- **find** - Find rows that match a predicate across a set of tables.
+
+To see a live example of these operators, run them as part of the **Get started** section.
+
+## Access query language documentation
+
+For more information on the query language and supported operators, see [Query Language](https://docs.loganalytics.io/docs/Language-Reference/).
+
+## Use exposed tables in Advanced hunting
+
+The following tables are exposed as part of Advanced hunting:
+
+- **AlertEvents** - Stores alerts related information
+- **MachineInfo** - Stores machines properties
+- **ProcessCreationEvents** - Stores process creation events
+- **NetworkCommunicationEvents** - Stores network communication events
+- **FileCreationEvents** - Stores file creation, modification, and rename events
+- **RegistryEvents** - Stores registry key creation, modification, rename and deletion events
+- **LogonEvents** - Stores login events
+- **ImageLoadEvents** - Stores load dll events
+- **MiscEvents** - Stores several types of events, including Windows Defender blocks (Windows Defender Antivirus, Exploit Guard, Windows Defender SmartScreen, Windows Defender Application Guard, and Firewall), process injection events, access to LSASS processes, and others.
+
+These tables include data from the last 30 days.
+
+## Use shared queries
+Shared queries are prepopulated queries that give you a starting point on running queries on your organization's data. It includes a couple of examples that help demonstrate the query language capabilities.
+
+
+
+You can save, edit, update, or delete queries.
+
+### Save a query
+You can create or modify a query and save it as your own query or share it with users who are in the same tenant.
+
+1. Create or modify a query.
+
+2. Click the **Save query** drop-down button and select **Save as**.
+
+3. Enter a name for the query.
+
+ 
+
+4. Select the folder where you'd like to save the query.
+ - Shared queries - Allows other users in the tenant to access the query
+ - My query - Accessible only to the user who saved the query
+
+5. Click **Save**.
+
+### Update a query
+These steps guide you on modifying and overwriting an existing query.
+
+1. Edit an existing query.
+
+2. Click the **Save**.
+
+### Delete a query
+1. Right-click on a query you want to delete.
+
+ 
+
+2. Select **Delete** and confirm that you want to delete the query.
+
+## Result set capabilities in Advanced hunting
+
+The result set has several capabilities to provide you with effective investigation, including:
+
+- Columns that return entity-related objects, such as Machine name, Machine ID, File name, SHA1, User, IP, and URL, are linked to their entity pages in the Windows Defender ATP portal.
+- You can right-click on a cell in the result set and add a filter to your written query. The current filtering options are **include**, **exclude** or **advanced filter**, which provides additional filtering options on the cell value. These cell values are part of the row set.
+
+
+
+## Filter results in Advanced hunting
+In Advanced hunting, you can use the advanced filter on the output result set of the query.
+The filters provide an overview of the result set where
+each column has it's own section and shows the distinct values that appear in the column and their prevalence.
+
+You can refine your query based on the filter by clicking the "+" or "-" buttons on the values that you want to include or exclude and click **Run query**.
+
+
+
+The filter selections will resolve as an additional query term and the results will be updated accordingly.
+
+
+
+## Public Advanced Hunting query GitHub repository
+Check out the [Advanced Hunting repository](https://github.com/Microsoft/WindowsDefenderATP-Hunting-Queries). Contribute and use example queries shared by our customers.
+
+
+>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhunting-belowfoldlink)
+
+## Related topic
+- [Advanced hunting reference](advanced-hunting-reference-windows-defender-advanced-threat-protection.md)
+- [Advanced hunting query language best practices](/advanced-hunting-best-practices-windows-defender-advanced-threat-protection.md)
+
+
+
diff --git a/windows/security/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md
index 489d6db5d4..3955ce8269 100644
--- a/windows/security/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 03/12/2018
+ms.date: 04/24/2018
---
# View and organize the Windows Defender Advanced Threat Protection Alerts queue
@@ -23,11 +23,11 @@ ms.date: 03/12/2018
- Windows 10 Pro Education
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-
+[!include[Prerelease information](prerelease.md)]
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-alertsq-abovefoldlink)
-The **Alerts queue** shows a list of alerts that were flagged from endpoints in your network. Alerts are displayed in queues according to their current status. In each queue, you'll see details such as the severity of alerts and the number of machines the alerts were raised on.
+The **Alerts queue** shows a list of alerts that were flagged from machines in your network. Alerts are displayed in queues according to their current status. In each queue, you'll see details such as the severity of alerts and the number of machines the alerts were raised on.
Alerts are organized in queues by their workflow status or assignment:
@@ -35,14 +35,13 @@ Alerts are organized in queues by their workflow status or assignment:
- **In progress**
- **Resolved**
- **Assigned to me**
-- **Suppression rules**
To see a list of alerts, click any of the queues under the **Alerts queue** option in the navigation pane.
> [!NOTE]
> By default, alerts in the queues are sorted from newest to oldest.
-
+
## Sort, filter, and group the alerts list
You can sort and filter the alerts using the available filters or clicking on a column's header that will sort the view in ascending or descending order.
@@ -64,12 +63,11 @@ You can sort and filter the alerts using the available filters or clicking on a
Alert severity | Description
:---|:---
-High (Red) | Threats often associated with advanced persistent threats (APT). These alerts indicate a high risk due to the severity of damage they can inflict on endpoints.
+High (Red) | Threats often associated with advanced persistent threats (APT). These alerts indicate a high risk due to the severity of damage they can inflict on machines.
Medium (Orange) | Threats rarely observed in the organization, such as anomalous registry change, execution of suspicious files, and observed behaviors typical of attack stages.
Low (Yellow) | Threats associated with prevalent malware and hack-tools that do not necessarily indicate an advanced threat targeting the organization.
Informational (Grey) | Informational alerts are those that might not be considered harmful to the network but might be good to keep track of.
-Reviewing the various alerts and their severity can help you decide on the appropriate action to protect your organization's endpoints.
#### Understanding alert severity
It is important to understand that the Windows Defender Antivirus (Windows Defender AV) and Windows Defender ATP alert severities are different because they represent different scopes.
@@ -92,7 +90,8 @@ So, for example:
- Others
>[!NOTE]
->The Windows Defender Antivirus filter will only appear if your endpoints are using Windows Defender Antivirus as the default real-time protection antimalware product.
+>The Windows Defender Antivirus filter will only appear if machines are using Windows Defender Antivirus as the default real-time protection antimalware product.
+
### View
- **Flat view** - Lists alerts individually with alerts having the latest activity displayed at the top.
@@ -100,6 +99,22 @@ So, for example:
The grouped view allows for efficient alert triage and management.
+## Alert queue columns
+You can click on the first column to open up the **Alert management pane**. You can also select view the machine and user panes by selecting the icons beside the links.
+
+Alerts are listed with the following columns:
+
+- **Title** - Displays a brief description of the alert and its category.
+- **Machine and user** - Displays the machine name and user associated with the alert. You view the machine or user details pane or pivot the actual details page.
+- **Severity** - Displays the severity of the alert. Possible values are informational, low, medium, or high.
+- **Last activity** - Date and time for when the last action was taken on the alert.
+- **Time in queue** - Length of time the alert has been in the alerts queue.
+- **Detection source** - Displays the detection source of the alert.
+- **Status** - Current status of the alert. Possible values include new, in progress, or resolved.
+- **Investigation state** - Reflects the number of related investigations and it's current state.
+- **Assigned to** - Displays who is addressing the alert.
+- **Manage icon** - You can click on the icon to bring up the alert management pane where you can manage and see details about the alert.
+
### Use the Alert management pane
Selecting an alert brings up the **Alert management** pane where you can manage and see details about the alert.
@@ -134,14 +149,11 @@ Select multiple alerts (Ctrl or Shift select) and manage or edit alerts together
## Related topics
-- [View the Windows Defender Advanced Threat Protection Security operations dashboard](dashboard-windows-defender-advanced-threat-protection.md)
-- [View the Windows Defender Advanced Threat Protection Secure score dashboard](security-analytics-dashboard-windows-defender-advanced-threat-protection.md)
+- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md)
- [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md)
- [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md)
+- [Investigate machines in the Windows Defender ATP Machines list](investigate-machines-windows-defender-advanced-threat-protection.md)
- [Investigate an IP address associated with a Windows Defender ATP alert](investigate-ip-windows-defender-advanced-threat-protection.md)
- [Investigate a domain associated with a Windows Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md)
-- [View and organize the Windows Defender ATP Machines list](machines-view-overview-windows-defender-advanced-threat-protection.md)
-- [Investigate machines in the Windows Defender ATP Machines list](investigate-machines-windows-defender-advanced-threat-protection.md)
- [Investigate a user account in Windows Defender ATP](investigate-user-windows-defender-advanced-threat-protection.md)
-- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md)
-- [Take response actions in Windows Defender ATP](response-actions-windows-defender-advanced-threat-protection.md)
+
diff --git a/windows/security/threat-protection/windows-defender-atp/assign-portal-access-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/assign-portal-access-windows-defender-advanced-threat-protection.md
index ac64b927c8..5acb334a86 100644
--- a/windows/security/threat-protection/windows-defender-atp/assign-portal-access-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/assign-portal-access-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/16/2017
+ms.date: 04/24/2018
---
# Assign user access to the Windows Defender ATP portal
@@ -24,18 +24,33 @@ ms.date: 10/16/2017
- Office 365
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-
+[!include[Prerelease information](prerelease.md)]
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-assignaccess-abovefoldlink)
-Windows Defender ATP users and access permissions are managed in Azure Active Directory (AAD). Use the following methods to assign security roles.
+Windows Defender ATP supports two ways to manage permissions:
-## Assign user access using Azure PowerShell
+- **Basic permissions management**: Set permissions to either full access or read-only.
+- **Role-based access control (RBAC)**: Set granular permissions by defining roles, assigning Azure AD user groups to the roles, and granting the user groups access to machine groups. For more information on RBAC, see [Manage portal access using role-based access control](rbac-windows-defender-advanced-threat-protection.md).
+
+> [!NOTE]
+>If you have already assigned basic permissions, you may switch to RBAC anytime. Consider the following before making the switch:
+
+>- Users with full access (Security Administrators) are automatically assigned the default **Global administrator** role, which also has full access. Only global administrators can manage permissions using RBAC.
+>- Users that have read-only access (Security Readers) will lose access to the portal until they are assigned a role. Note that only Azure AD user groups can be assigned a role under RBAC.
+>- After switching to RBAC, you will not be able to switch back to using basic permissions management.
+
+## Use basic permissions management
+Refer to the instructions below to use basic permissions management. You can use either Azure PowerShell or the Azure Portal.
+
+For granular control over permissions, [switch to role-based access control](rbac-windows-defender-advanced-threat-protection.md).
+
+### Assign user access using Azure PowerShell
You can assign users with one of the following levels of permissions:
- Full access (Read and Write)
-- Read only access
+- Read-only access
-### Before you begin
+#### Before you begin
- Install Azure PowerShell. For more information see, [How to install and configure Azure PowerShell](https://azure.microsoft.com/documentation/articles/powershell-install-configure/).
> [!NOTE]
@@ -43,8 +58,6 @@ You can assign users with one of the following levels of permissions:
- Connect to your Azure Active Directory. For more information see, [Connect-MsolService](https://msdn.microsoft.com/library/dn194123.aspx).
-
-
**Full access**
Users with full access can log in, view all system information and resolve alerts, submit files for deep analysis, and download the onboarding package.
Assigning full access rights requires adding the users to the “Security Administrator” or “Global Administrator” AAD built-in roles.
@@ -67,7 +80,7 @@ Add-MsolRoleMember -RoleName "Security Reader" -RoleMemberEmailAddress “reader
For more information see, [Manage Azure AD group and role membership](https://technet.microsoft.com/library/321d532e-407d-4e29-a00a-8afbe23008dd#BKMK_ManageGroups).
-## Assign user access using the Azure portal
+### Assign user access using the Azure portal
1. Go to the [Azure portal](https://portal.azure.com).
@@ -86,4 +99,8 @@ For more information see, [Manage Azure AD group and role membership](https://te
+
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-portalaccess-belowfoldlink)
+
+## Related topic
+- [Manage portal access using RBAC](rbac-windows-defender-advanced-threat-protection.md)
diff --git a/windows/security/threat-protection/windows-defender-atp/attack-simulations-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/attack-simulations-windows-defender-advanced-threat-protection.md
new file mode 100644
index 0000000000..b0954a8441
--- /dev/null
+++ b/windows/security/threat-protection/windows-defender-atp/attack-simulations-windows-defender-advanced-threat-protection.md
@@ -0,0 +1,63 @@
+---
+title: Experience Windows Defender ATP through simulated attacks
+description: Run the provided attack scenario simulations to experience how Windows Defender ATP can detect, investigate, and respond to breaches.
+keywords: wdatp, test, scenario, attack, simulation, simulated, diy, windows defender advanced threat protection
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: lomayor
+author: lomayor
+ms.localizationpriority: high
+ms.date: 28/02/2018
+---
+
+# Experience Windows Defender ATP through simulated attacks
+
+**Applies to:**
+
+- Windows 10 Enterprise
+- Windows 10 Education
+- Windows 10 Pro
+- Windows 10 Pro Education
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
+>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-attacksimulations-abovefoldlink)
+
+You might want to experience Windows Defender ATP before you onboard more than a few machines to the service. To do this, you can run controlled attack simulations on a few test machines. After running the simulated attacks, you can review how Windows Defender ATP surfaces malicious activity and explore how it enables an efficient response.
+
+## Before you begin
+
+To run any of the provided simulations, you need at least [one onboarded machine](onboard-configure-windows-defender-advanced-threat-protection.md).
+
+Read the walkthrough document provided with each attack scenario. Each document includes OS and application requirements as well as detailed instructions that are specific to an attack scenario.
+
+## Run a simulation
+
+1. In **Help** > **Simulations & tutorials**, select which of the available attack scenarios you would like to simulate:
+
+ - **Scenario 1: Document drops backdoor** - simulates delivery of a socially engineered lure document. The document launches a specially crafted backdoor that gives attackers control.
+
+ - **Scenario 2: PowerShell script in fileless attack** - simulates a fileless attack that relies on PowerShell, showcasing attack surface reduction and machine learning detection of malicious memory activity.
+
+ - **Scenario 3: Automated incident response** - triggers Automated investigation, which automatically hunts for and remediates breach artifacts to scale your incident response capacity.
+
+2. Download and read the corresponding walkthrough document provided with your selected scenario.
+
+3. Download the simulation file or copy the simulation script by navigating to **Help** > **Simulations & tutorials**. You can choose to download the file or script on the test machine but it's not mandatory.
+
+4. Run the simulation file or script on the test machine as instructed in the walkthrough document.
+
+>[!NOTE]
+>Simulation files or scripts mimic attack activity but are actually benign and will not harm or compromise the test machine.
+
+
+>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-attacksimulations-belowfoldlink)
+
+
+## Related topics
+- [Onboard machines](onboard-configure-windows-defender-advanced-threat-protection.md)
+- [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md)
\ No newline at end of file
diff --git a/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection.md
new file mode 100644
index 0000000000..94e1a95594
--- /dev/null
+++ b/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection.md
@@ -0,0 +1,267 @@
+---
+title: Use Automated investigations to investigate and remediate threats
+description: View the list of automated investigations, its status, detection source and other details.
+keywords: automated, investigation, detection, source, threat types, id, tags, machines, duration, filter export
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: high
+ms.date: 04/24/2018
+---
+
+# Use Automated investigations to investigate and remediate threats
+
+**Applies to:**
+
+- Windows 10 Enterprise
+- Windows 10 Education
+- Windows 10 Pro
+- Windows 10 Pro Education
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
+>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-automated-investigations-abovefoldlink)
+
+The Windows Defender ATP service has a wide breadth of visibility on multiple machines. With this kind of optics, the service generates a multitude of alerts. The volume of alerts generated can be challenging for a typical security operations team to individually address.
+
+
+To address this challenge, Windows Defender ATP uses Automated investigations to significantly reduce the volume of alerts that need to be investigated individually. The Automated investigation feature leverages various inspection algorithms, and processes used by analysts (such as playbooks) to examine alerts and take immediate remediation action to resolve breaches. This significantly reduces alert volume, allowing security operations experts to focus on more sophisticated threats and other high value initiatives.
+
+The Automated investigations list shows all the investigations that have been initiated automatically and shows other details such as its status, detection source, and the date for when the investigation was initiated.
+
+## Understand the Automated investigation flow
+### How the Automated investigation starts
+Entities are the starting point for Automated investigations. When an alert contains a supported entity for Automated investigation (for example, a file) that resides on a machine that has a *supported operating system for Automated investigation then an Automated investigation can start.
+*Currently only Windows 10 version 1803 (spring creators update) and above are supported operating systems for Autoamted Investigation
+
+The alerts start by analyzing the supported entities from the alert and also runs a generic machine playbook to see if there is anything else suspicious on that machine. The outcome and details from the investigation is seen in the Automated investigation view.
+
+### Details of an Automated investigation
+As the investigation proceeds, you'll be able to view the details of the investigation. Selecting a triggering alert brings you to the investigation details view where you can pivot from the **Investigation graph**, **Alerts**, **Machines**, **Threats**, **Entities**, and **Log** tabs.
+
+In the **Alerts** tab, you'll see the alert that started the investigation.
+
+The **Machines** tab shows where the alert was seen.
+
+The **Threats** tab shows the entities that were found to be malicious during the investigation.
+
+During an Automated investigation, details about each analyzed entity is categorized in the **Entities** tab. You'll be able to see the determination for each entity type, such as whether it was determined to be malicious, suspicious, or clean.
+
+The **Log** tab reflects the chronological detailed view of all the investigation actions taken on the alert.
+
+If there are pending actions on the investigation, the **Pending actions** tab will be displayed where you can approve or reject actions.
+
+### How an Automated investigation expands its scope
+
+While an investigation is running, any other alert generated from the machine will be added to an ongoing Automated investigation until that investigation is completed. In addition, if the same threat is seen on other machines, those machines are added to the investigation.
+
+If an incriminated entity is seen in another machine, the Automated investigation will expand the investigation to include that machine and a generic machine playbook will start on that machine. If 10 or more machines are found during this expansion process from the same entity, then that expansion action will require an approval and will be seen in the **Pending actions** view.
+
+### How threats are remediated
+Depending on how you set up the machine groups and their level of automation, the Automated investigation will either automaticlly remediate threats or require user approval (this is the default). For more information, see [Create and manage machine groups](machine-groups-windows-defender-advanced-threat-protection.md).
+
+The default machine group is configured for semi-automatic remediation. This means that any malicious entity that needs to be remediated requires an approval and the investigation is added to the **Pending actions** section, this can be changed to fully automatic so that no user approval is needed.
+
+When a pending action is approved, the entity is then remediated and this new state is reflected in the **Entities** tab of the investigation.
+
+### How an Automated investigation is completed
+When the Automated investigation completes its analysis, and all pending actions are resolved, an investigation is considered complete. It's important to understand that an investigation is only considered complete if there are no pending actions on it.
+
+
+## Manage Automated investigations
+By default, the Automated investigations list displays investigations initiated in the last week. You can also choose to select other time ranges from the drop-down menu or specify a custom range.
+
+>[!NOTE]
+>If your organization has implemented role-based access to manage portal access, only authorized users or user groups who have permission to view the machine or machine group will be able to view the entire investigation.
+
+Use the **Customize columns** drop-down menu to select columns that you'd like to show or hide.
+
+From this view, you can also download the entire list in CSV format using the **Export** button, specify the number of items to show per page, and navigate between pages. You also have the flexibility to filter the list based on your preferred criteria.
+
+
+
+
+**Filters**
+You can use the following operations to customize the list of Automated investigations displayed:
+
+
+**Triggering alert**
+The alert the initiated the Automated investigation.
+
+**Status**
+An Automated investigation can be in one of the following status:
+
+Status | Description
+:---|:---
+| No threats found | No malicious entities found during the investigation.
+| Failed | A problem has interrupted the investigation, preventing it from completing. |
+| Partially remediated | A problem prevented the remediation of some malicious entities. |
+| Action required | Remediation actions require review and approval. |
+| Waiting for machine | Investigation paused. The investigation will resume as soon as the machine is available. |
+| Queued | Investigation has been queued and will resume as soon as other remediation activities are completed. |
+| Running | Investigation ongoing. Malicious entities found will be remediated. |
+| Remediated | Malicious entities found were successfully remediated. |
+| Terminated by system | Investigation was stopped due to Browse to the location of the *wdatp-connector.properties* file. The name must match the file provided in the .zip that you downloaded.
Refresh Token
- You can obtain a refresh token in two ways: by generating a refresh token from the **SIEM integration preferences setup** page or using the restutil tool.
For more information on generating a refresh token from the **Preferences setup** , see [Enable SIEM integration in Windows Defender ATP](enable-siem-integration-windows-defender-advanced-threat-protection.md). **Get your refresh token using the restutil tool:** a. Open a command prompt. Navigate to C:\\*folder_location*\current\bin where *folder_location* represents the location where you installed the tool. b. Type: `arcsight restutil token -config` from the bin directory. A Web browser window will open. c. Type in your credentials then click on the password field to let the page redirect. In the login prompt, enter your credentials. d. A refresh token is shown in the command prompt. e. Copy and paste it into the **Refresh Token** field.
+ You can obtain a refresh token in two ways: by generating a refresh token from the **SIEM settings** page or using the restutil tool.
For more information on generating a refresh token from the **Preferences setup** , see [Enable SIEM integration in Windows Defender ATP](enable-siem-integration-windows-defender-advanced-threat-protection.md). **Get your refresh token using the restutil tool:** a. Open a command prompt. Navigate to C:\\*folder_location*\current\bin where *folder_location* represents the location where you installed the tool. b. Type: `arcsight restutil token -config` from the bin directory. A Web browser window will open. c. Type in your credentials then click on the password field to let the page redirect. In the login prompt, enter your credentials. d. A refresh token is shown in the command prompt. e. Copy and paste it into the **Refresh Token** field.
Key type is a string.
Possible values are:
-- Normal - sets reporting frequency from the endpoint to Normal mode for the optimal speed and performance balance
-- Expedite - sets reporting frequency from the endpoint to Expedite mode
+- Normal - sets reporting frequency from the machine to Normal mode for the optimal speed and performance balance
+- Expedite - sets reporting frequency from the machine to Expedite mode
The default value in case the registry key doesn’t exist is Normal.
-### Offboard endpoints
-For security reasons, the package used to offboard endpoints will expire 30 days after the date it was downloaded. Expired offboarding packages sent to an endpoint will be rejected. When downloading an offboarding package you will be notified of the packages expiry date and it will also be included in the package name.
+## Offboard machines using Group Policy
+For security reasons, the package used to Offboard machines will expire 30 days after the date it was downloaded. Expired offboarding packages sent to a machine will be rejected. When downloading an offboarding package you will be notified of the packages expiry date and it will also be included in the package name.
> [!NOTE]
-> Onboarding and offboarding policies must not be deployed on the same endpoint at the same time, otherwise this will cause unpredictable collisions.
+> Onboarding and offboarding policies must not be deployed on the same machine at the same time, otherwise this will cause unpredictable collisions.
1. Get the offboarding package from the [Windows Defender ATP portal](https://securitycenter.windows.com/):
- a. Click **Endpoint management** > **Clients** on the **Navigation pane**.
+ a. In the navigation pane, select **Settings** > **Machine management** > **Offboarding**.
- b. Click the **Endpoint offboarding** section.
+ b. Select Windows 10 as the operating system.
+
+ c. In the **Deployment method** field, select **Group policy**.
- c. Select **Group Policy**, click **Download package** and save the .zip file.
+ d. Click **Download package** and save the .zip file.
-2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the endpoints. You should have a file named *WindowsDefenderATPOffboardingScript_valid_until_YYYY-MM-DD.cmd*.
+2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the machine. You should have a file named *WindowsDefenderATPOffboardingScript_valid_until_YYYY-MM-DD.cmd*.
3. Open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx) (GPMC), right-click the Group Policy Object (GPO) you want to configure and click **Edit**.
@@ -144,22 +150,22 @@ For security reasons, the package used to offboard endpoints will expire 30 days
> Offboarding causes the machine to stop sending sensor data to the portal but data from the machine, including reference to any alerts it has had will be retained for up to 6 months.
-## Monitor endpoint configuration
-With Group Policy there isn’t an option to monitor deployment of policies on the endpoints. Monitoring can be done directly on the portal, or by using the different deployment tools.
+## Monitor machine configuration
+With Group Policy there isn’t an option to monitor deployment of policies on the machines. Monitoring can be done directly on the portal, or by using the different deployment tools.
-## Monitor endpoints using the portal
+## Monitor machines using the portal
1. Go to the [Windows Defender ATP portal](https://securitycenter.windows.com/).
2. Click **Machines list**.
-3. Verify that endpoints are appearing.
+3. Verify that machines are appearing.
> [!NOTE]
-> It can take several days for endpoints to start showing on the **Machines list**. This includes the time it takes for the policies to be distributed to the endpoint, the time it takes before the user logs on, and the time it takes for the endpoint to start reporting.
+> It can take several days for machines to start showing on the **Machines list**. This includes the time it takes for the policies to be distributed to the machine, the time it takes before the user logs on, and the time it takes for the endpoint to start reporting.
## Related topics
-- [Configure endpoints using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md)
-- [Configure endpoints using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md)
-- [Configure endpoints using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md)
-- [Configure non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi-windows-defender-advanced-threat-protection.md)
-- [Run a detection test on a newly onboarded Windows Defender ATP endpoint](run-detection-test-windows-defender-advanced-threat-protection.md)
+- [Onboard Windows 10 machines using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md)
+- [Onboard Windows 10 machines using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md)
+- [Onboard Windows 10 machines using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md)
+- [Onboard non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi-windows-defender-advanced-threat-protection.md)
+- [Run a detection test on a newly onboarded Windows Defender ATP machines](run-detection-test-windows-defender-advanced-threat-protection.md)
- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
diff --git a/windows/security/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md
index 1da2319b09..c7774a5663 100644
--- a/windows/security/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md
@@ -1,7 +1,7 @@
---
-title: Configure endpoints using Mobile Device Management tools
-description: Use Mobile Device Management tools to deploy the configuration package on endpoints so that they are onboarded to the service.
-keywords: configure endpoints using mdm, endpoint management, configure Windows ATP endpoints, configure Windows Defender Advanced Threat Protection endpoints, mdm
+title: Onboard Windows 10 machines using Mobile Device Management tools
+description: Use Mobile Device Management tools to deploy the configuration package on machines so that they are onboarded to the service.
+keywords: onboard machines using mdm, machine management, onboard Windows ATP machines, onboard Windows Defender Advanced Threat Protection machines, mdm
search.product: eADQiWindows 10XVcnh
ms.prod: w10
ms.mktglfcycl: deploy
@@ -10,10 +10,10 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 11/06/2017
+ms.date: 04/24/2018
---
-# Configure endpoints using Mobile Device Management tools
+# Onboard Windows 10 machines using Mobile Device Management tools
**Applies to:**
@@ -23,11 +23,9 @@ ms.date: 11/06/2017
- Windows 10 Pro Education
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-
-
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpointsmdm-abovefoldlink)
-You can use mobile device management (MDM) solutions to configure endpoints. Windows Defender ATP supports MDMs by providing OMA-URIs to create policies to manage endpoints.
+You can use mobile device management (MDM) solutions to configure machines. Windows Defender ATP supports MDMs by providing OMA-URIs to create policies to manage machines.
For more information on using Windows Defender ATP CSP see, [WindowsAdvancedThreatProtection CSP](https://msdn.microsoft.com/library/windows/hardware/mt723296(v=vs.85).aspx) and [WindowsAdvancedThreatProtection DDF file](https://msdn.microsoft.com/library/windows/hardware/mt723297(v=vs.85).aspx).
@@ -36,19 +34,85 @@ If you're using Microsoft Intune, you must have the device MDM Enrolled. Otherwi
For more information on enabling MDM with Microsoft Intune, see [Setup Windows Device Management](https://docs.microsoft.com/intune-classic/deploy-use/set-up-windows-device-management-with-microsoft-intune).
-## Configure endpoints using Microsoft Intune
+## Onboard machines using Microsoft Intune
For more information on using Windows Defender ATP CSP see, [WindowsAdvancedThreatProtection CSP](https://msdn.microsoft.com/library/windows/hardware/mt723296(v=vs.85).aspx) and [WindowsAdvancedThreatProtection DDF file](https://msdn.microsoft.com/library/windows/hardware/mt723297(v=vs.85).aspx).
-### Onboard and monitor endpoints using the classic Intune console
+### Using the Azure Intune Portal to deploy Windows Defender Advanced Threat Protection policies on Windows 10 1607 and higher
1. Open the Microsoft Intune configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/):
- a. Select **Endpoint management** > **Clients** on the **Navigation pane**.
+ a. In the navigation pane, select **Settings** > **Machine management** > **Onboarding**.
- b. Select **Mobile Device Management/Microsoft Intune** > **Download package** and save the .zip file.
+ b. Select Windows 10 as the operating system.
- 
+ c. In the **Deployment method** field, select **Mobile Device Management / Microsoft Intune**.
+
+ d. Click **Download package**, and save the .zip file.
+
+2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. You should have a file named *WindowsDefenderATP.onboarding*.
+
+3. Login to the [Microsoft Azure portal](https://portal.azure.com).
+
+4. From the Intune blade, choose **Device configuration**.
+
+ 
+
+5. Under **Manage**, choose **Profiles** and click **Create Profile**.
+
+ 
+
+6. Type a name, description and choose **Windows 10 and later** as the Platform and **Custom** as the Profile type.
+
+ 
+
+7. Click **Settings** > **Configure**.
+
+ 
+
+8. Under Custom OMA-URI Settings, click **Add**.
+
+ 
+
+9. Enter the following values, then click **OK**.
+
+ 
+
+ - **Name**: Type a name for the setting.
+ - **Description**: Type a description for the setting.
+ - **OMA-URI**: _./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Onboarding_
+ - **Value**: Copy and paste the contents of the WindowsDefenderATP.onboarding file you downloaded.
+
+10. Save the settings by clicking **OK**.
+
+11. Click **Create**.
+
+ 
+
+12. To deploy the Profile, click **Assignments**.
+
+ 
+
+13. Search for and select the Group you want to apply the Configuration Profile to, then click **Select**.
+
+ 
+
+14. Click **Save** to finish deploying the Configuration Profile.
+
+ 
+
+
+### Onboard and monitor machines using the classic Intune console
+
+1. Open the Microsoft Intune configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/):
+
+ a. In the navigation pane, select **Settings** > **Machine management** > **Onboarding**.
+
+ b. Select Windows 10 as the operating system.
+
+ c. In the **Deployment method** field, select **Mobile Device Management / Microsoft Intune**.
+
+ d. Click **Download package**, and save the .zip file.
2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. You should have a file named *WindowsDefenderATP.onboarding*.
@@ -91,9 +155,9 @@ For more information on using Windows Defender ATP CSP see, [WindowsAdvancedThre
-When the policy is deployed and is propagated, endpoints will be shown in the **Machines list**.
+When the policy is deployed and is propagated, machines will be shown in the **Machines list**.
-You can use the following onboarding policies to deploy configuration settings on endpoints. These policies can be sub-categorized to:
+You can use the following onboarding policies to deploy configuration settings on machines. These policies can be sub-categorized to:
- Onboarding
- Health Status for onboarded machines
- Configuration for onboarded machines
@@ -115,30 +179,29 @@ Configuration for onboarded machines: diagnostic data reporting frequency | ./De
>[!TIP]
-> After onboarding the endpoint, you can choose to run a detection test to verify that an endpoint is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Windows Defender ATP endpoint](run-detection-test-windows-defender-advanced-threat-protection.md).
+> After onboarding the machine, you can choose to run a detection test to verify that a machine is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Windows Defender ATP machine](run-detection-test-windows-defender-advanced-threat-protection.md).
-
-
-### Offboard and monitor endpoints
-
-For security reasons, the package used to offboard endpoints will expire 30 days after the date it was downloaded. Expired offboarding packages sent to an endpoint will be rejected. When downloading an offboarding package you will be notified of the packages expiry date and it will also be included in the package name.
+## Offboard and monitor machines using Mobile Device Management tools
+For security reasons, the package used to Offboard machines will expire 30 days after the date it was downloaded. Expired offboarding packages sent to a machine will be rejected. When downloading an offboarding package you will be notified of the packages expiry date and it will also be included in the package name.
> [!NOTE]
-> Onboarding and offboarding policies must not be deployed on the same endpoint at the same time, otherwise this will cause unpredictable collisions.
+> Onboarding and offboarding policies must not be deployed on the same machine at the same time, otherwise this will cause unpredictable collisions.
1. Get the offboarding package from the [Windows Defender ATP portal](https://securitycenter.windows.com/):
- a. Click **Endpoint management** > **Clients** on the **Navigation pane**.
+ a. In the navigation pane, select **Settings** > **Machine management** > **Offboarding**.
- b. Click the **Endpoint offboarding** section.
+ b. Select Windows 10 as the operating system.
- c. Select **Mobile Device Management /Microsoft Intune**, click **Download package** and save the .zip file.
+ c. In the **Deployment method** field, select **Mobile Device Management / Microsoft Intune**.
+
+ d. Click **Download package**, and save the .zip file.
2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. You should have a file named *WindowsDefenderATP_valid_until_YYYY-MM-DD.offboarding*.
3. Use the Microsoft Intune custom configuration policy to deploy the following supported OMA-URI settings. For more information on Microsoft Intune policy settings see, [Windows 10 policy settings in Microsoft Intune](https://docs.microsoft.com/en-us/intune/deploy-use/windows-10-policy-settings-in-microsoft-intune).
-Offboarding - Use the offboarding policies to remove configuration settings on endpoints. These policies can be sub-categorized to:
+Offboarding - Use the offboarding policies to remove configuration settings on machines. These policies can be sub-categorized to:
- Offboarding
- Health Status for offboarded machines
- Configuration for offboarded machines
@@ -156,9 +219,9 @@ Health Status for offboarded machines: Onboarding State | ./Device/Vendor/MSFT/W
> Offboarding causes the machine to stop sending sensor data to the portal but data from the machine, including reference to any alerts it has had will be retained for up to 6 months.
## Related topics
-- [Configure endpoints using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md)
-- [Configure endpoints using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md)
-- [Configure endpoints using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md)
-- [Configure non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi-windows-defender-advanced-threat-protection.md)
-- [Run a detection test on a newly onboarded Windows Defender ATP endpoint](run-detection-test-windows-defender-advanced-threat-protection.md)
+- [Onboard Windows 10 machines using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md)
+- [Onboard Windows 10 machines using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md)
+- [Onboard Windows 10 machines using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md)
+- [Onboard non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi-windows-defender-advanced-threat-protection.md)
+- [Run a detection test on a newly onboarded Windows Defender ATP machine](run-detection-test-windows-defender-advanced-threat-protection.md)
- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
diff --git a/windows/security/threat-protection/windows-defender-atp/configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md
index f98fcf98cf..450371174d 100644
--- a/windows/security/threat-protection/windows-defender-atp/configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md
@@ -1,7 +1,7 @@
---
-title: Configure non-Windows endpoints in Windows Defender ATP
-description: Configure non-Winodws endpoints so that they can send sensor data to the Windows Defender ATP service.
-keywords: configure endpoints non-Windows endpoints, macos, linux, endpoint management, configure Windows ATP endpoints, configure Windows Defender Advanced Threat Protection endpoints
+title: Onboard non-Windows machines to the Windows Defender ATP service
+description: Configure non-Winodws machines so that they can send sensor data to the Windows Defender ATP service.
+keywords: onboard non-Windows machines, macos, linux, machine management, configure Windows ATP machines, configure Windows Defender Advanced Threat Protection machines
search.product: eADQiWindows 10XVcnh
ms.prod: w10
ms.mktglfcycl: deploy
@@ -9,10 +9,10 @@ ms.sitesec: library
ms.pagetype: security
author: mjcaparas
localizationpriority: high
-ms.date: 12/12/2017
+ms.date: 04/24/2018
---
-# Configure non-Windows endpoints
+# Onboard non-Windows machines
**Applies to:**
@@ -28,20 +28,21 @@ Windows Defender ATP provides a centralized security operations experience for W
You'll need to know the exact Linux distros and macOS X versions that are compatible with Windows Defender ATP for the integration to work.
-## Onboard non-Windows endpoints
-You'll need to take the following steps to oboard non-Windows endpoints:
+You'll need to take the following steps to onboard non-Windows machines:
1. Turn on third-party integration
2. Run a detection test
### Turn on third-party integration
-1. In Windows Defender Security Center portal, select **Endpoint management** > **Clients** > **Non-Windows**. Make sure the third-party solution is listed.
+1. In the navigation pane, select **Settings** > **Machine management** > **Onboarding**. Make sure the third-party solution is listed.
-2. Toggle the third-party provider switch button to turn on the third-party solution integration.
+2. Select Mac and Linux as the operating system.
-3. Click **Generate access token** button and then **Copy**.
+3. Turn on the third-party solution integration.
-4. You’ll need to copy and paste the token to the third-party solution you’re using. The implementation may vary depending on the solution.
+4. Click **Generate access token** button and then **Copy**.
+
+5. You’ll need to copy and paste the token to the third-party solution you’re using. The implementation may vary depending on the solution.
>[!WARNING]
@@ -52,21 +53,21 @@ Create an EICAR test file by saving the string displayed on the portal in an emp
The file should trigger a detection and a corresponding alert on Windows Defender ATP.
-### Offboard non-Windows endpoints
-To effectively offboard the endpoints from the service, you'll need to disable the data push on the third-party portal first then switch the toggle to off in Windows Defender Security Center. The toggle in the portal only blocks the data inbound flow.
+## Offboard non-Windows machines
+To effectively offboard the machine from the service, you'll need to disable the data push on the third-party portal first then switch the toggle to off in Windows Defender Security Center. The toggle in the portal only blocks the data inbound flow.
1. Follow the third-party documentation to opt-out on the third-party service side.
-2. In Windows Defender Security Center portal, select **Endpoint management**> **Non-Windows**.
+2. In the navigation pane, select **Settings** > **Machine management** > **Onboarding**.
-3. Toggle the third-party provider switch button to turn stop diagnostic data from endpoints.
+3. Turn off the third-party solution integration.
>[!WARNING]
->If you decide to turn on the third-party integration again after disabling the integration, you'll need to regenerate the token and reapply it on endpoints.
+>If you decide to turn on the third-party integration again after disabling the integration, you'll need to regenerate the token and reapply it on machines.
## Related topics
-- [Configure Windows Defender ATP client endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
-- [Configure server endpoints](configure-server-endpoints-windows-defender-advanced-threat-protection.md)
+- [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md)
+- [Onboard servers](configure-server-endpoints-windows-defender-advanced-threat-protection.md)
- [Configure proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md)
- [Troubleshooting Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
\ No newline at end of file
diff --git a/windows/security/threat-protection/windows-defender-atp/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md
index de4aa4ddca..ab8da7cafa 100644
--- a/windows/security/threat-protection/windows-defender-atp/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md
@@ -1,7 +1,7 @@
---
-title: Configure endpoints using System Center Configuration Manager
-description: Use System Center Configuration Manager to deploy the configuration package on endpoints so that they are onboarded to the service.
-keywords: configure endpoints using sccm, endpoint management, configure Windows ATP endpoints, configure Windows Defender Advanced Threat Protection endpoints, sccm
+title: Onboard Windows 10 machines using System Center Configuration Manager
+description: Use System Center Configuration Manager to deploy the configuration package on machines so that they are onboarded to the service.
+keywords: onboard machines using sccm, machine management, configure Windows ATP machines, configure Windows Defender Advanced Threat Protection machines, sccm
search.product: eADQiWindows 10XVcnh
ms.prod: w10
ms.mktglfcycl: deploy
@@ -10,10 +10,10 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 11/06/2017
+ms.date: 04/24/2018
---
-# Configure endpoints using System Center Configuration Manager
+# Onboard Windows 10 machines using System Center Configuration Manager
**Applies to:**
@@ -24,33 +24,38 @@ ms.date: 11/06/2017
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
- System Center 2012 Configuration Manager or later versions
-
+[!include[Prerelease information](prerelease.md)]
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpointssccm-abovefoldlink)
-## Configure endpoints using System Center Configuration Manager (current branch) version 1606
-System Center Configuration Manager (SCCM) (current branch) version 1606, has UI integrated support for configuring and managing Windows Defender ATP on endpoints. For more information, see [Support for Windows Defender Advanced Threat Protection service](https://go.microsoft.com/fwlink/p/?linkid=823682).
+## Onboard Windows 10 machines using System Center Configuration Manager (current branch) version 1606
+System Center Configuration Manager (SCCM) (current branch) version 1606, has UI integrated support for configuring and managing Windows Defender ATP on machines. For more information, see [Support for Windows Defender Advanced Threat Protection service](https://go.microsoft.com/fwlink/p/?linkid=823682).
>[!NOTE]
> If you’re using SCCM client version 1606 with server version 1610 or above, you must upgrade the client version to match the server version.
-## Configure endpoints using System Center Configuration Manager earlier versions
-You can use existing System Center Configuration Manager functionality to create a policy to configure your endpoints. This is supported in the following System Center Configuration Manager versions:
+## Onboard Windows 10 machines using System Center Configuration Manager earlier versions
+You can use existing System Center Configuration Manager functionality to create a policy to configure your machines. This is supported in the following System Center Configuration Manager versions:
- System Center 2012 Configuration Manager
- System Center 2012 R2 Configuration Manager
- System Center Configuration Manager (current branch), version 1511
- System Center Configuration Manager (current branch), version 1602
-### Onboard endpoints
+### Onboard machines using System Center Configuration Manager
+
1. Open the SCCM configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/):
- a. Click **Endpoint management** > **Clients** on the **Navigation pane**.
+ a. In the navigation pane, select **Settings** > **Machine management** > **Onboarding**.
+
+ b. Select Windows 10 as the operating system.
- b. Select **System Center Configuration Manager 2012/2012 R2/1511/1602**, click **Download package**, and save the .zip file.
+ c. In the **Deployment method** field, select **System Center Configuration Manager 2012/2012 R2/1511/1602**.
+
+ d. Click **Download package**, and save the .zip file.
2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. You should have a file named *WindowsDefenderATPOnboardingScript.cmd*.
@@ -62,12 +67,12 @@ You can use existing System Center Configuration Manager functionality to create
> Windows Defender ATP doesn't support onboarding during the [Out-Of-Box Experience (OOBE)](https://answers.microsoft.com/en-us/windows/wiki/windows_10/how-to-complete-the-windows-10-out-of-box/47e3f943-f000-45e3-8c5c-9d85a1a0cf87) phase. Make sure users complete OOBE after running Windows installation or upgrading.
>[!TIP]
-> After onboarding the endpoint, you can choose to run a detection test to verify that an endpoint is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Windows Defender ATP endpoint](run-detection-test-windows-defender-advanced-threat-protection.md).
+> After onboarding the machine, you can choose to run a detection test to verify that an machine is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Windows Defender ATP machine](run-detection-test-windows-defender-advanced-threat-protection.md).
### Configure sample collection settings
-For each endpoint, you can set a configuration value to state whether samples can be collected from the endpoint when a request is made through the Windows Defender ATP portal to submit a file for deep analysis.
+For each machine, you can set a configuration value to state whether samples can be collected from the machine when a request is made through the Windows Defender ATP portal to submit a file for deep analysis.
-You can set a compliance rule for configuration item in System Center Configuration Manager to change the sample share setting on an endpoint.
+You can set a compliance rule for configuration item in System Center Configuration Manager to change the sample share setting on a machine.
This rule should be a *remediating* compliance rule configuration item that sets the value of a registry key on targeted machines to make sure they’re complaint.
The configuration is set through the following registry key entry:
@@ -80,8 +85,8 @@ Value: 0 or 1
Where:
Key type is a D-WORD.
Possible values are:
-- 0 - doesn't allow sample sharing from this endpoint
-- 1 - allows sharing of all file types from this endpoint
+- 0 - doesn't allow sample sharing from this machine
+- 1 - allows sharing of all file types from this machine
The default value in case the registry key doesn’t exist is 1.
@@ -95,7 +100,7 @@ In cases where high-value assets or machines are at high risk, you can configure
> [!NOTE]
> Using the Expedite mode might have an impact on the machine's battery usage and actual bandwidth used for sensor data. You should consider this when these measures are critical.
-For each endpoint, you can configure a registry key value that determines how frequent a machine reports sensor data to the portal.
+For each machine, you can configure a registry key value that determines how frequent a machine reports sensor data to the portal.
The configuration is set through the following registry key entry:
@@ -107,26 +112,28 @@ Value: Normal or Expedite
Where:
Key type is a string.
Possible values are:
-- Normal - sets reporting frequency from the endpoint to Normal mode for the optimal speed and performance balance
-- Expedite - sets reporting frequency from the endpoint to Expedite mode
+- Normal - sets reporting frequency from the machine to Normal mode for the optimal speed and performance balance
+- Expedite - sets reporting frequency from the machine to Expedite mode
The default value in case the registry key doesn’t exist is Normal.
-### Offboard endpoints
+## Offboard machines using System Center Configuration Manager
-For security reasons, the package used to offboard endpoints will expire 30 days after the date it was downloaded. Expired offboarding packages sent to an endpoint will be rejected. When downloading an offboarding package you will be notified of the packages expiry date and it will also be included in the package name.
+For security reasons, the package used to Offboard machines will expire 30 days after the date it was downloaded. Expired offboarding packages sent to an machine will be rejected. When downloading an offboarding package you will be notified of the packages expiry date and it will also be included in the package name.
> [!NOTE]
-> Onboarding and offboarding policies must not be deployed on the same endpoint at the same time, otherwise this will cause unpredictable collisions.
+> Onboarding and offboarding policies must not be deployed on the same machine at the same time, otherwise this will cause unpredictable collisions.
1. Get the offboarding package from the [Windows Defender ATP portal](https://securitycenter.windows.com/):
- a. Click **Endpoint management** > **Clients** on the **Navigation pane**.
+ a. In the navigation pane, select **Settings** > **Machine management** > **Offboarding**.
- b. Click the **Endpoint offboarding** section.
+ b. Select Windows 10 as the operating system.
- c. Select **System Center Configuration Manager System Center Configuration Manager 2012/2012 R2/1511/1602**, click **Download package**, and save the .zip file.
+ c. In the **Deployment method** field, select **System Center Configuration Manager 2012/2012 R2/1511/1602**.
+
+ d. Click **Download package**, and save the .zip file.
2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. You should have a file named *WindowsDefenderATPOffboardingScript_valid_until_YYYY-MM-DD.cmd*.
@@ -138,12 +145,12 @@ For security reasons, the package used to offboard endpoints will expire 30 days
> Offboarding causes the machine to stop sending sensor data to the portal but data from the machine, including reference to any alerts it has had will be retained for up to 6 months.
-### Monitor endpoint configuration
+### Monitor machine configuration
Monitoring with SCCM consists of two parts:
-1. Confirming the configuration package has been correctly deployed and is running (or has successfully run) on the endpoints in your network.
+1. Confirming the configuration package has been correctly deployed and is running (or has successfully run) on the machines in your network.
-2. Checking that the endpoints are compliant with the Windows Defender ATP service (this ensures the endpoint can complete the onboarding process and can continue to report data to the service).
+2. Checking that the machines are compliant with the Windows Defender ATP service (this ensures the machine can complete the onboarding process and can continue to report data to the service).
**To confirm the configuration package has been correctly deployed:**
@@ -155,11 +162,11 @@ Monitoring with SCCM consists of two parts:
4. Review the status indicators under **Completion Statistics** and **Content Status**.
-If there are failed deployments (endpoints with **Error**, **Requirements Not Met**, or **Failed statuses**), you may need to troubleshoot the endpoints. For more information see, [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md).
+If there are failed deployments (machines with **Error**, **Requirements Not Met**, or **Failed statuses**), you may need to troubleshoot the machines. For more information see, [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md).
-**Check that the endpoints are compliant with the Windows Defender ATP service:**
+**Check that the machines are compliant with the Windows Defender ATP service:**
You can set a compliance rule for configuration item in System Center Configuration Manager to monitor your deployment.
This rule should be a *non-remediating* compliance rule configuration item that monitors the value of a registry key on targeted machines.
@@ -173,9 +180,9 @@ Value: “1”
For more information about System Center Configuration Manager Compliance see [Compliance Settings in Configuration Manager](https://technet.microsoft.com/library/gg681958.aspx).
## Related topics
-- [Configure endpoints using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md)
-- [Configure endpoints using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md)
-- [Configure endpoints using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md)
-- [Configure non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi-windows-defender-advanced-threat-protection.md)
-- [Run a detection test on a newly onboarded Windows Defender ATP endpoint](run-detection-test-windows-defender-advanced-threat-protection.md)
+- [Onboard Windows 10 machines using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md)
+- [Onboard Windows 10 machines using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md)
+- [Onboard Windows 10 machines using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md)
+- [Onboard non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi-windows-defender-advanced-threat-protection.md)
+- [Run a detection test on a newly onboarded Windows Defender ATP machine](run-detection-test-windows-defender-advanced-threat-protection.md)
- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
diff --git a/windows/security/threat-protection/windows-defender-atp/configure-endpoints-script-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/configure-endpoints-script-windows-defender-advanced-threat-protection.md
index f1219c9897..4dbf933ec5 100644
--- a/windows/security/threat-protection/windows-defender-atp/configure-endpoints-script-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/configure-endpoints-script-windows-defender-advanced-threat-protection.md
@@ -1,7 +1,7 @@
---
-title: Configure Windows Defender ATP endpoints using a local script
-description: Use a local script to deploy the configuration package on endpoints so that they are onboarded to the service.
-keywords: configure endpoints using a local script, endpoint management, configure Windows ATP endpoints, configure Windows Defender Advanced Threat Protection endpoints
+title: Onboard Windows 10 machines using a local script
+description: Use a local script to deploy the configuration package on machines so that they are onboarded to the service.
+keywords: configure machines using a local script, machine management, configure Windows ATP machines, configure Windows Defender Advanced Threat Protection machines
search.product: eADQiWindows 10XVcnh
ms.prod: w10
ms.mktglfcycl: deploy
@@ -10,10 +10,10 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 11/06/2017
+ms.date: 04/24/2018
---
-# Configure endpoints using a local script
+# Onboard Windows 10 machines using a local script
**Applies to:**
@@ -23,26 +23,31 @@ ms.date: 11/06/2017
- Windows 10 Pro Education
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+[!include[Prerelease information](prerelease.md)]
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpointsscript-abovefoldlink)
-You can also manually onboard individual endpoints to Windows Defender ATP. You might want to do this first when testing the service before you commit to onboarding all endpoints in your network.
+You can also manually onboard individual machines to Windows Defender ATP. You might want to do this first when testing the service before you commit to onboarding all machines in your network.
> [!NOTE]
-> The script has been optimized to be used on a limited number of machines (1-10 machines). To deploy to scale, use other deployment options. For more information on using other deployment options, see [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md).
+> The script has been optimized to be used on a limited number of machines (1-10 machines). To deploy to scale, use other deployment options. For more information on using other deployment options, see [Onboard Window 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md).
-## Onboard endpoints
+## Onboard machines
1. Open the GP configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/):
- a. Click **Endpoint management** > **Clients** on the **Navigation pane**.
+ a. In the navigation pane, select **Settings** > **Machine management** > **Onboarding**.
- b. Select **Local Script**, click **Download package** and save the .zip file.
+ b. Select Windows 10 as the operating system.
+ c. In the **Deployment method** field, select **Local Script**.
-2. Extract the contents of the configuration package to a location on the endpoint you want to onboard (for example, the Desktop). You should have a file named *WindowsDefenderATPOnboardingScript.cmd*.
+ d. Click **Download package** and save the .zip file.
-3. Open an elevated command-line prompt on the endpoint and run the script:
+
+2. Extract the contents of the configuration package to a location on the machine you want to onboard (for example, the Desktop). You should have a file named *WindowsDefenderATPOnboardingScript.cmd*.
+
+3. Open an elevated command-line prompt on the machine and run the script:
a. Go to **Start** and type **cmd**.
@@ -54,16 +59,16 @@ You can also manually onboard individual endpoints to Windows Defender ATP. You
5. Press the **Enter** key or click **OK**.
-For information on how you can manually validate that the endpoint is compliant and correctly reports sensor data see, [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md).
+For information on how you can manually validate that the machine is compliant and correctly reports sensor data see, [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md).
>[!TIP]
-> After onboarding the endpoint, you can choose to run a detection test to verify that an endpoint is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Windows Defender ATP endpoint](run-detection-test-windows-defender-advanced-threat-protection.md).
+> After onboarding the machine, you can choose to run a detection test to verify that an machine is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Windows Defender ATP endpoint](run-detection-test-windows-defender-advanced-threat-protection.md).
## Configure sample collection settings
-For each endpoint, you can set a configuration value to state whether samples can be collected from the endpoint when a request is made through the Windows Defender ATP portal to submit a file for deep analysis.
+For each machine, you can set a configuration value to state whether samples can be collected from the machine when a request is made through the Windows Defender ATP portal to submit a file for deep analysis.
-You can manually configure the sample sharing setting on the endpoint by using *regedit* or creating and running a *.reg* file.
+You can manually configure the sample sharing setting on the machine by using *regedit* or creating and running a *.reg* file.
The configuration is set through the following registry key entry:
@@ -75,29 +80,31 @@ Value: 0 or 1
Where:
Name type is a D-WORD.
Possible values are:
-- 0 - doesn't allow sample sharing from this endpoint
-- 1 - allows sharing of all file types from this endpoint
+- 0 - doesn't allow sample sharing from this machine
+- 1 - allows sharing of all file types from this machine
The default value in case the registry key doesn’t exist is 1.
-## Offboard endpoints
-For security reasons, the package used to offboard endpoints will expire 30 days after the date it was downloaded. Expired offboarding packages sent to an endpoint will be rejected. When downloading an offboarding package you will be notified of the packages expiry date and it will also be included in the package name.
+## Offboard machines using a local script
+For security reasons, the package used to Offboard machines will expire 30 days after the date it was downloaded. Expired offboarding packages sent to an machine will be rejected. When downloading an offboarding package you will be notified of the packages expiry date and it will also be included in the package name.
> [!NOTE]
-> Onboarding and offboarding policies must not be deployed on the same endpoint at the same time, otherwise this will cause unpredictable collisions.
+> Onboarding and offboarding policies must not be deployed on the same machine at the same time, otherwise this will cause unpredictable collisions.
1. Get the offboarding package from the [Windows Defender ATP portal](https://securitycenter.windows.com/):
- a. Click **Endpoint management** on the **Navigation pane**.
+ a. In the navigation pane, select **Settings** > **Machine management** > **Offboarding**.
- b. Click the **Endpoint offboarding** section.
+ b. Select Windows 10 as the operating system.
- c. Select **Group Policy**, click **Download package** and save the .zip file.
+ c. In the **Deployment method** field, select **Local Script**.
-2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the endpoints. You should have a file named *WindowsDefenderATPOffboardingScript_valid_until_YYYY-MM-DD.cmd*.
+ d. Click **Download package** and save the .zip file.
-3. Open an elevated command-line prompt on the endpoint and run the script:
+2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the machines. You should have a file named *WindowsDefenderATPOffboardingScript_valid_until_YYYY-MM-DD.cmd*.
+
+3. Open an elevated command-line prompt on the machine and run the script:
a. Go to **Start** and type **cmd**.
@@ -113,23 +120,23 @@ For security reasons, the package used to offboard endpoints will expire 30 days
> Offboarding causes the machine to stop sending sensor data to the portal but data from the machine, including reference to any alerts it has had will be retained for up to 6 months.
-## Monitor endpoint configuration
+## Monitor machine configuration
You can follow the different verification steps in the [Troubleshoot onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) to verify that the script completed successfully and the agent is running.
Monitoring can also be done directly on the portal, or by using the different deployment tools.
-### Monitor endpoints using the portal
+### Monitor machines using the portal
1. Go to the Windows Defender ATP portal.
2. Click **Machines list**.
-3. Verify that endpoints are appearing.
+3. Verify that machines are appearing.
## Related topics
-- [Configure endpoints using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md)
-- [Configure endpoints using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md)
-- [Configure endpoints using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md)
-- [Configure non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi-windows-defender-advanced-threat-protection.md)
-- [Run a detection test on a newly onboarded Windows Defender ATP endpoint](run-detection-test-windows-defender-advanced-threat-protection.md)
+- [Onboard Windows 10 machines using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md)
+- [Onboard Windows 10 machines using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md)
+- [Onboard Windows 10 machines using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md)
+- [Onboard non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi-windows-defender-advanced-threat-protection.md)
+- [Run a detection test on a newly onboarded Windows Defender ATP machine](run-detection-test-windows-defender-advanced-threat-protection.md)
- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
diff --git a/windows/security/threat-protection/windows-defender-atp/configure-endpoints-vdi-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/configure-endpoints-vdi-windows-defender-advanced-threat-protection.md
index 06efff80c7..3053183884 100644
--- a/windows/security/threat-protection/windows-defender-atp/configure-endpoints-vdi-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/configure-endpoints-vdi-windows-defender-advanced-threat-protection.md
@@ -1,7 +1,7 @@
---
-title: Configure non-persistent virtual desktop infrastructure (VDI) machines
+title: Onboard non-persistent virtual desktop infrastructure (VDI) machines
description: Deploy the configuration package on virtual desktop infrastructure (VDI) machine so that they are onboarded to Windows Defender ATP the service.
-keywords: configure virtual desktop infrastructure (VDI) machine, vdi, endpoint management, configure Windows ATP endpoints, configure Windows Defender Advanced Threat Protection endpoints
+keywords: configure virtual desktop infrastructure (VDI) machine, vdi, machine management, configure Windows ATP endpoints, configure Windows Defender Advanced Threat Protection endpoints
search.product: eADQiWindows 10XVcnh
ms.prod: w10
ms.mktglfcycl: deploy
@@ -10,15 +10,15 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/16/2017
+ms.date: 04/24/2018
---
-# Configure non-persistent virtual desktop infrastructure (VDI) machines
+# Onboard non-persistent virtual desktop infrastructure (VDI) machines
**Applies to:**
- Virtual desktop infrastructure (VDI) machines
-
+[!include[Prerelease information](prerelease.md)]
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configvdi-abovefoldlink)
@@ -40,9 +40,13 @@ You can onboard VDI machines using a single entry or multiple entries for each m
1. Open the VDI configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/):
- a. Click **Endpoint management** > **Clients** on the **Navigation pane**.
+ a. In the navigation pane, select **Settings** > **Machine management** > **Onboarding**.
- b. Select **VDI onboarding scripts for non-persistent endpoints** then click **Download package** and save the .zip file.
+ b. Select Windows 10 as the operating system.
+
+ c. In the **Deployment method** field, select **VDI onboarding scripts for non-persistent endpoints**.
+
+ d. Click **Download package** and save the .zip file.
2. Copy the extracted files from the .zip into `golden/master` image under the path `C:\WINDOWS\System32\GroupPolicy\Machine\Scripts\Startup`. You should have a folder called `WindowsDefenderATPOnboardingPackage` containing the file `WindowsDefenderATPOnboardingScript.cmd`.
@@ -67,9 +71,13 @@ You can onboard VDI machines using a single entry or multiple entries for each m
6. Test your solution:
a. Create a pool with one machine.
+
b. Logon to machine.
+
c. Logoff from machine.
+
d. Logon to machine with another user.
+
e. **For single entry for each machine**: Check only one entry in the Windows Defender ATP portal.
**For multiple entries for each machine**: Check multiple entries in the Windows Defender ATP portal.
@@ -78,10 +86,10 @@ You can onboard VDI machines using a single entry or multiple entries for each m
8. Use the search function by entering the machine name and select **Machine** as search type.
## Related topics
-- [Configure endpoints using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md)
-- [Configure endpoints using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md)
-- [Configure endpoints using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md)
-- [Configure endpoints using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md)
+- [Onboard Windows 10 machines using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md)
+- [Onboard Windows 10 machines using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md)
+- [Onboard Windows 10 machines using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md)
+- [Onboard Windows 10 machines using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md)
- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
diff --git a/windows/security/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection.md
index 4afc560682..dab99dbf01 100644
--- a/windows/security/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection.md
@@ -1,7 +1,7 @@
---
-title: Configure Windows Defender ATP client endpoints
-description: Configure client endpoints so that they can send sensor data to the Windows Defender ATP sensor.
-keywords: configure client endpoints, endpoint management, configure Windows ATP endpoints, configure Windows Defender Advanced Threat Protection endpoints
+title: Onboard Windows 10 machines on Windows Defender ATP
+description: Onboard Windows 10 machines so that they can send sensor data to the Windows Defender ATP sensor
+keywords: Onboard Windows 10 machines, group policy, system center configuration manager, mobile device management, local script, gp, sccm, mdm, intune
search.product: eADQiWindows 10XVcnh
ms.prod: w10
ms.mktglfcycl: deploy
@@ -10,10 +10,10 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/16/2017
+ms.date: 04/24/2018
---
-# Configure Windows Defender ATP client endpoints
+# Onboard Windows 10 machines
**Applies to:**
@@ -23,9 +23,9 @@ ms.date: 10/16/2017
- Windows 10 Pro Education
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+[!include[Prerelease information](prerelease.md)]
-
-Endpoints in your organization must be configured so that the Windows Defender ATP service can get sensor data from them. There are various methods and deployment tools that you can use to configure the endpoints in your organization.
+Machines in your organization must be configured so that the Windows Defender ATP service can get sensor data from them. There are various methods and deployment tools that you can use to configure the machines in your organization.
Windows Defender ATP supports the following deployment tools and methods:
@@ -37,11 +37,11 @@ Windows Defender ATP supports the following deployment tools and methods:
## In this section
Topic | Description
:---|:---
-[Configure endpoints using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md) | Use Group Policy to deploy the configuration package on endpoints.
-[Configure endpoints using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md) | You can use either use System Center Configuration Manager (current branch) version 1606 or System Center Configuration Manager(current branch) version 1602 or earlier to deploy the configuration package on endpoints.
-[Configure endpoints using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md) | Use Mobile Device Management tools or Microsoft Intune to deploy the configuration package on endpoints.
-[Configure endpoints using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md) | Learn how to use the local script to deploy the configuration package on endpoints.
-[Configure non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi-windows-defender-advanced-threat-protection.md) | Learn how to use the configuration package to configure VDI machines.
+[Onboard Windows 10 machines using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md) | Use Group Policy to deploy the configuration package on machines.
+[Onboard Windows 10 machines using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md) | You can use either use System Center Configuration Manager (current branch) version 1606 or System Center Configuration Manager(current branch) version 1602 or earlier to deploy the configuration package on machines.
+[Onboard Windows 10 machines using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md) | Use Mobile Device Management tools or Microsoft Intune to deploy the configuration package on machine.
+[Onboard Windows 10 machines using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md) | Learn how to use the local script to deploy the configuration package on endpoints.
+[Onboard non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi-windows-defender-advanced-threat-protection.md) | Learn how to use the configuration package to configure VDI machines.
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpoints-belowfoldlink)
\ No newline at end of file
diff --git a/windows/security/threat-protection/windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection.md
index cd4942e214..ac747f99f5 100644
--- a/windows/security/threat-protection/windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection.md
@@ -1,5 +1,5 @@
---
-title: Configure endpoint proxy and Internet connection settings
+title: Configure machine proxy and Internet connection settings
description: Configure the Windows Defender ATP proxy and internet settings to enable communication with the cloud service.
keywords: configure, proxy, internet, internet connectivity, settings, proxy settings, netsh, winhttp, proxy server
search.product: eADQiWindows 10XVcnh
@@ -14,7 +14,7 @@ ms.date: 10/16/2017
---
-# Configure endpoint proxy and Internet connectivity settings
+# Configure machine proxy and Internet connectivity settings
**Applies to:**
@@ -39,7 +39,7 @@ The WinHTTP configuration setting is independent of the Windows Internet (WinINe
- Web Proxy Auto-discovery Protocol (WPAD)
> [!NOTE]
-> If you're using Transparent proxy or WPAD in your network topology, you don't need special endpoint configuration settings. For more information on Windows Defender ATP URL exclusions in the proxy, see [Enable access to Windows Defender ATP service URLs in the proxy server](#enable-access-to-windows-defender-atp-service-urls-in-the-proxy-server).
+> If you're using Transparent proxy or WPAD in your network topology, you don't need special configuration settings. For more information on Windows Defender ATP URL exclusions in the proxy, see [Enable access to Windows Defender ATP service URLs in the proxy server](#enable-access-to-windows-defender-atp-service-urls-in-the-proxy-server).
- Manual static proxy configuration:
@@ -99,7 +99,7 @@ Verify the proxy configuration completed successfully, that WinHTTP can discover
1. Download the [connectivity verification tool](https://go.microsoft.com/fwlink/p/?linkid=823683) to the PC where Windows Defender ATP sensor is running on.
-2. Extract the contents of WDATPConnectivityAnalyzer on the endpoint.
+2. Extract the contents of WDATPConnectivityAnalyzer on the machine.
3. Open an elevated command-line:
@@ -135,5 +135,5 @@ If at least one of the connectivity options returns a (200) status, then the Win
However, if the connectivity check results indicate a failure, an HTTP error is displayed (see HTTP Status Codes). You can then use the URLs in the table shown in [Enable access to Windows Defender ATP service URLs in the proxy server](#enable-access-to-windows-defender-atp-service-urls-in-the-proxy-server). The URLs you'll use will depend on the region selected during the onboarding procedure.
## Related topics
-- [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
+- [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md)
- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
diff --git a/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md
index 576adf3128..d11e0dc92e 100644
--- a/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md
@@ -1,7 +1,7 @@
---
-title: Configure Windows Defender ATP server endpoints
-description: Configure server endpoints so that they can send sensor data to the Windows Defender ATP sensor.
-keywords: configure server endpoints, server, server onboarding, endpoint management, configure Windows ATP server endpoints, configure Windows Defender Advanced Threat Protection server endpoints
+title: Onboard servers to the Windows Defender ATP service
+description: Onboard servers so that they can send sensor data to the Windows Defender ATP sensor.
+keywords: onboard server, server, server onboarding, machine management, configure Windows ATP servers, onboard Windows Defender Advanced Threat Protection servers
search.product: eADQiWindows 10XVcnh
ms.prod: w10
ms.mktglfcycl: deploy
@@ -9,15 +9,16 @@ ms.sitesec: library
ms.pagetype: security
author: mjcaparas
localizationpriority: high
-ms.date: 11/30/2017
+ms.date: 04/24/2018
---
-# Configure Windows Defender ATP server endpoints
+# Onboard servers to the Windows Defender ATP service
**Applies to:**
- Windows Server 2012 R2
- Windows Server 2016
+- Windows Server, version 1803
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
[!include[Prerelease information](prerelease.md)]
@@ -29,8 +30,9 @@ Windows Defender ATP extends support to also include the Windows Server operatin
Windows Defender ATP supports the onboarding of the following servers:
- Windows Server 2012 R2
- Windows Server 2016
+- Windows Server, version 1803
-## Onboard server endpoints
+## Onboard Windows Server 2012 R2 and Windows Server 2016
To onboard your servers to Windows Defender ATP, you’ll need to:
@@ -38,16 +40,16 @@ To onboard your servers to Windows Defender ATP, you’ll need to:
- If you're already leveraging System Center Operations Manager (SCOM) or Operations Management Suite (OMS), simply attach the Microsoft Monitoring Agent (MMA) to report to your Windows Defender ATP workspace through [Multi Homing support](https://blogs.technet.microsoft.com/msoms/2016/05/26/oms-log-analytics-agent-multi-homing-support/). Otherwise, install and configure MMA to report sensor data to Windows Defender ATP as instructed below.
>[!TIP]
-> After onboarding the endpoint, you can choose to run a detection test to verify that an endpoint is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Windows Defender ATP endpoint](run-detection-test-windows-defender-advanced-threat-protection.md).
+> After onboarding the machine, you can choose to run a detection test to verify that it is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Windows Defender ATP endpoint](run-detection-test-windows-defender-advanced-threat-protection.md).
### Turn on Server monitoring from the Windows Defender Security Center portal
-1. In the navigation pane, select **Endpoint management** > **Servers**.
+1. In the navigation pane, select **Settings** > **Machine management** > **Onboarding**.
-2. Click **Turn on server monitoring** and confirm that you'd like to proceed with the environment set up. When the set up completes, the **Workspace ID** and **Workspace key** fields are populated with unique values. You'll need to use these values to configure the MMA agent.
-
- 
+2. Select Windows server 2012, 2012R2 and 2016 as the operating system.
+
+3. Click **Turn on server monitoring** and confirm that you'd like to proceed with the environment set up. When the set up completes, the **Workspace ID** and **Workspace key** fields are populated with unique values. You'll need to use these values to configure the MMA agent.
### Install and configure Microsoft Monitoring Agent (MMA) to report sensor data to Windows Defender ATP
@@ -64,7 +66,8 @@ To onboard your servers to Windows Defender ATP, you’ll need to:
Once completed, you should see onboarded servers in the portal within an hour.
-### Configure server endpoint proxy and Internet connectivity settings
+### Configure server proxy and Internet connectivity settings
+
- Each Windows server must be able to connect to the Internet using HTTPS. This connection can be direct, using a proxy, or through the [OMS Gateway](https://docs.microsoft.com/en-us/azure/log-analytics/log-analytics-oms-gateway).
- If a proxy or firewall is blocking all traffic by default and allowing only specific domains through or HTTPS scanning (SSL inspection) is enabled, make sure that the following URLs are white-listed to permit communication with Windows Defender ATP service:
@@ -79,17 +82,84 @@ Once completed, you should see onboarded servers in the portal within an hour.
| winatp-gw-neu.microsoft.com | 443 |
| winatp-gw-weu.microsoft.com | 443 |
+## Onboard Windows Server 2012 R2 and Windows Server 2016
-### Offboard server endpoints
-To offboard the server, you can uninstall the MMA agent from the server or detach it from reporting to your Windows Defender ATP workspace. After offboarding the agent, the server will no longer send sensor data to Windows Defender ATP.
-For more information, see [To disable an agent](https://docs.microsoft.com/en-us/azure/log-analytics/log-analytics-windows-agents#to-disable-an-agent).
+You’ll be able to onboard in the same method available for Windows 10 client machines. For more information, see [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md). Support for Windows Server, version 1803 provides deeper insight into activities happening on the server, coverage for kernel and memory attack detection, and enables response actions on Windows Server endpoint as well.
+
+1. Install the latest Windows Server Insider build on a machine. For more information, see [Windows Server Insider Preview](https://www.microsoft.com/en-us/software-download/windowsinsiderpreviewserver).
+
+2. Configure Windows Defender ATP onboarding settings on the server. For more information, see [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md).
+
+3. If you’re running a third party antimalware solution, you'll need to apply the following Windows Defender AV passive mode settings and verify it was configured correctly:
+
+ a. Set the following registry entry:
+ - Path: `HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection`
+ - Name: ForceDefenderPassiveMode
+ - Value: 1
+
+ b. Run the following PowerShell command to verify that the passive mode was configured:
+
+ ```Get-WinEvent -FilterHashtable @{ProviderName="Microsoft-Windows-Sense" ;ID=84}```
+
+ c. Confirm that a recent event containing the passive mode event is found:
+
+ 
+
+4. Run the following command to check if Windows Defender AV is installed:
+
+ ```sc query Windefend```
+
+ If the result is ‘The specified service does not exist as an installed service’, then you'll need to install Windows Defender AV. For more information, see [Windows Defender Antivirus in Windows 10](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10).
+
+## Offboard servers
+You have two options to offboard servers from the service:
+- Uninstall the MMA agent
+- Remove the Windows Defender ATP workspace configuration
>[!NOTE]
>Offboarding causes the server to stop sending sensor data to the portal but data from the server, including reference to any alerts it has had will be retained for up to 6 months.
+### Uninstall servers by uinstalling the MMA agent
+To offboard the server, you can uninstall the MMA agent from the server or detach it from reporting to your Windows Defender ATP workspace. After offboarding the agent, the server will no longer send sensor data to Windows Defender ATP.
+For more information, see [To disable an agent](https://docs.microsoft.com/en-us/azure/log-analytics/log-analytics-windows-agents#to-disable-an-agent).
+
+### Remove the Windows Defender ATP workspace configuration
+To offboard the server, you can use either of the following methods:
+
+- Remove the Windows Defender ATP workspace configuration from the MMA agent
+- Run a PowerShell command to remove the configuration
+
+#### Remove the Windows Defender ATP workspace configuration from the MMA agent
+
+1. In the **Microsoft Monitoring Agent Properties**, select the **Azure Log Analytics (OMS)** tab.
+
+2. Select the Windows Defender ATP workspace, and click **Remove**.
+
+ 
+
+#### Run a PowerShell command to remove the configuration
+
+1. Get your Workspace ID:
+ a. In the navigation pane, select **Settings** > **Machine management** > **Onboarding**.
+
+ b. Select **Windows server 2012, 2012R2 and 2016** as the operating system and get your Workspace ID:
+
+ 
+
+2. Open an elevated PowerShell and run the following command. Use the Workspace ID you obtained and replacing `WorkspaceID`:
+
+ ```
+ # Load agent scripting object
+ $AgentCfg = New-Object -ComObject AgentConfigManager.MgmtSvcCfg
+ # Remove OMS Workspace
+ $AgentCfg.RemoveCloudWorkspace($WorkspaceID)
+ # Reload the configuration and apply changes
+ $AgentCfg.ReloadConfiguration()
+ ```
+
## Related topics
-- [Configure Windows Defender ATP client endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
-- [Configure non-Windows endpoints](configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md)
+- [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md)
+- [Onboard non-Windows machines](configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md)
- [Configure proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md)
-- [Run a detection test on a newly onboarded Windows Defender ATP endpoint](run-detection-test-windows-defender-advanced-threat-protection.md)
+- [Run a detection test on a newly onboarded Windows Defender ATP machine](run-detection-test-windows-defender-advanced-threat-protection.md)
- [Troubleshooting Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
diff --git a/windows/security/threat-protection/windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection.md
index e3847a41ad..f2ab846f15 100644
--- a/windows/security/threat-protection/windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection.md
@@ -23,11 +23,9 @@ ms.date: 10/16/2017
- Windows 10 Pro Education
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-
-
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configuresiem-abovefoldlink)
-## Pull alerts using supported security information and events management (SIEM) tools
+## Pull alerts using security information and events management (SIEM) tools
Windows Defender ATP supports (SIEM) tools to pull alerts. Windows Defender ATP exposes alerts through an HTTPS endpoint hosted in Azure. The endpoint can be configured to pull alerts from your enterprise tenant in Azure Active Directory (AAD) using the OAuth 2.0 authentication protocol for an AAD application that represents the specific SIEM connector installed in your environment.
@@ -56,7 +54,7 @@ For more information, see [Pull Windows Defender ATP alerts using REST API](pull
Topic | Description
:---|:---
-[Enable SIEM integration in Windows Defender ATP](enable-siem-integration-windows-defender-advanced-threat-protection.md)| Learn about enabling the SIEM integration feature in the **Preferences setup** page in the portal so that you can use and generate the required information to configure supported SIEM tools.
+[Enable SIEM integration in Windows Defender ATP](enable-siem-integration-windows-defender-advanced-threat-protection.md)| Learn about enabling the SIEM integration feature in the **Settings** page in the portal so that you can use and generate the required information to configure supported SIEM tools.
[Configure Splunk to pull Windows Defender ATP alerts](configure-splunk-windows-defender-advanced-threat-protection.md)| Learn about installing the REST API Modular Input app and other configuration settings to enable Splunk to pull Windows Defender ATP alerts.
[Configure HP ArcSight to pull Windows Defender ATP alerts](configure-arcsight-windows-defender-advanced-threat-protection.md)| Learn about installing the HP ArcSight REST FlexConnector package and the files you need to configure ArcSight to pull Windows Defender ATP alerts.
[Windows Defender ATP alert API fields](api-portal-mapping-windows-defender-advanced-threat-protection.md) | Understand what data fields are exposed as part of the alerts API and how they map to the Windows Defender ATP portal.
diff --git a/windows/security/threat-protection/windows-defender-atp/configure-splunk-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/configure-splunk-windows-defender-advanced-threat-protection.md
index ed2b034f45..be0b750935 100644
--- a/windows/security/threat-protection/windows-defender-atp/configure-splunk-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/configure-splunk-windows-defender-advanced-threat-protection.md
@@ -32,7 +32,7 @@ You'll need to configure Splunk so that it can pull Windows Defender ATP alerts.
## Before you begin
- Install the [REST API Modular Input app](https://splunkbase.splunk.com/app/1546/) in Splunk.
-- Make sure you have enabled the **SIEM integration** feature from the **Preferences setup** menu. For more information, see [Enable SIEM integration in Windows Defender ATP](enable-siem-integration-windows-defender-advanced-threat-protection.md)
+- Make sure you have enabled the **SIEM integration** feature from the **Settings** menu. For more information, see [Enable SIEM integration in Windows Defender ATP](enable-siem-integration-windows-defender-advanced-threat-protection.md)
- Have the details file you saved from enabling the **SIEM integration** feature ready. You'll need to get the following values:
- OAuth 2 Token refresh URL
@@ -105,7 +105,7 @@ You'll need to configure Splunk so that it can pull Windows Defender ATP alerts.
Polling Interval
- Number of seconds that Splunk will ping the Windows Defender ATP endpoint. Accepted values are in seconds.
+ Number of seconds that Splunk will ping the Windows Defender ATP machine. Accepted values are in seconds.
Set sourcetype
diff --git a/windows/security/threat-protection/windows-defender-atp/custom-ti-api-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/custom-ti-api-windows-defender-advanced-threat-protection.md
index 05d249bdc3..e06ccda51d 100644
--- a/windows/security/threat-protection/windows-defender-atp/custom-ti-api-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/custom-ti-api-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 03/27/2018
+ms.date: 04/24/2018
---
# Create custom alerts using the threat intelligence (TI) application program interface (API)
@@ -23,7 +23,7 @@ ms.date: 03/27/2018
- Windows 10 Pro Education
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-
+[!include[Prerelease information](prerelease.md)]
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-customti-abovefoldlink)
@@ -59,7 +59,7 @@ For this URL:
Each tenant has a defined quota that limits the number of possible alert definitions, IOCs and another quota for IOCs of Action different than “equals” in the system. If you upload data beyond this quota, you'll encounter an HTTP error status code 507 (Insufficient Storage).
## Request an access token from the token issuing endpoint
-Windows Defender ATP Threat Intelligence API uses OAuth 2.0. In the context of Windows Defender ATP, the alert definitions are a protected resource. To issue tokens for ad-hoc, non-automatic operations you can use the **Preferences settings** page and click the **Generate Token** button. However, if you’d like to create an automated client, you need to use the “Client Credentials Grant” flow. For more information, see the [OAuth 2.0 authorization framework](https://tools.ietf.org/html/rfc6749#section-4.4).
+Windows Defender ATP Threat Intelligence API uses OAuth 2.0. In the context of Windows Defender ATP, the alert definitions are a protected resource. To issue tokens for ad-hoc, non-automatic operations you can use the **Settings** page and click the **Generate Token** button. However, if you’d like to create an automated client, you need to use the “Client Credentials Grant” flow. For more information, see the [OAuth 2.0 authorization framework](https://tools.ietf.org/html/rfc6749#section-4.4).
For more information about the authorization flow, see [OAuth 2.0 authorization flow](https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-protocols-oauth-code#oauth-20-authorization-flow).
diff --git a/windows/security/threat-protection/windows-defender-atp/data-retention-settings-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/data-retention-settings-windows-defender-advanced-threat-protection.md
new file mode 100644
index 0000000000..2f1642def7
--- /dev/null
+++ b/windows/security/threat-protection/windows-defender-atp/data-retention-settings-windows-defender-advanced-threat-protection.md
@@ -0,0 +1,46 @@
+---
+title: Update data retention settings for Windows Defender Advanced Threat Protection
+description: Update data retention settings by selecting between 30 days to 180 days.
+keywords: data, storage, settings, retention, update
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: high
+ms.date: 04/24/2018
+---
+# Update data retention settings for Windows Defender ATP
+
+**Applies to:**
+
+- Windows 10 Enterprise
+- Windows 10 Education
+- Windows 10 Pro
+- Windows 10 Pro Education
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
+>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-gensettings-abovefoldlink)
+
+During the onboarding process, a wizard takes you through the general settings of Windows Defender ATP. After onboarding, you might want to update the data retention settings.
+
+1. In the navigation pane, select **Settings** > **General** > **Data rention**.
+
+2. Select the data retention duration from the drop-down list.
+
+ > [!NOTE]
+ > Other settings are not editable.
+
+3. Click **Save preferences**.
+
+
+## Related topics
+- [Update data retention settings](data-retention-settings-windows-defender-advanced-threat-protection.md)
+- [Configure alert notifications in Windows Defender ATP](configure-email-notifications-windows-defender-advanced-threat-protection.md)
+- [Enable and create Power BI reports using Windows Defender ATP data](powerbi-reports-windows-defender-advanced-threat-protection.md)
+- [Enable Secure Score security controls](enable-secure-score-windows-defender-advanced-threat-protection.md)
+- [Configure advanced features](advanced-features-windows-defender-advanced-threat-protection.md)
diff --git a/windows/security/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md
index a650f8fe1f..e04a79d353 100644
--- a/windows/security/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md
@@ -27,7 +27,7 @@ This section covers some of the most frequently asked questions regarding privac
## What data does Windows Defender ATP collect?
-Microsoft will collect and store information from your configured endpoints in a database specific to the service for administration, tracking, and reporting purposes.
+Microsoft will collect and store information from your configured machines in a database specific to the service for administration, tracking, and reporting purposes.
Information collected includes file data (such as file names, sizes, and hashes), process data (running processes, hashes), registry data, network connection data (host IPs and ports), and machine details (such as machine identifiers, names, and the operating system version).
@@ -51,7 +51,7 @@ In all scenarios, data is encrypted using 256-bit [AES encyption](https://en.wik
## Do I have the flexibility to select where to store my data?
-When onboarding the service for the first time, you can choose to store your data in Microsoft Azure datacenters in Europe or in the United States. Once configured, you cannot change the location where your data is stored. This provides a convenient way to minimize compliance risk by actively selecting the geographic locations where your data will reside. Microsoft will not under any circumstance, transfer the data from the specified geolocation into another geolocation.
+When onboarding the service for the first time, you can choose to store your data in Microsoft Azure datacenters in Europe or in the United States. Once configured, you cannot change the location where your data is stored. This provides a convenient way to minimize compliance risk by actively selecting the geographic locations where your data will reside. Customer data in de-identified form may also be stored in the central storage and processing systems in the United States.
## Is my data isolated from other customer data?
Yes, your data is isolated through access authentication and logical segregation based on customer identifier. Each customer can only access data collected from its own organization and generic data that Microsoft provides.
diff --git a/windows/security/threat-protection/windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection.md
index 4e082b67d2..035afaf190 100644
--- a/windows/security/threat-protection/windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 11/28/2017
+ms.date: 04/24/2018
---
# Windows Defender Antivirus compatibility with Windows Defender ATP
@@ -33,12 +33,12 @@ The Windows Defender Advanced Threat Protection agent depends on Windows Defende
>[!IMPORTANT]
>Windows Defender ATP does not adhere to the Windows Defender Antivirus Exclusions settings.
-You must configure the signature updates on the Windows Defender ATP endpoints whether Windows Defender Antivirus is the active antimalware or not. For more information, see [Manage Windows Defender Antivirus updates and apply baselines](../windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md).
+You must configure the signature updates on the Windows Defender ATP machines whether Windows Defender Antivirus is the active antimalware or not. For more information, see [Manage Windows Defender Antivirus updates and apply baselines](../windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md).
-If an onboarded endpoint is protected by a third-party antimalware client, Windows Defender Antivirus on that endpoint will enter into passive mode.
+If an onboarded machine is protected by a third-party antimalware client, Windows Defender Antivirus on that endpoint will enter into passive mode.
Windows Defender Antivirus will continue to receive updates, and the *mspeng.exe* process will be listed as a running a service, but it will not perform scans and will not replace the running third-party antimalware client.
-The Windows Defender Antivirus interface will be disabled, and users on the endpoint will not be able to use Windows Defender Antivirus to perform on-demand scans or configure most options.
+The Windows Defender Antivirus interface will be disabled, and users on the machine will not be able to use Windows Defender Antivirus to perform on-demand scans or configure most options.
For more information, see the [Windows Defender Antivirus and Windows Defender ATP compatibility topic](../windows-defender-antivirus/windows-defender-antivirus-compatibility.md).
diff --git a/windows/security/threat-protection/windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection.md
index def73c0599..babca11760 100644
--- a/windows/security/threat-protection/windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/16/2017
+ms.date: 04/24/2018
---
# Enable the custom threat intelligence API in Windows Defender ATP
@@ -23,13 +23,13 @@ ms.date: 10/16/2017
- Windows 10 Pro Education
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-
+[!include[Prerelease information](prerelease.md)]
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-enablecustomti-abovefoldlink)
Before you can create custom threat intelligence (TI) using REST API, you'll need to set up the custom threat intelligence application through the Windows Defender ATP portal.
-1. In the navigation pane, select **Preference Setup** > **Threat intel API**.
+1. In the navigation pane, select **Settings** > **APIs** > **Threat intel**.
@@ -47,7 +47,7 @@ You’ll need to use the access token in the Authorization header when doing RES
## Related topics
- [Understand threat intelligence concepts](threat-indicator-concepts-windows-defender-advanced-threat-protection.md)
-- [Enable the custom threat intelligence API in Windows Defender ATP](enable-custom-ti-windows-defender-advanced-threat-protection.md)
+- [Create custom alerts using the threat intelligence API](custom-ti-api-windows-defender-advanced-threat-protection.md)
- [PowerShell code examples for the custom threat intelligence API](powershell-example-code-windows-defender-advanced-threat-protection.md)
- [Python code examples for the custom threat intelligence API](python-example-code-windows-defender-advanced-threat-protection.md)
- [Experiment with custom threat intelligence alerts](experiment-custom-ti-windows-defender-advanced-threat-protection.md)
diff --git a/windows/security/threat-protection/windows-defender-atp/enable-secure-score-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/enable-secure-score-windows-defender-advanced-threat-protection.md
new file mode 100644
index 0000000000..472a8abc15
--- /dev/null
+++ b/windows/security/threat-protection/windows-defender-atp/enable-secure-score-windows-defender-advanced-threat-protection.md
@@ -0,0 +1,46 @@
+---
+title: Enable Secure Score in Windows Defender ATP
+description: Set the baselines for calculating the score of Windows Defender security controls on the Secure Score dashboard.
+keywords: enable secure score, baseline, calculation, analytics, score, secure score dashboard, dashboard
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: high
+ms.date: 04/24/2018
+---
+
+# Enable Secure Score security controls
+
+**Applies to:**
+
+- Windows 10 Enterprise
+- Windows 10 Education
+- Windows 10 Pro
+- Windows 10 Pro Education
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
+Set the baselines for calculating the score of Windows Defender security controls on the Secure Score dashboard. If you use third-party solutions, consider excluding the corresponding controls from the calculations.
+
+ >[!NOTE]
+ >Changes might take up to a few hours to reflect on the dashboard.
+
+1. In the navigation pane, select **Settings** > **General** > **Secure Score**.
+
+ 
+
+2. Select the security control, then toggle the setting between **On** and **Off**.
+
+3. Click **Save preferences**.
+
+## Related topics
+- [View the Secure Score dashboard](secure-score-dashboard-windows-defender-advanced-threat-protection.md)
+- [Update data retention settings for Windows Defender ATP](data-retention-settings-windows-defender-advanced-threat-protection.md)
+- [Configure alert notifications in Windows Defender ATP](configure-email-notifications-windows-defender-advanced-threat-protection.md)
+- [Enable and create Power BI reports using Windows Defender ATP data](powerbi-reports-windows-defender-advanced-threat-protection.md)
+- [Configure advanced features in Windows Defender ATP](advanced-features-windows-defender-advanced-threat-protection.md)
diff --git a/windows/security/threat-protection/windows-defender-atp/enable-security-analytics-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/enable-security-analytics-windows-defender-advanced-threat-protection.md
deleted file mode 100644
index fc7325015e..0000000000
--- a/windows/security/threat-protection/windows-defender-atp/enable-security-analytics-windows-defender-advanced-threat-protection.md
+++ /dev/null
@@ -1,49 +0,0 @@
----
-title: Enable Secure score security controls in Windows Defender ATP
-description: Set the baselines for calculating the score of Windows Defender security controls on the Secure score dashboard.
-keywords: secure score, baseline, calculation, score, secure score dashboard, dashboard, windows defender antivirus, av, exploit guard, application guard, smartscreen
-search.product: eADQiWindows 10XVcnh
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.sitesec: library
-ms.pagetype: security
-ms.author: macapara
-author: mjcaparas
-ms.localizationpriority: high
-ms.date: 03/12/2018
----
-
-# Enable Secure score security controls
-
-**Applies to:**
-
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
-- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-
-
-
-Set the baselines for calculating the score of Windows Defender security controls on the Secure score dashboard. If you use third-party solutions, consider excluding the corresponding controls from the calculations.
-
- >[!NOTE]
- >Changes might take up to a few hours to reflect on the dashboard.
-
-1. In the navigation pane, select **Preferences setup** > **Secure score**.
-
- 
-
-2. Select the security control, then toggle the setting between **On** and **Off**.
-
-3. Click **Save preferences**.
-
-## Related topics
-- [View the Secure score dashboard](security-analytics-dashboard-windows-defender-advanced-threat-protection.md)
-- [Update general settings in Windows Defender ATP](general-settings-windows-defender-advanced-threat-protection.md)
-- [Turn on advanced features in Windows Defender ATP](advanced-features-windows-defender-advanced-threat-protection.md)
-- [Turn on the preview experience in Windows Defender ATP](preview-settings-windows-defender-advanced-threat-protection.md)
-- [Configure email notifications in Windows Defender ATP](configure-email-notifications-windows-defender-advanced-threat-protection.md)
-- [Enable SIEM integration in Windows Defender ATP](enable-siem-integration-windows-defender-advanced-threat-protection.md)
-- [Enable the custom threat intelligence API in Windows Defender ATP](enable-custom-ti-windows-defender-advanced-threat-protection.md)
-- [Create and build Power BI reports](powerbi-reports-windows-defender-advanced-threat-protection.md)
\ No newline at end of file
diff --git a/windows/security/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection.md
index c444afe13d..183ecc286d 100644
--- a/windows/security/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 11/21/2017
+ms.date: 04/24/2018
---
# Enable SIEM integration in Windows Defender ATP
@@ -29,9 +29,9 @@ ms.date: 11/21/2017
Enable security information and event management (SIEM) integration so you can pull alerts from the Windows Defender ATP portal using your SIEM solution or by connecting directly to the alerts REST API.
-1. In the navigation pane, select **Preferences setup** > **SIEM integration**.
+1. In the navigation pane, select **Settings** > **APIs** > **SIEM**.
- 
+ 
2. Select **Enable SIEM integration**. This activates the **SIEM connector access details** section with pre-populated values and an application is created under you Azure Active Directory (AAD) tenant.
diff --git a/windows/security/threat-protection/windows-defender-atp/event-error-codes-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/event-error-codes-windows-defender-advanced-threat-protection.md
index 79a751c4a0..f4c7dd2bb3 100644
--- a/windows/security/threat-protection/windows-defender-atp/event-error-codes-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/event-error-codes-windows-defender-advanced-threat-protection.md
@@ -1,5 +1,5 @@
---
-title: Review events and errors on endpoints with Event Viewer
+title: Review events and errors using Event Viewer
description: Get descriptions and further troubleshooting steps (if required) for all events reported by the Windows Defender ATP service.
keywords: troubleshoot, event viewer, log summary, failure code, failed, Windows Defender Advanced Threat Protection service, cannot start, broken, can't start
search.product: eADQiWindows 10XVcnh
@@ -10,11 +10,11 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/16/2017
+ms.date: 04/24/2018
---
-# Review events and errors on endpoints with Event Viewer
+# Review events and errors using Event Viewer
**Applies to:**
@@ -25,14 +25,14 @@ ms.date: 10/16/2017
- Windows 10 Pro Education
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+[!include[Prerelease information](prerelease.md)]
+You can review event IDs in the [Event Viewer](https://msdn.microsoft.com/library/aa745633(v=bts.10).aspx) on individual machines.
-You can review event IDs in the [Event Viewer](https://msdn.microsoft.com/library/aa745633(v=bts.10).aspx) on individual endpoints.
-
-For example, if endpoints are not appearing in the **Machines list**, you might need to look for event IDs on the endpoints. You can then use this table to determine further troubleshooting steps.
+For example, if machines are not appearing in the **Machines list**, you might need to look for event IDs on the machines. You can then use this table to determine further troubleshooting steps.
> [!NOTE]
-> It can take several days for endpoints to begin reporting to the Windows Defender ATP service.
+> It can take several days for machines to begin reporting to the Windows Defender ATP service.
**Open Event Viewer and find the Windows Defender ATP service event log:**
@@ -65,7 +65,7 @@ For example, if endpoints are not appearing in the **Machines list**, you might
2
Windows Defender Advanced Threat Protection service shutdown.
-Occurs when the endpoint is shut down or offboarded.
+Occurs when the machine is shut down or offboarded.
Normal operating notification; no action required.
@@ -91,17 +91,17 @@ The service could not contact the external processing servers at that URL.
6
Windows Defender Advanced Threat Protection service is not onboarded and no onboarding parameters were found.
-The endpoint did not onboard correctly and will not be reporting to the portal.
+The machine did not onboard correctly and will not be reporting to the portal.
Onboarding must be run before starting the service.
+See [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md).
Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
-See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md).
7
Windows Defender Advanced Threat Protection service failed to read the onboarding parameters. Failure: ```variable```.
-Variable = detailed error description. The endpoint did not onboard correctly and will not be reporting to the portal.
+Variable = detailed error description. The machine did not onboard correctly and will not be reporting to the portal.
Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
+See [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md).
-See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md).
8
@@ -109,28 +109,28 @@ See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defen
**During onboarding:** The service failed to clean its configuration during the onboarding. The onboarding process continues.
**During offboarding:** The service failed to clean its configuration during the offboarding. The offboarding process finished but the service keeps running.
**Onboarding:** No action required.
+See [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md).
**Offboarding:** Reboot the system.
-See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md).
9
Windows Defender Advanced Threat Protection service failed to change its start type. Failure code: ```variable```.
-**During onboarding:** The endpoint did not onboard correctly and will not be reporting to the portal.
+
**During offboarding:** Failed to change the service start type. The offboarding process continues. **During onboarding:** The machine did not onboard correctly and will not be reporting to the portal.
**During offboarding:** Failed to change the service start type. The offboarding process continues. Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
+See [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md).
-See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md).
10
Windows Defender Advanced Threat Protection service failed to persist the onboarding information. Failure code: ```variable```.
-The endpoint did not onboard correctly and will not be reporting to the portal.
+The machine did not onboard correctly and will not be reporting to the portal.
Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
+See [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md).
-See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md).
11
Onboarding or re-onboarding of Windows Defender Advanced Threat Protection service completed.
-The endpoint onboarded correctly.
+The machine onboarded correctly.
Normal operating notification; no action required.
+It may take several hours for the machine to appear in the portal.
-It may take several hours for the endpoint to appear in the portal.
12
@@ -157,7 +157,7 @@ The service could not contact the external processing servers at that URL.
An error occurred with the Windows telemetry service.
[Ensure the diagnostic data service is enabled](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-the-diagnostics-service-is-enabled).
+See [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md).
Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
-See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md).
18
@@ -181,25 +181,25 @@ If this error persists after a system restart, ensure all Windows updates have f
25
Windows Defender Advanced Threat Protection service failed to reset health status in the registry. Failure code: ```variable```.
-The endpoint did not onboard correctly.
+ The machine did not onboard correctly.
It will report to the portal, however the service may not appear as registered in SCCM or the registry.
Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
+See [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md).
-See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md).
26
Windows Defender Advanced Threat Protection service failed to set the onboarding status in the registry. Failure code: ```variable```.
-The endpoint did not onboard correctly.
+The machine did not onboard correctly.
It will report to the portal, however the service may not appear as registered in SCCM or the registry.Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
+See [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md).
-See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md).
27
Windows Defender Advanced Threat Protection service failed to enable SENSE aware mode in Windows Defender Antivirus. Onboarding process failed. Failure code: ```variable```.
-Normally, Windows Defender Antivirus will enter a special passive state if another real-time antimalware product is running properly on the endpoint, and the endpoint is reporting to Windows Defender ATP.
+Normally, Windows Defender Antivirus will enter a special passive state if another real-time antimalware product is running properly on the machine, and the machine is reporting to Windows Defender ATP.
Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
-See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md).
+See [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md).
Ensure real-time antimalware protection is running properly.
@@ -208,14 +208,14 @@ Ensure real-time antimalware protection is running properly.
An error occurred with the Windows telemetry service.
[Ensure the diagnostic data service is enabled](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-the-diagnostic-data-service-is-enabled).
+See [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md).
Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
-See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md).
30
Windows Defender Advanced Threat Protection service failed to disable SENSE aware mode in Windows Defender Antivirus. Failure code: ```variable```.
-Normally, Windows Defender Antivirus will enter a special passive state if another real-time antimalware product is running properly on the endpoint, and the endpoint is reporting to Windows Defender ATP.
+Normally, Windows Defender Antivirus will enter a special passive state if another real-time antimalware product is running properly on the machine, and the machine is reporting to Windows Defender ATP.
Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
-See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
+See [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md)
Ensure real-time antimalware protection is running properly.
@@ -233,9 +233,9 @@ Ensure real-time antimalware protection is running properly.
33
Windows Defender Advanced Threat Protection service failed to persist SENSE GUID. Failure code: ```variable```.
-A unique identifier is used to represent each endpoint that is reporting to the portal.
+A unique identifier is used to represent each machine that is reporting to the portal.
-
If the identifier does not persist, the same machine might appear twice in the portal.Check registry permissions on the endpoint to ensure the service can update the registry.
+Check registry permissions on the machine to ensure the service can update the registry.
34
@@ -243,7 +243,7 @@ If the identifier does not persist, the same machine might appear twice in the p
An error occurred with the Windows telemetry service.
[Ensure the diagnostic data service is enabled](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-the-diagnostic-data-service-is-enabled).
+See [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md).
Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
-See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md).
35
@@ -337,6 +337,6 @@ See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defen
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-eventerrorcodes-belowfoldlink)
## Related topics
-- [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
-- [Configure endpoint proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md)
+- [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md)
+- [Configure machine proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md)
- [Troubleshoot Windows Defender ATP](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
diff --git a/windows/security/threat-protection/windows-defender-atp/experiment-custom-ti-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/experiment-custom-ti-windows-defender-advanced-threat-protection.md
index 5652ee66e3..5a34950b31 100644
--- a/windows/security/threat-protection/windows-defender-atp/experiment-custom-ti-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/experiment-custom-ti-windows-defender-advanced-threat-protection.md
@@ -152,8 +152,8 @@ This step will guide you in exploring the custom alert in the portal.
## Related topics
- [Understand threat intelligence concepts](threat-indicator-concepts-windows-defender-advanced-threat-protection.md)
-- [Create custom alerts using the threat intelligence API](custom-ti-api-windows-defender-advanced-threat-protection.md)
- [Enable the custom threat intelligence API in Windows Defender ATP](enable-custom-ti-windows-defender-advanced-threat-protection.md)
+- [Create custom alerts using the threat intelligence API](custom-ti-api-windows-defender-advanced-threat-protection.md)
- [PowerShell code examples for the custom threat intelligence API](powershell-example-code-windows-defender-advanced-threat-protection.md)
- [Python code examples for the custom threat intelligence API](python-example-code-windows-defender-advanced-threat-protection.md)
- [Troubleshoot custom threat intelligence issues](troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md)
diff --git a/windows/security/threat-protection/windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md
index b31dad703f..d35ec1554e 100644
--- a/windows/security/threat-protection/windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md
@@ -54,7 +54,7 @@ This status indicates that there's limited communication between the machine and
The following suggested actions can help fix issues related to a misconfigured machine with impaired communications:
-- [Ensure the endpoint has Internet connection](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-the-endpoint-has-an-internet-connection)
+- [Ensure the machine has Internet connection](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#troubleshoot-onboarding-issues-on-the-machine)
The Window Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to report sensor data and communicate with the Windows Defender ATP service.
- [Verify client connectivity to Windows Defender ATP service URLs](configure-proxy-internet-windows-defender-advanced-threat-protection.md#verify-client-connectivity-to-windows-defender-atp-service-urls)
@@ -66,17 +66,17 @@ If you took corrective actions and the machine status is still misconfigured, [o
A misconfigured machine with status ‘No sensor data’ has communication with the service but can only report partial sensor data.
Follow theses actions to correct known issues related to a misconfigured machine with status ‘No sensor data’:
-- [Ensure the endpoint has Internet connection](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-the-endpoint-has-an-internet-connection)
+- [Ensure the machine has Internet connection](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#troubleshoot-onboarding-issues-on-the-machine)
The Window Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to report sensor data and communicate with the Windows Defender ATP service.
- [Verify client connectivity to Windows Defender ATP service URLs](configure-proxy-internet-windows-defender-advanced-threat-protection.md#verify-client-connectivity-to-windows-defender-atp-service-urls)
Verify the proxy configuration completed successfully, that WinHTTP can discover and communicate through the proxy server in your environment, and that the proxy server allows traffic to the Windows Defender ATP service URLs.
- [Ensure the diagnostic data service is enabled](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-the-diagnostics-service-is-enabled)
-If the endpoints aren't reporting correctly, you might need to check that the Windows 10 diagnostic data service is set to automatically start and is running on the endpoint.
+If the machines aren't reporting correctly, you might need to check that the Windows 10 diagnostic data service is set to automatically start and is running on the endpoint.
- [Ensure that Windows Defender Antivirus is not disabled by policy](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-that-windows-defender-antivirus-is-not-disabled-by-a-policy)
-If your endpoints are running a third-party antimalware client, the Windows Defender ATP agent needs the Windows Defender Antivirus Early Launch Antimalware (ELAM) driver to be enabled.
+If your machines are running a third-party antimalware client, the Windows Defender ATP agent needs the Windows Defender Antivirus Early Launch Antimalware (ELAM) driver to be enabled.
If you took corrective actions and the machine status is still misconfigured, [open a support ticket](http://go.microsoft.com/fwlink/?LinkID=761093&clcid=0x409).
diff --git a/windows/security/threat-protection/windows-defender-atp/general-settings-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/general-settings-windows-defender-advanced-threat-protection.md
deleted file mode 100644
index 7c8b6ad443..0000000000
--- a/windows/security/threat-protection/windows-defender-atp/general-settings-windows-defender-advanced-threat-protection.md
+++ /dev/null
@@ -1,47 +0,0 @@
----
-title: Update general Windows Defender Advanced Threat Protection settings
-description: Update your general Windows Defender Advanced Threat Protection settings such as data retention or industry after onboarding.
-keywords: general settings, settings, update settings
-search.product: eADQiWindows 10XVcnh
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.sitesec: library
-ms.pagetype: security
-ms.author: macapara
-author: mjcaparas
-ms.localizationpriority: high
-ms.date: 10/16/2017
----
-# Update general Windows Defender ATP settings
-
-**Applies to:**
-
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
-- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-
-
-
->Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-gensettings-abovefoldlink)
-
-During the onboarding process, a wizard takes you through the general settings of Windows Defender ATP. After onboarding, you might want to update some settings which you'll be able to do through the **Preferences setup** menu.
-
-1. In the navigation pane, select **Preferences setup** > **General**.
-
-2. Modify settings such as data retention policy or the industry that best describes your organization.
-
- > [!NOTE]
- > Other settings are not editable.
-
-3. Click **Save preferences**.
-
-
-## Related topics
-- [Turn on advanced features in Windows Defender ATP](advanced-features-windows-defender-advanced-threat-protection.md)
-- [Turn on the preview experience in Windows Defender ATP](preview-settings-windows-defender-advanced-threat-protection.md)
-- [Configure email notifications in Windows Defender ATP](configure-email-notifications-windows-defender-advanced-threat-protection.md)
-- [Enable SIEM integration in Windows Defender ATP](enable-siem-integration-windows-defender-advanced-threat-protection.md)
-- [Enable the custom threat intelligence API in Windows Defender ATP](enable-custom-ti-windows-defender-advanced-threat-protection.md)
-- [Create and build Power BI reports](powerbi-reports-windows-defender-advanced-threat-protection.md)
\ No newline at end of file
diff --git a/windows/security/threat-protection/windows-defender-atp/images/Failed.png b/windows/security/threat-protection/windows-defender-atp/images/Failed.png
new file mode 100644
index 0000000000..6cef8a46db
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/Failed.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/No threats found.png b/windows/security/threat-protection/windows-defender-atp/images/No threats found.png
new file mode 100644
index 0000000000..11eb05d7c6
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/No threats found.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/Partially investigated.png b/windows/security/threat-protection/windows-defender-atp/images/Partially investigated.png
new file mode 100644
index 0000000000..430acc7c42
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/Partially investigated.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/Partially remediated.png b/windows/security/threat-protection/windows-defender-atp/images/Partially remediated.png
new file mode 100644
index 0000000000..c3060b51b0
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/Partially remediated.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/Pending.png b/windows/security/threat-protection/windows-defender-atp/images/Pending.png
new file mode 100644
index 0000000000..b5a27d0a58
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/Pending.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/Remediated.png b/windows/security/threat-protection/windows-defender-atp/images/Remediated.png
new file mode 100644
index 0000000000..9f13d8e5dc
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/Remediated.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/Running.png b/windows/security/threat-protection/windows-defender-atp/images/Running.png
new file mode 100644
index 0000000000..5de179503f
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/Running.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/Terminated by system.png b/windows/security/threat-protection/windows-defender-atp/images/Terminated by system.png
new file mode 100644
index 0000000000..f1d7bb0531
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/Terminated by system.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/advanced-hunting-query-example.PNG b/windows/security/threat-protection/windows-defender-atp/images/advanced-hunting-query-example.PNG
new file mode 100644
index 0000000000..3958d9a532
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/advanced-hunting-query-example.PNG differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/advanced-hunting-save-query.PNG b/windows/security/threat-protection/windows-defender-atp/images/advanced-hunting-save-query.PNG
new file mode 100644
index 0000000000..2da889163c
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/advanced-hunting-save-query.PNG differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/alerts-q-bulk.png b/windows/security/threat-protection/windows-defender-atp/images/alerts-q-bulk.png
index 4a2c0fa98e..bafa469657 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/alerts-q-bulk.png and b/windows/security/threat-protection/windows-defender-atp/images/alerts-q-bulk.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-active-investigations-tile.png b/windows/security/threat-protection/windows-defender-atp/images/atp-active-investigations-tile.png
new file mode 100644
index 0000000000..6950882187
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-active-investigations-tile.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-advanced-hunting-query.png b/windows/security/threat-protection/windows-defender-atp/images/atp-advanced-hunting-query.png
new file mode 100644
index 0000000000..c148c887c1
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-advanced-hunting-query.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-advanced-hunting-results-filter.PNG b/windows/security/threat-protection/windows-defender-atp/images/atp-advanced-hunting-results-filter.PNG
new file mode 100644
index 0000000000..40d4cf3b5c
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-advanced-hunting-results-filter.PNG differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-advanced-hunting-results-set.png b/windows/security/threat-protection/windows-defender-atp/images/atp-advanced-hunting-results-set.png
new file mode 100644
index 0000000000..cfec514362
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-advanced-hunting-results-set.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-advanced-hunting.png b/windows/security/threat-protection/windows-defender-atp/images/atp-advanced-hunting.png
new file mode 100644
index 0000000000..f43355e6e2
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-advanced-hunting.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-alert-details.png b/windows/security/threat-protection/windows-defender-atp/images/atp-alert-details.png
index 89fd66df5f..f98240f439 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-alert-details.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-alert-details.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-alert-page.png b/windows/security/threat-protection/windows-defender-atp/images/atp-alert-page.png
index 379423a53a..7ae7d3aa20 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-alert-page.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-alert-page.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-alert-timeline.png b/windows/security/threat-protection/windows-defender-atp/images/atp-alert-timeline.png
index 12537a9efb..b34d5f4779 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-alert-timeline.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-alert-timeline.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-alert-view.png b/windows/security/threat-protection/windows-defender-atp/images/atp-alert-view.png
new file mode 100644
index 0000000000..1b6c2dfa10
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-alert-view.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-alerts-queue-user.png b/windows/security/threat-protection/windows-defender-atp/images/atp-alerts-queue-user.png
index 745712f857..00185b3daa 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-alerts-queue-user.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-alerts-queue-user.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-alerts-related-to-machine.PNG b/windows/security/threat-protection/windows-defender-atp/images/atp-alerts-related-to-machine.PNG
index af1915fb0b..dcaa87034d 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-alerts-related-to-machine.PNG and b/windows/security/threat-protection/windows-defender-atp/images/atp-alerts-related-to-machine.PNG differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-alerts-selected.png b/windows/security/threat-protection/windows-defender-atp/images/atp-alerts-selected.png
index eaacfa5256..4fcc40c32c 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-alerts-selected.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-alerts-selected.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-alerts-tile.png b/windows/security/threat-protection/windows-defender-atp/images/atp-alerts-tile.png
index ed3cf79941..7a975960a1 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-alerts-tile.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-alerts-tile.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-alertsq2.png b/windows/security/threat-protection/windows-defender-atp/images/atp-alertsq2.png
index a2960ce201..7d65413066 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-alertsq2.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-alertsq2.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-analyze-auto-ir.png b/windows/security/threat-protection/windows-defender-atp/images/atp-analyze-auto-ir.png
new file mode 100644
index 0000000000..ec8235b996
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-analyze-auto-ir.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-approve-reject-action.png b/windows/security/threat-protection/windows-defender-atp/images/atp-approve-reject-action.png
new file mode 100644
index 0000000000..f96acc7694
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-approve-reject-action.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-auto-investigation-pending.png b/windows/security/threat-protection/windows-defender-atp/images/atp-auto-investigation-pending.png
new file mode 100644
index 0000000000..f006033aef
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-auto-investigation-pending.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-auto-investigations-list.png b/windows/security/threat-protection/windows-defender-atp/images/atp-auto-investigations-list.png
new file mode 100644
index 0000000000..b2cdc68a24
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-auto-investigations-list.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-automated-investigations-statistics.png b/windows/security/threat-protection/windows-defender-atp/images/atp-automated-investigations-statistics.png
new file mode 100644
index 0000000000..82565d784f
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-automated-investigations-statistics.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-azure-atp-machine-user.png b/windows/security/threat-protection/windows-defender-atp/images/atp-azure-atp-machine-user.png
new file mode 100644
index 0000000000..c2c13fe289
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-azure-atp-machine-user.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-azure-atp-machine.png b/windows/security/threat-protection/windows-defender-atp/images/atp-azure-atp-machine.png
new file mode 100644
index 0000000000..62e88527b3
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-azure-atp-machine.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-block-file.png b/windows/security/threat-protection/windows-defender-atp/images/atp-block-file.png
new file mode 100644
index 0000000000..3f7e3dba8a
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-block-file.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-community-center.png b/windows/security/threat-protection/windows-defender-atp/images/atp-community-center.png
new file mode 100644
index 0000000000..96c73fc027
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-community-center.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-conditional-access-numbered.png b/windows/security/threat-protection/windows-defender-atp/images/atp-conditional-access-numbered.png
new file mode 100644
index 0000000000..c9ff0c1688
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-conditional-access-numbered.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-conditional-access.png b/windows/security/threat-protection/windows-defender-atp/images/atp-conditional-access.png
new file mode 100644
index 0000000000..c8126f92a3
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-conditional-access.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-create-dashboard.png b/windows/security/threat-protection/windows-defender-atp/images/atp-create-dashboard.png
index 1918a2064d..fc628073fc 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-create-dashboard.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-create-dashboard.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-dashboard-security-analytics-9.png b/windows/security/threat-protection/windows-defender-atp/images/atp-dashboard-security-analytics-9.png
new file mode 100644
index 0000000000..f40dff2c63
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-dashboard-security-analytics-9.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-dashboard-security-analytics-full.png b/windows/security/threat-protection/windows-defender-atp/images/atp-dashboard-security-analytics-full.png
index 2c44e15d09..e4ec0ca34e 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-dashboard-security-analytics-full.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-dashboard-security-analytics-full.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-delete-query.png b/windows/security/threat-protection/windows-defender-atp/images/atp-delete-query.png
new file mode 100644
index 0000000000..703204c040
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-delete-query.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-download-connector.png b/windows/security/threat-protection/windows-defender-atp/images/atp-download-connector.png
index 9405ae0d6e..fc1a15b8e1 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-download-connector.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-download-connector.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-enable-security-analytics.png b/windows/security/threat-protection/windows-defender-atp/images/atp-enable-security-analytics.png
index 1fa1650882..0ada1afc87 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-enable-security-analytics.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-enable-security-analytics.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-file-action.png b/windows/security/threat-protection/windows-defender-atp/images/atp-file-action.png
index 5982447692..6d0e7a9d55 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-file-action.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-file-action.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-filter-advanced-hunting.png b/windows/security/threat-protection/windows-defender-atp/images/atp-filter-advanced-hunting.png
new file mode 100644
index 0000000000..2787e7d147
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-filter-advanced-hunting.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-image.png b/windows/security/threat-protection/windows-defender-atp/images/atp-image.png
new file mode 100644
index 0000000000..e3f4b5b27f
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-image.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-improv-opps-9.png b/windows/security/threat-protection/windows-defender-atp/images/atp-improv-opps-9.png
new file mode 100644
index 0000000000..99a4376f93
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-improv-opps-9.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-improv-opps.png b/windows/security/threat-protection/windows-defender-atp/images/atp-improv-opps.png
index 0f5ef13a77..692238433d 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-improv-opps.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-improv-opps.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-machine-details-view.png b/windows/security/threat-protection/windows-defender-atp/images/atp-machine-details-view.png
index 6a005352c5..97529ae015 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-machine-details-view.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-machine-details-view.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-machine-details-view2.png b/windows/security/threat-protection/windows-defender-atp/images/atp-machine-details-view2.png
new file mode 100644
index 0000000000..5ce3e0d034
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-machine-details-view2.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-machine-health-details.png b/windows/security/threat-protection/windows-defender-atp/images/atp-machine-health-details.png
index 63431efa68..9dd1e801dd 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-machine-health-details.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-machine-health-details.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-machine-timeline-details-panel.png b/windows/security/threat-protection/windows-defender-atp/images/atp-machine-timeline-details-panel.png
index b5dee50cd9..e2e3ae3944 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-machine-timeline-details-panel.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-machine-timeline-details-panel.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-machine-timeline-export.png b/windows/security/threat-protection/windows-defender-atp/images/atp-machine-timeline-export.png
index 0be9abed27..45f38aa956 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-machine-timeline-export.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-machine-timeline-export.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-machine-timeline-filter.png b/windows/security/threat-protection/windows-defender-atp/images/atp-machine-timeline-filter.png
index 8047e53b44..bbf578bd52 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-machine-timeline-filter.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-machine-timeline-filter.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-machines-at-risk.png b/windows/security/threat-protection/windows-defender-atp/images/atp-machines-at-risk.png
index cfa3cbda3e..9347d09c04 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-machines-at-risk.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-machines-at-risk.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-machines-list-view2.png b/windows/security/threat-protection/windows-defender-atp/images/atp-machines-list-view2.png
new file mode 100644
index 0000000000..692b21869f
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-machines-list-view2.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-mapping5.png b/windows/security/threat-protection/windows-defender-atp/images/atp-mapping5.png
index c405166f01..d3291b5cd5 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-mapping5.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-mapping5.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-mdm-onboarding-package.png b/windows/security/threat-protection/windows-defender-atp/images/atp-mdm-onboarding-package.png
index d8d2aea802..2645ee2e58 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-mdm-onboarding-package.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-mdm-onboarding-package.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-mma.png b/windows/security/threat-protection/windows-defender-atp/images/atp-mma.png
new file mode 100644
index 0000000000..df43379ab5
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-mma.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-ms-secure-score-9.png b/windows/security/threat-protection/windows-defender-atp/images/atp-ms-secure-score-9.png
new file mode 100644
index 0000000000..3d3330a2db
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-ms-secure-score-9.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-ms-secure-score.png b/windows/security/threat-protection/windows-defender-atp/images/atp-ms-secure-score.png
new file mode 100644
index 0000000000..860899d286
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-ms-secure-score.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-new-alerts-list.png b/windows/security/threat-protection/windows-defender-atp/images/atp-new-alerts-list.png
new file mode 100644
index 0000000000..b9a758e159
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-new-alerts-list.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-new-suppression-rule.png b/windows/security/threat-protection/windows-defender-atp/images/atp-new-suppression-rule.png
index b330f34ac1..3b4cf3197c 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-new-suppression-rule.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-new-suppression-rule.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-no-subscriptions-found.png b/windows/security/threat-protection/windows-defender-atp/images/atp-no-subscriptions-found.png
index 24b6aee777..b538946141 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-no-subscriptions-found.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-no-subscriptions-found.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-not-authorized-to-access-portal.png b/windows/security/threat-protection/windows-defender-atp/images/atp-not-authorized-to-access-portal.png
index 020eeac764..738c1470e7 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-not-authorized-to-access-portal.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-not-authorized-to-access-portal.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-notification-action.png b/windows/security/threat-protection/windows-defender-atp/images/atp-notification-action.png
new file mode 100644
index 0000000000..ca06a6bea9
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-notification-action.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-notifications.png b/windows/security/threat-protection/windows-defender-atp/images/atp-notifications.png
new file mode 100644
index 0000000000..ec00bdcb5e
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-notifications.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-onboard-endpoints-WDATP-portal.png b/windows/security/threat-protection/windows-defender-atp/images/atp-onboard-endpoints-WDATP-portal.png
index a0c18757a8..ee2cf3dc71 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-onboard-endpoints-WDATP-portal.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-onboard-endpoints-WDATP-portal.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-org-sec-score.png b/windows/security/threat-protection/windows-defender-atp/images/atp-org-sec-score.png
index 729042ed30..a109efd09c 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-org-sec-score.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-org-sec-score.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-pending-actions-auto-ir.png b/windows/security/threat-protection/windows-defender-atp/images/atp-pending-actions-auto-ir.png
new file mode 100644
index 0000000000..8c38cc18a2
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-pending-actions-auto-ir.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-pending-actions-file.png b/windows/security/threat-protection/windows-defender-atp/images/atp-pending-actions-file.png
new file mode 100644
index 0000000000..006d7c1a3f
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-pending-actions-file.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-pending-actions-list.png b/windows/security/threat-protection/windows-defender-atp/images/atp-pending-actions-list.png
new file mode 100644
index 0000000000..55113991e6
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-pending-actions-list.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-pending-actions-multiple.png b/windows/security/threat-protection/windows-defender-atp/images/atp-pending-actions-multiple.png
new file mode 100644
index 0000000000..f0878a6699
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-pending-actions-multiple.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-pending-actions-notification.png b/windows/security/threat-protection/windows-defender-atp/images/atp-pending-actions-notification.png
new file mode 100644
index 0000000000..af05f88e0b
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-pending-actions-notification.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-portal-sensor.png b/windows/security/threat-protection/windows-defender-atp/images/atp-portal-sensor.png
index 4a41dff7b6..06147c025e 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-portal-sensor.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-portal-sensor.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-preferences-setup.png b/windows/security/threat-protection/windows-defender-atp/images/atp-preferences-setup.png
index 74b6e5fae6..f271f16509 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-preferences-setup.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-preferences-setup.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-save-query.png b/windows/security/threat-protection/windows-defender-atp/images/atp-save-query.png
new file mode 100644
index 0000000000..0e8c9e12d2
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-save-query.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-sec-ops-1.png b/windows/security/threat-protection/windows-defender-atp/images/atp-sec-ops-1.png
new file mode 100644
index 0000000000..ae8d72d307
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-sec-ops-1.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-sec-ops-dashboard.png b/windows/security/threat-protection/windows-defender-atp/images/atp-sec-ops-dashboard.png
new file mode 100644
index 0000000000..5a4816bf80
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-sec-ops-dashboard.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-security-analytics-view-machines2.png b/windows/security/threat-protection/windows-defender-atp/images/atp-security-analytics-view-machines2.png
index 20e5f4f5fa..f80648993e 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-security-analytics-view-machines2.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-security-analytics-view-machines2.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-security-controls-9.png b/windows/security/threat-protection/windows-defender-atp/images/atp-security-controls-9.png
new file mode 100644
index 0000000000..9ce191083b
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-security-controls-9.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-security-controls.png b/windows/security/threat-protection/windows-defender-atp/images/atp-security-controls.png
new file mode 100644
index 0000000000..023881cd9b
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-security-controls.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-security-score-over-time-9.png b/windows/security/threat-protection/windows-defender-atp/images/atp-security-score-over-time-9.png
new file mode 100644
index 0000000000..8afeee9566
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-security-score-over-time-9.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-security-score-over-time.png b/windows/security/threat-protection/windows-defender-atp/images/atp-security-score-over-time.png
index 9cbf01f81a..3bfad3afc3 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-security-score-over-time.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-security-score-over-time.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-sensor-filter.png b/windows/security/threat-protection/windows-defender-atp/images/atp-sensor-filter.png
index 76267fb27f..f3de71739d 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-sensor-filter.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-sensor-filter.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-server-offboarding-workspaceid.png b/windows/security/threat-protection/windows-defender-atp/images/atp-server-offboarding-workspaceid.png
new file mode 100644
index 0000000000..1d1cbb4448
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-server-offboarding-workspaceid.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-server-onboarding-workspaceid.png b/windows/security/threat-protection/windows-defender-atp/images/atp-server-onboarding-workspaceid.png
new file mode 100644
index 0000000000..1c3154f188
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-server-onboarding-workspaceid.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-shared-queries.png b/windows/security/threat-protection/windows-defender-atp/images/atp-shared-queries.png
new file mode 100644
index 0000000000..bdcc1997eb
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-shared-queries.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-siem-integration.png b/windows/security/threat-protection/windows-defender-atp/images/atp-siem-integration.png
index 2ce7dbc637..d611574dbc 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-siem-integration.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-siem-integration.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-stop-quarantine.png b/windows/security/threat-protection/windows-defender-atp/images/atp-stop-quarantine.png
index b2ae248d35..db6082c4e1 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-stop-quarantine.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-stop-quarantine.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-subscription-expired.png b/windows/security/threat-protection/windows-defender-atp/images/atp-subscription-expired.png
index 7a6c15ebbb..8fc24beeab 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-subscription-expired.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-subscription-expired.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-suspicious-activities-tile.png b/windows/security/threat-protection/windows-defender-atp/images/atp-suspicious-activities-tile.png
new file mode 100644
index 0000000000..0989362804
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-suspicious-activities-tile.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-threat-intel-api.png b/windows/security/threat-protection/windows-defender-atp/images/atp-threat-intel-api.png
index 70a7ce9fee..0b532a888a 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-threat-intel-api.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-threat-intel-api.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-tile-sensor-health.png b/windows/security/threat-protection/windows-defender-atp/images/atp-tile-sensor-health.png
index 3aa0b451bc..dce4ee3f5e 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-tile-sensor-health.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-tile-sensor-health.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-user-details-view-azureatp.png b/windows/security/threat-protection/windows-defender-atp/images/atp-user-details-view-azureatp.png
new file mode 100644
index 0000000000..2fcb58e44f
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-user-details-view-azureatp.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-user-details.png b/windows/security/threat-protection/windows-defender-atp/images/atp-user-details.png
index eb1366d9cb..94c0f5cd1f 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-user-details.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-user-details.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-verify-passive-mode.png b/windows/security/threat-protection/windows-defender-atp/images/atp-verify-passive-mode.png
new file mode 100644
index 0000000000..32907fedb6
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-verify-passive-mode.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/dashboard.png b/windows/security/threat-protection/windows-defender-atp/images/dashboard.png
new file mode 100644
index 0000000000..974708504f
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/dashboard.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/io.png b/windows/security/threat-protection/windows-defender-atp/images/io.png
new file mode 100644
index 0000000000..a03e5fb917
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/io.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/mss.png b/windows/security/threat-protection/windows-defender-atp/images/mss.png
new file mode 100644
index 0000000000..63a22c2e50
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/mss.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/no-threats-found.png b/windows/security/threat-protection/windows-defender-atp/images/no-threats-found.png
new file mode 100644
index 0000000000..fc3ee208d2
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/no-threats-found.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/no_threats_found.png b/windows/security/threat-protection/windows-defender-atp/images/no_threats_found.png
new file mode 100644
index 0000000000..4db61c4162
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/no_threats_found.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/partially-investigated.png b/windows/security/threat-protection/windows-defender-atp/images/partially-investigated.png
new file mode 100644
index 0000000000..225988f58b
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/partially-investigated.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/partially_investigated.png b/windows/security/threat-protection/windows-defender-atp/images/partially_investigated.png
new file mode 100644
index 0000000000..469ec08f53
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/partially_investigated.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/partially_remediated.png b/windows/security/threat-protection/windows-defender-atp/images/partially_remediated.png
new file mode 100644
index 0000000000..b381112d21
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/partially_remediated.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/save-query.png b/windows/security/threat-protection/windows-defender-atp/images/save-query.png
new file mode 100644
index 0000000000..719a1a7113
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/save-query.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/securescore.png b/windows/security/threat-protection/windows-defender-atp/images/securescore.png
new file mode 100644
index 0000000000..2b8104bd7d
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/securescore.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/ss1.png b/windows/security/threat-protection/windows-defender-atp/images/ss1.png
new file mode 100644
index 0000000000..ebd17712d6
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/ss1.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/ssot.png b/windows/security/threat-protection/windows-defender-atp/images/ssot.png
new file mode 100644
index 0000000000..a21b675f64
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/ssot.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/status-tile.png b/windows/security/threat-protection/windows-defender-atp/images/status-tile.png
index 78812e3248..452918b63f 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/status-tile.png and b/windows/security/threat-protection/windows-defender-atp/images/status-tile.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/terminated-by-system.png b/windows/security/threat-protection/windows-defender-atp/images/terminated-by-system.png
new file mode 100644
index 0000000000..7db354747c
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/terminated-by-system.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/terminated_by_system.png b/windows/security/threat-protection/windows-defender-atp/images/terminated_by_system.png
new file mode 100644
index 0000000000..f2d59131d5
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/terminated_by_system.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/wdsc.png b/windows/security/threat-protection/windows-defender-atp/images/wdsc.png
new file mode 100644
index 0000000000..3cd583ed74
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/wdsc.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md
index b4fae526ee..c8df547c6b 100644
--- a/windows/security/threat-protection/windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md
@@ -1,7 +1,7 @@
---
title: Investigate Windows Defender Advanced Threat Protection alerts
description: Use the investigation options to get details on alerts are affecting your network, what they mean, and how to resolve them.
-keywords: investigate, investigation, machines, machine, endpoints, endpoint, alerts queue, dashboard, IP address, file, submit, submissions, deep analysis, timeline, search, domain, URL, IP
+keywords: investigate, investigation, machines, machine, alerts queue, dashboard, IP address, file, submit, submissions, deep analysis, timeline, search, domain, URL, IP
search.product: eADQiWindows 10XVcnh
ms.prod: w10
ms.mktglfcycl: deploy
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/16/2017
+ms.date: 04/24/2018
---
# Investigate Windows Defender Advanced Threat Protection alerts
@@ -19,17 +19,17 @@ ms.date: 10/16/2017
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-
+[!include[Prerelease information](prerelease.md)]
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-investigatealerts-abovefoldlink)
-Investigate alerts that are affecting your network, what they mean, and how to resolve them.
+Investigate alerts that are affecting your network, understand what they mean, and how to resolve them.
Click an alert to see the alert details view and the various tiles that provide information about the alert.
-You can also manage an alert and see alert metadata along with other information that can help you make better decisions on how to approach them.
+You can also manage an alert and see alert metadata along with other information that can help you make better decisions on how to approach them. You'll also see a status of the automated investigation on the upper right corner. Clicking on the link will take you to the Automated investigations view. For more information, see [Automated investigations](automated-investigations-windows-defender-advanced-threat-protection.md).
-
+
The alert context tile shows the where, who, and when context of the alert. As with other pages, you can click on the icon beside the name or user account to bring up the machine or user details pane. The alert details view also has a status tile that shows the status of the alert in the queue. You'll also see a description and a set of recommended actions which you can expand.
@@ -91,13 +91,12 @@ The **Artifact timeline** feature provides an addition view of the evidence that
Selecting an alert detail brings up the **Details pane** where you'll be able to see more information about the alert such as file details, detections, instances of it observed worldwide, and in the organization.
## Related topics
-- [View the Windows Defender Advanced Threat Protection Security operations dashboard](dashboard-windows-defender-advanced-threat-protection.md)
- [View and organize the Windows Defender Advanced Threat Protection Alerts queue ](alerts-queue-windows-defender-advanced-threat-protection.md)
+- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md)
- [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md)
+- [Investigate machines in the Windows Defender ATP Machines list](investigate-machines-windows-defender-advanced-threat-protection.md)
- [Investigate an IP address associated with a Windows Defender ATP alert](investigate-ip-windows-defender-advanced-threat-protection.md)
- [Investigate a domain associated with a Windows Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md)
-- [View and organize the Windows Defender ATP Machines list](machines-view-overview-windows-defender-advanced-threat-protection.md)
-- [Investigate machines in the Windows Defender ATP Machines list](investigate-machines-windows-defender-advanced-threat-protection.md)
- [Investigate a user account in Windows Defender ATP](investigate-user-windows-defender-advanced-threat-protection.md)
-- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md)
-- [Take response actions in Windows Defender ATP](response-actions-windows-defender-advanced-threat-protection.md)
+
+
diff --git a/windows/security/threat-protection/windows-defender-atp/investigate-domain-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/investigate-domain-windows-defender-advanced-threat-protection.md
index f4f611b986..cf096a36d3 100644
--- a/windows/security/threat-protection/windows-defender-atp/investigate-domain-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/investigate-domain-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/16/2017
+ms.date: 04/24/2018
---
# Investigate a domain associated with a Windows Defender ATP alert
@@ -22,7 +22,7 @@ ms.date: 10/16/2017
- Windows 10 Pro Education
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-
+[!include[Prerelease information](prerelease.md)]
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-investigatedomain-abovefoldlink)
@@ -58,13 +58,10 @@ The **Most recent observed machinew with URL** section provides a chronological
5. Clicking any of the machine names will take you to that machine's view, where you can continue investigate reported alerts, behaviors, and events.
## Related topics
-- [View the Windows Defender Advanced Threat Protection Security operations dashboard](dashboard-windows-defender-advanced-threat-protection.md)
- [View and organize the Windows Defender Advanced Threat Protection Alerts queue ](alerts-queue-windows-defender-advanced-threat-protection.md)
+- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md)
- [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md)
- [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md)
-- [Investigate an IP address associated with a Windows Defender ATP alert](investigate-ip-windows-defender-advanced-threat-protection.md)
-- [View and organize the Windows Defender ATP Machines list](machines-view-overview-windows-defender-advanced-threat-protection.md)
- [Investigate machines in the Windows Defender ATP Machines list](investigate-machines-windows-defender-advanced-threat-protection.md)
+- [Investigate an IP address associated with a Windows Defender ATP alert](investigate-ip-windows-defender-advanced-threat-protection.md)
- [Investigate a user account in Windows Defender ATP](investigate-user-windows-defender-advanced-threat-protection.md)
-- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md)
-- [Take response actions in Windows Defender ATP](response-actions-windows-defender-advanced-threat-protection.md)
diff --git a/windows/security/threat-protection/windows-defender-atp/investigate-files-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/investigate-files-windows-defender-advanced-threat-protection.md
index df24b9a27b..042216f1a6 100644
--- a/windows/security/threat-protection/windows-defender-atp/investigate-files-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/investigate-files-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/16/2017
+ms.date: 04/24/2018
---
# Investigate a file associated with a Windows Defender ATP alert
@@ -22,7 +22,7 @@ ms.date: 10/16/2017
- Windows 10 Pro Education
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-
+[!include[Prerelease information](prerelease.md)]
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-investigatefiles-abovefoldlink)
@@ -63,13 +63,10 @@ The **Most recent observed machines with the file** section allows you to specif
This allows for greater accuracy in defining entities to display such as if and when an entity was observed in the organization. For example, if you’re trying to identify the origin of a network communication to a certain IP Address within a 10-minute period on a given date, you can specify that exact time interval, and see only files that communicated with that IP Address at that time, drastically reducing unnecessary scrolling and searching.
## Related topics
-- [View the Windows Defender Advanced Threat Protection Security operations dashboard](dashboard-windows-defender-advanced-threat-protection.md)
- [View and organize the Windows Defender Advanced Threat Protection Alerts queue ](alerts-queue-windows-defender-advanced-threat-protection.md)
+- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md)
- [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md)
+- [Investigate machines in the Windows Defender ATP Machines list](investigate-machines-windows-defender-advanced-threat-protection.md)
- [Investigate an IP address associated with a Windows Defender ATP alert](investigate-ip-windows-defender-advanced-threat-protection.md)
- [Investigate a domain associated with a Windows Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md)
-- [View and organize the Windows Defender ATP Machines list](machines-view-overview-windows-defender-advanced-threat-protection.md)
-- [Investigate machines in the Windows Defender ATP Machines list](investigate-machines-windows-defender-advanced-threat-protection.md)
-- [Investigate a user account in Windows Defender ATP](investigate-user-windows-defender-advanced-threat-protection.md)
-- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md)
-- [Take response actions in Windows Defender ATP](response-actions-windows-defender-advanced-threat-protection.md)
+- [Investigate a user account in Windows Defender ATP](investigate-user-windows-defender-advanced-threat-protection.md)
\ No newline at end of file
diff --git a/windows/security/threat-protection/windows-defender-atp/investigate-ip-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/investigate-ip-windows-defender-advanced-threat-protection.md
index 01828ef7ff..cd9eaa9b7c 100644
--- a/windows/security/threat-protection/windows-defender-atp/investigate-ip-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/investigate-ip-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/16/2017
+ms.date: 04/24/2018
---
# Investigate an IP address associated with a Windows Defender ATP alert
@@ -65,13 +65,10 @@ Use the search filters to define the search criteria. You can also use the timel
Clicking any of the machine names will take you to that machine's view, where you can continue investigate reported alerts, behaviors, and events.
## Related topics
-- [View the Windows Defender Advanced Threat Protection Security operations dashboard](dashboard-windows-defender-advanced-threat-protection.md)
- [View and organize the Windows Defender Advanced Threat Protection Alerts queue ](alerts-queue-windows-defender-advanced-threat-protection.md)
+- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md)
- [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md)
- [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md)
-- [Investigate a domain associated with a Windows Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md)
-- [View and organize the Windows Defender ATP Machines list](machines-view-overview-windows-defender-advanced-threat-protection.md)
- [Investigate machines in the Windows Defender ATP Machines list](investigate-machines-windows-defender-advanced-threat-protection.md)
+- [Investigate a domain associated with a Windows Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md)
- [Investigate a user account in Windows Defender ATP](investigate-user-windows-defender-advanced-threat-protection.md)
-- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md)
-- [Take response actions in Windows Defender ATP](response-actions-windows-defender-advanced-threat-protection.md)
diff --git a/windows/security/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md
index e9940d0a2b..7f17822158 100644
--- a/windows/security/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md
@@ -1,7 +1,7 @@
---
title: Investigate machines in the Windows Defender ATP Machines list
description: Investigate affected machines by reviewing alerts, network connection information, adding machine tags and groups, and checking the service health.
-keywords: machines, endpoints, tags, groups, endpoint, alerts queue, alerts, machine name, domain, last seen, internal IP, active alerts, threat category, filter, sort, review alerts, network, connection, type, password stealer, ransomware, exploit, threat, low severity, service heatlh
+keywords: machines, tags, groups, endpoint, alerts queue, alerts, machine name, domain, last seen, internal IP, active alerts, threat category, filter, sort, review alerts, network, connection, type, password stealer, ransomware, exploit, threat, low severity, service heatlh
search.product: eADQiWindows 10XVcnh
ms.prod: w10
ms.mktglfcycl: deploy
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/16/2017
+ms.date: 04/24/2018
---
# Investigate machines in the Windows Defender ATP Machines list
@@ -19,8 +19,6 @@ ms.date: 10/16/2017
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-
-
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-investigatemachines-abovefoldlink)
## Investigate machines
@@ -30,87 +28,55 @@ You can click on affected machines whenever you see them in the portal to open a
- The [Machines list](investigate-machines-windows-defender-advanced-threat-protection.md)
- The [Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md)
-- The [Security operations dashboard](dashboard-windows-defender-advanced-threat-protection.md)
+- The [Security operations dashboard](security-operations-dashboard-windows-defender-advanced-threat-protection.md)
- Any individual alert
- Any individual file details view
- Any IP address or domain details view
When you investigate a specific machine, you'll see:
-- Machine details, Logged on users, and Machine Reporting
+- Machine details, Logged on users, Machine risk, and Machine Reporting
- Alerts related to this machine
- Machine timeline
-
+
-The machine details, total logged on users, and machine reporting sections display various attributes about the machine.
+The machine details, logged on users, machine risk, and machine reporting sections display various attributes about the machine.
+**Machine details**
The machine details tile provides information such as the domain and OS of the machine. If there's an investigation package available on the machine, you'll see a link that allows you to download the package.
For more information on how to take action on a machine, see [Take response action on a machine](respond-machine-alerts-windows-defender-advanced-threat-protection.md).
-Clicking on the number of total logged on users in the Logged on users tile opens the Users Details pane that displays the following information for logged on users in the past 30 days:
+
+**Logged on users**
+Clicking on the logged on users in the Logged on users tile opens the Users Details pane that displays the following information for logged on users in the past 30 days:
- Interactive and remote interactive logins
- Network, batch, and system logins
-
+
You'll also see details such as logon types for each user account, the user group, and when the account logon occurred.
For more information, see [Investigate user entities](investigate-user-windows-defender-advanced-threat-protection.md).
-## Manage machine group and tags
-Machine group and tags support proper mapping of the network, enabling you to attach different tags to machines to capture context and to enable dynamic groups creation as part of an incident.
+**Machine risk**
+The Machine risk tile shows the overall risk assessment of a machine. A machine's risk level is determined using the number of active alerts and their severity levels. You can influence a machine's risk level by resolving associated alerts manually or automatically and also by suppressing an alert. It's also indicators of the active threats that machines could be exposed to.
-Machine related properties are being extended to account for:
-
-- Group affiliation
-- Dynamic context capturing
-
-
-
-### Group machines
-Machine group affiliation can represent geographic location, specific activity, importance level and others. Grouping machines with similar attributes can be handy when you need to apply contextual action on a specific list of machines. After creating groups, you can apply the Group filter on the Machines list to get a narrowed list of machines.
-
-Machine group is defined in the following registry key entry of the machine:
-
-- Registry key: `HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection\DeviceTagging\`
-- Registry key value (string): Group
-
-
-### Set standard tags on machines
-Dynamic context capturing is achieved using tags. By tagging machines, you can keep track of individual machines in your organization. After adding tags on machines, you can apply the Tags filter on the Machines list to get a narrowed list of machines with the tag.
-
-1. Select the machine that you want to manage tags on. You can select or search for a machine from any of the following views:
-
- - **Security operations dashboard** - Select the machine name from the Top machines with active alerts section.
- - **Alerts queue** - Select the machine name beside the machine icon from the alerts queue.
- - **Machines list** - Select the machine name from the list of machines.
- - **Search box** - Select Machine from the drop-down menu and enter the machine name.
-
- You can also get to the alert page through the file and IP views.
-
-2. Open the **Actions** menu and select **Manage tags**.
-
- 
-
-3. Enter tags on the machine. To add more tags, click the + icon.
-4. Click **Save and close**.
-
- 
-
- Tags are added to the machine view and will also be reflected on the **Machines list** view. You can then use the **Tags** or **Groups** filter to see the relevant list of machines.
-
-### Manage machine tags
-You can manage tags from the Actions button or by selecting a machine from the Machines list and opening the machine details panel.
-
-
+**Azure Advanced Threat Protection**
+If you have enabled the Azure ATP feature and there are alerts related to the machine, you can click on the link that will take you to the Azure ATP page where more information about the alerts are provided.
+>[!NOTE]
+>You'll need to enable the integration on both Azure ATP and Windows Defender ATP to use this feature. In Windows Defender ATP, you can enable this feature in advanced features. For more information on how to enable advanced features, see [Turn on advanced features](advanced-features-windows-defender-advanced-threat-protection.md).
+**Machine reporting**
+Provides the last internal IP and external IP of the machine. It also shows when the machine was first and last seen reporting to the service.
## Alerts related to this machine
The **Alerts related to this machine** section provides a list of alerts that are associated with the machine. You can also manage alerts from this section by clicking the circle icons to the left of the alert (or using Ctrl or Shift + click to select multiple alerts).
+
+
This list is a filtered version of the [Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md), and shows the date when the alert's last activity was detected, a short description of the alert, the user account associated with the alert, the alert's severity, the alert's status in the queue, and who is addressing the alert.
You can also choose to highlight an alert from the **Alerts related to this machine** or from the **Machine timeline** section to see the correlation between the alert and its related events on the machine by right-clicking on the alert and selecting **Select and mark events**. This highlights the alert and its related events and helps distinguish them from other alerts and events appearing in the timeline. Highlighted events are displayed in all information levels whether you choose to view the timeline by **Detections**, **Behaviors**, or **Verbose**.
@@ -184,20 +150,71 @@ From the list of events that are displayed in the timeline, you can examine the
You can also use the [Alerts spotlight](investigate-alerts-windows-defender-advanced-threat-protection.md#artifact-timeline) feature to see the correlation between alerts and events on a specific machine.
-Expand an event to view associated processes related to the event. Click on the circle next to any process or IP address in the process tree to investigate additional details of the identified processes. This action brings up the **Details pane** which includes execution context of processes, network communications and a summary of metadata on the file or IP address.
+Expand an event to view associated processes related to the event. Click on the circle next to any process or IP address in the process tree to investigate additional details of the identified processes. This action brings up the **Details pane** which includes execution context of processes, network communications and a summary of meta data on the file or IP address.
The details pane enriches the ‘in-context’ information across investigation and exploration activities, reducing the need to switch between contexts. It lets you focus on the task of tracing associations between attributes without leaving the current context.
+## Add machine tags
+You can add tags on machines during an investigation. Machine tags support proper mapping of the network, enabling you to attach different tags to capture context and to enable dynamic list creation as part of an incident.
+
+You can add tags on machines using the following ways:
+- By setting a registry key value
+- By using the portal
+
+### Add machine tags by setting a registry key value
+Add tags on machines which can be used as a filter in Machines list view. You can limit the machines in the list by selecting the Tag filter on the Machines list.
+
+Machines with similar tags can be handy when you need to apply contextual action on a specific list of machines.
+
+Use the following registry key entry to add a tag on a machine:
+
+- Registry key: `HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection\DeviceTagging\`
+- Registry key value (string): Group
+
+
+### Add machine tags using the portal
+Dynamic context capturing is achieved using tags. By tagging machines, you can keep track of individual machines in your organization. After adding tags on machines, you can apply the Tags filter on the Machines list to get a narrowed list of machines with the tag.
+
+1. Select the machine that you want to manage tags on. You can select or search for a machine from any of the following views:
+
+ - **Security operations dashboard** - Select the machine name from the Top machines with active alerts section.
+ - **Alerts queue** - Select the machine name beside the machine icon from the alerts queue.
+ - **Machines list** - Select the machine name from the list of machines.
+ - **Search box** - Select Machine from the drop-down menu and enter the machine name.
+
+ You can also get to the alert page through the file and IP views.
+
+2. Open the **Actions** menu and select **Manage tags**.
+
+ 
+
+3. Enter tags on the machine. To add more tags, click the + icon.
+4. Click **Save and close**.
+
+ 
+
+ Tags are added to the machine view and will also be reflected on the **Machines list** view. You can then use the **Tags** filter to see the relevant list of machines.
+
+### Manage machine tags
+You can manage tags from the Actions button or by selecting a machine from the Machines list and opening the machine details panel.
+
+
+
+## Use machine groups in an investigation
+Machine group affiliation can represent geographic location, specific activity, importance level and others.
+
+You can create machine groups in the context of role-based access (RBAC) to control who can take specific action or who can see information on a specific machine group or groups by assigning the machine group to a user group. For more information, see [Manage portal access using role-based access control](rbac-windows-defender-advanced-threat-protection.md).
+
+You can also use machine groups to assign specific remediation levels to apply during automated investigations. For more information, see [Create and manage machine groups](machine-groups-windows-defender-advanced-threat-protection.md).
+
+In an investigation, you can filter the Machines list to just specific machine groups by using the Groups filter.
## Related topics
-- [View the Windows Defender Advanced Threat Protection Security operations dashboard](dashboard-windows-defender-advanced-threat-protection.md)
- [View and organize the Windows Defender Advanced Threat Protection Alerts queue ](alerts-queue-windows-defender-advanced-threat-protection.md)
+- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md)
- [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md)
- [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md)
- [Investigate an IP address associated with a Windows Defender ATP alert](investigate-ip-windows-defender-advanced-threat-protection.md)
- [Investigate a domain associated with a Windows Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md)
-- [View and organize the Windows Defender ATP Machines list](machines-view-overview-windows-defender-advanced-threat-protection.md)
- [Investigate a user account in Windows Defender ATP](investigate-user-windows-defender-advanced-threat-protection.md)
-- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md)
-- [Take response actions in Windows Defender ATP](response-actions-windows-defender-advanced-threat-protection.md)
diff --git a/windows/security/threat-protection/windows-defender-atp/investigate-user-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/investigate-user-windows-defender-advanced-threat-protection.md
index 7d166a4ede..fb5d06dfd4 100644
--- a/windows/security/threat-protection/windows-defender-atp/investigate-user-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/investigate-user-windows-defender-advanced-threat-protection.md
@@ -10,16 +10,12 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/16/2017
+ms.date: 04/24/2018
---
# Investigate a user account in Windows Defender ATP
**Applies to:**
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
@@ -37,17 +33,32 @@ You can find user account information in the following views:
A clickable user account link is available in these views, that will take you to the user account details page where more details about the user account are shown.
When you investigate a user account entity, you'll see:
-- User account details and Logged on machines
+- User account details, Azure Advanced Threat Protection (Azure ATP) alerts, and Logged on machines
- Alerts related to this user
- Observed in organization (machines logged on to)
-
+
-The user account entity details and logged on machines section display various attributes about the user account. You'll see details such as when the user was first and last seen and the total number of machines the user logged on to. You'll also see a list of the machines that the user logged on to, and can expand these to see details of the logon events on each machine.
+**User details**
+The user account entity details, Azure ATP alerts, and logged on machines sections display various attributes about the user account.
-The **Alerts related to this user** section provides a list of alerts that are associated with the user account. This list is a filtered view of the [Alert queue](alerts-queue-windows-defender-advanced-threat-protection.md), and shows alerts where the user context is the selected user account, the date when the last activity was detected, a short description of the alert, the machine associated with the alert, the alert's severity, the alert's status in the queue, and who is assigned the alert.
+The user entity tile provides details about the user such as when the user was first and last seen. Depending on the integration features you enable, you'll see other details. For example, if you enable the Skype for business integration, you'll be able to contact the user from the portal.
-The **Observed in organization** section allows you to specify a date range to see a list of machines where this user was observed logged on to, and the most frequent and least frequent logged on user account on each of these machines.
+**Azure Advanced Threat Protection**
+If you have enabled the Azure ATP feature and there are alerts related to the user, you can click on the link that will take you to the Azure ATP page where more information about the alerts are provided. The Azure ATP tile also provides details such as the last AD site, total group memberships, and login failure associated with the user.
+
+>[!NOTE]
+>You'll need to enable the integration on both Azure ATP and Windows Defender ATP to use this feature. In Windows Defender ATP, you can enable this feature in advanced features. For more information on how to enable advanced features, see [Turn on advanced features](advanced-features-windows-defender-advanced-threat-protection.md).
+
+**Logged on machines**
+You'll also see a list of the machines that the user logged on to, and can expand these to see details of the logon events on each machine.
+
+
+## Alerts related to this user
+This section provides a list of alerts that are associated with the user account. This list is a filtered view of the [Alert queue](alerts-queue-windows-defender-advanced-threat-protection.md), and shows alerts where the user context is the selected user account, the date when the last activity was detected, a short description of the alert, the machine associated with the alert, the alert's severity, the alert's status in the queue, and who is assigned the alert.
+
+## Observed in organization
+This section allows you to specify a date range to see a list of machines where this user was observed logged on to, and the most frequent and least frequent logged on user account on each of these machines.
The machine health state is displayed in the machine icon and color as well as in a description text. Clicking on the icon displays additional details regarding machine health.
@@ -69,13 +80,11 @@ You can filter the results by the following time periods:
- 6 months
## Related topics
-- [View the Windows Defender Advanced Threat Protection Security operations dashboard](dashboard-windows-defender-advanced-threat-protection.md)
- [View and organize the Windows Defender Advanced Threat Protection Alerts queue ](alerts-queue-windows-defender-advanced-threat-protection.md)
+- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md)
- [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md)
- [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md)
+- [Investigate machines in the Windows Defender ATP Machines list](investigate-machines-windows-defender-advanced-threat-protection.md)
- [Investigate an IP address associated with a Windows Defender ATP alert](investigate-ip-windows-defender-advanced-threat-protection.md)
- [Investigate a domain associated with a Windows Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md)
-- [View and organize the Windows Defender ATP Machines list](machines-view-overview-windows-defender-advanced-threat-protection.md)
-- [Investigate machines in the Windows Defender ATP Machines list](investigate-machines-windows-defender-advanced-threat-protection.md)
-- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md)
-- [Take response actions in Windows Defender ATP](response-actions-windows-defender-advanced-threat-protection.md)
+
diff --git a/windows/security/threat-protection/windows-defender-atp/is-domain-seen-in-org-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/is-domain-seen-in-org-windows-defender-advanced-threat-protection.md
index c2e2c9f696..a7c1630a56 100644
--- a/windows/security/threat-protection/windows-defender-atp/is-domain-seen-in-org-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/is-domain-seen-in-org-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/16/2017
+ms.date: 04/24/2018
---
# Is domain seen in org
diff --git a/windows/security/threat-protection/windows-defender-atp/licensing-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/licensing-windows-defender-advanced-threat-protection.md
index 4e8281d86e..71573b1352 100644
--- a/windows/security/threat-protection/windows-defender-atp/licensing-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/licensing-windows-defender-advanced-threat-protection.md
@@ -22,6 +22,7 @@ ms.date: 10/16/2017
- Windows 10 Pro Education
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+[!include[Prerelease information](prerelease.md)]
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-validatelicense-abovefoldlink)
@@ -53,7 +54,7 @@ To gain access into which licenses are provisioned to your company, and to check
When accessing the [Windows Defender ATP portal](https://SecurityCenter.Windows.com) for the first time there will be a setup wizard that will guide you through some initial steps. At the end of the setup wizard there will be a dedicated cloud instance of Windows Defender ATP created.
-1. Each time you access the portal you will need to validate that you are authorized to access the product. Only if you are not authorized will This **Set up your permissions** step will only be available if you are not currently authorized to access the product.
+1. Each time you access the portal you will need to validate that you are authorized to access the product. This **Set up your permissions** step will only be available if you are not currently authorized to access the product.
@@ -117,20 +118,20 @@ When accessing the [Windows Defender ATP portal](https://SecurityCenter.Windows.
10. You are almost done. Before you can start using Windows Defender ATP you'll need to:
- - [Onboard endpoints and setup access](https://technet.microsoft.com/en-us/itpro/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection)
+ - [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md)
- Run detection test (optional)
- 
+ 
> [!IMPORTANT]
- > If you click **Start using Windows Defender ATP** before onboarding endpoints you will receive the following notification:
+ > If you click **Start using Windows Defender ATP** before onboarding machines you will receive the following notification:
>
-11. After onboarding endpoints you can click **Start using Windows Defender ATP**. You will now launch Windows Defender ATP for the first time.
+11. After onboarding machines you can click **Start using Windows Defender ATP**. You will now launch Windows Defender ATP for the first time.
- 
+ 
## Related topics
-- [Onboard and set up Windows Defender Advanced Threat Protection](onboard-configure-windows-defender-advanced-threat-protection.md)
-- [Troubleshoot onboarding process and error messages](troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md)
\ No newline at end of file
+- [Onboard machines to the Windows Defender Advanced Threat Protection service](onboard-configure-windows-defender-advanced-threat-protection.md)
+- [Troubleshoot onboarding process and portal access issues](troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md)
diff --git a/windows/security/threat-protection/windows-defender-atp/machine-groups-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/machine-groups-windows-defender-advanced-threat-protection.md
new file mode 100644
index 0000000000..221bfd7884
--- /dev/null
+++ b/windows/security/threat-protection/windows-defender-atp/machine-groups-windows-defender-advanced-threat-protection.md
@@ -0,0 +1,94 @@
+---
+title: Create and manage machine groups in Windows Defender ATP
+description: Create machine groups and set automated remediation levels on them by confiring the rules that apply on the group
+keywords: machine groups, groups, remediation, level, rules, aad group, role, assign, rank
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: high
+ms.date: 04/24/2018
+---
+
+# Create and manage machine groups in Windows Defender ATP
+**Applies to:**
+
+- Windows 10 Enterprise
+- Windows 10 Education
+- Windows 10 Pro
+- Windows 10 Pro Education
+- Azure Active Directory
+- Office 365
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
+In an enterprise scenario, security operation teams are typically assigned a set of machines. These machines are grouped together based on a set of attributes such as their domains, computer names, or designated tags.
+
+In Windows Defender ATP, you can create machine groups and use them to:
+- Limit access to related alerts and data to specific Azure AD user groups with [assigned RBAC roles](rbac-windows-defender-advanced-threat-protection.md)
+- Configure different auto-remediation settings for different sets of machines
+
+As part of the process of creating a machine group, you'll:
+- Set the automated remediation level for that group
+- Define a matching rule based on the machine name, domain, tags, and OS platform to determine which machines belong to the group. If a machine is also matched to other groups, it is added only to the highest ranked machine group.
+- Determine access to machine group
+- Rank the machine group relative to other groups after it is created
+
+>[!NOTE]
+>All machine groups are accessible to all users if you don’t assign any Azure AD groups to them.
+
+
+## Add a machine group
+
+1. In the navigation pane, select **Settings > Permissions > Machine groups**.
+
+2. Click **Add machine group**.
+
+3. Set the machine group details, configure an association rule, preview the results, then assign the group to an Azure user group:
+
+ - **Name**
+
+ - **Remediation level for automated investigations**
+ - **No remediation**
+ - **Require approval (all folders)**
+ - **Require approval (non-temp folders)**
+ - **Require approval (core folders)**
+ - **Fully automated**
+
+ - **Description**
+
+ - **Matching rule** – you can apply the rule based on machine name, domain, tag, or OS version.
+
+ >[!TIP]
+ >If you want to group machines by organizational unit, you can configure the registry key for the group affiliation. For more information on device tagging, see [Manage machine group and tags](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection#manage-machine-group-and-tags).
+
+4. Review the result of the preview of matched machines. If you are satisfied with the rules, click the **Access** tab.
+
+5. Assign the user groups that can access the machine group you created.
+
+ >[!NOTE]
+ >You can only grant access to Azure AD user groups that have been assigned to RBAC roles.
+
+6. Click **Close**.
+
+7. Apply the configuration settings.
+
+## Understand matching and manage groups
+You can promote the rank of a machine group so that it is given higher priority during matching. When a machine is matched to more than one group, it is added only to the highest ranked group. You can also edit and delete groups.
+
+By default, machine groups are accessible to all users with portal access. You can change the default behavior by assigning Azure AD user groups to the machine group.
+
+Machines that are not matched to any groups are added to Ungrouped machines (default) group. You cannot change the rank of this group or delete it. However, you can change the remediation level of this group, and define the Azure AD user groups that can access this group.
+
+>[!NOTE]
+>Applying changes to machine group configuration may take up to several minutes.
+
+
+
+
+## Related topic
+- [Manage portal access using role-based based access control](rbac-windows-defender-advanced-threat-protection.md)
\ No newline at end of file
diff --git a/windows/security/threat-protection/windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection.md
index b25f671461..c304f74048 100644
--- a/windows/security/threat-protection/windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 03/12/2018
+ms.date: 04/24/2018
---
# View and organize the Windows Defender ATP Machines list
@@ -23,8 +23,6 @@ ms.date: 03/12/2018
- Windows 10 Pro Education
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-
-
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-machinesview-abovefoldlink)
The **Machines list** shows a list of the machines in your network, the domain of each machine, when it last reported and the local IP Address it reported on, its **Health state**, the number of active alerts on each machine categorized by alert severity level, and the number of active malware detections. This view allows viewing machines ranked by risk or sensor health state, and keeping track of all machines that are reporting sensor data in your network.
@@ -32,7 +30,7 @@ The **Machines list** shows a list of the machines in your network, the domain o
Use the Machines list in these main scenarios:
- **During onboarding**
- During the onboarding process, the **Machines list** is gradually populated with endpoints as they begin to report sensor data. Use this view to track your onboarded endpoints as they come online. Sort and filter by time of last report, **Active malware category**, or **Sensor health state**, or download the complete endpoint list as a CSV file for offline analysis.
+ During the onboarding process, the **Machines list** is gradually populated with machines as they begin to report sensor data. Use this view to track your onboarded endpoints as they come online. Sort and filter by time of last report, **Active malware category**, or **Sensor health state**, or download the complete endpoint list as a CSV file for offline analysis.
- **Day-to-day work**
The **Machines list** enables easy identification of machines most at risk in a glance. High-risk machines have the greatest number and highest-severity alerts; **Sensor health state** provides another dimension to rank machines. Sorting machines by **Active alerts**, and then by **Sensor health state** helps identify the most vulnerable machines and take action on them.
@@ -43,7 +41,7 @@ Filter the **Machines list** by **Time**, **OS Platform**, **Health**, **Securit
You can also download the entire list in CSV format using the **Export to CSV** feature.
-
+
You can use the following filters to limit the list of machines displayed during an investigation:
@@ -54,6 +52,9 @@ You can use the following filters to limit the list of machines displayed during
- 30 days
- 6 months
+**Risk level**
+Machine risk levels are indicators of the active threats that machines could be exposed to. A machine's risk level is determined using the number of active alerts and their severity levels. You can influence a machine's risk level by resolving associated alerts manually or automatically and also by suppressing an alert.
+
**OS Platform**
- Windows 10
- Windows Server 2012 R2
@@ -80,7 +81,7 @@ Filter the list to view specific machines that are well configured or require at
- **Well configured** - Machines have the Windows Defender security controls well configured.
- **Requires attention** - Machines where improvements can be made to increase the overall security posture of your organization.
-For more information, see [View the Secure score dashboard](security-analytics-dashboard-windows-defender-advanced-threat-protection.md).
+For more information, see [View the Secure Score dashboard](secure-score-dashboard-windows-defender-advanced-threat-protection.md).
**Malware category alerts**
Filter the list to view specific machines grouped together by the following malware categories:
@@ -92,13 +93,14 @@ Filter the list to view specific machines grouped together by the following malw
- **General malware** – Malware are malicious programs that perform unwanted actions, including actions that can disrupt, cause direct damage, and facilitate intrusion and data theft. Some malware can replicate and spread from one machine to another. Others are able to receive commands from remote attackers and perform activities associated with cyberattacks.
- **PUA** – Unwanted software is a category of applications that install and perform undesirable activity without adequate user consent. These applications are not necessarily malicious, but their behaviors often negatively impact the computing experience, even appearing to invade user privacy. Many of these applications display advertising, modify browser settings, and install bundled software.
-## Groups and tags
-You can filter the list based on the grouping and tagging that you've added to individual machines. For more information, see [Manage machine group and tags](investigate-machines-windows-defender-advanced-threat-protection.md#manage-machine-group-and-tags).
+**Groups and tags**
+You can filter the list based on the grouping and tagging that you've added to individual machines.
## Export machine list to CSV
You can download a full list of all the machines in your organization, in CSV format. Click the **Export to CSV** button to download the entire list as a CSV file.
-**Note**: Exporting the list depends on the number of machines in your organization. It might take a significant amount of time to download, depending on how large your organization is.
+>[NOTE]
+> Exporting the list depends on the number of machines in your organization. It might take a significant amount of time to download, depending on how large your organization is.
Exporting the list in CSV format displays the data in an unfiltered manner. The CSV file will include all machines in the organization, regardless of any filtering applied in the view itself.
## Sort the Machines list
@@ -112,17 +114,10 @@ You can sort the **Machines list** by the following columns:
- **Active malware alerts** - Number of active malware detections reported by the machine
> [!NOTE]
-> The **Active malware detections** filter column will only appear if your endpoints are using [Windows Defender Antivirus](../windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md) as the active real-time protection antimalware product.
+> The **Active malware detections** filter column will only appear if your machines are using [Windows Defender Antivirus](../windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md) as the active real-time protection antimalware product.
## Related topics
-- [View the Windows Defender Advanced Threat Protection Security operations dashboard](dashboard-windows-defender-advanced-threat-protection.md)
-- [View and organize the Windows Defender Advanced Threat Protection Alerts queue ](alerts-queue-windows-defender-advanced-threat-protection.md)
-- [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md)
-- [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md)
-- [Investigate an IP address associated with a Windows Defender ATP alert](investigate-ip-windows-defender-advanced-threat-protection.md)
-- [Investigate a domain associated with a Windows Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md)
- [Investigate machines in the Windows Defender ATP Machines list](investigate-machines-windows-defender-advanced-threat-protection.md)
-- [Investigate a user account in Windows Defender ATP](investigate-user-windows-defender-advanced-threat-protection.md)
-- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md)
-- [Take response actions in Windows Defender ATP](response-actions-windows-defender-advanced-threat-protection.md)
+
+
diff --git a/windows/security/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md
index 496720c009..54bc053ce4 100644
--- a/windows/security/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/16/2017
+ms.date: 04/24/2018
---
# Manage Windows Defender Advanced Threat Protection alerts
@@ -23,7 +23,7 @@ ms.date: 10/16/2017
- Windows 10 Pro Education
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-
+[!include[Prerelease information](prerelease.md)]
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-managealerts-abovefoldlink)
@@ -87,20 +87,20 @@ Create custom rules to control when alerts are suppressed, or resolved. You can
-3. Choose the context for suppressing the alert.
+3. Enter an alert title then select an indicator of compromise from the drop-down list.
> [!NOTE]
> You cannot create a custom or blank suppression rule. You must start from an existing alert.
-4. Specify the conditions for when the rule is applied:
- - Alert title
- - Indicator of compromise (IOC)
- - Suppression conditions
+4. Specify the suppression conditions by entering values for any of the following:
+ - Sha1
+ - File name
+ - Folder path
> [!NOTE]
- > The SHA1 of the alert cannot be modified, however you can clear the SHA1 to remove it from the suppression conditions.
+ > The SHA1 of the alert cannot be modified, however you can clear the SHA1 to remove it from the suppression conditions by removing the deselecting the checkbox.
5. Specify the action and scope on the alert.
You can automatically resolve an alert or hide it from the portal. Alerts that are automatically resolved will appear in the resolved section of the alerts queue. Alerts that are marked as hidden will be suppressed from the entire system, both on the machine's associated alerts and from the dashboard. You can also specify to suppress the alert on the machine only or the whole organization.
@@ -110,20 +110,18 @@ Create custom rules to control when alerts are suppressed, or resolved. You can
### View the list of suppression rules
-1. Click **Alerts queue** > **Suppression rules**.
+1. In the navigation pane, select **Settings** > **Rules** > **Alert suppression**.
2. The list of suppression rules shows all the rules that users in your organization have created.
-You can select rules to open up the **Alert management** pane. From there, you can activate previously disabled rules.
+For more information on managing suppression rules, see [Manage suppression rules](manage-suppression-rules-windows-defender-advanced-threat-protection.md)
## Related topics
-- [View the Windows Defender Advanced Threat Protection Security operations dashboard](dashboard-windows-defender-advanced-threat-protection.md)
+- [Manage suppression rules](manage-suppression-rules-windows-defender-advanced-threat-protection.md)
- [View and organize the Windows Defender Advanced Threat Protection Alerts queue ](alerts-queue-windows-defender-advanced-threat-protection.md)
- [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md)
- [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md)
+- [Investigate machines in the Windows Defender ATP Machines list](investigate-machines-windows-defender-advanced-threat-protection.md)
- [Investigate an IP address associated with a Windows Defender ATP alert](investigate-ip-windows-defender-advanced-threat-protection.md)
- [Investigate a domain associated with a Windows Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md)
-- [View and organize the Windows Defender ATP Machines list](machines-view-overview-windows-defender-advanced-threat-protection.md)
-- [Investigate machines in the Windows Defender ATP Machines list](investigate-machines-windows-defender-advanced-threat-protection.md)
- [Investigate a user account in Windows Defender ATP](investigate-user-windows-defender-advanced-threat-protection.md)
-- [Take response actions in Windows Defender ATP](response-actions-windows-defender-advanced-threat-protection.md)
diff --git a/windows/security/threat-protection/windows-defender-atp/manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md
new file mode 100644
index 0000000000..abe6240f77
--- /dev/null
+++ b/windows/security/threat-protection/windows-defender-atp/manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md
@@ -0,0 +1,73 @@
+---
+title: Manage automation allowed/blocked lists
+description: Create lists that control what items are automatically blocked or allowed during an automatic investigation.
+keywords: manage, automation, whitelist, blacklist, block, clean, malicious
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: high
+ms.date: 04/24/2018
+---
+
+# Manage automation allowed/blocked lists
+
+**Applies to:**
+
+- Windows 10 Enterprise
+- Windows 10 Education
+- Windows 10 Pro
+- Windows 10 Pro Education
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
+>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-automationexclusionlist-abovefoldlink)
+
+Create a rule to control which entities are automatically incriminated or exonerated during Automated investigations.
+
+Entities added to the allowed list are considered safe and will not be analyzed during Automated investigations.
+
+Entities added to the blocked list are considered malicious and will be remediated during Automated investigations.
+
+You can define the conditions for when entities are identified as malicious or safe based on certain attributes such as hash values or certificates.
+
+## Create an allowed or blocked list
+1. In the navigation pane, select **Settings** > **Rules** > **Automation allowed/blocked list**.
+
+2. Select the type of entity you'd like to create an exclusion for. You can choose any of the following entities:
+ - File hash
+ - Certificate
+
+3. Click **Add system exclusion**.
+
+4. For each attribute specify the exclusion type, details, and the following required values:
+
+ - **Files** - Hash value
+ - **Certificate** - PEM certificate file
+
+5. Click **Update rule**.
+
+## Edit a list
+1. In the navigation pane, select **Settings** > **Rules** > **Automation allowed/blocked list**.
+
+2. Select the type of entity you'd like to edit the list from.
+
+3. Update the details of the rule and click **Update rule**.
+
+## Delete a list
+1. In the navigation pane, select **Settings** > **Rules** > **Automation allowed/blocked list**.
+
+2. Select the type of entity you'd like to delete the list from.
+
+3. Select the list type by clicking the check-box beside the list type.
+
+4. Click **Delete**.
+
+
+## Related topics
+- [Manage automation file uploads](manage-automation-file-uploads-windows-defender-advanced-threat-protection.md)
+- [Manage automation folder exclusions](manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md)
\ No newline at end of file
diff --git a/windows/security/threat-protection/windows-defender-atp/manage-automation-file-uploads-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/manage-automation-file-uploads-windows-defender-advanced-threat-protection.md
new file mode 100644
index 0000000000..a418fca559
--- /dev/null
+++ b/windows/security/threat-protection/windows-defender-atp/manage-automation-file-uploads-windows-defender-advanced-threat-protection.md
@@ -0,0 +1,50 @@
+---
+title: Manage automation file uploads
+description: Enable content analysis and configure the file extension and email attachment extensions that will be sumitted for analysis
+keywords: automation, file, uploads, content, analysis, file, extension, email, attachment
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: high
+ms.date: 04/24/2018
+---
+
+# Manage automation file uploads
+
+**Applies to:**
+
+- Windows 10 Enterprise
+- Windows 10 Education
+- Windows 10 Pro
+- Windows 10 Pro Education
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
+>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-automationefileuploads-abovefoldlink)
+
+Enable the content analysis capability so that certain files and email attachments can automatically be uploaded to the cloud for additional inspection in Automated investigation.
+
+Identify the files and email attachments by specifying the file extension names and email attachment extension names.
+
+For example, if you add *exe* and *bat* as file or attachment extension names, then all files or attachments with those extensions will automatically be sent to the cloud for additional inspection during Automated investigation.
+
+## Add file extension names and attachment extension names.
+
+1. In the navigation pane, select **Settings** > **Rules** > **Automation file uploads**.
+
+2. Toggle the content analysis setting between **On** and **Off**.
+
+3. Configure the following extension names and separate extension names with a comma:
+ - **File extension names** - Suspicious files except email attachments will be submitted for additional inspection
+ - **Attachment extension names** - Suspicious email attachments with these extension names will be submitted for additional inspection
+
+
+
+## Related topics
+- [Manage automation allowed/blocked lists](manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md)
+- [Manage automation folder exclusions](manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md)
\ No newline at end of file
diff --git a/windows/security/threat-protection/windows-defender-atp/manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md
new file mode 100644
index 0000000000..0388d3e0dd
--- /dev/null
+++ b/windows/security/threat-protection/windows-defender-atp/manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md
@@ -0,0 +1,78 @@
+---
+title: Manage automation folder exclusions
+description: Add automation folder exclusions to control the files that are excluded from an automated investigation.
+keywords: manage, automation, exclusion, whitelist, blacklist, block, clean, malicious
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: high
+ms.date: 04/24/2018
+---
+
+# Manage automation folder exclusions
+
+**Applies to:**
+
+- Windows 10 Enterprise
+- Windows 10 Education
+- Windows 10 Pro
+- Windows 10 Pro Education
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
+>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-automationexclusionfolder-abovefoldlink)
+
+Automation folder exclusions allow you to specify folders that the Automated investigation will skip.
+
+You can control the following attributes about the folder that you'd like to be skipped:
+- Folders
+- Extensions of the files
+- File names
+
+
+**Folders**
+You can specify a folder and its subfolders to be skipped. You can use wild cards so that all files under the directory is skipped by the automated investigation.
+
+**Extensions**
+You can specify the extensions to exclude in a specific directory. The extensions are a way to prevent an attacker from using an excluded folder to hide an exploit. The extensions explicitly define which files to ignore.
+
+**File names**
+You can specify the file names that you want to be excluded in a specific directory. The names are a way to prevent an attacker from using an excluded folder to hide an exploit. The names explicitly define which files to ignore.
+
+
+
+## Add an automation folder exclusion
+1. In the navigation pane, select **Settings** > **Rules** > **Automation folder exclusions**.
+
+2. Click **New folder exclusion**.
+
+3. Enter the folder details:
+
+ - Folder
+ - Extensions
+ - File names
+ - Description
+
+
+4. Click **Save**.
+
+## Edit an automation folder exclusion
+1. In the navigation pane, select **Settings** > **Rules** > **Automation folder exclusions**.
+
+2. Click **Edit** on the folder exclusion.
+
+3. Update the details of the rule and click **Save**.
+
+## Remove an automation folder exclusion
+1. In the navigation pane, select **Settings** > **Rules** > **Automation folder exclusions**.
+2. Click **Remove exclusion**.
+
+
+## Related topics
+- [Manage automation allowed/blocked lists](manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md)
+- [Manage automation file uploads](manage-automation-file-uploads-windows-defender-advanced-threat-protection.md)
diff --git a/windows/security/threat-protection/windows-defender-atp/manage-suppression-rules-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/manage-suppression-rules-windows-defender-advanced-threat-protection.md
new file mode 100644
index 0000000000..afd498bd1b
--- /dev/null
+++ b/windows/security/threat-protection/windows-defender-atp/manage-suppression-rules-windows-defender-advanced-threat-protection.md
@@ -0,0 +1,49 @@
+---
+title: Manage Windows Defender Advanced Threat Protection suppression rules
+description: Manage suppression rules
+keywords: manage suppression, rules, rule name, scope, action, alerts, turn on, turn off
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: high
+ms.date: 04/24/2018
+---
+
+# Manage suppression rules
+
+**Applies to:**
+
+- Windows 10 Enterprise
+- Windows 10 Education
+- Windows 10 Pro
+- Windows 10 Pro Education
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
+>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-suppressionrules-abovefoldlink)
+
+There might be scenarios where you need to suppress alerts from appearing in the portal. You can create suppression rules for specific alerts that are known to be innocuous such as known tools or processes in your organization. For more information on how to suppress alerts, see [Suppress alerts](manage-alerts-windows-defender-advanced-threat-protection.md#suppress-alerts).
+
+You can view a list of all the suppression rules and manage them in one place. You can also turn an alert suppression rule on or off.
+
+## Turn a suppression rule on or off
+1. In the navigation pane, select **Settings** > **Rules** > **Alert suppression**. The list of suppression rules that users in your organization have created is displayed.
+
+2. Select a rule by clicking on the check-box beside the rule name.
+
+3. Click **Turn rule on** or **Turn rule off**.
+
+## View details of a suppression rule
+
+1. In the navigation pane, select **Settings** > **Rules** > **Alert suppression**. The list of suppression rules that users in your organization have created is displayed.
+
+2. Click on a rule name. Details of the rule is displayed. You'll see the rule details such as status, scope, action, number of matching alerts, created by, and date when the rule was created. You can also view associated alerts and the rule conditions.
+
+## Related topics
+- [Manage alerts](manage-alerts-windows-defender-advanced-threat-protection.md)
+
diff --git a/windows/security/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md
index 368f43a52c..9afdfa86cb 100644
--- a/windows/security/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md
@@ -1,7 +1,7 @@
---
title: Minimum requirements for Windows Defender ATP
-description: Minimum network and data storage configuration, endpoint hardware and software requirements, and deployment channel requirements for Windows Defender ATP.
-keywords: minimum requirements, Windows Defender Advanced Threat Protection minimum requirements, network and data storage, endpoint, endpoint configuration, deployment channel
+description: Minimum network and data storage configuration, machine hardware and software requirements, and deployment channel requirements for Windows Defender ATP.
+keywords: minimum requirements, Windows Defender Advanced Threat Protection minimum requirements, network and data storage, machine configuration, deployment channel
search.product: eADQiWindows 10XVcnh
ms.prod: w10
ms.mktglfcycl: deploy
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 03/21/2018
+ms.date: 04/24/2018
---
# Minimum requirements for Windows Defender ATP
@@ -23,9 +23,9 @@ ms.date: 03/21/2018
- Windows 10 Pro Education
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+[!include[Prerelease information](prerelease.md)]
-
-There are some minimum requirements for onboarding your network and endpoints.
+There are some minimum requirements for onboarding machines to the service.
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-minreqs-abovefoldlink)
@@ -49,7 +49,7 @@ When you run the onboarding wizard for the first time, you must choose where you
> - You cannot change your data storage location after the first-time setup.
> - Review the [Windows Defender ATP data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md) for more information on where and how Microsoft stores your data.
-### Endpoint hardware and software requirements
+### Hardware and software requirements
The Windows Defender ATP agent only supports the following editions of Windows 10:
@@ -58,30 +58,30 @@ The Windows Defender ATP agent only supports the following editions of Windows 1
- Windows 10 Pro
- Windows 10 Pro Education
-Endpoints on your network must be running one of these editions.
+Machines on your network must be running one of these editions.
-The hardware requirements for Windows Defender ATP on endpoints is the same as those for the supported editions.
+The hardware requirements for Windows Defender ATP on machines is the same as those for the supported editions.
> [!NOTE]
-> Endpoints that are running mobile versions of Windows are not supported.
+> Machines that are running mobile versions of Windows are not supported.
#### Internet connectivity
-Internet connectivity on endpoints is required either directly or through proxy.
+Internet connectivity on machines is required either directly or through proxy.
The Windows Defender ATP sensor can utilize a daily average bandwidth of 5MB to communicate with the Windows Defender ATP cloud service and report cyber data.
-For more information on additional proxy configuration settings see, [Configure Windows Defender ATP endpoint proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) .
+For more information on additional proxy configuration settings see, [Configure machine proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) .
-Before you configure endpoints, the diagnostic data service must be enabled. The service is enabled by default in Windows 10.
+Before you onboard machines, the diagnostic data service must be enabled. The service is enabled by default in Windows 10.
### Diagnostic data settings
-You must ensure that the diagnostic data service is enabled on all the endpoints in your organization.
+You must ensure that the diagnostic data service is enabled on all the machines in your organization.
By default, this service is enabled, but it's good practice to check to ensure that you'll get sensor data from them.
**Use the command line to check the Windows 10 diagnostic data service startup type**:
-1. Open an elevated command-line prompt on the endpoint:
+1. Open an elevated command-line prompt on the machine:
a. Go to **Start** and type **cmd**.
@@ -124,15 +124,20 @@ If the **START_TYPE** is not set to **AUTO_START**, then you'll need to set the
## Windows Defender Antivirus signature updates are configured
The Windows Defender ATP agent depends on the ability of Windows Defender Antivirus to scan files and provide information about them.
-You must configure the signature updates on the Windows Defender ATP endpoints whether Windows Defender Antivirus is the active antimalware or not. For more information, see [Manage Windows Defender Antivirus updates and apply baselines](../windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md).
+You must configure the signature updates on the Windows Defender ATP machines whether Windows Defender Antivirus is the active antimalware or not. For more information, see [Manage Windows Defender Antivirus updates and apply baselines](../windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md).
When Windows Defender Antivirus is not the active antimalware in your organization and you use the Windows Defender ATP service, Windows Defender Antivirus goes on passive mode. If your organization has disabled Windows Defender Antivirus through group policy or other methods, machines that are onboarded to Windows Defender ATP must be excluded from this group policy.
+Depending on the server version you're onboarding, you might need to configure a Group Policy setting to run on passive mode. For more information, see [Onboard servers](configure-server-endpoints-windows-defender-advanced-threat-protection.md).
+
For more information, see [Windows Defender Antivirus compatibility](../windows-defender-antivirus/windows-defender-antivirus-compatibility.md).
## Windows Defender Antivirus Early Launch Antimalware (ELAM) driver is enabled
-If you're running Windows Defender Antivirus as the primary antimalware product on your endpoints, the Windows Defender ATP agent will successfully onboard.
+If you're running Windows Defender Antivirus as the primary antimalware product on your machines, the Windows Defender ATP agent will successfully onboard.
If you're running a third-party antimalware client and use Mobile Device Management solutions or System Center Configuration Manager (current branch) version 1606, you'll need to ensure that the Windows Defender Antivirus ELAM driver is enabled. For more information, see [Ensure that Windows Defender Antivirus is not disabled by policy](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-that-windows-defender-antivirus-is-not-disabled-by-a-policy).
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=technet-wd-atp-minreq-belowfoldlink1)
+
+## Related topic
+- [Validate licensing and complete setup](licensing-windows-defender-advanced-threat-protection.md)
diff --git a/windows/security/threat-protection/windows-defender-atp/offboard-machines-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/offboard-machines-windows-defender-advanced-threat-protection.md
new file mode 100644
index 0000000000..5083d2feae
--- /dev/null
+++ b/windows/security/threat-protection/windows-defender-atp/offboard-machines-windows-defender-advanced-threat-protection.md
@@ -0,0 +1,47 @@
+---
+title: Offboard machines from the Windows Defender ATP service
+description: Onboard Windows 10 machines, servers, non-Windows machines from the Windows Defender ATP service
+keywords: offboarding, windows defender advanced threat protection offboarding, windows atp offboarding
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: high
+ms.date: 04/24/2018
+---
+
+# Offboard machines from the Windows Defender ATP service
+
+**Applies to:**
+
+- Windows 10 Enterprise
+- Windows 10 Education
+- Windows 10 Pro
+- Windows 10 Pro Education
+- macOS
+- Linux
+- Windows Server 2012 R2
+- Windows Server 2016
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
+>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-offboardmachines-abovefoldlink)
+
+Follow the corresponding instructions depending on your preferred deployment method.
+
+## Offboard Windows 10 machines
+ - [Offboard machines using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md#offboard-machines-using-a-local-script)
+ - [Offboard machines using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md#offboard-machines-using-group-policy)
+ - [Offboard machines using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md#offboard-machines-using-system-center-configuration-manager)
+ - [Offboard machines using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md#offboard-and-monitor-machines-using-mobile-device-management-tools)
+
+## Offboard Servers
+ - [Offboard servers](configure-server-endpoints-windows-defender-advanced-threat-protection.md#offboard-servers)
+
+## Offboard non-Windows machines
+ - [Offboard non-Windows machines](configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md#offboard-non-windows-machines)
+
diff --git a/windows/security/threat-protection/windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection.md
index 17df4fab03..e5ee209594 100644
--- a/windows/security/threat-protection/windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection.md
@@ -1,7 +1,7 @@
---
-title: Onboard endpoints and set up the Windows Defender ATP user access
-description: Set up user access in Azure Active Directory and use Group Policy, SCCM, or do manual registry changes to onboard endpoints to the service.
-keywords: onboarding, windows defender advanced threat protection onboarding, windows atp onboarding, sccm, group policy, mdm, local script
+title: Onboard machines to the Windows Defender ATP service
+description: Onboard Windows 10 machines, servers, non-Windows machines and learn how to run a detection test.
+keywords: onboarding, windows defender advanced threat protection onboarding, windows atp onboarding, sccm, group policy, mdm, local script, detection test
search.product: eADQiWindows 10XVcnh
ms.prod: w10
ms.mktglfcycl: deploy
@@ -10,10 +10,10 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 11/21/2017
+ms.date: 04/24/2018
---
-# Onboard and set up Windows Defender Advanced Threat Protection
+# Onboard machines to the Windows Defender ATP service
**Applies to:**
@@ -21,15 +21,19 @@ ms.date: 11/21/2017
- Windows 10 Education
- Windows 10 Pro
- Windows 10 Pro Education
+- macOS
+- Linux
+- Windows Server 2012 R2
+- Windows Server 2016
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-
+[!include[Prerelease information](prerelease.md)]
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-onboardconfigure-abovefoldlink)
You need to onboard to Windows Defender ATP before you can use the service.
-For more information, see [Onboard your Windows 10 endpoints to Windows Defender ATP](https://www.youtube.com/watch?v=JT7VGYfeRlA&feature=youtu.be).
+For more information, see [Onboard your Windows 10 machines to Windows Defender ATP](https://www.youtube.com/watch?v=JT7VGYfeRlA&feature=youtu.be).
## Licensing requirements
Windows Defender Advanced Threat Protection requires one of the following Microsoft Volume Licensing offers:
@@ -43,19 +47,23 @@ For more information, see [Windows 10 Licensing](https://www.microsoft.com/en-us
## Windows Defender Antivirus configuration requirement
The Windows Defender ATP agent depends on the ability of Windows Defender Antivirus to scan files and provide information about them.
-You must configure the signature updates on the Windows Defender ATP endpoints whether Windows Defender Antivirus is the active antimalware or not. For more information, see [Manage Windows Defender Antivirus updates and apply baselines](../windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md).
+You must configure the signature updates on the Windows Defender ATP machines whether Windows Defender Antivirus is the active antimalware or not. For more information, see [Manage Windows Defender Antivirus updates and apply baselines](../windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md).
When Windows Defender Antivirus is not the active antimalware in your organization and you use the Windows Defender ATP service, Windows Defender Antivirus goes on passive mode. If your organization has disabled Windows Defender Antivirus through group policy or other methods, machines that are onboarded to Windows Defender ATP must be excluded from this group policy.
+If you are onboarding servers and Windows Defender Antivirus is not the active antimalware on your servers, you shouldn't uninstall Windows Defender Antivirus. You'll need to configure it to run on passive mode. For more information, see [Onboard servers](configure-server-endpoints-windows-defender-advanced-threat-protection.md).
+
+
For more information, see [Windows Defender Antivirus compatibility](../windows-defender-antivirus/windows-defender-antivirus-compatibility.md).
## In this section
Topic | Description
:---|:---
-[Configure client endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) | You'll need to configure endpoints for it to report to the Windows Defender ATP service. Learn about the tools and methods you can use to configure endpoints in your enterprise.
-[Configure non-Windows endpoints](configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md) | Windows Defender ATP provides a centralized security operations experience for Windows as well as non-Windows platforms. You'll be able to see alerts from various supported operating systems (OS) in the Windows Defender ATP portal and better protect your organization's network. This experience leverages on a third-party security products sensor data.
-[Configure server endpoints](configure-server-endpoints-windows-defender-advanced-threat-protection.md) | Onboard Windows Server 2012 R2 and Windows Server 2016 to Windows Defender ATP
+[Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md) | You'll need to onboard machines for it to report to the Windows Defender ATP service. Learn about the tools and methods you can use to configure machines in your enterprise.
+[Onboard servers](configure-server-endpoints-windows-defender-advanced-threat-protection.md) | Onboard Windows Server 2012 R2 and Windows Server 2016 to Windows Defender ATP
+[Onboard non-Windows machines](configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md) | Windows Defender ATP provides a centralized security operations experience for Windows as well as non-Windows platforms. You'll be able to see alerts from various supported operating systems (OS) in the Windows Defender ATP portal and better protect your organization's network. This experience leverages on a third-party security products' sensor data.
+[Run a detection test on a newly onboarded machine](run-detection-test-windows-defender-advanced-threat-protection.md) | Run a script on a newly onboarded machine to verify that it is properly reporting to the Windows Defender ATP service.
[Configure proxy and Internet settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md)| Enable communication with the Windows Defender ATP cloud service by configuring the proxy and Internet connectivity settings.
[Troubleshoot onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) | Learn about resolving issues that might arise during onboarding.
diff --git a/windows/security/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md
index 14d4fc1ac4..d8e518f47c 100644
--- a/windows/security/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md
@@ -1,16 +1,16 @@
---
title: Windows Defender Advanced Threat Protection portal overview
description: Use the Windows Defender ATP portal to monitor your enterprise network and assist in responding to alerts to potential advanced persistent threat (APT) activity or data breaches.
-keywords: Windows Defender ATP portal, portal, cybersecurity threat intelligence, dashboard, alerts queue, machines list, preferences setup, endpoint management, advanced attacks
+keywords: Windows Defender ATP portal, portal, cybersecurity threat intelligence, dashboard, alerts queue, machines list, settings, machine management, advanced attacks
search.product: eADQiWindows 10XVcnh
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
ms.author: macapara
-author: DulceMV
+author: mjcaparas
ms.localizationpriority: high
-ms.date: 03/12/2018
+ms.date: 04/24/2018
---
# Windows Defender Advanced Threat Protection portal overview
@@ -23,7 +23,7 @@ ms.date: 03/12/2018
- Windows 10 Pro Education
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-
+[!include[Prerelease information](prerelease.md)]
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-portaloverview-abovefoldlink)
@@ -37,29 +37,29 @@ You can use the [Windows Defender ATP portal](https://securitycenter.windows.com
## Windows Defender ATP portal
When you open the portal, you’ll see the main areas of the application:
- 
+ 
- (1) Navigation pane
- (2) Main portal
-- (3) Search, Feedback, Settings, Help and support
+- (3) Search, Community center, Time settings, Help and support, Feedback
> [!NOTE]
-> Malware related detections will only appear if your endpoints are using [Windows Defender Antivirus](https://technet.microsoft.com/library/mt622091(v=vs.85).aspx) as the default real-time protection antimalware product.
+> Malware related detections will only appear if your machines are using [Windows Defender Antivirus](https://technet.microsoft.com/library/mt622091(v=vs.85).aspx) as the default real-time protection antimalware product.
You can navigate through the portal using the menu options available in all sections. Refer to the following table for a description of each section.
Area | Description
:---|:---
-(1) Navigation pane | Use the navigation pane to move between the **Dashboards**, **Alerts queue**, **Machines list**, **Service health**, **Preferences setup**, and **Endpoint management**.
-**Dashboards** | Allows you to access the Security operations or the Secure score dashboard.
-**Alerts queue** | Allows you to view separate queues: new, in progress, resolved alerts, alerts assigned to you, and suppression rules.
+(1) Navigation pane | Use the navigation pane to move between the **Dashboards**, **Alerts queue**, **Automated investigations**, **Machines list**, **Service health**, **Advanced hunting**, and **Settings**.
+**Dashboards** | Access the Security operations, the Secure Score, or Threat analytics dashboard.
+**Alerts** | View separate queues of new, in progress, resolved alerts, alerts assigned to you.
+**Automated investigations** | Displays a list of automated investigations that's been conducted in the network, the status of each investigation and other details such as when the investigation started and the duration of the investigation.
**Machines list** | Displays the list of machines that are onboarded to Windows Defender ATP, some information about them, and the corresponding number of alerts.
**Service health** | Provides information on the current status of the Window Defender ATP service. You'll be able to verify that the service health is healthy or if there are current issues.
-**Preferences setup** | Shows the settings you selected during onboarding and lets you update your industry preferences and retention policy period. You can also set other configuration settings such as email notifications, activate the preview experience, enable or turn off advanced features, SIEM integration, threat intel API, build Power BI reports, and set baselines for the Secure score dashboard.
-**Endpoint management** | Provides access to endpoints such as clients and servers. Allows you to download the onboarding configuration package for endpoints. It also provides access to endpoint offboarding.
-**Community center** | Access the Community center to learn, collaborate, and share experiences about the product.
-(2) Main portal| Main area where you will see the different views such as the Dashboards, Alerts queue, and Machines list.
-(3) Search bar, Feedback, Settings, Help and support | **Search** - Provides access to the search bar where you can search for file, IP, machine, URL, and user. Displays the Search box: the drop-down list allows you to select the entity type and then enter the search query text. **Feedback** - Access the feedback button to provide comments about the portal. **Settings** - Gives you access to the configuration settings where you can set time zones and view license information. **Help and support** - Gives you access to the Windows Defender ATP guide, Microsoft support, and Premier support.
+**Advanced hunting** | Advanced hunting allows you to proactively hunt and investigate across your organization using a powerful search and query tool.
+**Settings** | Shows the settings you selected during onboarding and lets you update your industry preferences and retention policy period. You can also set other configuration settings such as email notifications, activate the preview experience, enable or turn off advanced features, SIEM integration, threat intel API, build Power BI reports, and set baselines for the Secure Score dashboard.
+**(2) Main portal** | Main area where you will see the different views such as the Dashboards, Alerts queue, and Machines list.
+**(3) Search, Community center, Time settings, Help and support, Feedback** | **Search** - Provides access to the search bar where you can search for file, IP, machine, URL, and user. Displays the Search box: the drop-down list allows you to select the entity type and then enter the search query text. **Community center** -Access the Community center to learn, collaborate, and share experiences about the product. **Time settings** - Gives you access to the configuration settings where you can set time zones and view license information. **Help and support** - Gives you access to the Windows Defender ATP guide, Microsoft support, and Premier support. **Feedback** - Access the feedback button to provide comments about the portal.
## Windows Defender ATP icons
The following table provides information on the icons used all throughout the portal:
@@ -97,6 +97,20 @@ Icon | Description
| Memory allocation
| Process injection
| Powershell command run
+ | Community center
+ | Notifications
+ | Automated investigation - no threats found
+ | Automated investigation - failed
+ | Automated investigation - partially investigated
+ | Automated investigation - terminated by system
+ | Automated investigation - pending
+ | Automated investigation - running
+ | Automated investigation - remediated
+ | Automated investigation - partially remediated
-## Related topic
-[Use the Windows Defender Advanced Threat Protection portal](use-windows-defender-advanced-threat-protection.md)
\ No newline at end of file
+
+## Related topics
+- [Understand the Windows Defender Advanced Threat Protection portal](use-windows-defender-advanced-threat-protection.md)
+- [View the Security operations dashboard](security-operations-dashboard-windows-defender-advanced-threat-protection.md)
+- [View the Secure Score dashboard and improve your secure score](secure-score-dashboard-windows-defender-advanced-threat-protection.md)
+- [View the Threat analytics dashboard and take recommended mitigation actions](threat-analytics-dashboard-windows-defender-advanced-threat-protection.md)
\ No newline at end of file
diff --git a/windows/security/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md
index 36517f85e2..ecb07ccd1e 100644
--- a/windows/security/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md
@@ -1,7 +1,7 @@
---
title: Create and build Power BI reports using Windows Defender ATP data
description: Get security insights by creating and building Power BI dashboards using data from Windows Defender ATP and other data sources.
-keywords: preferences setup, power bi, power bi service, power bi desktop, reports, dashboards, connectors , security insights, mashup
+keywords: settings, power bi, power bi service, power bi desktop, reports, dashboards, connectors , security insights, mashup
search.product: eADQiWindows 10XVcnh
ms.prod: w10
ms.mktglfcycl: deploy
@@ -9,7 +9,7 @@ ms.sitesec: library
ms.pagetype: security
author: mjcaparas
localizationpriority: high
-ms.date: 03/16/2018
+ms.date: 04/24/2018
---
# Create and build Power BI reports using Windows Defender ATP data
@@ -32,24 +32,26 @@ Windows Defender ATP supports the use of Power BI data connectors to enable you
Data connectors integrate seamlessly in Power BI, and make it easy for power users to query, shape and combine data to build reports and dashboards that meet the needs of your organization.
You can easily get started by:
-- Creating a dashboard on the Power BI service:
- - From the Windows Defender ATP portal or
- - From the Power BI portal
+- Creating a dashboard on the Power BI service
- Building a custom dashboard on Power BI Desktop and tweaking it to fit the visual analytics and reporting requirements of your organization
You can access these options from the Windows Defender ATP portal. Both the Power BI service and Power BI Desktop are supported.
-## Create a Power BI dashboard from the Windows Defender ATP portal
+## Create a Windows Defender ATP dashboard on Power BI service
Windows Defender ATP makes it easy to create a Power BI dashboard by providing an option straight from the portal.
-1. In the navigation pane, select **Preferences setup** > **Power BI reports**.
-
- 
+1. In the navigation pane, select **Settings** > **General** > **Power BI reports**.
-2. Click **Create dashboard**. You'll see a notification that things are being loaded.
+2. Click **Create dashboard**.
+
+ 
+
+ You'll see a notification that things are being loaded.
+ >[!NOTE]
+ >Loading your data in the Power BI service can take a few minutes.
3. Specify the following details:
- **extensionDataSourceKind**: WDATPConnector
@@ -62,7 +64,7 @@ Windows Defender ATP makes it easy to create a Power BI dashboard by providing a
-5. Click **Accept**. Power BI service will start downloading your Windows Defender ATP data from Microsoft Graph. After a successful login, you'll see a notification that data is being imported:
+5. Click **Accept**. Power BI service will start downloading your Windows Defender ATP data from Microsoft Graph. After a successful login, you'll see a notification that data is being imported:
@@ -78,7 +80,6 @@ Windows Defender ATP makes it easy to create a Power BI dashboard by providing a
For more information, see [Create a Power BI dashboard from a report](https://powerbi.microsoft.com/en-us/documentation/powerbi-service-create-a-dashboard/).
-
## Create a Power BI dashboard from the Power BI portal
1. Login to [Power BI](https://powerbi.microsoft.com/).
@@ -126,11 +127,11 @@ You can create a custom dashboard in Power BI Desktop to create visualizations t
### Before you begin
1. Make sure you use Power BI Desktop June 2017 and above. [Download the latest version](https://powerbi.microsoft.com/en-us/desktop/).
-2. In the Windows Defender ATP portal navigation pane, select **Preferences setup** > **Power BI reports**.
+2. In the navigation pane, select **Settings** > **General** > **Power BI reports**.
3. Click **Download connector** to download the WDATPPowerBI.zip file and extract it.
- 
+ 
4. Create a new directory `Microsoft Power BI Desktop\Custom Connectors` under the user's Documents folder.
@@ -154,12 +155,14 @@ After completing the steps in the Before you begin section, you can proceed with
1. Open WDATPPowerBI.pbit from the zip with Power BI Desktop.
-2. If this is the first time you’re using Power BI with Windows Defender ATP, you’ll need to sign in and give consent to Windows Defender ATP Power BI app. By providing consent, you’re allowing Windows Defender ATP Power BI to sign in and read your profile, access your data, and be used for report refresh.
+2. If this is the first time you’re using Power BI with Windows Defender ATP, you’ll need to sign in and give consent to Windows Defender ATP Power BI app. By providing consent, you’re allowing Windows Defender ATP Power BI to sign in and read your profile, and access your data.
- 
+ 
3. Click **Accept**. Power BI Desktop will start downloading your Windows Defender ATP data from Microsoft Graph. When all data has been downloaded, you can proceed to customize your reports.
+
+
## Mashup Windows Defender ATP data with other data sources
You can use Power BI Desktop to analyse data from Windows Defender ATP and mash that data up with other data sources to gain better security perspective in your organization.
@@ -173,9 +176,9 @@ You can use Power BI Desktop to analyse data from Windows Defender ATP and mash
-4. If this is the first time you’re using Power BI with Windows Defender ATP, you’ll need to sign in and give consent to Windows Defender ATP Power BI app. By providing consent, you’re allowing Windows Defender ATP Power BI to sign in and read your profile, access your data, and be used for report refresh.
+4. If this is the first time you’re using Power BI with Windows Defender ATP, you’ll need to sign in and give consent to Windows Defender ATP Power BI app. By providing consent, you’re allowing Windows Defender ATP Power BI to sign in and read your profile, and access your data.
- 
+ 
5. Click **Accept**. Power BI Desktop will start downloading your Windows Defender ATP data from Microsoft Graph. When all data has been downloaded, you can proceed to customize your reports.
@@ -187,13 +190,14 @@ You can use Power BI Desktop to analyse data from Windows Defender ATP and mash
8. Add visuals and select fields from the available data sources.
-## Related topics
-- [Update general settings in Windows Defender ATP](general-settings-windows-defender-advanced-threat-protection.md)
-- [Turn on advanced features in Windows Defender ATP](advanced-features-windows-defender-advanced-threat-protection.md)
-- [Turn on the preview experience in Windows Defender ATP](preview-settings-windows-defender-advanced-threat-protection.md)
-- [Configure email notifications in Windows Defender ATP](configure-email-notifications-windows-defender-advanced-threat-protection.md)
-- [Enable SIEM integration in Windows Defender ATP](enable-siem-integration-windows-defender-advanced-threat-protection.md)
-- [Enable the custom threat intelligence API in Windows Defender ATP](enable-custom-ti-windows-defender-advanced-threat-protection.md)
+## Using the Power BI reports
+There are a couple of tabs on the report that's generated:
+
+- Machine and alerts
+- Investigation results and action center
+- Secure Score
+
+In general, if you know of a specific threat name, CVE, or KB, you can identify machines with unpatched vulnerabilities that might be leveraged by threats. This report also helps you determine whether machine-level mitigations are configured correctly on the machines and prioritize those that might need attention.
diff --git a/windows/security/threat-protection/windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection.md
index 38a4ba668d..f08533a767 100644
--- a/windows/security/threat-protection/windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/16/2017
+ms.date: 04/24/2018
---
# PowerShell code examples for the custom threat intelligence API
@@ -23,7 +23,7 @@ ms.date: 10/16/2017
- Windows 10 Pro Education
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-
+[!include[Prerelease information](prerelease.md)]
This article provides PowerShell code examples for using the custom threat intelligence API.
@@ -38,7 +38,7 @@ These code examples demonstrate the following tasks:
## Step 1: Obtain an Azure AD access token
The following example demonstrates how to obtain an Azure AD access token that you can use to call methods in the custom threat intelligence API. After you obtain a token, you have 60 minutes to use this token in calls to the custom threat intelligence API before the token expires. After the token expires, you can generate a new token.
-Replace the *authUrl*, *clientid*, and *clientSecret* values with the ones you got from **Preferences settings** page in the portal:
+Replace the *authUrl*, *clientid*, and *clientSecret* values with the ones you got from **Settings** page in the portal:
```powershell
$authUrl = 'Your Authorization URL'
@@ -180,8 +180,8 @@ $ioc =
## Related topics
- [Understand threat intelligence concepts](threat-indicator-concepts-windows-defender-advanced-threat-protection.md)
-- [Create custom alerts using the threat intelligence API](custom-ti-api-windows-defender-advanced-threat-protection.md)
- [Enable the custom threat intelligence API in Windows Defender ATP](enable-custom-ti-windows-defender-advanced-threat-protection.md)
+- [Create custom alerts using the threat intelligence API](custom-ti-api-windows-defender-advanced-threat-protection.md)
- [Python code examples for the custom threat intelligence API](python-example-code-windows-defender-advanced-threat-protection.md)
- [Experiment with custom threat intelligence alerts](experiment-custom-ti-windows-defender-advanced-threat-protection.md)
- [Troubleshoot custom threat intelligence issues](troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md)
diff --git a/windows/security/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection.md
index a21cd910cd..72dd86675c 100644
--- a/windows/security/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection.md
@@ -1,7 +1,7 @@
---
-title: Configure Windows Defender ATP preferences settings
-description: Use the preferences setup to configure and update your preferences settings such as enabling advanced features, preview experience, email notifications, or custom threat intelligence.
-keywords: preferences settings, settings, advanced features, preview experience, email notifications, custom threat intelligence
+title: Configure Windows Defender ATP settings
+description: Use the settings page to configure general settings, permissions, apis, and rules.
+keywords: settings, general settings, permissions, apis, rules
search.product: eADQiWindows 10XVcnh
ms.prod: w10
ms.mktglfcycl: deploy
@@ -10,9 +10,9 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/16/2017
+ms.date: 04/24/2018
---
-# Configure Windows Defender ATP preferences settings
+# Configure Windows Defender ATP settings
**Applies to:**
@@ -22,20 +22,19 @@ ms.date: 10/16/2017
- Windows 10 Pro Education
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-
+[!include[Prerelease information](prerelease.md)]
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-prefsettings-abovefoldlink)
-Use the **Preferences setup** menu to modify general settings, advanced features, enable the preview experience, email notifications, and the custom threat intelligence feature.
+Use the **Settings** menu to modify general settings, advanced features, enable the preview experience, email notifications, and the custom threat intelligence feature.
## In this section
Topic | Description
:---|:---
-[Update general settings](general-settings-windows-defender-advanced-threat-protection.md) | Modify your general settings that were previously defined as part of the onboarding process.
-[Enable advanced features](advanced-features-windows-defender-advanced-threat-protection.md)| Enable features such as **Block file** and other features that require integration with other products.
-[Enable the preview experience](preview-settings-windows-defender-advanced-threat-protection.md) | Allows you to turn on preview features so you can try upcoming features.
-[Configure email notifications](configure-email-notifications-windows-defender-advanced-threat-protection.md) | Enables you to configure and identify a group of individuals who will immediately be informed of new alerts through email notifications.
-[Enable SIEM integration](enable-siem-integration-windows-defender-advanced-threat-protection.md) | Enable security information and event management (SIEM) integration to pull alerts from the Windows Defender ATP portal using your SIEM solution.
-[Enable Threat intel API](enable-custom-ti-windows-defender-advanced-threat-protection.md) | Before you can create custom threat intelligence (TI) using REST API, you'll need to set up the custom threat intelligence application.
-[Create and build Power BI reports](powerbi-reports-windows-defender-advanced-threat-protection.md) | Get security insights by creating and building Power BI dashboards using data from Windows Defender ATP and other data sources.
+[Update general settings](data-retention-settings-windows-defender-advanced-threat-protection.md) | Modify your general settings that were previously defined as part of the onboarding process.
+Permissions | Manage portal access using RBAC as well as machine groups.
+APIs | Enable the threat intel and SIEM integration.
+Rules | Configure suppressions rules and automation settings.
+Machine management | Onboard and offboard machines.
+
diff --git a/windows/security/threat-protection/windows-defender-atp/preview-settings-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/preview-settings-windows-defender-advanced-threat-protection.md
index b6de75210b..61315574f8 100644
--- a/windows/security/threat-protection/windows-defender-atp/preview-settings-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/preview-settings-windows-defender-advanced-threat-protection.md
@@ -1,7 +1,7 @@
---
title: Turn on the preview experience in Windows Defender ATP
description: Turn on the preview experience in Windows Defender Advanced Threat Protection to try upcoming features.
-keywords: advanced features, preferences setup, block file
+keywords: advanced features, settings, block file
search.product: eADQiWindows 10XVcnh
ms.prod: w10
ms.mktglfcycl: deploy
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/16/2017
+ms.date: 04/24/2018
---
# Turn on the preview experience in Windows Defender ATP
@@ -22,21 +22,21 @@ ms.date: 10/16/2017
- Windows 10 Pro Education
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-
+[!include[Prerelease information](prerelease.md)]
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-previewsettings-abovefoldlink)
Turn on the preview experience setting to be among the first to try upcoming features.
-1. In the navigation pane, select **Preferences setup** > **Preview experience**.
+1. In the navigation pane, select **Settings** > **Preview experience**.
- 
+ 
2. Toggle the setting between **On** and **Off** and select **Save preferences**.
## Related topics
-- [Update general settings in Windows Defender ATP](general-settings-windows-defender-advanced-threat-protection.md)
+- [Update general settings in Windows Defender ATP](data-retention-settings-windows-defender-advanced-threat-protection.md)
- [Turn on advanced features in Windows Defender ATP](advanced-features-windows-defender-advanced-threat-protection.md)
- [Configure email notifications in Windows Defender ATP](configure-email-notifications-windows-defender-advanced-threat-protection.md)
- [Enable SIEM integration in Windows Defender ATP](enable-siem-integration-windows-defender-advanced-threat-protection.md)
diff --git a/windows/security/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md
index a05e77c9a2..63395308fe 100644
--- a/windows/security/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 11/30/2017
+ms.date: 04/24/2018
---
# Windows Defender ATP preview features
@@ -23,31 +23,31 @@ ms.date: 11/30/2017
- Windows 10 Pro Education
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-
+[!include[Prerelease information](prerelease.md)]
The Windows Defender ATP service is constantly being updated to include new feature enhancements and capabilities.
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-preview-abovefoldlink)
+
Learn about new features in the Windows Defender ATP preview release and be among the first to try upcoming features by turning on the preview experience.
You'll have access to upcoming features which you can provide feedback on to help improve the overall experience before features are generally available.
Turn on the preview experience setting to be among the first to try upcoming features.
-1. In the navigation pane, select **Preferences setup** > **Preview experience**.
-
- 
+1. In the navigation pane, select **Settings** > **General** > **Advanced features** > **Preview features**.
2. Toggle the setting between **On** and **Off** and select **Save preferences**.
## Preview features
The following features are included in the preview release:
-- [Configure server endpoints](configure-server-endpoints-windows-defender-advanced-threat-protection.md)
+- [Onboard servers](configure-server-endpoints-windows-defender-advanced-threat-protection.md)
Windows Defender ATP supports the onboarding of the following servers:
- Windows Server 2012 R2
- Windows Server 2016
+ - Windows Server, version 1803
- [Create and build Power BI reports using Windows Defender ATP data](powerbi-reports-windows-defender-advanced-threat-protection.md)
Windows Defender ATP supports the use of Power BI data connectors to enable you to connect and access Windows Defender ATP data using Microsoft Graph.
@@ -55,12 +55,6 @@ Windows Defender ATP supports the use of Power BI data connectors to enable you
- [Use the Windows Defender ATP exposed APIs](exposed-apis-windows-defender-advanced-threat-protection.md)
Windows Defender ATP exposes much of the available data and actions using a set of programmatic APIs that are part of the Microsoft Intelligence Security Graph. Those APIs will enable you, to automate workflows and innovate based on Windows Defender ATP capabilities.
-- [Configure non-Windows endpoints](configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md)
-Windows Defender ATP provides a centralized security operations experience for Windows as well as non-Windows platforms. You'll be able to see alerts from various supported operating systems (OS) in the Windows Defender ATP portal and better protect your organization's network. This experience leverages on a third-party security products' sensor data.
-
-- [Access the Windows Defender ATP Community Center](community-windows-defender-advanced-threat-protection.md)
-The Windows Defender ATP Community Center is a place where community members can learn, collaborate, and share experiences about the product. Access and join the community to learn and interact with other members on product specific information.
-
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-preview-belowfoldlink)
diff --git a/windows/security/threat-protection/windows-defender-atp/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md
index 82d802c5f9..441d1895d8 100644
--- a/windows/security/threat-protection/windows-defender-atp/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/16/2017
+ms.date: 04/24/2018
---
# Pull Windows Defender ATP alerts using REST API
@@ -23,7 +23,7 @@ ms.date: 10/16/2017
- Windows 10 Pro Education
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-
+[!include[Prerelease information](prerelease.md)]
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-pullalerts-abovefoldlink)
@@ -67,18 +67,18 @@ POST /72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/token HTTP/1.1
Host: login.microsoftonline.com
Content-Type: application/x-www-form-urlencoded
-resource=https%3A%2F%2FWDATPAlertExport.Seville.onmicrosoft.com&client_id=35e0f735-5fe4-4693-9e68-3de80f1d3745&client_secret=IKXc6PxB2eoFNJ%2FIT%2Bl2JZZD9d9032VXz6Ul3D2WyUQ%3D&grant_type=client_credentials
+resource=https%3A%2F%2Fgraph.windows.net&client_id=35e0f735-5fe4-4693-9e68-3de80f1d3745&client_secret=IKXc6PxB2eoFNJ%2FIT%2Bl2JZZD9d9032VXz6Ul3D2WyUQ%3D&grant_type=client_credentials
```
The response will include an access token and expiry information.
```json
{
- "token type": "Bearer",
- "expires in": "3599"
+ "token_type": "Bearer",
+ "expires_in": "3599"
"ext_expires_in": "0",
"expires_on": "1488720683",
"not_before": "1488720683",
- "resource": "https://WDATPAlertExport.Seville.onmicrosoft.com",
+ "resource": "https://graph.windows.net",
"access_token":"eyJ0eXaioJJOIneiowiouqSuzNiZ345FYOVkaJL0625TueyaJasjhIjEnbMlWqP..."
}
```
@@ -103,7 +103,9 @@ Use optional query parameters to specify and control the amount of data returned
Name | Value| Description
:---|:---|:---
-DateTime?sinceTimeUtc | string | Defines the time alerts are retrieved from based from `LastProccesedTimeUtc` time to current time.
**NOTE**: When not specified, all alerts generated in the last two hours are retrieved.
+DateTime?sinceTimeUtc | string | Defines the lower time bound alerts are retrieved from, based on field:
`LastProccesedTimeUtc`
The time range will be: from sinceTimeUtc time to current time.
**NOTE**: When not specified, all alerts generated in the last two hours are retrieved.
+DateTime?untilTimeUtc | string | Defines the upper time bound alerts are retrieved.
The time range will be: from `sinceTimeUtc` time to `untilTimeUtc` time.
**NOTE**: When not specified, the default value will be the current time.
+string ago | string | Pulls alerts in the following time range: from `(current_time - ago)` time to `current_time` time.
Value should be set according to **ISO 8601** duration format
E.g. `ago=PT10M` will pull alerts received in the last 10 minutes.
int?limit | int | Defines the number of alerts to be retrieved. Most recent alerts will be retrieved based on the number defined.
**NOTE**: When not specified, all alerts available in the time range will be retrieved.
### Request example
@@ -117,7 +119,7 @@ Authorization: Bearer
This team usually triages and investigates alerts contained within their geolocation and escalates to Tier 2 in cases where an active remediation is required.
+Tier 2 | **Regional security operations team**
This team can see all the machines for their region and perform remediation actions.
+Tier 3 | **Global security operations team**
This team consists of security experts and are authorized to see and perform all actions from the portal.
+
+Windows Defender ATP RBAC is designed to support your tier- or role-based model of choice and gives you granular control over what roles can see, machines they can access, and actions they can take. The RBAC framework is centered around the following controls:
+
+- **Control who can take specific action**
+ - Create custom roles and control what Windows Defender ATP capabilities they can access with granularity.
+
+- **Control who can see information on specific machine group or groups**
+ - [Create machine groups](machine-groups-windows-defender-advanced-threat-protection.md) by specific criteria such as names, tags, domains, and others, then grant role access to them using a specific Azure AD user group.
+
+To implement role-based access, you'll need to define admin roles, assign corresponding permissions, and assign Azure Active Directory (Azure AD) user groups assigned to the roles.
+
+
+### Before you begin
+Before using RBAC, it's important that you understand the roles that can grant permissions and the consequences of turning on RBAC.
+
+
+> [!WARNING]
+> Before enabling the feature, it's important that you have a Global Administrator role or Security Administrator role in Azure AD and that you have your Azure AD groups ready to reduce the risk of being locked out of the portal.
+
+When you first log in to the Windows Defender ATP portal, you're granted either full access or read only access. Full access rights are granted to users with Security Administrator or Global Administrator roles in Azure AD. Read only access is granted to users with a Security Reader role in Azure AD.
+
+Someone with a Windows Defender ATP Global administrator role has unrestricted access to all machines, regardless of their machine group association and the Azure AD user groups assignments
+
+> [!WARNING]
+> Initially, only those with Azure AD Global Administrator or Security Administrator rights will be able to create and assign roles in the Windows Defender ATP portal, therefore, having the right groups ready in Azure AD is important.
+>
+> **Turning on role-based access control will cause users with read-only permissions (for example, users assigned to Azure AD Security reader role) to lose access until they are assigned to a role.**
+>
+>Users with admin permissions are automatically assigned the default built-in Windows Defender ATP global administrator role with full permissions. After opting in to use RBAC, you can assign additional users that are not Azure AD Global or Security Administrators to the Windows Defender ATP global administrator role.
+>
+> After opting in to use RBAC, you cannot revert to the initial roles as when you first logged into the portal.
+
+## Create roles and assign the role to a group
+
+1. In the navigation pane, select **Settings > Role based access control > Roles**.
+
+2. Click **Add role**.
+
+3. Enter the role name, description, and active permissions you’d like to assign to the role.
+
+ - **Role name**
+
+ - **Description**
+
+ - **Active permissions**
+ - **View data** - Users can view information in the portal.
+ - **Investigate alerts** - Users can manage alerts, initiate automated investigations, collect investigation packages, manage machine tags, and export machine timeline.
+ - **Approve or take action** - Users can take response actions and approve or dismiss pending remediation actions.
+ - **Manage system settings** - Users can configure settings, SIEM and threat intel API settings, advanced settings, preview features, and automated file uploads.
+
+4. Click **Next** to assign the role to an Azure AD group.
+
+5. Use the filter to select the Azure AD group that you’d like to add to this role.
+
+6. Click **Save and close**.
+
+7. Apply the configuration settings.
+
+## Edit roles
+
+1. Select the role you'd like to edit.
+
+2. Click **Edit**.
+
+3. Modify the details or the groups that the role is a part of.
+
+4. Click **Save and close**.
+
+## Delete roles
+
+1. Select the role row you'd like to delete.
+
+2. Click the drop-down button and select **Delete role**.
+
+## Related topic
+- [Create and manage machine groups in Windows Defender ATP](machine-groups-windows-defender-advanced-threat-protection.md)
\ No newline at end of file
diff --git a/windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md
index c3162d20c2..f3fa656be3 100644
--- a/windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 03/06/2018
+ms.date: 04/24/2018
---
# Take response actions on a file
@@ -57,23 +57,25 @@ The action takes effect on machines with Windows 10, version 1703 or later, wher
- **Search box** - select File from the drop–down menu and enter the file name
2. Open the **Actions menu** and select **Stop and Quarantine File**.
+
-3. Type a comment and select **Yes, stop and quarantine** to take action on the file.
+3. Specify a reason, then click **Yes, stop and quarantine**.
+
- The Action center shows the submission information:
+ The Action center shows the submission information:
- - **Submission time** - Shows when the action was submitted.
- - **Success** - Shows the number of machines where the file has been stopped and quarantined.
- - **Failed** - Shows the number of machines where the action failed and details about the failure.
- - **Pending** - Shows the number of machines where the file is yet to be stopped and quarantined from. This can take time for cases when the machine is offline or not connected to the network.
+ - **Submission time** - Shows when the action was submitted.
+ - **Success** - Shows the number of machines where the file has been stopped and quarantined.
+ - **Failed** - Shows the number of machines where the action failed and details about the failure.
+ - **Pending** - Shows the number of machines where the file is yet to be stopped and quarantined from. This can take time for cases when the machine is offline or not connected to the network.
4. Select any of the status indicators to view more information about the action. For example, select **Failed** to see where the action failed.
**Notification on machine user**:
-When the file is being removed from an endpoint, the following notification is shown:
+When the file is being removed from a machine, the following notification is shown:
@@ -89,7 +91,7 @@ For prevalent files in the organization, a warning is shown before an action is
## Remove file from quarantine
You can roll back and remove a file from quarantine if you’ve determined that it’s clean after an investigation. Run the following command on each machine where the file was quarantined.
-1. Open an elevated command–line prompt on the endpoint:
+1. Open an elevated command–line prompt on the machine:
a. Go to **Start** and type cmd.
@@ -116,14 +118,27 @@ You can prevent further propagation of an attack in your organization by banning
### Enable the block file feature
-1. In the navigation pane, select **Preference Setup** > **Advanced features** > **Block file**.
+Before you can block files, you'll need to enable the feature.
+
+1. In the navigation pane, select **Settings** > **Advanced features** > **Block file**.
2. Toggle the setting between **On** and **Off** and select **Save preferences**.
+
+ 
+
+### Block a file
+1. Select the file you want to block. You can select a file from any of the following views or use the Search box:
- 
+ - **Alerts** - click the corresponding links from the Description or Details in the Artifact timeline
+ - **Search box** - select File from the drop–down menu and enter the file name
+2. Open the **Actions menu** and select **Block**.
+
+ 
-3. Type a comment and select **Yes, block file** to take action on the file.
+3. Specify a reason and select **Yes, block file** to take action on the file.
+
+ 
The Action center shows the submission information:
@@ -135,7 +150,7 @@ You can prevent further propagation of an attack in your organization by banning
When the file is blocked, there will be a new event in the machine timeline.
**Notification on machine user**:
-When a file is being blocked on the endpoint, the following notification is displayed to inform the user that the file was blocked:
+When a file is being blocked on the machine, the following notification is displayed to inform the user that the file was blocked:
@@ -150,7 +165,6 @@ For prevalent files in the organization, a warning is shown before an action is
1. Select the file you want to remove from the blocked list. You can select a file from any of the following views or use the Search box:
- **Alerts** - Click the file links from the Description or Details in the Artifact timeline
- - **Machines list** - Click the file links in the Description or Details columns in the Observed on machine section
- **Search box** - Select File from the drop–down menu and enter the file name
2. Open the **Actions** menu and select **Remove file from blocked list**.
@@ -235,7 +249,7 @@ If you encounter a problem when trying to submit a file, try each of the followi
3. You can wait a short while and try to submit the file again, in case the queue is full or there was a temporary connection or communication error.
4. Verify the policy setting enables sample collection and try to submit the file again.
- a. Change the following registry entry and values to change the policy on specific endpoints:
+ a. Change the following registry entry and values to change the policy on specific machines:
```
HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection
Value = 0 – block sample collection
@@ -247,5 +261,5 @@ HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection
> [!NOTE]
> If the value *AllowSampleCollection* is not available, the client will allow sample collection by default.
-## Related topics
+## Related topic
- [Take response actions on a machine](respond-machine-alerts-windows-defender-advanced-threat-protection.md)
diff --git a/windows/security/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md
index adcfd622e0..ac9d6c02de 100644
--- a/windows/security/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md
@@ -73,6 +73,7 @@ The package contains the following folders:
The Action center shows the submission information:
+
- **Submission time** - Shows when the action was submitted.
@@ -247,5 +248,5 @@ All other related details are also shown, for example, submission time, submitti
-## Related topics
+## Related topic
- [Take response actions on a file](respond-file-alerts-windows-defender-advanced-threat-protection.md)
diff --git a/windows/security/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection.md
index 6092b45364..f4a083f835 100644
--- a/windows/security/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection.md
@@ -38,15 +38,3 @@ Topic | Description
:---|:---
[Take response actions on a machine](respond-machine-alerts-windows-defender-advanced-threat-protection.md)| Isolate machines or collect an investigation package.
[Take response actions on a file](respond-file-alerts-windows-defender-advanced-threat-protection.md)| Stop and quarantine files or block a file from your network.
-
-## Related topics
-- [View the Windows Defender Advanced Threat Protection Security operations dashboard](dashboard-windows-defender-advanced-threat-protection.md)
-- [View and organize the Windows Defender Advanced Threat Protection Alerts queue ](alerts-queue-windows-defender-advanced-threat-protection.md)
-- [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md)
-- [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md)
-- [Investigate an IP address associated with a Windows Defender ATP alert](investigate-ip-windows-defender-advanced-threat-protection.md)
-- [Investigate a domain associated with a Windows Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md)
-- [View and organize the Windows Defender ATP Machines list](machines-view-overview-windows-defender-advanced-threat-protection.md)
-- [Investigate machines in the Windows Defender ATP Machines list](investigate-machines-windows-defender-advanced-threat-protection.md)
-- [Investigate a user account in Windows Defender ATP](investigate-user-windows-defender-advanced-threat-protection.md)
-- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md)
diff --git a/windows/security/threat-protection/windows-defender-atp/run-detection-test-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/run-detection-test-windows-defender-advanced-threat-protection.md
index 9be70be191..f74f0543b9 100644
--- a/windows/security/threat-protection/windows-defender-atp/run-detection-test-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/run-detection-test-windows-defender-advanced-threat-protection.md
@@ -1,7 +1,7 @@
---
-title: Run a detection test on a newly onboarded Windows Defender ATP endpoint
-description: Run the detection script on a newly onboarded endpoint to verify that it is properly onboarded to the Windows Defender ATP service.
-keywords: detection test, detection, powershell, script, verify, onboarding, windows defender advanced threat protection onboarding, clients, servers, endpoint, test
+title: Run a detection test on a newly onboarded Windows Defender ATP machine
+description: Run the detection script on a newly onboarded machine to verify that it is properly onboarded to the Windows Defender ATP service.
+keywords: detection test, detection, powershell, script, verify, onboarding, windows defender advanced threat protection onboarding, clients, servers, test
search.product: eADQiWindows 10XVcnh
ms.prod: w10
ms.mktglfcycl: deploy
@@ -13,7 +13,7 @@ ms.localizationpriority: high
ms.date: 11/06/2017
---
-# Run a detection test on a newly onboarded Windows Defender ATP endpoint
+# Run a detection test on a newly onboarded Windows Defender ATP machine
**Applies to:**
@@ -24,9 +24,9 @@ ms.date: 11/06/2017
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-Run the following PowerShell script on a newly onboarded endpoint to verify that it is properly reporting to the Windows Defender ATP service.
+Run the following PowerShell script on a newly onboarded machine to verify that it is properly reporting to the Windows Defender ATP service.
-1. Open an elevated command-line prompt on the endpoint and run the script:
+1. Open an elevated command-line prompt on the machine and run the script:
a. Go to **Start** and type **cmd**.
@@ -40,8 +40,8 @@ Run the following PowerShell script on a newly onboarded endpoint to verify that
powershell.exe -NoExit -ExecutionPolicy Bypass -WindowStyle Hidden (New-Object System.Net.WebClient).DownloadFile('http://127.0.0.1/1.exe', 'C:\test-WDATP-test\invoice.exe');Start-Process 'C:\test-WDATP-test\invoice.exe'
```
-The Command Prompt window will close automatically. If successful, the detection test will be marked as completed and a new alert will appear in the portal for the onboarded endpoint in approximately 10 minutes.
+The Command Prompt window will close automatically. If successful, the detection test will be marked as completed and a new alert will appear in the portal for the onboarded machine in approximately 10 minutes.
## Related topics
-- [Configure client endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
-- [Configure server endpoints](configure-server-endpoints-windows-defender-advanced-threat-protection.md)
\ No newline at end of file
+- [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md)
+- [Onboard servers](configure-server-endpoints-windows-defender-advanced-threat-protection.md)
\ No newline at end of file
diff --git a/windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection.md
new file mode 100644
index 0000000000..8fce3d5f13
--- /dev/null
+++ b/windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection.md
@@ -0,0 +1,351 @@
+---
+title: View the Secure Score dashboard in Windows Defender ATP
+description: Use the Secure Score dashboard to assess and improve the security state of your organization by analyzing various security control tiles.
+keywords: secure score, dashboard, security recommendations, security control state, security score, score improvement, microsoft secure score, security controls, security control, improvement opportunities, edr, antivirus, av, os security updates
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+author: mjcaparas
+localizationpriority: high
+ms.date: 04/24/2018
+---
+
+# View the Windows Defender Advanced Threat Protection Secure score dashboard
+
+**Applies to:**
+
+- Windows 10 Enterprise
+- Windows 10 Education
+- Windows 10 Pro
+- Windows 10 Pro Education
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prerelease information](prerelease.md)]
+
+>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-sadashboard-abovefoldlink)
+
+
+The Secure score dashboard expands your visibility into the overall security posture of your organization. From this dashboard, you'll be able to quickly assess the security posture of your organization, see machines that require attention, as well as recommendations for actions to further reduce the attack surface in your organization - all in one place. From there you can take action based on the recommended configuration baselines.
+
+>[!IMPORTANT]
+> This feature is available for machines on Windows 10, version 1703 or later.
+
+
+The **Secure score dashboard** displays a snapshot of:
+- Microsoft Secure score
+- Windows Defender security controls
+- Improvement opportunities
+- Security score over time
+
+
+
+## Microsoft secure score
+The Microsoft secure score tile is reflective of the sum of all the Windows Defender security controls that are configured according to the recommended baseline and Office 365 controls. It allows you to drill down into each portal for further analysis. You can also improve this score by taking the steps in configuring each of the security controls in the optimal settings.
+
+
+
+Each Windows Defender security control contributes 100 points to the score. The total number is reflective of the score potential and calculated by multiplying the number of supported security controls (Windows Defender security controls pillars) by the maximum points that each pillar contributes (maximum of 100 points for each pillar).
+
+The Office 365 Secure Score looks at your settings and activities and compares them to a baseline established by Microsoft. For more information, see [Introducing the Office 365 Secure Score](https://support.office.com/en-us/article/introducing-the-office-365-secure-score-c9e7160f-2c34-4bd0-a548-5ddcc862eaef#howtoaccess).
+
+In the example image, the total points for the Windows security controls and Office 365 add up to 718 points.
+
+You can set the baselines for calculating the score of Windows Defender security controls on the Secure score dashboard through the **Settings**. For more information, see [Enable Secure score security controls](enable-secure-score-windows-defender-advanced-threat-protection.md).
+
+## Windows Defender security controls
+The security controls tile shows a bar graph where each bar represents a Windows Defender security control. Each bar reflects the number of machines that are well configured and those that require **any kind of attention** for each security control. Hovering on top of the individual bars will show exact numbers for each category. Machines that are green are well configured, while machines that are orange require some level of attention.
+
+
+
+
+## Improvement opportunities
+Improve your score by taking the recommended improvement actions listed on this tile. The goal is to reduce the gap between the perfect score and the current score for each control.
+
+Click on each control to see the recommended optimizations.
+
+
+
+The numbers beside the green triangle icon on each recommended action represents the number of points you can gain by taking the action. When added together, the total number makes up the numerator in the fraction for each segment in the Improvement opportunities tile.
+
+>[!IMPORTANT]
+>Recommendations that do not display a green triangle icon are informational only and no action is required.
+
+Clicking **View machines** in a specific recommendation opens up the **Machines list** with filters applied to show only the list of machines where the recommendation is applicable. You can export the list in Excel to create a target collection and apply relevant policies using a management solution of your choice.
+
+The following image shows an example list of machines where the EDR sensor is not turned on.
+
+
+
+## Security score over time
+You can track the progression of your organizational security posture over time using this tile. It displays the overall and individual control scores in a historical trend line enabling you to see how taking the recommended actions increase your overall security posture.
+
+
+
+You can click on specific date points to see the total score for that security control is on a particular date.
+
+## Improve your secure score by applying improvement recommendations
+Each security control lists recommendations that you can take to increase the security posture of your organization.
+
+### Endpoint detection and response (EDR) optimization
+For an machine to be considered "well configured", it must comply to a minimum baseline configuration setting. This tile shows you a specific list of actions you must apply on endpoints so that the minimum baseline configuration setting for your Endpoint detection and response tool.
+
+>[!IMPORTANT]
+>This feature is available for machines on Windows 10, version 1607 or later.
+
+#### Minimum baseline configuration setting for EDR:
+- Windows Defender ATP sensor is on
+- Data collection is working correctly
+- Communication to Windows Defender ATP service is not impaired
+
+##### Recommended actions:
+You can take the following actions to increase the overall security score of your organization:
+- Turn on sensor
+- Fix sensor data collection
+- Fix impaired communications
+
+For more information, see [Fix unhealthy sensors](fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md).
+
+### Windows Defender Antivirus (Windows Defender AV) optimization
+For a machine to be considered "well configured", it must comply to a minimum baseline configuration setting. This tile shows you a specific list of actions you must apply on endpoints so that the minimum baseline configuration setting for Windows Defender AV is fulfilled.
+
+>[!IMPORTANT]
+>This feature is available for machines on Windows 10, version 1607 or later.
+
+#### Minimum baseline configuration setting for Windows Defender AV:
+Machines are considered "well configured" for Windows Defender AV if the following requirements are met:
+
+- Windows Defender AV is reporting correctly
+- Windows Defender AV is turned on
+- Signature definitions are up to date
+- Real-time protection is on
+- Potentially Unwanted Application (PUA) protection is enabled
+
+##### Recommended actions:
+You can take the following actions to increase the overall security score of your organization:
+
+>[!NOTE]
+> For the Windows Defender Antivirus properties to show, you'll need to ensure that the Windows Defender Antivirus Cloud-based protection is properly configured on the machine.
+
+- Fix antivirus reporting
+ - This recommendation is displayed when the Windows Defender Antivirus is not properly configured to report its health state. For more information on fixing the reporting, see [Configure and validate network connections](../windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md).
+- Turn on antivirus
+- Update antivirus definitions
+- Turn on real-time protection
+- Turn on PUA protection
+
+For more information, see [Configure Windows Defender Antivirus](../windows-defender-antivirus/configure-windows-defender-antivirus-features.md).
+
+
+### OS security updates optimization
+This tile shows you the exact number of machines that require the latest security updates. It also shows machines that are running on the latest Windows Insider preview build and serves as a reminder to ensure that users should run the latest builds.
+
+>[!IMPORTANT]
+>This feature is available for machines on Windows 10, version 1607 or later.
+
+You can take the following actions to increase the overall security score of your organization:
+- Install the latest security updates
+- Fix sensor data collection
+ - The Windows Defender ATP service relies on sensor data collection to determine the security state of a machine. The service will not be able to determine the security state of machines that are not reporting sensor data properly. Therefore, it's important to ensure that sensor data collection is working properly. For more information, see [Fix unhealthy sensors](fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md).
+
+For more information, see [Windows Update Troubleshooter](https://support.microsoft.com/en-us/help/4027322/windows-windows-update-troubleshooter).
+
+
+### Windows Defender Exploit Guard (Windows Defender EG) optimization
+For a machine to be considered "well configured", it must comply to a minimum baseline configuration setting. This tile shows you a specific list of actions you must apply on machines so that the minimum baseline configuration setting for Windows Defender EG is fulfilled. When endpoints are configured according to the baseline you'll be able to see Windows Defender EG events on the Windows Defender ATP Machine timeline.
+
+
+>[!IMPORTANT]
+>This security control is only applicable for machines with Windows 10, version 1709 or later.
+
+#### Minimum baseline configuration setting for Windows Defender EG:
+Machines are considered "well configured" for Windows Defender EG if the following requirements are met:
+
+- System level protection settings are configured correctly
+- Attack Surface Reduction rules are configured correctly
+- Controlled Folder Access setting is configured correctly
+
+##### System level protection:
+The following system level configuration settings must be set to **On or Force On**:
+
+1. Control Flow Guard
+2. Data Execution Prevention (DEP)
+3. Randomize memory allocations (Bottom-up ASLR)
+4. Validate exception chains (SEHOP)
+5. Validate heap integrity
+
+>[!NOTE]
+>The setting **Force randomization for images (Mandatory ASLR)** is currently excluded from the baseline.
+>Consider configuring **Force randomization for images (Mandatory ASLR)** to **On or Force On** for better protection.
+
+##### Attack Surface Reduction (ASR) rules:
+The following ASR rules must be configured to **Block mode**:
+
+Rule description | GUIDs
+-|-
+Block executable content from email client and webmail | BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550
+Block Office applications from creating child processes | D4F940AB-401B-4EFC-AADC-AD5F3C50688A
+Block Office applications from creating executable content | 3B576869-A4EC-4529-8536-B80A7769E899
+Impede JavaScript and VBScript to launch executables | D3E037E1-3EB8-44C8-A917-57927947596D
+Block execution of potentially obfuscated scripts | 5BEB7EFE-FD9A-4556-801D-275E5FFC04CC
+Block Win32 imports from Macro code in Office | 92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B
+
+
+
+>[!NOTE]
+>The setting **Block Office applications from injecting into other processes** with GUID 75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84 is excluded from the baseline.
+>Consider enabling this rule in **Audit** or **Block mode** for better protection.
+
+
+##### Controlled Folder Access
+The Controlled Folder Access setting must be configured to **Audit mode** or **Enabled**.
+
+>[!NOTE]
+> Audit mode, allows you to see audit events in the Windows Defender ATP Machine timeline however it does not block suspicious applications.
+>Consider enabling Controlled Folder Access for better protection.
+
+##### Recommended actions:
+You can take the following actions to increase the overall security score of your organization:
+- Turn on all system-level Exploit Protection settings
+- Set all ASR rules to enabled or audit mode
+- Turn on Controlled Folder Access
+- Turn on Windows Defender Antivirus on compatible machines
+
+For more information, see [Windows Defender Exploit Guard](../windows-defender-exploit-guard/windows-defender-exploit-guard.md).
+
+### Windows Defender Application Guard (Windows Defender AG) optimization
+For a machine to be considered "well configured", it must comply to a minimum baseline configuration setting. This tile shows you a specific list of actions you must apply on endpoints so that the minimum baseline configuration setting for Windows Defender AG is fulfilled. When endpoints are configured according to the baseline you'll be able to see Windows Defender AG events on the Windows Defender ATP Machine timeline.
+
+>[!IMPORTANT]
+>This security control is only applicable for machines with Windows 10, version 1709 or later.
+
+#### Minimum baseline configuration setting for Windows Defender AG:
+Machines are considered "well configured" for Windows Defender AG if the following requirements are met:
+
+- Hardware and software prerequisites are met
+- Windows Defender AG is turned on compatible machines
+- Managed mode is turned on
+
+##### Recommended actions:
+You can take the following actions to increase the overall security score of your organization:
+- Ensure hardware and software prerequisites are met
+
+ >[!NOTE]
+ >This improvement item does not contribute to the security score in itself because it's not a prerequisite for Windows Defender AG. It gives an indication of a potential reason why Windows Defender AG is not turned on.
+
+- Turn on Windows Defender AG on compatible machines
+- Turn on managed mode
+
+
+For more information, see [Windows Defender Application Guard overview](../windows-defender-application-guard/wd-app-guard-overview.md).
+
+
+### Windows Defender SmartScreen optimization
+For a machine to be considered "well configured", it must comply to a minimum baseline configuration setting. This tile shows you a specific list of actions you must apply on endpoints so that the minimum baseline configuration setting for Windows Defender SmartScreen is fulfilled.
+
+>[!IMPORTANT]
+>This security control is only applicable for machines with Windows 10, version 1709 or later.
+
+#### Minimum baseline configuration setting for Windows Defender SmartScreen:
+The following settings must be configured with the following settings:
+- Check apps and files: **Warn** or **Block**
+- SmartScreen for Microsoft Edge: **Warn** or **Block**
+- SmartScreen for Microsoft store apps: **Warn** or **Off**
+
+
+You can take the following actions to increase the overall security score of your organization:
+- Set **Check app and files** to **Warn** or **Block**
+- Set **SmartScreen for Microsoft Edge** to **Warn** or **Block**
+- Set **SmartScreen for Microsoft store apps** to **Warn** or **Off**
+
+For more information, see [Windows Defender SmartScreen](../windows-defender-smartscreen/windows-defender-smartscreen-overview.md).
+
+
+
+### Windows Defender Firewall optimization
+For a machine to be considered "well configured", Windows Defender Firewall must be turned on and enabled for all profiles and inbound connections are blocked by default. This tile shows you a specific list of actions you must apply on endpoints so that the minimum baseline configuration setting for Windows Defender Firewall is fulfilled.
+
+>[!IMPORTANT]
+>This security control is only applicable for machines with Windows 10, version 1709 or later.
+
+#### Minimum baseline configuration setting for Windows Defender Firewall
+
+- Windows Defender Firewall is turned on for all network connections
+- Secure domain profile by enabling Windows Defender Firewall and ensure that Inbound connections is set to Blocked
+- Secure private profile by enabling Windows Defender Firewall and ensure that Inbound connections is set to Blocked
+- Secure public profile is configured by enabling Windows Defender Firewall and ensure that Inbound connections is set to Blocked
+
+For more information on Windows Defender Firewall settings, see [Planning settings for a basic firewall policy](https://docs.microsoft.com/en-us/windows/security/identity-protection/windows-firewall/planning-settings-for-a-basic-firewall-policy).
+
+>[!NOTE]
+> If Windows Defender Firewall is not your primary firewall, consider excluding it from the security score calculations and make sure that your third-party firewall is configured in a securely.
+
+
+##### Recommended actions:
+You can take the following actions to increase the overall security score of your organization:
+- Turn on firewall
+- Secure domain profile
+- Secure private profile
+- Secure public profile
+- Verify secure configuration of third-party firewall
+- Fix sensor data collection
+ - The Windows Defender ATP service relies on sensor data collection to determine the security state of a machine. The service will not be able to determine the security state of machines that are not reporting sensor data properly. Therefore, it's important to ensure that sensor data collection is working properly. For more information, see [Fix unhealthy sensors](fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md).
+
+For more information, see [Windows Defender Firewall with Advanced Security](https://docs.microsoft.com/en-us/windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security).
+
+### BitLocker optimization
+For a machine to be considered "well configured", it must comply to a minimum baseline configuration setting. This tile shows you a specific list of actions you must apply on endpoints so that the minimum baseline configuration setting for BitLocker is fulfilled.
+
+>[!IMPORTANT]
+>This security control is only applicable for machines with Windows 10, version 1803 or later.
+
+#### Minimum baseline configuration setting for BitLocker
+- Ensure all supported internal drives are encrypted
+- Ensure that all suspended protection on drives resume protection
+- Ensure that drives are compatible
+
+
+##### Recommended actions:
+You can take the following actions to increase the overall security score of your organization:
+- Encrypt all supported drives
+- Resume protection on all drives
+- Ensure drive compatibility
+- Fix sensor data collection
+ - The Windows Defender ATP service relies on sensor data collection to determine the security state of a machine. The service will not be able to determine the security state of machines that are not reporting sensor data properly. Therefore, it's important to ensure that sensor data collection is working properly. For more information, see [Fix unhealthy sensors](fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md).
+
+For more information, see [Bitlocker](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-overview).
+
+### Windows Defender Credential Guard optimization
+For a machine to be considered "well configured", it must comply to a minimum baseline configuration setting. This tile shows you a specific list of actions you must apply on endpoints so that the minimum baseline configuration setting for Windows Defender Credential Guard is fulfilled.
+
+>[!IMPORTANT]
+>This security control is only applicable for machines with Windows 10, version 1709 or later.
+
+#### Minimum baseline configuration setting for Windows Defender Credential Guard:
+Machines are considered "well configured" for Windows Defender Credential Guard if the following requirements are met:
+
+- Hardware and software prerequisites are met
+- Windows Defender Credential Guard is turned on on compatible machines
+
+
+##### Recommended actions:
+You can take the following actions to increase the overall security score of your organization:
+
+- Ensure hardware and software prerequisites are met
+- Turn on Credential Guard
+- Fix sensor data collection
+ - The Windows Defender ATP service relies on sensor data collection to determine the security state of a machine. The service will not be able to determine the security state of machines that are not reporting sensor data properly. Therefore, it's important to ensure that sensor data collection is working properly. For more information, see [Fix unhealthy sensors](fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md).
+
+For more information, see [Manage Windows Defender Credential Guard](https://docs.microsoft.com/windows/security/identity-protection/credential-guard/credential-guard-manage).
+
+>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-sadashboard-belowfoldlink)
+
+## Related topics
+- [Understand the Windows Defender Advanced Threat Protection portal](use-windows-defender-advanced-threat-protection.md)
+- [Portal overview](portal-overview-windows-defender-advanced-threat-protection.md)
+- [View the Security operations dashboard](security-operations-dashboard-windows-defender-advanced-threat-protection.md)
+- [View the Threat analytics dashboard and take recommended mitigation actions](threat-analytics-dashboard-windows-defender-advanced-threat-protection.md)
+
+
+
diff --git a/windows/security/threat-protection/windows-defender-atp/security-analytics-dashboard-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/security-analytics-dashboard-windows-defender-advanced-threat-protection.md
deleted file mode 100644
index 6ea27c4f75..0000000000
--- a/windows/security/threat-protection/windows-defender-atp/security-analytics-dashboard-windows-defender-advanced-threat-protection.md
+++ /dev/null
@@ -1,256 +0,0 @@
----
-title: View the Secure score dashboard in Windows Defender ATP
-description: Use the Secure score dashboard to assess and improve the security state of your organization by analyzing various security control tiles.
-keywords: secure score, dashboard, security recommendations, security control state, security score, score improvement, organizational security score, security coverage, security control, improvement opportunities, edr, antivirus, av, os security updates
-search.product: eADQiWindows 10XVcnh
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.sitesec: library
-ms.pagetype: security
-author: mjcaparas
-localizationpriority: high
-ms.date: 03/12/2018
----
-
-# View the Windows Defender Advanced Threat Protection Secure score dashboard
-
-**Applies to:**
-
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
-- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-
-
-
->Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-sadashboard-abovefoldlink)
-
-
-The Secure score dashboard expands your visibility into the overall security posture of your organization. From this dashboard, you'll be able to quickly assess the security posture of your organization, see machines that require attention, as well as recommendations for actions to further reduce the attack surface in your organization - all in one place. From there you can take action based on the recommended configuration baselines.
-
->[!IMPORTANT]
-> This feature is available for machines on Windows 10, version 1703 or later.
-
-The **Secure score dashboard** displays a snapshot of:
-- Organizational security score
-- Security coverage
-- Improvement opportunities
-- Security score over time
-
-
-
-## Organizational security score
-The organization security score is reflective of the average score of all the Windows Defender security controls that are configured according to the recommended baseline. You can improve this score by taking the steps in configuring each of the security controls in the optimal settings.
-
-
-
-Each Windows Defender security control from the **Security coverage** tile contributes 100 points to the organizational security score.
-
-The denominator is reflective of the organizational score potential and calculated by multiplying the number of supported security controls (Security coverage pillars) by the maximum points that each pillar contributes (maximum of 100 points for each pillar).
-
-
-In the example image, the total points from the **Improvement opportunities** tile add up to 321 points for the six pillars from the **Security coverage** tile.
-
-You can set the baselines for calculating the score of Windows Defender security controls on the Secure score dashboard through the **Preferences settings**. For more information, see [Enable Secure score security controls](enable-security-analytics-windows-defender-advanced-threat-protection.md).
-
-## Security coverage
-The security coverage tile shows a bar graph where each bar represents a Windows Defender security control. Each bar reflects the number of machines that are well configured and those that require **any kind of attention** for each security control. Hovering on top of the individual bars will show exact numbers for each category. Machines that are green are well configured, while machines that are orange require some level of attention.
-
-
-
-
-## Improvement opportunities
-Improve your organizational security score by taking the recommended improvement actions listed on this tile. The goal is to reduce the gap between the perfect score and the current score for each control.
-
-Click on each control to see the recommended optimizations.
-
-
-
-The numbers beside the green triangle icon on each recommended action represents the number of points you can gain by taking the action. When added together, the total number makes up the numerator in the fraction for each segment in the Improvement opportunities tile.
-
->[!IMPORTANT]
->Recommendations that do not display a green triangle icon are informational only and no action is required.
-
-Clicking **View machines** in a specific recommendation opens up the **Machines list** with filters applied to show only the list of machines where the recommendation is applicable. You can export the list in Excel to create a target collection and apply relevant policies using a management solution of your choice.
-
-The following image shows an example list of machines where the EDR sensor is not turned on.
-
-
-
-## Security score over time
-You can track the progression of your organizational security posture over time using this tile. It displays the overall and individual control scores in a historical trend line enabling you to see how taking the recommended actions increase your overall security posture.
-
-
-
-You can click on specific date points to see the total score for that security control is on a particular date.
-
-### Endpoint detection and response (EDR) optimization
-For an endpoint to be considered "well configured", it must comply to a minimum baseline configuration setting. This tile shows you a specific list of actions you must apply on endpoints so that the minimum baseline configuration setting for your Endpoint detection and response tool.
-
-#### Minimum baseline configuration setting for EDR:
-- Windows Defender ATP sensor is on
-- Data collection is working correctly
-- Communication to Windows Defender ATP service is not impaired
-
-#### Minimum baseline configuration setting for EDR:
-You can take the following actions to increase the overall security score of your organization:
-- Turn on sensor
-- Fix sensor data collection
-- Fix impaired communications
-
-For more information, see [Fix unhealthy sensors](fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md).
-
-### Windows Defender Antivirus (Windows Defender AV) optimization
-For an endpoint to be considered "well configured", it must comply to a minimum baseline configuration setting. This tile shows you a specific list of actions you must apply on endpoints so that the minimum baseline configuration setting for Windows Defender AV is fulfilled.
-
-#### Minimum baseline configuration setting for Windows Defender AV:
-Endpoints are considered "well configured" for Windows Defender AV if the following requirements are met:
-
-- Windows Defender AV is reporting correctly
-- Windows Defender AV is turned on
-- Signature definitions are up to date
-- Real-time protection is on
-- Potentially Unwanted Application (PUA) protection is enabled
-
-##### Recommended actions:
-You can take the following actions to increase the overall security score of your organization:
-
->[!NOTE]
-> For the Windows Defender Antivirus properties to show, you'll need to ensure that the Windows Defender Antivirus Cloud-based protection is properly configured on the endpoint.
-
-- Fix antivirus reporting
- - This recommendation is displayed when the Windows Defender Antivirus is not properly configured to report its health state. For more information on fixing the reporting, see [Configure and validate network connections](../windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md).
-- Turn on antivirus
-- Update antivirus definitions
-- Turn on real-time protection
-- Turn on PUA protection
-
-For more information, see [Configure Windows Defender Antivirus](../windows-defender-antivirus/configure-windows-defender-antivirus-features.md).
-
-
-### OS security updates optimization
-This tile shows you the exact number of machines that require the latest security updates. It also shows machines that are running on the latest Windows Insider preview build and serves as a reminder to ensure that users should run the latest builds.
-
-You can take the following actions to increase the overall security score of your organization:
-- Install the latest security updates
-- Fix sensor data collection
- - The Windows Defender ATP service relies on sensor data collection to determine the security state of a machine. The service will not be able to determine the security state of machines that are not reporting sensor data properly. Therefore, it's important to ensure that sensor data collection is working properly. For more information, see [Fix unhealthy sensors](fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md).
-
-For more information, see [Windows Update Troubleshooter](https://support.microsoft.com/en-us/help/4027322/windows-windows-update-troubleshooter).
-
-
-### Windows Defender Exploit Guard (Windows Defender EG) optimization
-For an endpoint to be considered "well configured", it must comply to a minimum baseline configuration setting. This tile shows you a specific list of actions you must apply on endpoints so that the minimum baseline configuration setting for Windows Defender EG is fulfilled. When endpoints are configured according to the baseline you'll be able to see Windows Defender EG events on the Windows Defender ATP Machine timeline.
-
-#### Minimum baseline configuration setting for Windows Defender EG:
-Endpoints are considered "well configured" for Windows Defender EG if the following requirements are met:
-
-- System level protection settings are configured correctly
-- Attack Surface Reduction rules are configured correctly
-- Controlled Folder Access setting is configured correctly
-
-##### System level protection:
-The following system level configuration settings must be set to **On or Force On**:
-
-1. Control Flow Guard
-2. Data Execution Prevention (DEP)
-3. Randomize memory allocations (Bottom-up ASLR)
-4. Validate exception chains (SEHOP)
-5. Validate heap integrity
-
->[!NOTE]
->The setting **Force randomization for images (Mandatory ASLR)** is currently excluded from the baseline.
->Consider configuring **Force randomization for images (Mandatory ASLR)** to **On or Force On** for better protection.
-
-##### Attack Surface Reduction (ASR) rules:
-The following ASR rules must be configured to **Block mode**:
-
-Rule description | GUIDs
--|-
-Block executable content from email client and webmail | BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550
-Block Office applications from creating child processes | D4F940AB-401B-4EFC-AADC-AD5F3C50688A
-Block Office applications from creating executable content | 3B576869-A4EC-4529-8536-B80A7769E899
-Impede JavaScript and VBScript to launch executables | D3E037E1-3EB8-44C8-A917-57927947596D
-Block execution of potentially obfuscated scripts | 5BEB7EFE-FD9A-4556-801D-275E5FFC04CC
-Block Win32 imports from Macro code in Office | 92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B
-
-
->[!NOTE]
->The setting **Block Office applications from injecting into other processes** with GUID 75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84 is excluded from the baseline.
->Consider enabling this rule in **Audit** or **Block mode** for better protection.
-
-
-##### Controlled Folder Access
-The Controlled Folder Access setting must be configured to **Audit mode** or **Enabled**.
-
->[!NOTE]
-> Audit mode, allows you to see audit events in the Windows Defender ATP Machine timeline however it does not block suspicious applications.
->Consider enabling Controlled Folder Access for better protection.
-
-##### Recommended actions:
-You can take the following actions to increase the overall security score of your organization:
-- Turn on all system-level Exploit Protection settings
-- Set all ASR rules to enabled or audit mode
-- Turn on Controlled Folder Access
-- Turn on Windows Defender Antivirus on compatible machines
-
-For more information, see [Windows Defender Exploit Guard](../windows-defender-exploit-guard/windows-defender-exploit-guard.md).
-
-### Windows Defender Application Guard (Windows Defender AG) optimization
-For an endpoint to be considered "well configured", it must comply to a minimum baseline configuration setting. This tile shows you a specific list of actions you must apply on endpoints so that the minimum baseline configuration setting for Windows Defender AG is fulfilled. When endpoints are configured according to the baseline you'll be able to see Windows Defender AG events on the Windows Defender ATP Machine timeline.
-
-#### Minimum baseline configuration setting for Windows Defender AG:
-Endpoints are considered "well configured" for Windows Defender AG if the following requirements are met:
-
-- Hardware and software prerequisites are met
-- Windows Defender AG is turned on compatible machines
-- Managed mode is turned on
-
-##### Recommended actions:
-You can take the following actions to increase the overall security score of your organization:
-- Ensure hardware and software prerequisites are met
-
- >[!NOTE]
- >This improvement item does not contribute to the security score in itself because it's not a prerequisite for Windows Defender AG. It gives an indication of a potential reason why Windows Defender AG is not turned on.
-
-- Turn on Windows Defender AG on compatible machines
-- Turn on managed mode
-
-
-For more information, see [Windows Defender Application Guard overview](../windows-defender-application-guard/wd-app-guard-overview.md).
-
-
-### Windows Defender SmartScreen optimization
-For an endpoint to be considered "well configured", it must comply to a minimum baseline configuration setting. This tile shows you a specific list of actions you must apply on endpoints so that the minimum baseline configuration setting for Windows Defender SmartScreen is fulfilled.
-
-#### Minimum baseline configuration setting for Windows Defender SmartScreen:
-The following settings must be configured with the following settings:
-- Check apps and files: **Warn** or **Block**
-- SmartScreen for Microsoft Edge: **Warn** or **Block**
-- SmartScreen for Microsoft store apps: **Warn** or **Off**
-
-
-You can take the following actions to increase the overall security score of your organization:
-- Set **Check app and files** to **Warn** or **Block**
-- Set **SmartScreen for Microsoft Edge** to **Warn** or **Block**
-- Set **SmartScreen for Microsoft store apps** to **Warn** or **Off**
-
-For more information, see [Windows Defender SmartScreen](../windows-defender-smartscreen/windows-defender-smartscreen-overview.md).
-
->Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-sadashboard-belowfoldlink)
-
-## Related topics
-- [Enable Secure score security controls](enable-security-analytics-windows-defender-advanced-threat-protection.md)
-- [View the Security operations dashboard](dashboard-windows-defender-advanced-threat-protection.md)
-- [View and organize the Windows Defender Advanced Threat Protection Alerts queue ](alerts-queue-windows-defender-advanced-threat-protection.md)
-- [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md)
-- [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md)
-- [Investigate an IP address associated with a Windows Defender ATP alert](investigate-ip-windows-defender-advanced-threat-protection.md)
-- [Investigate a domain associated with a Windows Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md)
-- [View and organize the Windows Defender ATP Machines list](machines-view-overview-windows-defender-advanced-threat-protection.md)
-- [Investigate machines in the Windows Defender ATP Machines list](investigate-machines-windows-defender-advanced-threat-protection.md)
-- [Investigate a user account in Windows Defender ATP ](investigate-user-windows-defender-advanced-threat-protection.md)
-- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md)
-- [Take response actions in Windows Defender ATP](response-actions-windows-defender-advanced-threat-protection.md)
-
diff --git a/windows/security/threat-protection/windows-defender-atp/dashboard-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/security-operations-dashboard-windows-defender-advanced-threat-protection.md
similarity index 74%
rename from windows/security/threat-protection/windows-defender-atp/dashboard-windows-defender-advanced-threat-protection.md
rename to windows/security/threat-protection/windows-defender-atp/security-operations-dashboard-windows-defender-advanced-threat-protection.md
index 1846ca83c2..d3740aa25f 100644
--- a/windows/security/threat-protection/windows-defender-atp/dashboard-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/security-operations-dashboard-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 11/01/2017
+ms.date: 04/24/2018
---
# View the Windows Defender Advanced Threat Protection Security operations dashboard
@@ -23,20 +23,25 @@ ms.date: 11/01/2017
- Windows 10 Pro Education
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-
+[!include[Prerelease information](prerelease.md)]
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-secopsdashboard-abovefoldlink)
The **Security operations dashboard** displays a snapshot of:
- The latest active alerts on your network
-- Daily machines reporting
- Machines at risk
-- Users at risk
- Machines with active malware alerts
+- Daily machines reporting
+- Active automated investigations
+- Automated investigations statistics
+- Users at risk
+- Suspicious activities
- Sensor health
- Service health
+
+
You can explore and investigate alerts and machines to quickly determine if, where, and when suspicious activities occurred in your network to help you understand the context they appeared in.
From the **Security operations dashboard** you will see aggregated events to facilitate the identification of significant events or behaviors on a machine. You can also drill down into granular events and low-level indicators.
@@ -54,10 +59,7 @@ For more information see, [Alerts overview](alerts-queue-windows-defender-advanc
The **Latest active alerts** section includes the latest active alerts in your network. Each row includes an alert severity category and a short description of the alert. Click an alert to see its detailed view, or **Alerts queue** at the top of the list to go directly to the Alerts queue. For more information see, [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) and [Alerts overview](alerts-queue-windows-defender-advanced-threat-protection.md).
-## Daily machines reporting
-The **Daily machines reporting** tile shows a bar graph that represents the number of machines reporting daily in the last 30 days. Hover over individual bars on the graph to see the exact number of machines reporting in each day.
-
## Machines at risk
This tile shows you a list of machines with the highest number of active alerts. The total number of alerts for each machine is shown in a circle next to the machine name, and then further categorized by severity levels at the far end of the tile (hover over each severity bar to see its label).
@@ -68,19 +70,12 @@ Click the name of the machine to see details about that machine. For more inform
You can also click **Machines list** at the top of the tile to go directly to the **Machines list**, sorted by the number of active alerts. For more information see, [Investigate machines in the Windows Defender Advanced Threat Protection Machines list](investigate-machines-windows-defender-advanced-threat-protection.md).
-## Users at risk
-The tile shows you a list of user accounts with the most active alerts.
-
-
-
-Click the user account to see details about the user account. For more information see [Investigate a user account](investigate-user-windows-defender-advanced-threat-protection.md).
-
## Machines with active malware detections
-The **Machines with active malware detections** tile will only appear if your endpoints are using Windows Defender Antivirus.
+The **Machines with active malware detections** tile will only appear if your machines are using Windows Defender Antivirus.
Active malware is defined as threats that were actively executing at the time of detection.
-Hover over each bar to see the number of active malware detections (as **Malware detections**) and the number of endpoints with at least one active detection (as **Machines**) over the past 30 days.
+Hover over each bar to see the number of active malware detections (as **Malware detections**) and the number of machines with at least one active detection (as **Machines**) over the past 30 days.
@@ -98,12 +93,44 @@ Threats are considered "active" if there is a very high probability that the mal
Clicking on any of these categories will navigate to the [Machines list](investigate-machines-windows-defender-advanced-threat-protection.md), filtered by the appropriate category. This lets you see a detailed breakdown of which machines have active malware detections, and how many threats were detected per machine.
> [!NOTE]
-> The **Machines with active malware detections** tile will only appear if your endpoints are using [Windows Defender Antivirus](https://technet.microsoft.com/library/mt622091(v=vs.85).aspx) as the default real-time protection antimalware product.
+> The **Machines with active malware detections** tile will only appear if your machines are using [Windows Defender Antivirus](https://technet.microsoft.com/library/mt622091(v=vs.85).aspx) as the default real-time protection antimalware product.
+## Daily machines reporting
+The **Daily machines reporting** tile shows a bar graph that represents the number of machines reporting daily in the last 30 days. Hover over individual bars on the graph to see the exact number of machines reporting in each day.
+
+
+
+
+
+## Active automated investigations
+You can view the overall number of automated investigations from the last 30 days in your network from the **Active automated investigations** tile. Investigations are grouped into **Waiting for machine**, **Running**, and **Pending approval**.
+
+
+
+
+## Automated investigations statistics
+This tile shows statistics related to automated investigations in the last 30 days. It shows the number of investigations completed, the number of successfully remediated investigations, the average pending time it takes for an investigaiton to be initiated, the average time it takes to remediate an alert, the number of alerts investigated, and the number of hours of automation saved from a typical manual investigation.
+
+
+
+You can click on **Automated investigations**, **Remidated investigations**, and **Alerts investigated** to navigate to the **Invesgations** page, filtered by the appropriate category. This lets you see a detailed breakdown of investigations in context.
+
+## Users at risk
+The tile shows you a list of user accounts with the most active alerts and the number of alerts seen on high, medium, or low alerts.
+
+
+
+Click the user account to see details about the user account. For more information see [Investigate a user account](investigate-user-windows-defender-advanced-threat-protection.md).
+
+## Suspicious activities
+This tile shows audit events based on detections from various security components.
+
+
+
## Sensor health
-The **Sensor health** tile provides information on the individual endpoint’s ability to provide sensor data to the Windows Defender ATP service. It reports how many machines require attention and helps you identify problematic machines.
+The **Sensor health** tile provides information on the individual machine’s ability to provide sensor data to the Windows Defender ATP service. It reports how many machines require attention and helps you identify problematic machines.
@@ -126,13 +153,8 @@ For more information on the service health, see [Check the Windows Defender ATP
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-secopsdashboard-belowfoldlink)
## Related topics
-- [View and organize the Windows Defender Advanced Threat Protection Alerts queue ](alerts-queue-windows-defender-advanced-threat-protection.md)
-- [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md)
-- [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md)
-- [Investigate an IP address associated with a Windows Defender ATP alert](investigate-ip-windows-defender-advanced-threat-protection.md)
-- [Investigate a domain associated with a Windows Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md)
-- [View and organize the Windows Defender ATP Machines list](machines-view-overview-windows-defender-advanced-threat-protection.md)
-- [Investigate machines in the Windows Defender ATP Machines list](investigate-machines-windows-defender-advanced-threat-protection.md)
-- [Investigate a user account in Windows Defender ATP ](investigate-user-windows-defender-advanced-threat-protection.md)
-- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md)
-- [Take response actions in Windows Defender ATP](response-actions-windows-defender-advanced-threat-protection.md)
+- [Understand the Windows Defender Advanced Threat Protection portal](use-windows-defender-advanced-threat-protection.md)
+- [Portal overview](portal-overview-windows-defender-advanced-threat-protection.md)
+- [View the Secure Score dashboard and improve your secure score](secure-score-dashboard-windows-defender-advanced-threat-protection.md)
+- [View the Threat analytics dashboard and take recommended mitigation actions](threat-analytics-dashboard-windows-defender-advanced-threat-protection.md)
+
diff --git a/windows/security/threat-protection/windows-defender-atp/service-status-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/service-status-windows-defender-advanced-threat-protection.md
index fb58b3850a..488f25d704 100644
--- a/windows/security/threat-protection/windows-defender-atp/service-status-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/service-status-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/16/2017
+ms.date: 04/24/2018
---
# Check the Windows Defender Advanced Threat Protection service health
@@ -23,7 +23,7 @@ ms.date: 10/16/2017
- Windows 10 Pro Education
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-
+[!include[Prerelease information](prerelease.md)]
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-servicestatus-abovefoldlink)
@@ -57,4 +57,4 @@ When an issue is resolved, it gets recorded in the **Status history** tab.
The **Status history** tab reflects all the historical issues that were seen and resolved. You'll see details of the resolved issues along with the other information that were included while it was being resolved.
### Related topic
-- [View the Security operations dashboard](dashboard-windows-defender-advanced-threat-protection.md)
+- [View the Security operations dashboard](security-operations-dashboard-windows-defender-advanced-threat-protection.md)
diff --git a/windows/security/threat-protection/windows-defender-atp/supported-apis-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/supported-apis-windows-defender-advanced-threat-protection.md
index 6277924353..9fa8d8f13a 100644
--- a/windows/security/threat-protection/windows-defender-atp/supported-apis-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/supported-apis-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/16/2017
+ms.date: 04/24/2018
---
# Supported Windows Defender ATP query APIs
@@ -23,6 +23,7 @@ ms.date: 10/16/2017
- Windows 10 Pro Education
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+[!include[Prerelease information](prerelease.md)]
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-supportedapis-abovefoldlink)
@@ -39,3 +40,5 @@ IP | Run API calls such as get IP related alerts, IP related machines, IP statis
Machines | Run API calls such as find machine information by IP, get machines, get machines by ID, information about logged on users, and alerts related to a given machine ID.
User | Run API calls such as get alert related user information, user information, user related alerts, and user related machines.
+## Related topic
+- [Use the Windows Defender ATP exposed APIs](exposed-apis-windows-defender-advanced-threat-protection.md)
diff --git a/windows/security/threat-protection/windows-defender-atp/threat-analytics-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/threat-analytics-dashboard-windows-defender-advanced-threat-protection.md
similarity index 87%
rename from windows/security/threat-protection/windows-defender-atp/threat-analytics-windows-defender-advanced-threat-protection.md
rename to windows/security/threat-protection/windows-defender-atp/threat-analytics-dashboard-windows-defender-advanced-threat-protection.md
index e2bb30d5ac..1b25b996dc 100644
--- a/windows/security/threat-protection/windows-defender-atp/threat-analytics-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/threat-analytics-dashboard-windows-defender-advanced-threat-protection.md
@@ -50,5 +50,10 @@ To access Threat analytics, from the navigation pane select **Dashboards** > **T
Click a section of each chart to get a list of the machines in the corresponding mitigation status.
+## Related topics
+- [Understand the Windows Defender Advanced Threat Protection portal](use-windows-defender-advanced-threat-protection.md)
+- [Portal overview](portal-overview-windows-defender-advanced-threat-protection.md)
+- [View the Security operations dashboard](security-operations-dashboard-windows-defender-advanced-threat-protection.md)
+- [View the Secure Score dashboard and improve your secure score](secure-score-dashboard-windows-defender-advanced-threat-protection.md)
diff --git a/windows/security/threat-protection/windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection.md
index 54edd18d8c..160df53514 100644
--- a/windows/security/threat-protection/windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection.md
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 10/16/2017
+ms.date: 04/24/2018
---
# Understand threat intelligence concepts
@@ -23,7 +23,7 @@ ms.date: 10/16/2017
- Windows 10 Pro Education
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-
+[!include[Prerelease information](prerelease.md)]
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-threatindicator-abovefoldlink)
@@ -52,8 +52,8 @@ Here is an example of an IOC:
IOCs have a many-to-one relationship with alert definitions such that an alert definition can have many IOCs that correspond to it.
## Related topics
-- [Create custom alerts using the threat intelligence API](custom-ti-api-windows-defender-advanced-threat-protection.md)
- [Enable the custom threat intelligence API in Windows Defender ATP](enable-custom-ti-windows-defender-advanced-threat-protection.md)
+- [Create custom alerts using the threat intelligence API](custom-ti-api-windows-defender-advanced-threat-protection.md)
- [PowerShell code examples for the custom threat intelligence API](powershell-example-code-windows-defender-advanced-threat-protection.md)
- [Python code examples for the custom threat intelligence API](python-example-code-windows-defender-advanced-threat-protection.md)
- [Experiment with custom threat intelligence alerts](experiment-custom-ti-windows-defender-advanced-threat-protection.md)
diff --git a/windows/security/threat-protection/windows-defender-atp/settings-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/time-settings-windows-defender-advanced-threat-protection.md
similarity index 96%
rename from windows/security/threat-protection/windows-defender-atp/settings-windows-defender-advanced-threat-protection.md
rename to windows/security/threat-protection/windows-defender-atp/time-settings-windows-defender-advanced-threat-protection.md
index b376019c6a..8f05637899 100644
--- a/windows/security/threat-protection/windows-defender-atp/settings-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/time-settings-windows-defender-advanced-threat-protection.md
@@ -63,9 +63,9 @@ To set the time zone:
To apply different date formats for Windows Defender ATP, use regional settings for Internet Explorer (IE) and Microsoft Edge (Edge). If you're using another browser such as Google Chrome, follow the required steps to change the time and date settings for that browser.
-**Internet Explorer (IE) and Microsoft Edge (Edge)**
+**Internet Explorer (IE) and Microsoft Edge**
-IE and Edge use the **Region** settings configured in the **Clocks, Language, and Region** option in the Control panel.
+IE and Microsoft Edge use the **Region** settings configured in the **Clocks, Language, and Region** option in the Control panel.
#### Known issues with regional formats
diff --git a/windows/security/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md
index d6dbef14e6..b020424608 100644
--- a/windows/security/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md
@@ -23,7 +23,7 @@ ms.date: 02/26/2018
- Windows 10 Pro Education
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-
+[!include[Prerelease information](prerelease.md)]
You might need to troubleshoot issues while using the custom threat intelligence feature.
@@ -53,8 +53,8 @@ If your client secret expires or if you've misplaced the copy provided when you
## Related topics
- [Understand threat intelligence concepts](threat-indicator-concepts-windows-defender-advanced-threat-protection.md)
-- [Create custom alerts using the threat intelligence API](custom-ti-api-windows-defender-advanced-threat-protection.md)
- [Enable the custom threat intelligence API in Windows Defender ATP](enable-custom-ti-windows-defender-advanced-threat-protection.md)
+- [Create custom alerts using the threat intelligence API](custom-ti-api-windows-defender-advanced-threat-protection.md)
- [PowerShell code examples for the custom threat intelligence API](powershell-example-code-windows-defender-advanced-threat-protection.md)
- [Python code examples for the custom threat intelligence API](python-example-code-windows-defender-advanced-threat-protection.md)
- [Experiment with custom threat intelligence alerts](experiment-custom-ti-windows-defender-advanced-threat-protection.md)
diff --git a/windows/security/threat-protection/windows-defender-atp/troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md
index 67e7ed903c..ae602776bf 100644
--- a/windows/security/threat-protection/windows-defender-atp/troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md
@@ -50,10 +50,10 @@ For both cases you should contact Microsoft support at [General Windows Defender
If while accessing the Windows Defender ATP portal you get a **Your subscription has expired** message, your online service subscription has expired. Windows Defender ATP subscription, like any other online service subscription, has an expiration date.
-You can choose to renew or extend the license at any point in time. When accessing the portal after the expiration date a **Your subscription has expired** message will be presented with an option to download the endpoint offboarding package, should you choose to not renew the license.
+You can choose to renew or extend the license at any point in time. When accessing the portal after the expiration date a **Your subscription has expired** message will be presented with an option to download the machine offboarding package, should you choose to not renew the license.
> [!NOTE]
-> For security reasons, the package used to offboard endpoints will expire 30 days after the date it was downloaded. Expired offboarding packages sent to an endpoint will be rejected. When downloading an offboarding package you will be notified of the packages expiry date and it will also be included in the package name.
+> For security reasons, the package used to Offboard machines will expire 30 days after the date it was downloaded. Expired offboarding packages sent to a machine will be rejected. When downloading an offboarding package you will be notified of the packages expiry date and it will also be included in the package name.
@@ -73,4 +73,4 @@ You'll need to whitelist the `security.windows.com` and all sub-domains under it
## Related topics
-- [Validating licensing provisioning and completing setup for Windows Defender ATP](licensing-windows-defender-advanced-threat-protection.md)
\ No newline at end of file
+- [Validate licensing provisioning and complete setup for Windows Defender ATP](licensing-windows-defender-advanced-threat-protection.md)
\ No newline at end of file
diff --git a/windows/security/threat-protection/windows-defender-atp/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md
index 0dd01e9e60..53bbce16ae 100644
--- a/windows/security/threat-protection/windows-defender-atp/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md
@@ -1,6 +1,6 @@
---
title: Troubleshoot Windows Defender ATP onboarding issues
-description: Troubleshoot issues that might arise during the onboarding of endpoints or to the Windows Defender ATP service.
+description: Troubleshoot issues that might arise during the onboarding of machines or to the Windows Defender ATP service.
keywords: troubleshoot onboarding, onboarding issues, event viewer, data collection and preview builds, sensor data and diagnostics
search.product: eADQiWindows 10XVcnh
ms.prod: w10
@@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: high
-ms.date: 11/21/2017
+ms.date: 04/24/2018
---
# Troubleshoot Windows Defender Advanced Threat Protection onboarding issues
@@ -25,37 +25,37 @@ ms.date: 11/21/2017
- Windows Server 2012 R2
- Windows Server 2016
-
+[!include[Prerelease information](prerelease.md)]
You might need to troubleshoot the Windows Defender ATP onboarding process if you encounter issues.
-This page provides detailed steps to troubleshoot onboarding issues that might occur when deploying with one of the deployment tools and common errors that might occur on the endpoints.
+This page provides detailed steps to troubleshoot onboarding issues that might occur when deploying with one of the deployment tools and common errors that might occur on the machines.
-If you have completed the endpoint onboarding process and don't see endpoints in the [Machines list](investigate-machines-windows-defender-advanced-threat-protection.md) after an hour, it might indicate an endpoint onboarding or connectivity problem.
+If you have completed the onboarding process and don't see machines in the [Machines list](investigate-machines-windows-defender-advanced-threat-protection.md) after an hour, it might indicate an onboarding or connectivity problem.
## Troubleshoot onboarding when deploying with Group Policy
-Deployment with Group Policy is done by running the onboarding script on the endpoints. The Group Policy console does not indicate if the deployment has succeeded or not.
+Deployment with Group Policy is done by running the onboarding script on the machines. The Group Policy console does not indicate if the deployment has succeeded or not.
-If you have completed the endpoint onboarding process and don't see endpoints in the [Machines list](investigate-machines-windows-defender-advanced-threat-protection.md) after an hour, you can check the output of the script on the endpoints. For more information, see [Troubleshoot onboarding when deploying with a script on the endpoint](#troubleshoot-onboarding-when-deploying-with-a-script-on-the-endpoint).
+If you have completed the onboarding process and don't see machines in the [Machines list](investigate-machines-windows-defender-advanced-threat-protection.md) after an hour, you can check the output of the script on the machines. For more information, see [Troubleshoot onboarding when deploying with a script](#troubleshoot-onboarding-when-deploying-with-a-script).
-If the script completes successfully, see [Troubleshoot onboarding issues on the endpoint](#troubleshoot-onboarding-issues-on-the-endpoint) for additional errors that might occur.
+If the script completes successfully, see [Troubleshoot onboarding issues](#troubleshoot-onboarding-issues) for additional errors that might occur.
## Troubleshoot onboarding issues when deploying with System Center Configuration Manager
-When onboarding endpoints using the following versions of System Center Configuration Manager:
+When onboarding machines using the following versions of System Center Configuration Manager:
- System Center 2012 Configuration Manager
- System Center 2012 R2 Configuration Manager
- System Center Configuration Manager (current branch) version 1511
- System Center Configuration Manager (current branch) version 1602
-Deployment with the above-mentioned versions of System Center Configuration Manager is done by running the onboarding script on the endpoints. You can track the deployment in the Configuration Manager Console.
+Deployment with the above-mentioned versions of System Center Configuration Manager is done by running the onboarding script on the machines. You can track the deployment in the Configuration Manager Console.
-If the deployment fails, you can check the output of the script on the endpoints.
+If the deployment fails, you can check the output of the script on the machines.
-If the onboarding completed successfully but the endpoints are not showing up in the **Machines list** after an hour, see [Troubleshoot onboarding issues on the endpoint](#troubleshoot-onboarding-issues-on-the-endpoint) for additional errors that might occur.
+If the onboarding completed successfully but the machines are not showing up in the **Machines list** after an hour, see [Troubleshoot onboarding issues](#troubleshoot-onboarding-issues) for additional errors that might occur.
-## Troubleshoot onboarding when deploying with a script on the endpoint
+## Troubleshoot onboarding when deploying with a script
-**Check the result of the script on the endpoint**:
+**Check the result of the script on the machine**:
1. Click **Start**, type **Event Viewer**, and press **Enter**.
2. Go to **Windows Logs** > **Application**.
@@ -70,17 +70,17 @@ Event ID | Error Type | Resolution steps
:---|:---|:---
5 | Offboarding data was found but couldn't be deleted | Check the permissions on the registry, specifically ```HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection```.
10 | Onboarding data couldn't be written to registry | Check the permissions on the registry, specifically
```HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat```.
Verify that the script was ran as an administrator.
-15 | Failed to start SENSE service |Check the service health (```sc query sense``` command). Make sure it's not in an intermediate state (*'Pending_Stopped'*, *'Pending_Running'*) and try to run the script again (with administrator rights).
If the endpoint is running Windows 10, version 1607 and running the command `sc query sense` returns `START_PENDING`, reboot the machine. If rebooting the machine doesn't address the issue, upgrade to KB4015217 and try onboarding again.
+15 | Failed to start SENSE service |Check the service health (```sc query sense``` command). Make sure it's not in an intermediate state (*'Pending_Stopped'*, *'Pending_Running'*) and try to run the script again (with administrator rights).
If the machine is running Windows 10, version 1607 and running the command `sc query sense` returns `START_PENDING`, reboot the machine. If rebooting the machine doesn't address the issue, upgrade to KB4015217 and try onboarding again.
15 | Failed to start SENSE service | If the message of the error is: System error 577 has occurred. You need to enable the Windows Defender Antivirus ELAM driver, see [Ensure that Windows Defender Antivirus is not disabled by a policy](#ensure-that-windows-defender-antivirus-is-not-disabled-by-a-policy) for instructions.
-30 | The script failed to wait for the service to start running | The service could have taken more time to start or has encountered errors while trying to start. For more information on events and errors related to SENSE, see [Review events and errors on endpoints with Event viewer](event-error-codes-windows-defender-advanced-threat-protection.md).
-35 | The script failed to find needed onboarding status registry value | When the SENSE service starts for the first time, it writes onboarding status to the registry location
```HKLM\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status```.
The script failed to find it after several seconds. You can manually test it and check if it's there. For more information on events and errors related to SENSE, see [Review events and errors on endpoints with Event viewer](event-error-codes-windows-defender-advanced-threat-protection.md).
-40 | SENSE service onboarding status is not set to **1** | The SENSE service has failed to onboard properly. For more information on events and errors related to SENSE, see [Review events and errors on endpoints with Event viewer](event-error-codes-windows-defender-advanced-threat-protection.md).
+30 | The script failed to wait for the service to start running | The service could have taken more time to start or has encountered errors while trying to start. For more information on events and errors related to SENSE, see [Review events and errors using Event viewer](event-error-codes-windows-defender-advanced-threat-protection.md).
+35 | The script failed to find needed onboarding status registry value | When the SENSE service starts for the first time, it writes onboarding status to the registry location
```HKLM\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status```.
The script failed to find it after several seconds. You can manually test it and check if it's there. For more information on events and errors related to SENSE, see [Review events and errors using Event viewer](event-error-codes-windows-defender-advanced-threat-protection.md).
+40 | SENSE service onboarding status is not set to **1** | The SENSE service has failed to onboard properly. For more information on events and errors related to SENSE, see [Review events and errors using Event viewer](event-error-codes-windows-defender-advanced-threat-protection.md).
65 | Insufficient privileges| Run the script again with administrator privileges.
## Troubleshoot onboarding issues using Microsoft Intune
You can use Microsoft Intune to check error codes and attempt to troubleshoot the cause of the issue.
-If you have configured policies in Intune and they are not propagated on endpoints, you might need to configure automatic MDM enrollment. For more information, see the [Configure automatic MDM enrollment](https://go.microsoft.com/fwlink/?linkid=829597) section.
+If you have configured policies in Intune and they are not propagated on machines, you might need to configure automatic MDM enrollment. For more information, see the [Configure automatic MDM enrollment](https://go.microsoft.com/fwlink/?linkid=829597) section.
Use the following tables to understand the possible causes of issues while onboarding:
@@ -88,14 +88,14 @@ Use the following tables to understand the possible causes of issues while onboa
- Known issues with non-compliance table
- Mobile Device Management (MDM) event logs table
-If none of the event logs and troubleshooting steps work, download the Local script from the **Endpoint management** section of the portal, and run it in an elevated command prompt.
+If none of the event logs and troubleshooting steps work, download the Local script from the **Machine management** section of the portal, and run it in an elevated command prompt.
**Microsoft Intune error codes and OMA-URIs**:
Error Code Hex | Error Code Dec | Error Description | OMA-URI | Possible cause and troubleshooting steps
:---|:---|:---|:---|:---
-0x87D1FDE8 | -2016281112 | Remediation failed | Onboarding
Offboarding | **Possible cause:** Onboarding or offboarding failed on a wrong blob: wrong signature or missing PreviousOrgIds fields.
**Troubleshooting steps:**
Check the event IDs in the [View agent onboarding errors in the endpoint event log](#view-agent-onboarding-errors-in-the-endpoint-event-log) section.
Check the MDM event logs in the following table or follow the instructions in [Diagnose MDM failures in Windows 10](https://msdn.microsoft.com/library/windows/hardware/mt632120%28v=vs.85%29.aspx).
+0x87D1FDE8 | -2016281112 | Remediation failed | Onboarding
Offboarding | **Possible cause:** Onboarding or offboarding failed on a wrong blob: wrong signature or missing PreviousOrgIds fields.
**Troubleshooting steps:**
Check the event IDs in the [View agent onboarding errors in the machine event log](#view-agent-onboarding-errors-in-the-endpoint-event-log) section.
Check the MDM event logs in the following table or follow the instructions in [Diagnose MDM failures in Windows 10](https://msdn.microsoft.com/library/windows/hardware/mt632120%28v=vs.85%29.aspx).
| | | | Onboarding
Offboarding
SampleSharing | **Possible cause:** Windows Defender ATP Policy registry key does not exist or the OMA DM client doesn't have permissions to write to it.
**Troubleshooting steps:** Ensure that the following registry key exists: ```HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection```
If it doesn't exist, open an elevated command and add the key.
| | | | SenseIsRunning
OnboardingState
OrgId | **Possible cause:** An attempt to remediate by read-only property. Onboarding has failed.
**Troubleshooting steps:** Check the troubleshooting steps in [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](#troubleshoot-windows-defender-advanced-threat-protection-onboarding-issues).
Check the MDM event logs in the following table or follow the instructions in [Diagnose MDM failures in Windows 10](https://msdn.microsoft.com/library/windows/hardware/mt632120%28v=vs.85%29.aspx).
|| | | All | **Possible cause:** Attempt to deploy Windows Defender ATP on non-supported SKU/Platform, particularly Holographic SKU.
Currently is supported platforms: Enterprise, Education, and Professional.
Server is not supported.
@@ -125,16 +125,16 @@ ID | Severity | Event description | Troubleshooting steps
:---|:---|:---|:---
1819 | Error | Windows Defender Advanced Threat Protection CSP: Failed to Set Node's Value. NodeId: (%1), TokenName: (%2), Result: (%3). | Download the [Cumulative Update for Windows 10, 1607](https://go.microsoft.com/fwlink/?linkid=829760).
-## Troubleshoot onboarding issues on the endpoint
-If the deployment tools used does not indicate an error in the onboarding process, but endpoints are still not appearing in the machines list in an hour, go through the following verification topics to check if an error occurred with the Windows Defender ATP agent:
-- [View agent onboarding errors in the endpoint event log](#view-agent-onboarding-errors-in-the-endpoint-event-log)
+## Troubleshoot onboarding issues on the machine
+If the deployment tools used does not indicate an error in the onboarding process, but machines are still not appearing in the machines list in an hour, go through the following verification topics to check if an error occurred with the Windows Defender ATP agent:
+- [View agent onboarding errors in the machine event log](#view-agent-onboarding-errors-in-the-endpoint-event-log)
- [Ensure the diagnostic data service is enabled](#ensure-the-diagnostics-service-is-enabled)
- [Ensure the service is set to start](#ensure-the-service-is-set-to-start)
-- [Ensure the endpoint has an Internet connection](#ensure-the-endpoint-has-an-internet-connection)
+- [Ensure the machine has an Internet connection](#ensure-the-endpoint-has-an-internet-connection)
- [Ensure that Windows Defender Antivirus is not disabled by a policy](#ensure-that-windows-defender-antivirus-is-not-disabled-by-a-policy)
-### View agent onboarding errors in the endpoint event log
+### View agent onboarding errors in the machine event log
1. Click **Start**, type **Event Viewer**, and press **Enter**.
@@ -155,16 +155,16 @@ If the deployment tools used does not indicate an error in the onboarding proces
Event ID | Message | Resolution steps
:---|:---|:---
-5 | Windows Defender Advanced Threat Protection service failed to connect to the server at _variable_ | [Ensure the endpoint has Internet access](#ensure-the-endpoint-has-an-internet-connection).
-6 | Windows Defender Advanced Threat Protection service is not onboarded and no onboarding parameters were found. Failure code: _variable_ | [Run the onboarding script again](configure-endpoints-windows-defender-advanced-threat-protection.md).
-7 | Windows Defender Advanced Threat Protection service failed to read the onboarding parameters. Failure code: _variable_ | [Ensure the endpoint has Internet access](#ensure-the-endpoint-has-an-internet-connection), then run the entire onboarding process again.
-9 | Windows Defender Advanced Threat Protection service failed to change its start type. Failure code: variable | If the event happened during onboarding, reboot and re-attempt running the onboarding script. For more information, see [Run the onboarding script again](configure-endpoints-windows-defender-advanced-threat-protection.md).
If the event happened during offboarding, contact support.
-10 | Windows Defender Advanced Threat Protection service failed to persist the onboarding information. Failure code: variable | If the event happened during onboarding, re-attempt running the onboarding script. For more information, see [Run the onboarding script again](configure-endpoints-windows-defender-advanced-threat-protection.md).
If the problem persists, contact support.
-15 | Windows Defender Advanced Threat Protection cannot start command channel with URL: _variable_ | [Ensure the endpoint has Internet access](#ensure-the-endpoint-has-an-internet-connection).
-17 | Windows Defender Advanced Threat Protection service failed to change the Connected User Experiences and Telemetry service location. Failure code: variable | [Run the onboarding script again](configure-endpoints-windows-defender-advanced-threat-protection.md). If the problem persists, contact support.
+5 | Windows Defender Advanced Threat Protection service failed to connect to the server at _variable_ | [Ensure the machine has Internet access](#ensure-the-endpoint-has-an-internet-connection).
+6 | Windows Defender Advanced Threat Protection service is not onboarded and no onboarding parameters were found. Failure code: _variable_ | [Run the onboarding script again](configure-endpoints-script-windows-defender-advanced-threat-protection.md).
+7 | Windows Defender Advanced Threat Protection service failed to read the onboarding parameters. Failure code: _variable_ | [Ensure the machine has Internet access](#ensure-the-endpoint-has-an-internet-connection), then run the entire onboarding process again.
+9 | Windows Defender Advanced Threat Protection service failed to change its start type. Failure code: variable | If the event happened during onboarding, reboot and re-attempt running the onboarding script. For more information, see [Run the onboarding script again](configure-endpoints-script-windows-defender-advanced-threat-protection.md).
If the event happened during offboarding, contact support.
+10 | Windows Defender Advanced Threat Protection service failed to persist the onboarding information. Failure code: variable | If the event happened during onboarding, re-attempt running the onboarding script. For more information, see [Run the onboarding script again](configure-endpoints-script-windows-defender-advanced-threat-protection.md).
If the problem persists, contact support.
+15 | Windows Defender Advanced Threat Protection cannot start command channel with URL: _variable_ | [Ensure the machine has Internet access](#ensure-the-endpoint-has-an-internet-connection).
+17 | Windows Defender Advanced Threat Protection service failed to change the Connected User Experiences and Telemetry service location. Failure code: variable | [Run the onboarding script again](configure-endpoints-script-windows-defender-advanced-threat-protection.md). If the problem persists, contact support.
25 | Windows Defender Advanced Threat Protection service failed to reset health status in the registry. Failure code: _variable_ | Contact support.
27 | Failed to enable Windows Defender Advanced Threat Protection mode in Windows Defender. Onboarding process failed. Failure code: variable | Contact support.
-29 | Failed to read the offboarding parameters. Error type: %1, Error code: %2, Description: %3 | Ensure the endpoint has Internet access, then run the entire offboarding process again.
+29 | Failed to read the offboarding parameters. Error type: %1, Error code: %2, Description: %3 | Ensure the machine has Internet access, then run the entire offboarding process again.
30 | Failed to disable $(build.sense.productDisplayName) mode in Windows Defender Advanced Threat Protection. Failure code: %1 | Contact support.
32 | $(build.sense.productDisplayName) service failed to request to stop itself after offboarding process. Failure code: %1 | Verify that the service start type is manual and reboot the machine.
55 | Failed to create the Secure ETW autologger. Failure code: %1 | Reboot the machine.
@@ -174,11 +174,11 @@ Event ID | Message | Resolution steps
69 | The service is stopped. Service name: %1 | Start the mentioned service. Contact support if persists.
-There are additional components on the endpoint that the Windows Defender ATP agent depends on to function properly. If there are no onboarding related errors in the Windows Defender ATP agent event log, proceed with the following steps to ensure that the additional components are configured correctly.
+There are additional components on the machine that the Windows Defender ATP agent depends on to function properly. If there are no onboarding related errors in the Windows Defender ATP agent event log, proceed with the following steps to ensure that the additional components are configured correctly.
### Ensure the diagnostic data service is enabled
-If the endpoints aren't reporting correctly, you might need to check that the Windows 10 diagnostic data service is set to automatically start and is running on the endpoint. The service might have been disabled by other programs or user configuration changes.
+If the machines aren't reporting correctly, you might need to check that the Windows 10 diagnostic data service is set to automatically start and is running on the machine. The service might have been disabled by other programs or user configuration changes.
First, you should check that the service is set to start automatically when Windows starts, then you should check that the service is currently running (and start it if it isn't).
@@ -186,7 +186,7 @@ First, you should check that the service is set to start automatically when Wind
**Use the command line to check the Windows 10 diagnostic data service startup type**:
-1. Open an elevated command-line prompt on the endpoint:
+1. Open an elevated command-line prompt on the machine:
a. Click **Start**, type **cmd**, and press **Enter**.
@@ -207,7 +207,7 @@ First, you should check that the service is set to start automatically when Wind
**Use the command line to set the Windows 10 diagnostic data service to automatically start:**
-1. Open an elevated command-line prompt on the endpoint:
+1. Open an elevated command-line prompt on the machine:
a. Click **Start**, type **cmd**, and press **Enter**.
@@ -233,7 +233,7 @@ First, you should check that the service is set to start automatically when Wind
sc start diagtrack
```
-### Ensure the endpoint has an Internet connection
+### Ensure the machine has an Internet connection
The Window Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to report sensor data and communicate with the Windows Defender ATP service.
@@ -248,7 +248,7 @@ If the verification fails and your environment is using a proxy to connect to th
**Symptom**: Onboarding successfully completes, but you see error 577 when trying to start the service.
-**Solution**: If your endpoints are running a third-party antimalware client, the Windows Defender ATP agent needs the Windows Defender Early Launch Antimalware (ELAM) driver to be enabled. You must ensure that it's not disabled in system policy.
+**Solution**: If your machines are running a third-party antimalware client, the Windows Defender ATP agent needs the Windows Defender Early Launch Antimalware (ELAM) driver to be enabled. You must ensure that it's not disabled in system policy.
- Depending on the tool that you use to implement policies, you'll need to verify that the following Windows Defender policies are cleared:
@@ -259,7 +259,7 @@ If the verification fails and your environment is using a proxy to connect to th
- ```
-Hyper-V Hypervisor, which is enabled automatically. No further action is needed.
+5. Click **Ok** to close the editor.
-- With an earlier version of Windows 10:
-Hyper-V Hypervisor and Isolated User Mode (shown in Figure 1).
-
-
-
-**Figure 1. Enable operating system features for HVCI, Windows 10, version 1511**
-
-> [!NOTE]
-> You can configure these features by using Group Policy or Dism.exe, or manually by using Windows PowerShell or the Windows Features dialog box.
-
-## Enable virtualization-based protection of code integrity
-
-If you don't want to use the [hardware readiness tool](https://www.microsoft.com/en-us/download/details.aspx?id=53337), you can use Group Policy or the Registry to enable HVCI.
-
-### Use Group Policy to enable virtualization-based protection of code integrity
-
-1. To create a new GPO, right-click the OU where you want to link the GPO, and then click **Create a GPO in this domain, and Link it here**.
-
- 
-
- Figure 2. Create a new OU-linked GPO
-
-2. Give the new GPO a name, then right-click the new GPO, and click **Edit**.
-
-4. Within the selected GPO, navigate to Computer Configuration\\Policies\\Administrative Templates\\System\\Device Guard. Right-click **Turn On Virtualization Based Security**, and then click **Edit**.
-
- 
-
- Figure 3. Enable virtualization-based security (VBS)
-
-5. Select the **Enabled** button. For **Select Platform Security Level**:
-
- - **Secure Boot** provides as much protection as a computer’s hardware can support. If the computer does not have input/output memory management units (IOMMUs), enable **Secure Boot**.
- - **Secure Boot with DMA** enables Secure Boot—and VBS itself—only on a computer that supports DMA, that is, a computer with IOMMUs. With this setting, any computer without IOMMUs will not have VBS or HVCI protection, although it can have WDAC enabled.
For information about how VBS uses the hypervisor to strengthen protections provided by WDAC, see [How Windows Defender Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md#how-windows-defender-device-guard-features-help-protect-against-threats).
-
- For **Virtualization Based Protection of Code Integrity**:
-
- - Beginning with Windows 10, version 1607 and Windows Server 2016:
For an initial deployment or test deployment, we recommend **Enabled without lock**.
When your deployment is stable, we recommend changing to **Enabled with UEFI lock**. This option helps protect the registry from tampering, either through malware or by an unauthorized person.
-
- - With earlier versions of Windows 10:
Select the **Enable Virtualization Based Protection of Code Integrity** check box.
-
- 
-
- Figure 5. Configure HVCI, Lock setting (in Windows 10, version 1607)
-
-7. Close the Group Policy Management Editor, and then restart the Windows 10 test computer. The settings will take effect upon restart.
-
-8. Check Device Guard logs in Event Viewer at **Applications and Services Logs\\Microsoft\\Windows\\DeviceGuard-GPEXT\\Operational** for Event ID 7000, which contains the selected settings within a GPO that has been successfully processed. This event is logged only when Group Policy is used.
+To apply the new policy on a domain-joined computer, either restart or run `gpupdate /force` in an elevated command prompt.
### Use registry keys to enable virtualization-based protection of code integrity
@@ -93,7 +53,7 @@ Set the following registry keys to enable HVCI. This provides exactly the same s
> [!IMPORTANT]
-> - Among the commands that follow, you can choose settings for **Secure Boot** and **Secure Boot with DMA**. In most situations, we recommend that you choose **Secure Boot**. This option provides Secure Boot with as much protection as is supported by a given computer’s hardware. A computer with input/output memory management units (IOMMUs) will have Secure Boot with DMA protection. A computer without IOMMUs will simply have Secure Boot enabled.
In contrast, with **Secure Boot with DMA**, the setting will enable Secure Boot—and VBS itself—only on a computer that supports DMA, that is, a computer with IOMMUs. With this setting, any computer without IOMMUs will not have VBS or HVCI protection, although it can still have WDAC enabled.
For information about how VBS uses the hypervisor to strengthen protections provided by WDAC, see [How Windows Defender Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md#how-windows-defender-device-guard-features-help-protect-against-threats).
+> - Among the commands that follow, you can choose settings for **Secure Boot** and **Secure Boot with DMA**. In most situations, we recommend that you choose **Secure Boot**. This option provides Secure Boot with as much protection as is supported by a given computer’s hardware. A computer with input/output memory management units (IOMMUs) will have Secure Boot with DMA protection. A computer without IOMMUs will simply have Secure Boot enabled.
In contrast, with **Secure Boot with DMA**, the setting will enable Secure Boot—and VBS itself—only on a computer that supports DMA, that is, a computer with IOMMUs. With this setting, any computer without IOMMUs will not have VBS or HVCI protection, although it can still have WDAC enabled.
> - All drivers on the system must be compatible with virtualization-based protection of code integrity; otherwise, your system may fail. We recommend that you enable these features on a group of test computers before you enable them on users' computers.
#### For Windows 1607 and above
@@ -281,14 +241,38 @@ This field indicates whether VBS is enabled and running.
This field lists the computer name. All valid values for computer name.
-Another method to determine the available and enabled Windows Defender Device Guard features is to run msinfo32.exe from an elevated PowerShell session. When you run this program, the Windows Defender Device Guard properties are displayed at the bottom of the **System Summary** section, as shown in Figure 6.
+Another method to determine the available and enabled Windows Defender Device Guard features is to run msinfo32.exe from an elevated PowerShell session. When you run this program, the Windows Defender Device Guard properties are displayed at the bottom of the **System Summary** section.
-Figure 6. Windows Defender Device Guard properties in the System Summary
-## Related topics
+## Troubleshooting
-- [Introduction to Windows Defender Device Guard: virtualization-based security and Windows Defender Application Control](introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md)
+A. If a device driver fails to load or crashes at runtime, you may be able to update the driver using **Device Manager**.
-- [Deploy Windows Defender Application Control](deploy-windows-defender-application-control.md)
+B. If you experience software or device malfunction after using the above procedure to turn on HVCI, but you are able to log in to Windows, you can turn off HVCI by renaming or deleting the SIPolicy.p7b file from the file location in step 3 above and then restart your device.
+
+C. If you experience a critical error during boot or your system is unstable after using the above procedure to turn on HVCI, you can recover using the Windows Recovery Environment (Windows RE). To boot to Windows RE, see [Windows RE Technical Reference](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-recovery-environment--windows-re--technical-reference). After logging in to Windows RE, you can turn off HVCI by renaming or deleting the SIPolicy.p7b file from the file location in step 3 above and then restart your device.
+
+## How to turn off HVCI on the Windows 10 Fall Creators Update
+
+1. Rename or delete the SIPolicy.p7b file located at C:\Windows\System32\CodeIntegrity.
+2. Restart the device.
+3. To confirm HVCI has been successfully disabled, open System Information and check **Virtualization-based security Services Running**, which should now have no value displayed.
+
+## HVCI deployment in virtual machines
+
+HVCI can protect a Hyper-V virtual machine, just as it would a physical machine. The steps to enable WDAC are the same from within the virtual machine.
+
+WDAC protects against malware running in the guest virtual machine. It does not provide additional protection from the host administrator. From the host, you can disable WDAC for a virtual machine:
+
+```powershell
+Set-VMSecurity -VMName
plus **extended page tables** | These hardware features are required for VBS:
One of the following virtualization extensions:
• VT-x (Intel) or
• AMD-V
And:
• Extended page tables, also called Second Level Address Translation (SLAT). | VBS provides isolation of the secure kernel from the normal operating system. Vulnerabilities and zero-days in the normal operating system cannot be exploited because of this isolation. |
+| Firmware: **UEFI firmware version 2.3.1.c or higher with UEFI Secure Boot** | See the following Windows Hardware Compatibility Program requirement: [System.Fundamentals.Firmware.UEFISecureBoot](https://docs.microsoft.com/windows-hardware/design/compatibility/systems#systemfundamentalsfirmwareuefisecureboot) | UEFI Secure Boot helps ensure that the device boots only authorized code. This can prevent boot kits and root kits from installing and persisting across reboots. |
+| Firmware: **Secure firmware update process** | UEFI firmware must support secure firmware update found under the following Windows Hardware Compatibility Program requirement: [System.Fundamentals.Firmware.UEFISecureBoot](https://docs.microsoft.com/windows-hardware/design/compatibility/systems#systemfundamentalsfirmwareuefisecureboot) | UEFI firmware just like software can have security vulnerabilities that, when found, need to be patched through firmware updates. Patching helps prevent root kits from getting installed. |
+| Software: **HVCI compatible drivers** | See the Windows Hardware Compatibility Program requirements under [Filter.Driver.DeviceGuard.DriverCompatibility](https://docs.microsoft.com/windows-hardware/design/compatibility/filter#filterdriverdeviceguarddrivercompatibility).| [HVCI Compatible](https://blogs.msdn.microsoft.com/windows_hardware_certification/2015/05/22/driver-compatibility-with-device-guard-in-windows-10/) drivers help ensure that VBS can maintain appropriate memory permissions. This increases resistance to bypassing vulnerable kernel drivers and helps ensure that malware cannot run in kernel. Only code verified through code integrity can run in kernel mode. |
+| Software: Qualified **Windows operating system** | Windows 10 Enterprise, Windows 10 Education, Windows Server 2016, or Windows 10 IoT Enterprise
| Support for VBS and for management features that simplify configuration of Windows Defender Device Guard. |
+
+> **Important** The following tables list additional qualifications for improved security. You can use Windows Defender Device Guard with hardware, firmware, and software that support baseline protections, even if they do not support protections for improved security. However, we strongly recommend meeting these additional qualifications to significantly strengthen the level of security that Windows Defender Device Guard can provide.
+
+## Additional qualifications for improved security
+
+The following tables describe additional hardware and firmware qualifications, and the improved security that is available when these qualifications are met.
+
+
+### Additional security qualifications starting with Windows 10, version 1507, and Windows Server 2016, Technical Preview 4
+
+| Protections for Improved Security | Description | Security benefits |
+|---------------------------------------------|----------------------------------------------------|------|
+| Firmware: **Securing Boot Configuration and Management** | • BIOS password or stronger authentication must be supported.
Windows Server 2016 running as a domain controller does not support Windows Defender Credential Guard. Only virtualization-based protection of code integrity is supported in this configuration.
• In the BIOS configuration, BIOS authentication must be set.
• There must be support for protected BIOS option to configure list of permitted boot devices (for example, “Boot only from internal hard drive”) and boot device order, overriding BOOTORDER modification made by operating system.
• In the BIOS configuration, BIOS options related to security and boot options (list of permitted boot devices, boot order) must be secured to prevent other operating systems from starting and to prevent changes to the BIOS settings. | • BIOS password or stronger authentication helps ensure that only authenticated Platform BIOS administrators can change BIOS settings. This helps protect against a physically present user with BIOS access.
• Boot order when locked provides protection against the computer being booted into WinRE or another operating system on bootable media. |
+
+
+
+### Additional security qualifications starting with Windows 10, version 1607, and Windows Server 2016
+
+
+| Protections for Improved Security | Description | Security benefits |
+|---------------------------------------------|----------------------------------------------------|-----|
+| Firmware: **Hardware Rooted Trust Platform Secure Boot** | • Boot Integrity (Platform Secure Boot) must be supported. See the Windows Hardware Compatibility Program requirements under [System.Fundamentals.Firmware.CS.UEFISecureBoot.ConnectedStandby](https://docs.microsoft.com/windows-hardware/design/compatibility/systems#systemfundamentalsfirmwarecsuefisecurebootconnectedstandby)
• The Hardware Security Test Interface (HSTI) 1.1.a must be implemented. See [Hardware Security Testability Specification](https://docs.microsoft.com/windows-hardware/test/hlk/testref/hardware-security-testability-specification). | • Boot Integrity (Platform Secure Boot) from Power-On provides protections against physically present attackers, and defense-in-depth against malware.
• HSTI 1.1.a provides additional security assurance for correctly secured silicon and platform. |
+| Firmware: **Firmware Update through Windows Update** | Firmware must support field updates through Windows Update and UEFI encapsulation update. | Helps ensure that firmware updates are fast, secure, and reliable. |
+| Firmware: **Securing Boot Configuration and Management** | • Required BIOS capabilities: Ability of OEM to add ISV, OEM, or Enterprise Certificate in Secure Boot DB at manufacturing time.
• Required configurations: Microsoft UEFI CA must be removed from Secure Boot DB. Support for 3rd-party UEFI modules is permitted but should leverage ISV-provided certificates or OEM certificate for the specific UEFI software.| • Enterprises can choose to allow proprietary EFI drivers/applications to run.
• Removing Microsoft UEFI CA from Secure Boot DB provides full control to enterprises over software that runs before the operating system boots. |
+
+
+
+### Additional security qualifications starting with Windows 10, version 1703
+
+
+| Protections for Improved Security | Description | Security benefits |
+|---------------------------------------------|----------------------------------------------------|------|
+| Firmware: **VBS enablement of NX protection for UEFI runtime services** | • VBS will enable No-Execute (NX) protection on UEFI runtime service code and data memory regions. UEFI runtime service code must support read-only page protections, and UEFI runtime service data must not be exceutable.
• UEFI runtime service must meet these requirements:
• Implement UEFI 2.6 EFI_MEMORY_ATTRIBUTES_TABLE. All UEFI runtime service memory (code and data) must be described by this table.
• PE sections need to be page-aligned in memory (not required for in non-volitile storage).
• The Memory Attributes Table needs to correctly mark code and data as RO/NX for configuration by the OS:
• All entries must include attributes EFI_MEMORY_RO, EFI_MEMORY_XP, or both
• No entries may be left with neither of the above attributes, indicating memory that is both exceutable and writable. Memory must be either readable and executable or writeable and non-executable.
• This only applies to UEFI runtime service memory, and not UEFI boot service memory.
• This protection is applied by VBS on OS page tables.
Please also note the following:
• Do not use sections that are both writeable and exceutable
• Do not attempt to directly modify executable system memory
• Do not use dynamic code | • Vulnerabilities in UEFI runtime, if any, will be blocked from compromising VBS (such as in functions like UpdateCapsule and SetVariable)
• Reduces the attack surface to VBS from system firmware. |
+| Firmware: **Firmware support for SMM protection** | The [Windows SMM Security Mitigations Table (WSMT) specification](http://download.microsoft.com/download/1/8/A/18A21244-EB67-4538-BAA2-1A54E0E490B6/WSMT.docx) contains details of an Advanced Configuration and Power Interface (ACPI) table that was created for use with Windows operating systems that support Windows virtualization-based security (VBS) features.| • Protects against potential vulnerabilities in UEFI runtime services, if any, will be blocked from compromising VBS (such as in functions like UpdateCapsule and SetVariable)
• Reduces the attack surface to VBS from system firmware.
• Blocks additional security attacks against SMM. |
+
diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-asr.md b/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-asr.md
index 17d4105837..9080ea0988 100644
--- a/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-asr.md
+++ b/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-asr.md
@@ -9,16 +9,16 @@ ms.mktglfcycl: manage
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: iaanw
-ms.author: iawilt
-ms.date: 12/12/2017
+author: andreabichsel
+ms.author: v-anbic
+ms.date: 04/30/2018
---
# Troubleshoot Attack surface reduction rules
**Applies to:**
-- Windows 10, version 1709
+- Windows 10, version 1709 or higher
**Audience**
@@ -45,7 +45,7 @@ There are four steps to troubleshooting these problems:
Attack surface reduction (ASR) will only work on devices with the following conditions:
>[!div class="checklist"]
-> - Endpoints are running Windows 10, version 1709 (also known as the Fall Creators Update).
+> - Endpoints are running Windows 10 Enterprise edition, version 1709 (also known as the Fall Creators Update).
> - Endpoints are using Windows Defender Antivirus as the sole antivirus protection app. [Using any other antivirus app will cause Windows Defender AV to disable itself](../windows-defender-antivirus/windows-defender-antivirus-compatibility.md).
> - [Real-time protection](../windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) is enabled.
> - Audit mode is not enabled. Use Group Policy to set the rule to **Disabled** (value: **0**) as described in the [Enable ASR topic](enable-attack-surface-reduction.md#use-group-policy-to-enable-or-audit-attack-surface-reduction-rules).
diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-exploit-protection-mitigations.md b/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-exploit-protection-mitigations.md
index eb71a22518..250b4353fb 100644
--- a/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-exploit-protection-mitigations.md
+++ b/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-exploit-protection-mitigations.md
@@ -11,7 +11,7 @@ ms.pagetype: security
localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 01/31/18
+ms.date: 04/30/2018
---
@@ -21,7 +21,7 @@ ms.date: 01/31/18
**Applies to:**
-- Windows 10, version 1709
+- Windows 10, version 1709 and later
diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-np.md b/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-np.md
index bb99de7665..4bd048b729 100644
--- a/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-np.md
+++ b/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-np.md
@@ -9,8 +9,8 @@ ms.mktglfcycl: manage
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: iaanw
-ms.author: iawilt
+author: andreabichsel
+ms.author: v-anbic
ms.date: 12/12/2017
---
@@ -18,7 +18,7 @@ ms.date: 12/12/2017
**Applies to:**
-- Windows 10, version 1709
+- Windows 10, version 1709 or higher
**Audience**
@@ -45,7 +45,7 @@ There are four steps to troubleshooting these problems:
Windows Defender Exploit Guard will only work on devices with the following conditions:
>[!div class="checklist"]
-> - Endpoints are running Windows 10, version 1709 (also known as the Fall Creators Update).
+> - Endpoints are running Windows 10 Enterprise edition, version 1709 or higher (also known as the Fall Creators Update).
> - Endpoints are using Windows Defender Antivirus as the sole antivirus protection app. [Using any other antivirus app will cause Windows Defender AV to disable itself](../windows-defender-antivirus/windows-defender-antivirus-compatibility.md).
> - [Real-time protection](../windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) is enabled.
> - [Cloud-delivered protection](../windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md) is enabled.
diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md b/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md
index d75309c31b..996a0d79d9 100644
--- a/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md
+++ b/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md
@@ -11,7 +11,7 @@ ms.pagetype: security
localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 12/12/2017
+ms.date: 04/30/2018
---
@@ -21,7 +21,7 @@ ms.date: 12/12/2017
**Applies to:**
-- Windows 10, version 1709
+- Windows 10, version 1709 and later
@@ -38,6 +38,10 @@ There are four features in Windows Defender EG:
- [Network protection](network-protection-exploit-guard.md) extends the malware and social engineering protection offered by Windows Defender SmartScreen in Microsoft Edge to cover network traffic and connectivity on your organization's devices. Requires Windows Defender AV.
- [Controlled folder access](controlled-folders-exploit-guard.md) helps protect files in key system folders from changes made by malicious and suspicious apps, including file-encrypting ransomware malware. Requires Windows Defender AV.
+Windows 10, version 1803 provides additional protections:
+
+- New Attack surface reduction rules
+- Controlled folder access can now block disk sectors
You can evaluate each feature of Windows Defender EG with the guides at the following link, which provide pre-built PowerShell scripts and testing tools so you can see the features in action:
- [Evaluate Windows Defender Exploit Guard](evaluate-windows-defender-exploit-guard.md)
@@ -59,18 +63,31 @@ You can use the Windows Defender ATP console to obtain detailed reporting into e
## Requirements
-Each of the features in Windows Defender EG have slightly different requirements:
+This section covers requirements for each feature in Windows Defender EG.
-Feature | [Windows Defender Antivirus](../windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md) | [Windows Defender Advanced Threat Protection license](../windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md)
--|-|-|-
-Exploit protection | No requirement | Required for reporting in the Windows Defender ATP console
-Attack surface reduction | [Real-time protection](../windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) must be enabled | Required for reporting in the Windows Defender ATP console
-Network protection | [Real-time protection](../windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) must be enabled | Required for reporting in the Windows Defender ATP console
-Controlled folder access | [Real-time protection](../windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) must be enabled | Required for reporting in the Windows Defender ATP console
+| Symbol | Support |
+|--------|---------|
+|  | Not supported |
+|  | Supported |
+|  | Includes advanced exploit protection for the kernel mode via [HVCI](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/enable-virtualization-based-protection-of-code-integrity) |
+|  | Includes automated reporting into the Windows Defender ATP console|
-> [!NOTE]
-> Each feature's requirements are further described in the individual topics in this library.
+| Feature | Windows 10 Home | Windows 10 Professional | Windows 10 E3 | Windows 10 E5 |
+| ----------------- | :------------------------------------: | :---------------------------: | :-------------------------: | :--------------------------------------: |
+| Exploit protection |  |  |  |  |
+| Attack surface reduction |  |  |  |  |
+| Network protection |  |  |  |  |
+| Controlled folder access |  |  |  |  |
+
+The following table lists which features in Windows Defender EG require enabling [real-time protection](../windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) from Windows Defender Antivirus.
+
+| Feature | Real-time protection |
+|-----------------| ------------------------------------ |
+| Exploit protection | No requirement |
+| Attack surface reduction | Must be enabled |
+| Network protection | Must be enabled |
+| Controlled folder access | Must be enabled |
## In this library
diff --git a/windows/security/threat-protection/windows-defender-security-center/TOC.md b/windows/security/threat-protection/windows-defender-security-center/TOC.md
new file mode 100644
index 0000000000..92d6f70f01
--- /dev/null
+++ b/windows/security/threat-protection/windows-defender-security-center/TOC.md
@@ -0,0 +1,15 @@
+# [The Windows Defender Security Center app](windows-defender-security-center.md)
+
+
+## [Customize the Windows Defender Security Center app for your organization](wdsc-customize-contact-information.md)
+## [Hide Windows Defender Security Center app notifications](wdsc-hide-notifications.md)
+## [Manage Windows Defender Security Center in Windows 10 in S mode](wdsc-windows-10-in-s-mode.md)
+## [Virus and threat protection](wdsc-virus-threat-protection.md)
+## [Account protection](wdsc-account-protection.md)
+## [Firewall and network protection](wdsc-firewall-network-protection.md)
+## [App and browser control](wdsc-app-browser-control.md)
+## [Device security](wdsc-device-security.md)
+## [Device performance and health](wdsc-device-performance-health.md)
+## [Family options](wdsc-family-options.md)
+
+
diff --git a/windows/security/threat-protection/windows-defender-security-center/images/security-center-custom-flyout.png b/windows/security/threat-protection/windows-defender-security-center/images/security-center-custom-flyout.png
index ea5b039dd9..bf7a3e3910 100644
Binary files a/windows/security/threat-protection/windows-defender-security-center/images/security-center-custom-flyout.png and b/windows/security/threat-protection/windows-defender-security-center/images/security-center-custom-flyout.png differ
diff --git a/windows/security/threat-protection/windows-defender-security-center/images/security-center-home.png b/windows/security/threat-protection/windows-defender-security-center/images/security-center-home.png
index 601b2a32b8..13d6f59afc 100644
Binary files a/windows/security/threat-protection/windows-defender-security-center/images/security-center-home.png and b/windows/security/threat-protection/windows-defender-security-center/images/security-center-home.png differ
diff --git a/windows/security/threat-protection/windows-defender-security-center/images/security-center-taskbar.png b/windows/security/threat-protection/windows-defender-security-center/images/security-center-taskbar.png
index a35daeb1f4..0d1acbe82c 100644
Binary files a/windows/security/threat-protection/windows-defender-security-center/images/security-center-taskbar.png and b/windows/security/threat-protection/windows-defender-security-center/images/security-center-taskbar.png differ
diff --git a/windows/security/threat-protection/windows-defender-security-center/images/security-center-virus-and-threat-protection-windows-10-in-s-mode.png b/windows/security/threat-protection/windows-defender-security-center/images/security-center-virus-and-threat-protection-windows-10-in-s-mode.png
new file mode 100644
index 0000000000..abf5a30659
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-security-center/images/security-center-virus-and-threat-protection-windows-10-in-s-mode.png differ
diff --git a/windows/security/threat-protection/windows-defender-security-center/images/settings-windows-defender-security-center-areas.PNG b/windows/security/threat-protection/windows-defender-security-center/images/settings-windows-defender-security-center-areas.PNG
new file mode 100644
index 0000000000..ab123cc49b
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-security-center/images/settings-windows-defender-security-center-areas.PNG differ
diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-account-protection.md b/windows/security/threat-protection/windows-defender-security-center/wdsc-account-protection.md
new file mode 100644
index 0000000000..4dad649653
--- /dev/null
+++ b/windows/security/threat-protection/windows-defender-security-center/wdsc-account-protection.md
@@ -0,0 +1,58 @@
+---
+title: Account protection in the Windows Defender Security Center app
+description: Use the Account protection section to manage security for your account and sign in to Microsoft.
+keywords: account protection, wdav, smartscreen, antivirus, wdsc, exploit, protection, hide
+search.product: eADQiWindows 10XVcnh
+ms.pagetype: security
+ms.prod: w10
+ms.mktglfcycl: manage
+ms.sitesec: library
+ms.pagetype: security
+ms.localizationpriority: medium
+author: andreabichsel
+ms.author: v-anbic
+ms.date: 04/30/2018
+---
+
+
+# Account protection
+
+**Applies to**
+
+- Windows 10, version 1803 and later
+
+
+The **Account protection** section contains information and settings for account protection and sign in. IT administrators and IT pros can get more information and documentation about configuration from the following:
+
+- [Microsoft Account](https://account.microsoft.com/account/faq)
+- [Windows Hello for Business](https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-identity-verification)
+- [Lock your Windows 10 PC automatically when you step away from it](https://support.microsoft.com/en-us/help/4028111/windows-lock-your-windows-10-pc-automatically-when-you-step-away-from)
+
+You can also choose to hide the section from users of the machine. This can be useful if you don't want employees in your organization to see or have access to user-configured options for the features shown in the section.
+
+
+## Hide the Account protection section
+
+You can choose to hide the entire section by using Group Policy. The section will not appear on the home page of the Windows Defender Security Center app, and its icon will not be shown on the navigiation bar on the side of the app.
+
+This can only be done in Group Policy.
+
+>[!IMPORTANT]
+>### Requirements
+>
+>You must have Windows 10, version 1803 or later. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings.
+
+1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
+
+3. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
+
+5. Expand the tree to **Windows components > Windows Defender Security Center > Account protection**.
+
+6. Open the **Hide the Account protection area** setting and set it to **Enabled**. Click **OK**.
+
+7. [Deploy the updated GPO as you normally do](https://msdn.microsoft.com/en-us/library/ee663280(v=vs.85).aspx).
+
+>[!NOTE]
+>If you hide all sections then the app will show a restricted interface, as in the following screenshot:
+>
+>
\ No newline at end of file
diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-app-browser-control.md b/windows/security/threat-protection/windows-defender-security-center/wdsc-app-browser-control.md
index 4bc78122e2..aa52a93e41 100644
--- a/windows/security/threat-protection/windows-defender-security-center/wdsc-app-browser-control.md
+++ b/windows/security/threat-protection/windows-defender-security-center/wdsc-app-browser-control.md
@@ -9,9 +9,9 @@ ms.mktglfcycl: manage
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: iaanw
-ms.author: iawilt
-ms.date: 10/16/2017
+author: andreabichsel
+ms.author: v-anbic
+ms.date: 04/30/2018
---
@@ -24,7 +24,7 @@ ms.date: 10/16/2017
The **App and browser control** section contains information and settings for Windows Defender SmartScreen. IT administrators and IT pros can get configuration guidance from the [Windows Defender SmartScreen documentation library](https://docs.microsoft.com/en-us/windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview).
-In Windows 10, version 1709, the section also provides configuration options for Exploit protection. You can prevent users from modifying these specific options with Group Policy. IT administrators can get more information at the [Exploit protection](../windows-defender-exploit-guard/exploit-protection-exploit-guard.md) topic in the Windows Defender Exploit Guard library.
+In Windows 10, version 1709 and later, the section also provides configuration options for Exploit protection. You can prevent users from modifying these specific options with Group Policy. IT administrators can get more information at the [Exploit protection](../windows-defender-exploit-guard/exploit-protection-exploit-guard.md) topic in the Windows Defender Exploit Guard library.
You can also choose to hide the section from users of the machine. This can be useful if you don't want employees in your organization to see or have access to user-configured options for the features shown in the section.
@@ -38,13 +38,11 @@ You can only prevent users from modifying Exploit protection settings by using G
>[!IMPORTANT]
>### Requirements
>
->You must have Windows 10, version 1709 (the Fall Creators Update). The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings.
+>You must have Windows 10, version 1709 or later. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings.
1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
-3. In the **Group Policy Management Editor** go to **Computer configuration**.
-
-4. Click **Policies** then **Administrative templates**.
+3. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
5. Expand the tree to **Windows components > Windows Defender Security Center > App and browser protection**.
@@ -65,9 +63,7 @@ This can only be done in Group Policy.
1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
-3. In the **Group Policy Management Editor** go to **Computer configuration**.
-
-4. Click **Policies** then **Administrative templates**.
+3. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
5. Expand the tree to **Windows components > Windows Defender Security Center > App and browser protection**.
diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-customize-contact-information.md b/windows/security/threat-protection/windows-defender-security-center/wdsc-customize-contact-information.md
index 5bd67138c3..b528a224eb 100644
--- a/windows/security/threat-protection/windows-defender-security-center/wdsc-customize-contact-information.md
+++ b/windows/security/threat-protection/windows-defender-security-center/wdsc-customize-contact-information.md
@@ -9,16 +9,16 @@ ms.mktglfcycl: manage
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: iaanw
-ms.author: iawilt
-ms.date: 10/16/2017
+author: andreabichsel
+ms.author: v-anbic
+ms.date: 04/30/2018
---
# Customize the Windows Defender Security Center app for your organization
**Applies to**
-- Windows 10, version 1709
+- Windows 10, version 1709 and later
**Audience**
@@ -44,7 +44,7 @@ Users can click on the displayed information to initiate a support request:
## Requirements
-You must have Windows 10, version 1709 (the Fall Creators Update). The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings.
+You must have Windows 10, version 1709 or later. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings.
## Use Group Policy to enable and customize contact information
@@ -54,9 +54,7 @@ This can only be done in Group Policy.
1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
-3. In the **Group Policy Management Editor** go to **Computer configuration**.
-
-4. Click **Policies** then **Administrative templates**.
+3. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
5. Expand the tree to **Windows components > Windows Defender Security Center > Enterprise Customization**.
diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-device-performance-health.md b/windows/security/threat-protection/windows-defender-security-center/wdsc-device-performance-health.md
index 088e882a0f..67d58174c1 100644
--- a/windows/security/threat-protection/windows-defender-security-center/wdsc-device-performance-health.md
+++ b/windows/security/threat-protection/windows-defender-security-center/wdsc-device-performance-health.md
@@ -9,9 +9,9 @@ ms.mktglfcycl: manage
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: iaanw
-ms.author: iawilt
-ms.date: 10/16/2017
+author: andreabichsel
+ms.author: v-anbic
+ms.date: 04/30/2018
---
@@ -27,7 +27,7 @@ The **Device performance & health** section contains information about hardware,
The [Windows 10 IT pro troubleshooting topic](https://docs.microsoft.com/en-us/windows/client-management/windows-10-support-solutions), and the main [Windows 10 documentation library](https://docs.microsoft.com/en-us/windows/windows-10/) can also be helpful for resolving issues.
-In Windows 10, version 1709, the section can be hidden from users of the machine. This can be useful if you don't want employees in your organization to see or have access to user-configured options for the features shown in the section.
+In Windows 10, version 1709 and later, the section can be hidden from users of the machine. This can be useful if you don't want employees in your organization to see or have access to user-configured options for the features shown in the section.
## Hide the Device performance & health section
@@ -39,13 +39,11 @@ This can only be done in Group Policy.
>[!IMPORTANT]
>### Requirements
>
->You must have Windows 10, version 1709 (the Fall Creators Update). The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings.
+>You must have Windows 10, version 1709 or later. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings.
1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
-3. In the **Group Policy Management Editor** go to **Computer configuration**.
-
-4. Click **Policies** then **Administrative templates**.
+3. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
5. Expand the tree to **Windows components > Windows Defender Security Center > Device performance and health**.
diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-device-security.md b/windows/security/threat-protection/windows-defender-security-center/wdsc-device-security.md
new file mode 100644
index 0000000000..64af9bb9d8
--- /dev/null
+++ b/windows/security/threat-protection/windows-defender-security-center/wdsc-device-security.md
@@ -0,0 +1,54 @@
+---
+title: Device security in the Windows Defender Security Center app
+description: Use the Device security section to manage security built into your device, including virtualization-based security.
+keywords: device security, device guard, wdav, smartscreen, antivirus, wdsc, exploit, protection, hide
+search.product: eADQiWindows 10XVcnh
+ms.pagetype: security
+ms.prod: w10
+ms.mktglfcycl: manage
+ms.sitesec: library
+ms.pagetype: security
+ms.localizationpriority: medium
+author: andreabichsel
+ms.author: v-anbic
+ms.date: 04/30/2018
+---
+
+
+# Device security
+
+**Applies to**
+
+- Windows 10, version 1803 and later
+
+
+The **Device security** section contains information and settings for built-in device security.
+
+You can choose to hide the section from users of the machine. This can be useful if you don't want employees in your organization to see or have access to user-configured options for the features shown in the section.
+
+
+## Hide the Device security section
+
+You can choose to hide the entire section by using Group Policy. The section will not appear on the home page of the Windows Defender Security Center app, and its icon will not be shown on the navigiation bar on the side of the app.
+
+This can only be done in Group Policy.
+
+>[!IMPORTANT]
+>### Requirements
+>
+>You must have Windows 10, version 1803 or later. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings.
+
+1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
+
+3. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
+
+5. Expand the tree to **Windows components > Windows Defender Security Center > Device security**.
+
+6. Open the **Hide the Device security area** setting and set it to **Enabled**. Click **OK**.
+
+7. [Deploy the updated GPO as you normally do](https://msdn.microsoft.com/en-us/library/ee663280(v=vs.85).aspx).
+
+>[!NOTE]
+>If you hide all sections then the app will show a restricted interface, as in the following screenshot:
+>
+>
\ No newline at end of file
diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-family-options.md b/windows/security/threat-protection/windows-defender-security-center/wdsc-family-options.md
index 14ba41602f..47bf08fc3f 100644
--- a/windows/security/threat-protection/windows-defender-security-center/wdsc-family-options.md
+++ b/windows/security/threat-protection/windows-defender-security-center/wdsc-family-options.md
@@ -9,9 +9,9 @@ ms.mktglfcycl: manage
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: iaanw
-ms.author: iawilt
-ms.date: 10/16/2017
+author: andreabichsel
+ms.author: v-anbic
+ms.date: 04/30/2018
---
@@ -38,13 +38,11 @@ This can only be done in Group Policy.
>[!IMPORTANT]
>### Requirements
>
->You must have Windows 10, version 1709 (the Fall Creators Update). The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings.
+>You must have Windows 10, version 1709 or later. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings.
1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
-3. In the **Group Policy Management Editor** go to **Computer configuration**.
-
-4. Click **Policies** then **Administrative templates**.
+3. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
5. Expand the tree to **Windows components > Windows Defender Security Center > Family options**.
diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-firewall-network-protection.md b/windows/security/threat-protection/windows-defender-security-center/wdsc-firewall-network-protection.md
index 66e975a809..4986db4e3e 100644
--- a/windows/security/threat-protection/windows-defender-security-center/wdsc-firewall-network-protection.md
+++ b/windows/security/threat-protection/windows-defender-security-center/wdsc-firewall-network-protection.md
@@ -9,9 +9,9 @@ ms.mktglfcycl: manage
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: iaanw
-ms.author: iawilt
-ms.date: 10/16/2017
+author: andreabichsel
+ms.author: v-anbic
+ms.date: 04/30/2018
---
@@ -24,7 +24,7 @@ ms.date: 10/16/2017
The **Firewall & network protection** section contains information about the firewalls and network connections used by the machine, including the status of Windows Defender Firewall and any other third-party firewalls. IT administrators and IT pros can get configuration guidance from the [Windows Defender Firewall with Advanced Security documentation library](https://docs.microsoft.com/en-us/windows/access-protection/windows-firewall/windows-firewall-with-advanced-security).
-In Windows 10, version 1709, the section can be hidden from users of the machine. This can be useful if you don't want employees in your organization to see or have access to user-configured options for the features shown in the section.
+In Windows 10, version 1709 and later, the section can be hidden from users of the machine. This can be useful if you don't want employees in your organization to see or have access to user-configured options for the features shown in the section.
## Hide the Firewall & network protection section
@@ -36,13 +36,11 @@ This can only be done in Group Policy.
>[!IMPORTANT]
>### Requirements
>
->You must have Windows 10, version 1709 (the Fall Creators Update). The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings.
+>You must have Windows 10, version 1709 or later. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings.
1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
-3. In the **Group Policy Management Editor** go to **Computer configuration**.
-
-4. Click **Policies** then **Administrative templates**.
+3. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
5. Expand the tree to **Windows components > Windows Defender Security Center > Firewall and network protection**.
diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-hide-notifications.md b/windows/security/threat-protection/windows-defender-security-center/wdsc-hide-notifications.md
index 007e09586d..551ce1779b 100644
--- a/windows/security/threat-protection/windows-defender-security-center/wdsc-hide-notifications.md
+++ b/windows/security/threat-protection/windows-defender-security-center/wdsc-hide-notifications.md
@@ -9,16 +9,16 @@ ms.mktglfcycl: manage
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: iaanw
-ms.author: iawilt
-ms.date: 10/16/2017
+author: andreabichsel
+ms.author: v-anbic
+ms.date: 04/30/2018
---
# Hide Windows Defender Security Center app notifications
**Applies to**
-- Windows 10, version 1709
+- Windows 10, version 1709 and later
**Audience**
@@ -52,13 +52,11 @@ This can only be done in Group Policy.
>[!IMPORTANT]
>### Requirements
>
->You must have Windows 10, version 1709 (the Fall Creators Update). The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings.
+>You must have Windows 10, version 1709 or later. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings.
1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
-3. In the **Group Policy Management Editor** go to **Computer configuration**.
-
-4. Click **Policies** then **Administrative templates**.
+3. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
5. Expand the tree to **Windows components > Windows Defender Security Center > Notifications**.
@@ -76,13 +74,11 @@ This can only be done in Group Policy.
>[!IMPORTANT]
>### Requirements
>
->You must have Windows 10, version 1709 (the Fall Creators Update). The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings.
+>You must have Windows 10, version 1709 or later. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings.
1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
-3. In the **Group Policy Management Editor** go to **Computer configuration**.
-
-4. Click **Policies** then **Administrative templates**.
+3. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
5. Expand the tree to **Windows components > Windows Defender Security Center > Notifications**.
diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-virus-threat-protection.md b/windows/security/threat-protection/windows-defender-security-center/wdsc-virus-threat-protection.md
index 1346ef4193..5d7d2ce96b 100644
--- a/windows/security/threat-protection/windows-defender-security-center/wdsc-virus-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-security-center/wdsc-virus-threat-protection.md
@@ -9,9 +9,9 @@ ms.mktglfcycl: manage
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: iaanw
-ms.author: iawilt
-ms.date: 10/16/2017
+author: andreabichsel
+ms.author: v-anbic
+ms.date: 04/30/2018
---
@@ -22,14 +22,20 @@ ms.date: 10/16/2017
- Windows 10, version 1703 and later
-The **Virus & threat protection** section contains information and settings for antivirus protection from Windows Defender Antivirus and third-party AV products. IT administrators and IT pros can get more information and documentation about configuration from the following:
+The **Virus & threat protection** section contains information and settings for antivirus protection from Windows Defender Antivirus and third-party AV products.
+
+In Windows 10, version 1803, this section also contains information and settings for ransomware protection and recovery. This includes Controlled folder access settings to prevent unknown apps from changing files in protected folders, plus Microsoft OneDrive configuration to help you recover from a ransomware attack. This area also notifies users and provides recovery instructions in the event of a ransomware attack.
+
+IT administrators and IT pros can get more information and documentation about configuration from the following:
- [Windows Defender Antivirus in the Windows Defender Security Center app](../windows-defender-antivirus/windows-defender-security-center-antivirus.md)
- [Windows Defender Antivirus documentation library](../windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md)
+- [Protect important folders with Controlled folder access](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard)
+- [Defend yourself from cybercrime with new Office 365 capabilities](https://blogs.office.com/en-us/2018/04/05/defend-yourself-from-cybercrime-with-new-office-365-capabilities/)
+- [Office 365 advanced protection](https://support.office.com/en-us/article/office-365-advanced-protection-82e72640-39be-4dc7-8efd-740fb289123a)
+- [Ransomware detection and recovering your files](https://support.office.com/en-us/article/ransomware-detection-and-recovering-your-files-0d90ec50-6bfd-40f4-acc7-b8c12c73637f?ui=en-US&rs=en-US&ad=US)
-In Windows 10, version 1709, the section also provides configuration options for Controlled folder access. IT administrators can get more information at the [Controlled folder access](../windows-defender-exploit-guard/controlled-folders-exploit-guard.md) topic in the Windows Defender Exploit Guard library.
-
-You can also choose to hide the section from users of the machine. This can be useful if you don't want employees in your organization to see or have access to user-configured options for the features shown in the section.
+You can choose to hide the **Virus & threat protection** section or the **Ransomware protection** area from users of the machine. This can be useful if you don't want employees in your organization to see or have access to user-configured options for the features shown in the section.
## Hide the Virus & threat protection section
@@ -41,13 +47,11 @@ This can only be done in Group Policy.
>[!IMPORTANT]
>### Requirements
>
->You must have Windows 10, version 1709 (the Fall Creators Update). The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings.
+>You must have Windows 10, version 1709 or later. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings.
1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
-3. In the **Group Policy Management Editor** go to **Computer configuration**.
-
-4. Click **Policies** then **Administrative templates**.
+3. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
5. Expand the tree to **Windows components > Windows Defender Security Center > Virus and threat protection**.
@@ -58,4 +62,25 @@ This can only be done in Group Policy.
>[!NOTE]
>If you hide all sections then the app will show a restricted interface, as in the following screenshot:
>
->
\ No newline at end of file
+>
+
+## Hide the Ransomware protection area
+
+You can choose to hide the **Ransomware protection** area by using Group Policy. The area will not appear on the **Virus & threat protection** section of the Windows Defender Security Center app.
+
+This can only be done in Group Policy.
+
+>[!IMPORTANT]
+>### Requirements
+>
+>You must have Windows 10, version 1709 or later. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings.
+
+1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
+
+3. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
+
+5. Expand the tree to **Windows components > Windows Defender Security Center > Virus and threat protection**.
+
+6. Open the **Hide the Ransomware data recovery area** setting and set it to **Enabled**. Click **OK**.
+
+7. [Deploy the updated GPO as you normally do](https://msdn.microsoft.com/en-us/library/ee663280(v=vs.85).aspx).
diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-windows-10-in-s-mode.md b/windows/security/threat-protection/windows-defender-security-center/wdsc-windows-10-in-s-mode.md
new file mode 100644
index 0000000000..a4423252ca
--- /dev/null
+++ b/windows/security/threat-protection/windows-defender-security-center/wdsc-windows-10-in-s-mode.md
@@ -0,0 +1,44 @@
+---
+title: Manage Windows Defender Security Center in Windows 10 in S mode
+description: Windows Defender Security Center settings are different in Windows 10 in S mode
+keywords: windows 10 in s mode, windows 10 s, windows 10 s mode, wdav, smartscreen, antivirus, wdsc, firewall, device health, performance, Edge, browser, family, parental options, security, windows
+search.product: eADQiWindows 10XVcnh
+ms.pagetype: security
+ms.prod: w10
+ms.mktglfcycl: manage
+ms.sitesec: library
+ms.pagetype: security
+ms.localizationpriority: medium
+author: andreabichsel
+ms.author: v-anbic
+ms.date: 04/30/2018
+---
+
+# Manage Windows Defender Security Center in Windows 10 in S mode
+
+**Applies to**
+
+- Windows 10 in S mode, version 1803
+
+**Audience**
+
+- Enterprise security administrators
+
+**Manageability available with**
+
+- Microsoft Intune
+
+Windows 10 in S mode is streamlined for tighter security and superior performance. With Windows 10 in S mode, users can only use apps from the Microsoft Store, ensuring Microsoft-verified security so you can minimize malware attacks. In addition, using Microsoft Edge provides a more secure browser experience, with extra protections against phishing and malicious software.
+
+The Windows Defender Security Center interface is a little different in Windows 10 in S mode. The **Virus & threat protection** area has fewer options, because the built-in security of Windows 10 in S mode prevents viruses and other threats from running on devices in your organization. In addition, devices running Windows 10 in S mode receive security updates automatically.
+
+
+
+For more information about Windows 10 in S mode, including how to switch out of S mode, see [Windows 10 Pro/Enterprise in S mode](https://docs.microsoft.com/en-us/windows/deployment/windows-10-pro-in-s-mode).
+
+##Managing Windows Defender Security Center settings with Intune
+
+In the enterprise, you can only manage security settings for devices running Windows 10 in S mode with Microsoft Intune or other mobile device management apps. Windows 10 in S mode prevents making changes via PowerShell scripts.
+
+For information about using Intune to manage Windows Defender Security Center settings on your organization's devices, see [Set up Intune](https://docs.microsoft.com/en-us/intune/setup-steps) and [Endpoint protection settings for Windows 10 (and later) in Intune](https://docs.microsoft.com/en-us/intune/endpoint-protection-windows-10).
+
diff --git a/windows/security/threat-protection/windows-defender-security-center/windows-defender-security-center.md b/windows/security/threat-protection/windows-defender-security-center/windows-defender-security-center.md
index 8c998be64f..c98c737aad 100644
--- a/windows/security/threat-protection/windows-defender-security-center/windows-defender-security-center.md
+++ b/windows/security/threat-protection/windows-defender-security-center/windows-defender-security-center.md
@@ -9,9 +9,9 @@ ms.mktglfcycl: manage
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: iaanw
-ms.author: iawilt
-ms.date: 10/17/2017
+author: andreabichsel
+ms.author: v-anbic
+ms.date: 04/30/2018
---
@@ -27,7 +27,9 @@ ms.date: 10/17/2017
-In Windows 10, version 1703 we introduced the new Windows Defender Security Center app, which brings together common Windows security features into one app. Many settings that were previously part of the individual features and main Windows Settings have been combined and moved to the new app, which is installed out-of-the-box as part of Windows 10, version 1703.
+In Windows 10, version 1709 and later, the app also shows information from third-party antivirus and firewall apps.
+
+In Windows 10, version 1803, the app has two new areas, **Account protection** and **Device security**.
@@ -39,20 +41,28 @@ In Windows 10, version 1709, we increased the scope of the app to also show info
>[!NOTE]
>The Windows Defender Security Center app is a client interface on Windows 10, version 1703 and later. It is not the Windows Defender Security Center web portal console that is used to review and manage [Windows Defender Advanced Threat Protection](https://docs.microsoft.com/en-us/windows/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection).
-This library describes the Windows defender Security Center app, and provides information on configuring certain features, inlcuding:
+This library describes the Windows Defender Security Center app, and provides information on configuring certain features, including:
- [Showing and customizing contact information on the app and in notifications](wdsc-customize-contact-information.md)
- [Hiding notifications](wdsc-hide-notifications.md)
+You can't uninstall the Windows Defender Security Center app, but you can do one of the following:
+
+- Disable the interface on Windows Server 2016. See [Windows Defender Antivirus on Windows Server 2016](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016).
+- Hide all of the sections on client computers (see below).
+- Disable Windows Defender Antivirus, if needed. See [Enable and configure Windows Defender AV always-on protection and monitoring](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus).
+
You can find more information about each section, including options for configuring the sections - such as hiding each of the sections - at the following topics:
-- [Virus & threat protection](wdsc-virus-threat-protection.md), which has information and access to antivirus settings and the Controlled folder access feature of Windows Defender Exploit Guard
-- [Device performance & health](wdsc-device-performance-health.md), which has information about drivers, storage space, and general Windows Update issues
-- [Firewall & network protection](wdsc-firewall-network-protection.md), which has information and access to firewall settings, including Windows Defender Firewall
-- [App & browser control](wdsc-app-browser-control.md), covering Windows Defender SmartScreen settings and Exploit protection mitigations
-- [Family options](wdsc-family-options.md), which includes access to parental controls along with tips and information for keeping kids safe online
+- [Virus & threat protection](wdsc-virus-threat-protection.md), which has information and access to antivirus ransomware protection settings and notifications, including the Controlled folder access feature of Windows Defender Exploit Guard and sign-in to Microsoft OneDrive.
+- [Account protection](wdsc-account-protection.md), which has information and access to sign-in and account protection settings.
+- [Firewall & network protection](wdsc-firewall-network-protection.md), which has information and access to firewall settings, including Windows Defender Firewall.
+- [App & browser control](wdsc-app-browser-control.md), covering Windows Defender SmartScreen settings and Exploit protection mitigations.
+- [Device security](wdsc-device-security.md), which provides access to built-in device security settings.
+- [Device performance & health](wdsc-device-performance-health.md), which has information about drivers, storage space, and general Windows Update issues.
+- [Family options](wdsc-family-options.md), which includes access to parental controls along with tips and information for keeping kids safe online.
>[!NOTE]
@@ -65,12 +75,15 @@ You can find more information about each section, including options for configur
## Open the Windows Defender Security Center app
-- Right-click the icon in the notification area on the taskbar and click **Open**.
+- Click the icon in the notification area on the taskbar.
- Search the Start menu for **Windows Defender Security Center**.
+- Open an area from Windows **Settings**.
+
+ 
> [!NOTE]
diff --git a/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device.md b/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device.md
index 508f23802e..fadcf8e301 100644
--- a/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device.md
+++ b/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device.md
@@ -28,8 +28,6 @@ Starting with Windows 10, version 1703 your employees can use Windows Defender S
**To use Windows Defender Security Center to set up Windows Defender SmartScreen on a device**
1. Open the Windows Defender Security Center app, and then click **App & browser control**.
- 
-
2. In the **App & browser control** screen, choose from the following options:
- In the **Check apps and files** area:
diff --git a/windows/security/threat-protection/windows-security-baselines.md b/windows/security/threat-protection/windows-security-baselines.md
index 5f0da685dd..19059502a9 100644
--- a/windows/security/threat-protection/windows-security-baselines.md
+++ b/windows/security/threat-protection/windows-security-baselines.md
@@ -7,7 +7,7 @@ ms.mktglfcycl: deploy
ms.localizationpriority: high
ms.author: sagaudre
author: brianlic-msft
-ms.date: 10/31/2017
+ms.date: 05/01/2018
---
# Windows Security Baselines
diff --git a/windows/whats-new/TOC.md b/windows/whats-new/TOC.md
index 11ef584f2a..22e6c40651 100644
--- a/windows/whats-new/TOC.md
+++ b/windows/whats-new/TOC.md
@@ -1,4 +1,5 @@
# [What's new in Windows 10](index.md)
+## [What's new in Windows 10, version 1803](whats-new-windows-10-version-1803.md)
## [What's new in Windows 10, version 1709](whats-new-windows-10-version-1709.md)
## [What's new in Windows 10, version 1703](whats-new-windows-10-version-1703.md)
## [What's new in Windows 10, version 1607](whats-new-windows-10-version-1607.md)
diff --git a/windows/whats-new/index.md b/windows/whats-new/index.md
index 63f5964ba8..e37e313557 100644
--- a/windows/whats-new/index.md
+++ b/windows/whats-new/index.md
@@ -5,7 +5,7 @@ ms.assetid: F1867017-76A1-4761-A200-7450B96AEF44
keywords: ["What's new in Windows 10", "Windows 10", "anniversary update", "contribute", "edit topic", "Creators Update", "Fall Creators Update"]
ms.prod: w10
author: TrudyHa
-ms.date: 10/16/2017
+ms.date: 04/30/2018
ms.localizationpriority: high
---
@@ -16,6 +16,7 @@ Windows 10 provides IT professionals with advanced protection against modern sec
## In this section
+- [What's new in Windows 10, version 1803](whats-new-windows-10-version-1803.md)
- [What's new in Windows 10, version 1709](whats-new-windows-10-version-1709.md)
- [What's new in Windows 10, version 1703](whats-new-windows-10-version-1703.md)
- [What's new in Windows 10, version 1607](whats-new-windows-10-version-1607.md)
diff --git a/windows/whats-new/whats-new-windows-10-version-1709.md b/windows/whats-new/whats-new-windows-10-version-1709.md
index fba100bb3c..a58a02c87b 100644
--- a/windows/whats-new/whats-new-windows-10-version-1709.md
+++ b/windows/whats-new/whats-new-windows-10-version-1709.md
@@ -26,19 +26,19 @@ A brief description of new or updated features in this version of Windows 10 is
## Deployment
-### Windows AutoPilot
+### Windows Autopilot
-Windows AutoPilot is a zero touch experience for deploying Windows 10 devices. Configuration profiles can now be applied at the hardware vendor with devices being shipped directly to employees. For more information, see [Overview of Windows AutoPilot](https://docs.microsoft.com/windows/deployment/windows-10-auto-pilot).
+Windows Autopilot is a zero touch experience for deploying Windows 10 devices. Configuration profiles can now be applied at the hardware vendor with devices being shipped directly to employees. For more information, see [Overview of Windows Autopilot](https://docs.microsoft.com/windows/deployment/windows-10-auto-pilot).
-You can also apply an AutoPilot deployment profile to your devices using Microsoft Store for Business. When people in your organization run the out-of-box experience on the device, the profile configures Windows based on the AutoPilot deployment profile you applied to the device. For more information, see [Manage Windows device deployment with Windows AutoPilot Deployment](https://docs.microsoft.com/en-us/microsoft-store/add-profile-to-devices).
+You can also apply an Autopilot deployment profile to your devices using Microsoft Store for Business. When people in your organization run the out-of-box experience on the device, the profile configures Windows based on the Autopilot deployment profile you applied to the device. For more information, see [Manage Windows device deployment with Windows Autopilot Deployment](https://docs.microsoft.com/en-us/microsoft-store/add-profile-to-devices).
### Windows 10 Subscription Activation
Windows 10 Subscription Activation lets you deploy Windows 10 Enterprise in your organization with no keys and no reboots using a list of subscribed users. When a subscribed user signs in on their Windows 10 Pro device, features that are Enterprise-only are automatically enabled. For more information, see [Windows 10 Subscription Activation](https://docs.microsoft.com/windows/deployment/windows-10-enterprise-subscription-activation).
-### Windows Automatic Redeployment
+### Autopilot Reset
-IT Pros can use Windows Automatic Redeployment to quickly remove personal files, apps, and settings. A custom login screen is available from the lock screen that enables you to apply original settings and management enrollment (Azure Active Directory and device management) so that devices are returned to a fully configured, known, IT-approved state and ready to use. For more information, see [Reset devices with Windows Automatic Redeployment](https://docs.microsoft.com/education/windows/windows-automatic-redeployment).
+IT Pros can use Autopilot Reset to quickly remove personal files, apps, and settings. A custom login screen is available from the lock screen that enables you to apply original settings and management enrollment (Azure Active Directory and device management) so that devices are returned to a fully configured, known, IT-approved state and ready to use. For more information, see [Reset devices with Autopilot Reset](https://docs.microsoft.com/education/windows/autopilot-reset).
## Update
@@ -115,7 +115,7 @@ The minimum PIN length is being changed from 6 to 4, with a default of 6. For mo
Microsoft has released new [Windows security baselines](https://docs.microsoft.com/en-us/windows/device-security/windows-security-baselines) for Windows Server and Windows 10. A security baseline is a group of Microsoft-recommended configuration settings with an explanation of their security impact. For more information, and to download the Policy Analyzer tool, see [Microsoft Security Compliance Toolkit 1.0](https://docs.microsoft.com/en-us/windows/device-security/security-compliance-toolkit-10).
### SMBLoris vulnerability
-An issue, known as “SMBLoris”, which could result in denial of service, has been addressed.
+An issue, known as “SMBLoris?, which could result in denial of service, has been addressed.
## Windows Analytics
diff --git a/windows/whats-new/whats-new-windows-10-version-1803.md b/windows/whats-new/whats-new-windows-10-version-1803.md
new file mode 100644
index 0000000000..0f82c28ffd
--- /dev/null
+++ b/windows/whats-new/whats-new-windows-10-version-1803.md
@@ -0,0 +1,234 @@
+---
+title: What's new in Windows 10, version 1803
+description: New and updated IT Pro content about new features in Windows 10, version 1803 (also known as the Windows 10 April 2018 Update).
+keywords: ["What's new in Windows 10", "Windows 10", "April 2018 Update"]
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+author: greg-lindsay
+ms.date: 04/30/2018
+ms.localizationpriority: high
+---
+
+# What's new in Windows 10, version 1803 IT Pro content
+
+**Applies to**
+- Windows 10, version 1803
+
+This article lists new and updated features and content that are of interest to IT Pros for Windows 10 version 1803, also known as the Windows 10 April 2018 Update. This update also contains all features and fixes included in previous cumulative updates to Windows 10, version 1709. Also see [What's New in Windows](https://docs.microsoft.com/en-us/windows-hardware/get-started/what-s-new-in-windows) hardware.
+
+The following 3-minute video summarizes some of the new features that are available in this release.
+
+
+
+> [!video https://www.microsoft.com/en-us/videoplayer/embed/RE21ada?autoplay=false]
+
+
+## Deployment
+
+### Windows Autopilot
+
+[Windows Autopilot](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-10-autopilot) provides a modern device lifecycle management service powered by the cloud that delivers a zero touch experience for deploying Windows 10.
+
+Using Intune, Autopilot now enables locking the device during provisioning during the Windows Out Of Box Experience (OOBE) until policies and settings for the device get provisioned, thereby ensuring that by the time the user gets to the desktop, the device is secured and configured correctly.
+
+Windows Autopilot is now available with Surface, Lenovo, and Dell. Other OEM partners such as HP, Toshiba, Panasonic, and Fujitsu will support Autopilot in coming months. Check back here later for more information.
+
+### Windows 10 in S mode
+
+Windows 10 in S mode is now available on both Windows 10 Home and Pro PCs, and commercial customers will be able to deploy Windows 10 Enterprise in S mode - by starting with Windows 10 Pro in S mode and then activating Windows 10 Enterprise on the computer.
+
+Some additional information about Windows 10 in S mode:
+
+- Microsoft-verified. All of your applications are verified by Microsoft for security and performance.
+- Performance that lasts. Start-ups are quick, and S mode is built to keep them that way.
+- Choice and flexibility. Save your files to your favorite cloud, like OneDrive or DropBox, and access them from any device you choose. Browse the Microsoft Store for thousands of apps[]
+- S mode, on a range of modern devices. Enjoy all the great Windows multi-tasking features, like snapping Windows, task view and virtual desktops on a range of S mode enabled devices.
+
+If you want to switch out of S mode, you will be able to do so at no charge, regardless of edition. Once you switch out of S mode, you cannot switch back.
+
+For more information, see [Windows 10 Pro/Enterprise in S mode](https://docs.microsoft.com/windows/deployment/windows-10-pro-in-s-mode).
+
+### Windows 10 kiosk and Kiosk Browser
+
+With this release you can easily deploy and manage kiosk devices with Microsoft Intune in single and multiple app scenarios. This includes the new Kiosk Browser available from the Microsoft Store. Kiosk Browser is great for delivering a reliable and custom-tailored browsing experience for scenarios such as retail and signage. A summary of new features is below.
+
+- Using Intune, you can deploy the Kiosk Browser from the Microsoft Store, configure start URL, allowed URLs, and enable/disable navigation buttons.
+- Using Intune, you can deploy and configure shared devices and kiosks using assigned access to create a curated experience with the correct apps and configuration policies
+- Support for multiple screens for digital signage use cases.
+- The ability to ensure all MDM configurations are enforced on the device prior to entering assigned access using the Enrollment Status page.
+- The ability to configure and run Shell Launcher in addition to existing UWP Store apps.
+- A simplified process for creating and configuring an auto-logon kiosk account so that a public kiosk automatically enters a desired state after a reboot, a critical security requirement for public-facing use cases.
+- For multi-user Firstline Worker kiosk devices, instead of specifying every user, it’s now possible to assign different assigned access configurations to Azure AD groups or Active Directory groups.
+- To help with troubleshooting, you can now view error reports generated if an assigned access-configured app has issues.
+
+For more information, see:
+- [Making IT simpler with a modern workplace](https://www.microsoft.com/en-us/microsoft-365/blog/2018/04/27/making-it-simpler-with-a-modern-workplace/)
+- [Simplifying kiosk management for IT with Windows 10](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Simplifying-kiosk-management-for-IT-with-Windows-10/ba-p/187691)
+
+### Windows 10 Subscription Activation
+
+With this release, Subscription Activation supports Inherited Activation. Inherited Activation allows Windows 10 virtual machines to inherit activation state from their Windows 10 host.
+
+For more information, see [Windows 10 Subscription Activation](https://docs.microsoft.com/windows/deployment/windows-10-enterprise-subscription-activation#inherited-activation).
+
+### DISM
+
+The following new DISM commands have been added to manage feature updates:
+
+ DISM /Online /Initiate-OSUninstall
+ – Initiates a OS uninstall to take the computer back to the previous installation of windows.
+ DISM /Online /Remove-OSUninstall
+ – Removes the OS uninstall capability from the computer.
+ DISM /Online /Get-OSUninstallWindow
+ – Displays the number of days after upgrade during which uninstall can be performed.
+ DISM /Online /Set-OSUninstallWindow
+ – Sets the number of days after upgrade during which uninstall can be performed.
+
+For more information, see [DISM operating system uninstall command-line options](https://docs.microsoft.com/windows-hardware/manufacture/desktop/dism-uninstallos-command-line-options).
+
+### Windows Setup
+
+You can now run your own custom actions or scripts in parallel with Windows Setup. Setup will also migrate your scripts to next feature release, so you only need to add them once.
+
+Prerequisites:
+- Windows 10, version 1803 or later.
+- Windows 10 Enterprise or Pro
+
+For more information, see [Run custom actions during feature update](https://review.docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-enable-custom-actions).
+
+It is also now possible to run a script if the user rolls back their version of Windows using the PostRollback option.
+
+ /PostRollback
+[What's New in Windows 10](https://docs.microsoft.com/windows/whats-new/): See what’s new in other versions of Windows 10.
+[What's new in Windows 10, version 1709](https://docs.microsoft.com/windows-hardware/get-started/what-s-new-in-windows): See what’s new in Windows 10 hardware.
+[Windows 10 Fall Creators Update Next Generation Security](https://www.youtube.com/watch?v=JDGMNFwyUg8): YouTube video about Windows Defender ATP in Windows 10, version 1709.