mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-14 22:37:22 +00:00
Merge branch 'main' into pm-54601070-kiosk
This commit is contained in:
Paolo Matarazzo
GitHub
commit
f344d588df
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Bulk enrollment
|
||||
description: Bulk enrollment is an efficient way to set up an MDM server to manage a large number of devices without the need to reimage the devices.
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
ms.date: 07/08/2024
|
||||
---
|
||||
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Certificate authentication device enrollment
|
||||
description: This section provides an example of the mobile device enrollment protocol using certificate authentication policy.
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
ms.date: 07/08/2024
|
||||
---
|
||||
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Certificate Renewal
|
||||
description: Learn how to find all the resources that you need to provide continuous access to client certificates.
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
ms.date: 07/08/2024
|
||||
---
|
||||
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Windows default media removal policy
|
||||
description: Manage default media removal policy in Windows.
|
||||
ms.date: 07/01/2024
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
---
|
||||
|
||||
# Manage default media removal policy
|
||||
|
||||
@ -3,7 +3,7 @@ title: Connect to remote Microsoft Entra joined device
|
||||
description: Learn how to use Remote Desktop Connection to connect to a Microsoft Entra joined device.
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 07/01/2024
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
ms.collection:
|
||||
- highpri
|
||||
- tier2
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Manage Device Installation with Group Policy
|
||||
description: Find out how to manage Device Installation Restrictions with Group Policy.
|
||||
ms.date: 07/01/2024
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
---
|
||||
|
||||
# Manage Device Installation with Group Policy
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Manage the Settings app with Group Policy
|
||||
description: Find out how to manage the Settings app with Group Policy so you can hide specific pages from users.
|
||||
ms.date: 07/01/2024
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
---
|
||||
|
||||
# Manage the Settings app with Group Policy
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Create mandatory user profiles
|
||||
description: A mandatory user profile is a special type of preconfigured roaming user profile that administrators can use to specify settings for users.
|
||||
ms.date: 07/01/2024
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
---
|
||||
|
||||
# Create mandatory user profiles
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Use Quick Assist to help users
|
||||
description: Learn how IT Pros can use Quick Assist to help users.
|
||||
ms.date: 07/01/2024
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
ms.collection:
|
||||
- highpri
|
||||
- tier1
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Windows Libraries
|
||||
description: All about Windows Libraries, which are containers for users' content, such as Documents and Pictures.
|
||||
ms.topic: conceptual
|
||||
ms.topic: concept-article
|
||||
ms.date: 07/01/2024
|
||||
---
|
||||
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: What version of Windows am I running?
|
||||
description: Discover which version of Windows you're running to determine whether or not your device is enrolled in the Long-Term Servicing Channel or General Availability Channel.
|
||||
ms.date: 07/01/2024
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
---
|
||||
|
||||
# What version of Windows am I running?
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Enable ADMX policies in MDM
|
||||
description: Use this step-by-step guide to configure a selected set of Group Policy administrative templates (ADMX policies) in Mobile Device Management (MDM).
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 07/08/2024
|
||||
---
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Enroll a Windows device automatically using Group Policy
|
||||
description: Learn how to use a Group Policy to trigger autoenrollment to MDM for Active Directory (AD) domain-joined devices.
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
ms.date: 07/08/2024
|
||||
ms.collection:
|
||||
- highpri
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Support for Windows Information Protection (WIP) on Windows
|
||||
description: Learn about implementing the Windows version of Windows Information Protection (WIP), which is a lightweight solution for managing company data access and security on personal devices.
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
ms.date: 07/08/2024
|
||||
---
|
||||
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Collect MDM logs
|
||||
description: Learn how to collect MDM logs. Examining these logs can help diagnose enrollment or device management issues in Windows devices managed by an MDM server.
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
ms.date: 07/08/2024
|
||||
ms.collection:
|
||||
- highpri
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: MDM enrollment of Windows devices
|
||||
description: Learn about mobile device management (MDM) enrollment of Windows devices to simplify access to your organization's resources.
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
ms.collection:
|
||||
- highpri
|
||||
- tier2
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Push notification support for device management
|
||||
description: The DMClient CSP supports the ability to configure push-initiated device management sessions.
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
ms.date: 07/08/2024
|
||||
---
|
||||
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Structure of OMA DM provisioning files
|
||||
description: Learn about the structure of OMA DM provisioning files, for example how each message is composed of a header, specified by the SyncHdr element, and a message body.
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
ms.date: 07/08/2024
|
||||
---
|
||||
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Understanding ADMX policies
|
||||
description: You can use ADMX policies for Windows mobile device management (MDM) across Windows devices.
|
||||
ms.topic: conceptual
|
||||
ms.topic: concept-article
|
||||
ms.date: 07/08/2024
|
||||
---
|
||||
|
||||
|
||||
@ -52,7 +52,7 @@ This article details the requirements and recommended specifications for using M
|
||||
### Additional requirements for Linux host machines
|
||||
|
||||
- The Linux host machine must be using one of the following operating systems:
|
||||
- Ubuntu 22.04
|
||||
- Ubuntu 22.04, 24.04
|
||||
- Red Hat Enterprise Linux (RHEL) 8.* or 9.*
|
||||
- If using RHEL, the default container engine (Podman) must be replaced with [Moby](https://github.com/moby/moby#readme)
|
||||
|
||||
|
||||
@ -3,7 +3,7 @@ title: Checkpoint cumulative updates and the Microsoft Update Catalog
|
||||
description: This article describes how to handle checkpoint cumulative updates when you use the Microsoft Update Catalog to update devices and images.
|
||||
ms.service: windows-client
|
||||
ms.subservice: itpro-updates
|
||||
ms.topic: conceptual
|
||||
ms.topic: article
|
||||
ms.author: mstewart
|
||||
author: mestew
|
||||
manager: aaroncz
|
||||
|
||||
@ -3,7 +3,7 @@ title: Evaluate infrastructure and tools
|
||||
description: Review the steps to ensure your infrastructure is ready to deploy updates to clients in your organization.
|
||||
ms.service: windows-client
|
||||
ms.subservice: itpro-updates
|
||||
ms.topic: conceptual
|
||||
ms.topic: article
|
||||
author: mestew
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
|
||||
@ -3,7 +3,7 @@ title: Windows client updates, channels, and tools
|
||||
description: Brief summary of the kinds of Windows updates, the channels they're served through, and the tools for managing them
|
||||
ms.service: windows-client
|
||||
ms.subservice: itpro-updates
|
||||
ms.topic: conceptual
|
||||
ms.topic: article
|
||||
author: mestew
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
|
||||
@ -3,7 +3,7 @@ title: How Windows Update works
|
||||
description: In this article, learn about the process Windows Update uses to download and install updates on Windows client devices.
|
||||
ms.service: windows-client
|
||||
ms.subservice: itpro-updates
|
||||
ms.topic: conceptual
|
||||
ms.topic: article
|
||||
author: mestew
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
|
||||
@ -3,7 +3,7 @@ title: Migrating and acquiring optional Windows content
|
||||
description: How to keep language resources and Features on Demand during operating system updates for your organization.
|
||||
ms.service: windows-client
|
||||
ms.subservice: itpro-updates
|
||||
ms.topic: conceptual
|
||||
ms.topic: article
|
||||
author: mestew
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
|
||||
@ -3,7 +3,7 @@ title: Define readiness criteria
|
||||
description: Identify important roles and figure out how to classify apps so you can plan and manage your deployment
|
||||
ms.service: windows-client
|
||||
ms.subservice: itpro-updates
|
||||
ms.topic: conceptual
|
||||
ms.topic: article
|
||||
author: mestew
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
|
||||
@ -3,7 +3,7 @@ title: Define update strategy
|
||||
description: Example of using a calendar-based approach to achieve consistent update installation in your organization.
|
||||
ms.service: windows-client
|
||||
ms.subservice: itpro-updates
|
||||
ms.topic: conceptual
|
||||
ms.topic: article
|
||||
author: mestew
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
|
||||
@ -3,7 +3,7 @@ title: Update release cycle for Windows clients
|
||||
description: Learn about the release cycle for updates so Windows clients in your organization stay productive and protected.
|
||||
ms.service: windows-client
|
||||
ms.subservice: itpro-updates
|
||||
ms.topic: conceptual
|
||||
ms.topic: article
|
||||
author: mestew
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
|
||||
@ -3,7 +3,7 @@ title: Safeguard holds for Windows
|
||||
description: What are safeguard holds? How to can you tell if a safeguard hold is in effect, and what to do about it.
|
||||
ms.service: windows-client
|
||||
ms.subservice: itpro-updates
|
||||
ms.topic: conceptual
|
||||
ms.topic: article
|
||||
author: mestew
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
|
||||
@ -3,7 +3,7 @@ title: Opt out of safeguard holds
|
||||
description: How to install an update in your organization even when a safeguard hold for a known issue has been applied to it.
|
||||
ms.service: windows-client
|
||||
ms.subservice: itpro-updates
|
||||
ms.topic: conceptual
|
||||
ms.topic: article
|
||||
author: mestew
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
|
||||
@ -3,7 +3,7 @@ title: Servicing stack updates
|
||||
description: In this article, learn how servicing stack updates improve the code that installs the other updates.
|
||||
ms.service: windows-client
|
||||
ms.subservice: itpro-updates
|
||||
ms.topic: conceptual
|
||||
ms.topic: article
|
||||
author: mestew
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
|
||||
@ -3,7 +3,7 @@ title: Windows 10 Update Baseline
|
||||
description: Use an update baseline to optimize user experience and meet monthly update goals in your organization.
|
||||
ms.service: windows-client
|
||||
ms.subservice: itpro-updates
|
||||
ms.topic: conceptual
|
||||
ms.topic: article
|
||||
author: mestew
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
|
||||
@ -3,7 +3,7 @@ title: Policies for update compliance and user experience
|
||||
description: Explanation and recommendations for update compliance, activity, and user experience for your organization.
|
||||
ms.service: windows-client
|
||||
ms.subservice: itpro-updates
|
||||
ms.topic: conceptual
|
||||
ms.topic: article
|
||||
author: mestew
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
@ -94,7 +94,7 @@ options must be **Disabled** in order to take advantage of intelligent active ho
|
||||
If you do set active hours, we recommend setting the following policies to **Disabled** in order to increase update
|
||||
velocity:
|
||||
|
||||
- [Delay automatic reboot](waas-restart.md#delay-automatic-restart). While it's possible to set the system to delay restarts for users who are logged in, this setting might delay an update indefinitely if a user is always either logged in or shut down. Instead, we recommend setting the following polices to **Disabled**:
|
||||
- [Delay automatic reboot](waas-restart.md#delay-automatic-restart). While it's possible to set the system to delay restarts for users who are logged in, this setting might delay an update indefinitely if a user is always either logged in or shut down. Instead, we recommend setting the following policies to **Disabled**:
|
||||
- **Turn off auto-restart during active hours**
|
||||
- **No auto-restart with logged on users for scheduled automatic updates**
|
||||
|
||||
@ -183,7 +183,7 @@ As administrators, you have set up and expect certain behaviors, so we expressly
|
||||
> expected. For example, if a device is not reacting to your MDM policy changes, check to see if a similar
|
||||
> policy is set in Group Policy with a differing value.
|
||||
> If you find that update velocity is not as high as you expect or if some devices are slower than others, it might be
|
||||
> time to clear all polices and settings and specify only the recommended update policies. See the Policy and settings reference for a consolidated list of recommended polices.
|
||||
> time to clear all policies and settings and specify only the recommended update policies. See the Policy and settings reference for a consolidated list of recommended policies.
|
||||
|
||||
The following are policies that you might want to disable because they could decrease update velocity or there are better policies to use that might conflict:
|
||||
- **Defer Feature Updates Period in Days**. For maximum update velocity, it's best to set this to **0** (no
|
||||
|
||||
@ -3,7 +3,7 @@ title: Configure BranchCache for Windows client updates
|
||||
description: In this article, learn how to use BranchCache to optimize network bandwidth during update deployment.
|
||||
ms.service: windows-client
|
||||
ms.subservice: itpro-updates
|
||||
ms.topic: conceptual
|
||||
ms.topic: article
|
||||
author: mestew
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
|
||||
@ -6,7 +6,7 @@ ms.service: windows-client
|
||||
author: mestew
|
||||
ms.localizationpriority: medium
|
||||
ms.author: mstewart
|
||||
ms.topic: conceptual
|
||||
ms.topic: article
|
||||
ms.subservice: itpro-updates
|
||||
ms.collection:
|
||||
- tier1
|
||||
|
||||
@ -3,7 +3,7 @@ title: Quick guide to Windows as a service
|
||||
description: In Windows 10, Microsoft has streamlined servicing to make operating system updates simpler to test, manage, and deploy.
|
||||
ms.service: windows-client
|
||||
ms.subservice: itpro-updates
|
||||
ms.topic: conceptual
|
||||
ms.topic: article
|
||||
author: mestew
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
|
||||
@ -4,7 +4,7 @@ manager: aaroncz
|
||||
description: Overview of the security for Windows Update including security for the metadata exchange and content download.
|
||||
ms.service: windows-client
|
||||
ms.subservice: itpro-updates
|
||||
ms.topic: conceptual
|
||||
ms.topic: article
|
||||
author: mestew
|
||||
ms.author: mstewart
|
||||
appliesto:
|
||||
|
||||
@ -4,7 +4,7 @@ titleSuffix: Windows Update for Business
|
||||
description: This article contains information on how to enforce compliance deadlines using Windows Update for Business.
|
||||
ms.service: windows-client
|
||||
ms.subservice: itpro-updates
|
||||
ms.topic: conceptual
|
||||
ms.topic: article
|
||||
author: mestew
|
||||
ms.localizationpriority: medium
|
||||
ms.author: mstewart
|
||||
|
||||
@ -5,7 +5,7 @@ manager: aaroncz
|
||||
description: Microsoft admin center populates Windows Update for Business reports data into the software updates page.
|
||||
ms.service: windows-client
|
||||
ms.subservice: itpro-updates
|
||||
ms.topic: conceptual
|
||||
ms.topic: article
|
||||
author: mestew
|
||||
ms.author: mstewart
|
||||
ms.localizationpriority: medium
|
||||
|
||||
@ -4,7 +4,7 @@ titleSuffix: Windows Update for Business reports
|
||||
description: How to get and use the Windows Update for Business reports configuration script to configure devices for Windows Update for Business reports.
|
||||
ms.service: windows-client
|
||||
ms.subservice: itpro-updates
|
||||
ms.topic: conceptual
|
||||
ms.topic: article
|
||||
author: mestew
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
|
||||
@ -4,7 +4,7 @@ titleSuffix: Windows Update for Business reports
|
||||
description: This article provides information about Delivery Optimization data in Windows Update for Business reports.
|
||||
ms.service: windows-client
|
||||
ms.subservice: itpro-updates
|
||||
ms.topic: conceptual
|
||||
ms.topic: article
|
||||
author: mestew
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
|
||||
@ -4,7 +4,7 @@ titleSuffix: Windows Update for Business reports
|
||||
description: List of prerequisites for enabling and using Windows Update for Business reports in your organization.
|
||||
ms.service: windows-client
|
||||
ms.subservice: itpro-updates
|
||||
ms.topic: conceptual
|
||||
ms.topic: article
|
||||
author: mestew
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
|
||||
@ -3,7 +3,7 @@ title: Create your App Control for Business AppId Tagging Policies
|
||||
description: Create your App Control for Business AppId tagging policies for Windows devices.
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 09/23/2024
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
---
|
||||
|
||||
# Creating your App Control AppId Tagging Policies
|
||||
|
||||
@ -3,7 +3,7 @@ title: App Control and AppLocker Overview
|
||||
description: Compare Windows application control technologies.
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 09/11/2024
|
||||
ms.topic: conceptual
|
||||
ms.topic: concept-article
|
||||
---
|
||||
|
||||
# App Control for Business and AppLocker Overview
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Administer AppLocker
|
||||
description: This article for IT professionals provides links to specific procedures to use when administering AppLocker policies.
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
ms.date: 09/11/2024
|
||||
---
|
||||
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Configure an AppLocker policy for audit only
|
||||
description: This article for IT professionals describes how to set AppLocker policies to Audit only within your IT environment by using AppLocker.
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
ms.date: 09/11/2024
|
||||
---
|
||||
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Configure an AppLocker policy for enforce rules
|
||||
description: This article for IT professionals describes the steps to enable the AppLocker policy enforcement setting.
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
ms.date: 09/11/2024
|
||||
---
|
||||
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Add exceptions for an AppLocker rule
|
||||
description: This article for IT professionals describes the steps to specify which apps can or can't run as exceptions to an AppLocker rule.
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
ms.date: 09/11/2024
|
||||
---
|
||||
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Configure the AppLocker reference device
|
||||
description: This article for the IT professional describes the steps to create an AppLocker policy platform structure on a reference computer.
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
ms.date: 09/11/2024
|
||||
---
|
||||
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Configure the Application Identity service
|
||||
description: This article for IT professionals shows how to configure the Application Identity service to start automatically or manually.
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
ms.date: 09/11/2024
|
||||
---
|
||||
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Create a rule for packaged apps
|
||||
description: This article for IT professionals shows how to create an AppLocker rule for packaged apps with a publisher condition.
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
ms.date: 09/11/2024
|
||||
---
|
||||
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Create a rule that uses a file hash condition
|
||||
description: This article for IT professionals shows how to create an AppLocker rule with a file hash condition.
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
ms.date: 09/11/2024
|
||||
---
|
||||
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Create a rule that uses a path condition
|
||||
description: This article for IT professionals shows how to create an AppLocker rule with a path condition.
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
ms.date: 09/11/2024
|
||||
---
|
||||
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Create a rule that uses a publisher condition
|
||||
description: This article for IT professionals shows how to create an AppLocker rule with a publisher condition.
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
ms.date: 09/11/2024
|
||||
---
|
||||
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Create AppLocker default rules
|
||||
description: This article for IT professionals describes the steps to create a standard set of AppLocker rules that allow Windows system files to run.
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
ms.date: 09/11/2024
|
||||
---
|
||||
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Create Your AppLocker policies
|
||||
description: This overview article for the IT professional describes the steps to create an AppLocker policy and prepare it for deployment.
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
ms.date: 09/11/2024
|
||||
---
|
||||
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Create Your AppLocker rules
|
||||
description: This article for the IT professional describes what you need to know about AppLocker rules and the methods that you can to create rules.
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
ms.date: 09/11/2024
|
||||
---
|
||||
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Delete an AppLocker rule
|
||||
description: This article for IT professionals describes the steps to delete an AppLocker rule.
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
ms.date: 09/11/2024
|
||||
---
|
||||
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Find digitally signed apps on a reference device
|
||||
description: This article for the IT professional describes how to use AppLocker logs and tools to determine which applications are digitally signed.
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
ms.date: 09/11/2024
|
||||
---
|
||||
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Display a custom URL message when users try to run a blocked app
|
||||
description: This article for IT professionals describes the steps for displaying a customized message to users when an AppLocker policy blocks an app.
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
ms.date: 09/11/2024
|
||||
---
|
||||
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Document Group Policy structure & AppLocker rule enforcement
|
||||
description: This planning article describes what you need to include in your plan when you use AppLocker.
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
ms.date: 09/11/2024
|
||||
---
|
||||
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Document your AppLocker rules
|
||||
description: Learn how to document your AppLocker rules and associate rule conditions with files, permissions, rule source, and implementation.
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
ms.date: 09/11/2024
|
||||
---
|
||||
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Edit an AppLocker policy
|
||||
description: This article for IT professionals describes the steps required to modify an AppLocker policy.
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
ms.date: 09/11/2024
|
||||
---
|
||||
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Edit AppLocker rules
|
||||
description: This article for IT professionals describes the steps to edit a publisher rule, path rule, and file hash rule in AppLocker.
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
ms.date: 09/11/2024
|
||||
---
|
||||
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Enable the DLL rule collection
|
||||
description: This article for IT professionals describes the steps to enable the DLL rule collection feature for AppLocker.
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
ms.date: 09/11/2024
|
||||
---
|
||||
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Export an AppLocker policy from a GPO
|
||||
description: This article for IT professionals describes the steps to export an AppLocker policy from a Group Policy Object (GPO) so that it can be modified.
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
ms.date: 09/11/2024
|
||||
---
|
||||
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Export an AppLocker policy to an XML file
|
||||
description: This article for IT professionals describes the steps to export an AppLocker policy to an XML file for review or testing.
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
ms.date: 09/11/2024
|
||||
---
|
||||
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Import an AppLocker policy from another computer
|
||||
description: This article for IT professionals describes how to import an AppLocker policy.
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
ms.date: 09/11/2024
|
||||
---
|
||||
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Import an AppLocker policy into a GPO
|
||||
description: This article for IT professionals describes the steps to import an AppLocker policy into a Group Policy Object (GPO).
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
ms.date: 09/11/2024
|
||||
---
|
||||
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Maintain AppLocker policies
|
||||
description: Learn how to maintain rules within AppLocker policies. View common AppLocker maintenance scenarios and see the methods to use to maintain AppLocker policies.
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
ms.date: 09/11/2024
|
||||
---
|
||||
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Manage packaged apps with AppLocker
|
||||
description: Learn concepts and lists procedures to help you manage packaged apps with AppLocker as part of your overall application control strategy.
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
ms.date: 09/11/2024
|
||||
---
|
||||
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Merge AppLocker policies by using Set-ApplockerPolicy
|
||||
description: This article for IT professionals describes the steps to merge AppLocker policies by using Windows PowerShell.
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
ms.date: 09/11/2024
|
||||
---
|
||||
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Merge AppLocker policies manually
|
||||
description: This article for IT professionals describes the steps to manually merge AppLocker policies to update the Group Policy Object (GPO).
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
ms.date: 09/11/2024
|
||||
---
|
||||
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Monitor app usage with AppLocker
|
||||
description: This article for IT professionals describes how to monitor app usage when AppLocker policies are applied.
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
ms.date: 09/11/2024
|
||||
---
|
||||
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Plan for AppLocker policy management
|
||||
description: This article describes the decisions you need to make to establish the processes for managing and maintaining AppLocker policies.
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: conceptual
|
||||
ms.topic: concept-article
|
||||
ms.date: 09/11/2024
|
||||
---
|
||||
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Refresh an AppLocker policy
|
||||
description: This article for IT professionals describes the steps to force an update for an AppLocker policy.
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
ms.date: 09/11/2024
|
||||
---
|
||||
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Run the Automatically Generate Rules wizard
|
||||
description: This article for IT professionals describes steps to run the wizard to create AppLocker rules on a reference device.
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
ms.date: 09/11/2024
|
||||
---
|
||||
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Test an AppLocker policy by using Test-AppLockerPolicy
|
||||
description: This article for IT professionals describes the steps to test an AppLocker policy prior to importing it into a Group Policy Object (GPO) or another computer.
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
ms.date: 09/11/2024
|
||||
---
|
||||
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Test and update an AppLocker policy
|
||||
description: This article discusses the steps required to test an AppLocker policy prior to deployment.
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
ms.date: 09/11/2024
|
||||
---
|
||||
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Understand AppLocker policy design decisions
|
||||
description: Review some common considerations while you're planning to use AppLocker to deploy application control policies within a Windows environment.
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: conceptual
|
||||
ms.topic: concept-article
|
||||
ms.date: 09/11/2024
|
||||
---
|
||||
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Understand AppLocker rules and enforcement setting inheritance in Group Policy
|
||||
description: This article for the IT professional describes how application control policies configured in AppLocker are applied through Group Policy.
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: conceptual
|
||||
ms.topic: concept-article
|
||||
ms.date: 09/11/2024
|
||||
---
|
||||
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Understand the AppLocker policy deployment process
|
||||
description: This planning and deployment article for the IT professional describes the process for using AppLocker when deploying application control policies.
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: conceptual
|
||||
ms.topic: concept-article
|
||||
ms.date: 09/11/2024
|
||||
---
|
||||
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Understanding AppLocker allow and deny actions on rules
|
||||
description: This article explains the differences between allow and deny actions on AppLocker rules.
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: conceptual
|
||||
ms.topic: concept-article
|
||||
ms.date: 09/11/2024
|
||||
---
|
||||
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Understanding AppLocker default rules
|
||||
description: This article for IT professional describes the set of rules that can be used to ensure that required Windows system files continue to run when the policy is applied.
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: conceptual
|
||||
ms.topic: concept-article
|
||||
ms.date: 09/11/2024
|
||||
---
|
||||
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Understanding AppLocker rule behavior
|
||||
description: This article describes how AppLocker rules are enforced by using the allow and deny options in AppLocker.
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: conceptual
|
||||
ms.topic: concept-article
|
||||
ms.date: 09/11/2024
|
||||
---
|
||||
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Understanding AppLocker rule collections
|
||||
description: This article explains the five different types of AppLocker rule collections used to enforce AppLocker policies.
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: conceptual
|
||||
ms.topic: concept-article
|
||||
ms.date: 09/11/2024
|
||||
---
|
||||
|
||||
@ -19,11 +19,11 @@ An AppLocker rule collection is a set of rules that apply to one of five types:
|
||||
- Packaged apps and packaged app installers: .appx
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Each app can load several DLLs, and AppLocker must check each DLL before it is allowed to run. Be sure you create DLL allow rules for every DLL that is used by any of the allowed apps. Denying some DLLs from running can also create app compatibility problems.
|
||||
> Each app can load several DLLs, and AppLocker must check each DLL before it's allowed to run. Be sure you create DLL allow rules for every DLL that is used by any of the allowed apps. Denying some DLLs from running can also create app compatibility problems.
|
||||
>
|
||||
> DLL rules might cause performance problems on some computers which are already resource constrained.
|
||||
>
|
||||
> As a result, the DLL rule collection is not enabled by default.
|
||||
> As a result, the DLL rule collection isn't enabled by default.
|
||||
|
||||
For info about how to enable the DLL rule collection, see [Enable the DLL rule collection](enable-the-dll-rule-collection.md).
|
||||
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Understanding AppLocker rule exceptions
|
||||
description: This article describes the result of applying AppLocker rule exceptions to rule collections.
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: conceptual
|
||||
ms.topic: concept-article
|
||||
ms.date: 09/11/2024
|
||||
---
|
||||
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Understanding the file hash rule condition in AppLocker
|
||||
description: This article explains how to use the AppLocker file hash rule condition and its advantages and disadvantages.
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: conceptual
|
||||
ms.topic: concept-article
|
||||
ms.date: 09/11/2024
|
||||
---
|
||||
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Understanding the path rule condition in AppLocker
|
||||
description: This article explains how to apply the AppLocker path rule condition and its advantages and disadvantages.
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: conceptual
|
||||
ms.topic: concept-article
|
||||
ms.date: 09/11/2024
|
||||
---
|
||||
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Understanding the publisher rule condition in AppLocker
|
||||
description: This article explains how to apply the AppLocker publisher rule condition and what controls are available.
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: conceptual
|
||||
ms.topic: concept-article
|
||||
ms.date: 09/11/2024
|
||||
---
|
||||
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Use a reference device to create and maintain AppLocker policies
|
||||
description: This article for the IT professional describes the steps to create and maintain AppLocker policies by using a reference computer.
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
ms.date: 09/11/2024
|
||||
---
|
||||
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: What Is AppLocker
|
||||
description: This article for the IT professional describes what AppLocker is.
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: conceptual
|
||||
ms.topic: concept-article
|
||||
ms.date: 09/11/2024
|
||||
---
|
||||
|
||||
|
||||
@ -3,7 +3,7 @@ title: Use audit events to create App Control policy rules
|
||||
description: Audits allow admins to discover apps, binaries, and scripts that should be added to the App Control policy.
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 09/11/2024
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
---
|
||||
|
||||
# Use audit events to create App Control policy rules
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Create a code signing cert for App Control for Business
|
||||
description: Learn how to set up a publicly issued code signing certificate, so you can sign catalog files or App Control policies internally.
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
ms.date: 09/11/2024
|
||||
---
|
||||
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Use signed policies to protect App Control for Business against tampering
|
||||
description: Signed App Control for Business policies give organizations the highest level of malware protection available in Windows 10 and Windows 11.
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
ms.date: 09/11/2024
|
||||
---
|
||||
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Create an App Control policy for fully managed devices
|
||||
description: App Control for Business restricts which applications users are allowed to run and the code that runs in system core.
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 09/11/2024
|
||||
---
|
||||
@ -10,12 +10,12 @@ ms.date: 09/11/2024
|
||||
|
||||
[!INCLUDE [Feature availability note](../includes/feature-availability-note.md)]
|
||||
|
||||
This section outlines the process to create an App Control for Business policy for **fully managed devices** within an organization. The key difference between this scenario and [lightly managed devices](create-appcontrol-policy-for-lightly-managed-devices.md) is that all software deployed to a fully managed device is managed by IT and users of the device can't install arbitrary apps. Ideally, all apps are deployed using a software distribution solution, such as Microsoft Intune. Additionally, users on fully managed devices should ideally run as standard user and only authorized IT pros have administrative access.
|
||||
This section outlines the process to create an App Control for Business policy for **fully managed devices** within an organization. The key difference between this scenario and [lightly managed devices](create-appcontrol-policy-for-lightly-managed-devices.md) is that all software that's deployed to a fully managed device is managed by IT and users of the device can't install arbitrary apps. Ideally, all apps are deployed using a software distribution solution, such as Microsoft Intune. Additionally, users on fully managed devices should ideally run as standard user and only authorized IT pros have administrative access.
|
||||
|
||||
> [!NOTE]
|
||||
> Some of the App Control for Business options described in this topic are only available on Windows 10 version 1903 and above, or Windows 11. When using this topic to plan your own organization's App Control policies, consider whether your managed clients can use all or some of these features and assess the impact for any features that may be unavailable on your clients. You may need to adapt this guidance to meet your specific organization's needs.
|
||||
|
||||
As described in [common App Control for Business deployment scenarios](common-appcontrol-use-cases.md), we'll use the example of **Lamna Healthcare Company (Lamna)** to illustrate this scenario. Lamna is attempting to adopt stronger application policies, including the use of App Control to prevent unwanted or unauthorized applications from running on their managed devices.
|
||||
As described in [common App Control for Business deployment scenarios](common-appcontrol-use-cases.md), we use the example of **Lamna Healthcare Company (Lamna)** to illustrate this scenario. Lamna is attempting to adopt stronger application policies, including the use of App Control to prevent unwanted or unauthorized applications from running on their managed devices.
|
||||
|
||||
**Alice Pena** is the IT team lead tasked with the rollout of App Control.
|
||||
|
||||
@ -55,7 +55,7 @@ Having defined the "circle-of-trust", Alice is ready to generate the initial pol
|
||||
Alice follows these steps to complete this task:
|
||||
|
||||
> [!NOTE]
|
||||
> If you do not use Configuration Manager or prefer to use a different [example App Control for Business base policy](example-appcontrol-base-policies.md) for your own policy, skip to step 2 and substitute the Configuration Manager policy path with your preferred example base policy.
|
||||
> If you don't use Configuration Manager or prefer to use a different [example App Control for Business base policy](example-appcontrol-base-policies.md) for your own policy, skip to step 2 and substitute the Configuration Manager policy path with your preferred example base policy.
|
||||
|
||||
1. [Use Configuration Manager to create and deploy an audit policy](/configmgr/protect/deploy-use/use-device-guard-with-configuration-manager) to a client device running Windows 10 version 1903 or above, or Windows 11.
|
||||
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Create an App Control policy for lightly managed devices
|
||||
description: App Control for Business restricts which applications users are allowed to run and the code that runs in the system core.
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 09/11/2024
|
||||
---
|
||||
|
||||
@ -3,7 +3,7 @@ title: Plan for App Control policy management
|
||||
description: Learn about the decisions you need to make to establish the processes for managing and maintaining App Control for Business policies.
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 09/11/2024
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
---
|
||||
|
||||
# Plan for App Control for Business lifecycle policy management
|
||||
|
||||
@ -3,7 +3,7 @@ title: Understand App Control script enforcement
|
||||
description: App Control script enforcement
|
||||
ms.manager: jsuther
|
||||
ms.date: 09/11/2024
|
||||
ms.topic: conceptual
|
||||
ms.topic: concept-article
|
||||
ms.localizationpriority: medium
|
||||
---
|
||||
|
||||
@ -12,7 +12,7 @@ ms.localizationpriority: medium
|
||||
[!INCLUDE [Feature availability note](../includes/feature-availability-note.md)]
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Option **11 Disabled:Script Enforcement** is not supported on **Windows Server 2016** or on **Windows 10 1607 LTSB** and should not be used on those platforms. Doing so will result in unexpected script enforcement behaviors.
|
||||
> Option **11 Disabled:Script Enforcement** isn't supported on **Windows Server 2016** or on **Windows 10 1607 LTSB** and shouldn't be used on those platforms. Doing so will result in unexpected script enforcement behaviors.
|
||||
|
||||
## Script enforcement overview
|
||||
|
||||
@ -23,7 +23,7 @@ Validation for signed scripts is done using the [WinVerifyTrust API](/windows/wi
|
||||
App Control shares the *AppLocker - MSI and Script* event log for all script enforcement events. Whenever a script host asks App Control if a script should be allowed, an event is logged with the answer App Control returned to the script host. For more information on App Control script enforcement events, see [Understanding App Control events](../operations/event-id-explanations.md#app-control-block-events-for-packaged-apps-msi-installers-scripts-and-com-objects).
|
||||
|
||||
> [!NOTE]
|
||||
> When a script runs that is not allowed by policy, App Control raises an event indicating that the script was "blocked." However, the actual script enforcement behavior is handled by the script host and may not actually completely block the file from running.
|
||||
> When a script runs that isn't allowed by policy, App Control raises an event indicating that the script was "blocked." However, the actual script enforcement behavior is handled by the script host and may not actually completely block the file from running.
|
||||
>
|
||||
> Also be aware that some script hosts may change how they behave even if an App Control policy is in audit mode only. You should review the script host specific information in this article and test thoroughly within your environment to ensure the scripts you need to run are working properly.
|
||||
|
||||
|
||||
@ -3,7 +3,7 @@ title: Understand App Control for Business policy rules and file rules
|
||||
description: Learn how App Control policy rules and file rules can control your Windows 10 and Windows 11 computers.
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 09/11/2024
|
||||
ms.topic: conceptual
|
||||
ms.topic: concept-article
|
||||
---
|
||||
|
||||
# Understand App Control for Business policy rules and file rules
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
x
Reference in New Issue
Block a user