From 4f8b3beca8f3eb65dabbe4bc90f18cada5ad1371 Mon Sep 17 00:00:00 2001 From: Your Name Date: Tue, 10 Oct 2017 10:02:53 -0700 Subject: [PATCH 1/5] Updated deny rules --- .../deploy-code-integrity-policies-steps.md | 554 ++++++++++++++++-- 1 file changed, 490 insertions(+), 64 deletions(-) diff --git a/windows/device-security/device-guard/deploy-code-integrity-policies-steps.md b/windows/device-security/device-guard/deploy-code-integrity-policies-steps.md index 8b11311fb6..3af32baedf 100644 --- a/windows/device-security/device-guard/deploy-code-integrity-policies-steps.md +++ b/windows/device-security/device-guard/deploy-code-integrity-policies-steps.md @@ -76,7 +76,9 @@ Certain software applications may allow additional code to run by design. These Microsoft recommends that you install the latest security updates. The June 2017 Windows updates resolve several issues in in-box PowerShell modules that allowed an attacker to bypass Windows Defender Device Guard code integrity policies. These modules cannot be blocked by name or version, and therefore must be blocked by their corresponding hashes. -Microsoft recommends that you block the following Microsoft-signed applications and PowerShell files by merging the following policy into your existing policy to add these deny rules using the Merge-CIPolicy cmdlet: +For October 2017, we are announcing an update to system.management.automation.dll in which we are revoking older versions by hash values, instead of version rules. + +Microsoft recommends that you block the following icrosoft-signed applications and PowerShell files by merging the following policy into your existing policy to add these deny rules using the Merge-CIPolicy cmdlet: ``` @@ -94,9 +96,6 @@ Microsoft recommends that you block the following Microsoft-signed applications - - - @@ -113,7 +112,7 @@ Microsoft recommends that you block the following Microsoft-signed applications - + @@ -123,43 +122,257 @@ Microsoft recommends that you block the following Microsoft-signed applications - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - @@ -178,21 +391,20 @@ Microsoft recommends that you block the following Microsoft-signed applications - - - - - - - - - - - - - - - + + + + + + + + + + + + + + @@ -219,19 +431,233 @@ Microsoft recommends that you block the following Microsoft-signed applications - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - + v 0 From 0f7ccbfe983dcdde62d5e307957b9e6bd87535c0 Mon Sep 17 00:00:00 2001 From: Your Name Date: Tue, 10 Oct 2017 10:17:41 -0700 Subject: [PATCH 2/5] Fix typo --- .../device-guard/deploy-code-integrity-policies-steps.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/device-security/device-guard/deploy-code-integrity-policies-steps.md b/windows/device-security/device-guard/deploy-code-integrity-policies-steps.md index 3af32baedf..8c523bb65d 100644 --- a/windows/device-security/device-guard/deploy-code-integrity-policies-steps.md +++ b/windows/device-security/device-guard/deploy-code-integrity-policies-steps.md @@ -78,7 +78,7 @@ Microsoft recommends that you install the latest security updates. The June 2017 For October 2017, we are announcing an update to system.management.automation.dll in which we are revoking older versions by hash values, instead of version rules. -Microsoft recommends that you block the following icrosoft-signed applications and PowerShell files by merging the following policy into your existing policy to add these deny rules using the Merge-CIPolicy cmdlet: +Microsoft recommends that you block the following Microsoft-signed applications and PowerShell files by merging the following policy into your existing policy to add these deny rules using the Merge-CIPolicy cmdlet: ``` From 7d724f797976896c6adeedde639da77559ccab4c Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Tue, 10 Oct 2017 11:32:05 -0700 Subject: [PATCH 3/5] added visualuiaverifynative.exe --- .../device-guard/deploy-code-integrity-policies-steps.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/windows/device-security/device-guard/deploy-code-integrity-policies-steps.md b/windows/device-security/device-guard/deploy-code-integrity-policies-steps.md index 8c523bb65d..ca63dd6b20 100644 --- a/windows/device-security/device-guard/deploy-code-integrity-policies-steps.md +++ b/windows/device-security/device-guard/deploy-code-integrity-policies-steps.md @@ -122,6 +122,7 @@ Microsoft recommends that you block the following Microsoft-signed applications + @@ -405,6 +406,7 @@ Microsoft recommends that you block the following Microsoft-signed applications + @@ -657,7 +659,7 @@ Microsoft recommends that you block the following Microsoft-signed applications - v + 0 From fe4f3f71e01386820634ef0fd0b34eca43e01c77 Mon Sep 17 00:00:00 2001 From: Nicholas Brower Date: Tue, 10 Oct 2017 18:34:02 +0000 Subject: [PATCH 4/5] Merged PR 3675: Policy CSP bug fixes. [Bug 13932995](https://microsoft.visualstudio.com/OS/_workitems/edit/13932995) --- .../mdm/policy-csp-applicationmanagement.md | 7 ------- .../mdm/policy-csp-authentication.md | 7 ------- .../mdm/policy-csp-browser.md | 8 ++++---- .../mdm/policy-csp-experience.md | 7 ------- ...policy-csp-localpoliciessecurityoptions.md | 20 +++++++++---------- .../mdm/policy-csp-notifications.md | 7 ------- .../client-management/mdm/policy-csp-start.md | 10 +--------- .../mdm/policy-csp-wirelessdisplay.md | 7 ++++++- 8 files changed, 21 insertions(+), 52 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-applicationmanagement.md b/windows/client-management/mdm/policy-csp-applicationmanagement.md index 7953580ab4..6f5802427e 100644 --- a/windows/client-management/mdm/policy-csp-applicationmanagement.md +++ b/windows/client-management/mdm/policy-csp-applicationmanagement.md @@ -496,13 +496,6 @@ ms.date: 09/29/2017

Allows disabling of the retail catalog and only enables the Private store. -> [!IMPORTANT] -> This node must be accessed using the following paths: -> -> - **./User/Vendor/MSFT/Policy/Config/ApplicationManagement/RequirePrivateStoreOnly** to set the policy. -> - **./User/Vendor/MSFT/Policy/Result/ApplicationManagement/RequirePrivateStoreOnly** to get the result. - -

The following list shows the supported values: - 0 (default) – Allow both public and Private store. diff --git a/windows/client-management/mdm/policy-csp-authentication.md b/windows/client-management/mdm/policy-csp-authentication.md index d33bbd648c..9db44013c0 100644 --- a/windows/client-management/mdm/policy-csp-authentication.md +++ b/windows/client-management/mdm/policy-csp-authentication.md @@ -119,13 +119,6 @@ ms.date: 09/29/2017

Allows an EAP cert-based authentication for a single sign on (SSO) to access internal resources. -> [!IMPORTANT] -> This node must be accessed using the following paths: -> -> - **./User/Vendor/MSFT/Policy/Config/Authentication/AllowEAPCertSSO** to set the policy. -> - **./User/Vendor/MSFT/Policy/Result/Authentication/AllowEAPCertSSO** to get the result. - -

The following list shows the supported values: - 0 – Not allowed. diff --git a/windows/client-management/mdm/policy-csp-browser.md b/windows/client-management/mdm/policy-csp-browser.md index 2c7f399858..e31c570992 100644 --- a/windows/client-management/mdm/policy-csp-browser.md +++ b/windows/client-management/mdm/policy-csp-browser.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 09/29/2017 +ms.date: 10/10/2017 --- # Policy CSP - Browser @@ -231,7 +231,7 @@ ms.date: 09/29/2017

To verify AllowAutofill is set to 0 (not allowed): -1. Open Microsoft Edge or Microsoft Edge for Windows 10 Mobile. +1. Open Microsoft Edge. 2. In the upper-right corner of the browser, click **…**. 3. Click **Settings** in the drop down list, and select **View Advanced Settings**. 4. Verify the setting **Save form entries** is greyed out. @@ -1177,8 +1177,8 @@ Employees cannot remove these search engines, but they can set any one as the de check mark check mark - check mark - check mark + cross mark + cross mark diff --git a/windows/client-management/mdm/policy-csp-experience.md b/windows/client-management/mdm/policy-csp-experience.md index 4dfcea0e83..8f2199edcd 100644 --- a/windows/client-management/mdm/policy-csp-experience.md +++ b/windows/client-management/mdm/policy-csp-experience.md @@ -736,13 +736,6 @@ ms.date: 09/29/2017

This policy allows IT admins to turn on experiences that are typically for consumers only, such as Start suggestions, Membership notifications, Post-OOBE app install and redirect tiles. -> [!IMPORTANT] -> This node must be accessed using the following paths: -> -> - **./User/Vendor/MSFT/Policy/Config/Experience/AllowWindowsConsumerFeatures** to set the policy. -> - **./User/Vendor/MSFT/Policy/Result/Experience/AllowWindowsConsumerFeatures** to get the result. - - 

The following list shows the supported values: - 0 – Not allowed. diff --git a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md index f2c1e120e8..bb7fdbd8d7 100644 --- a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md +++ b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 09/29/2017 +ms.date: 10/05/2017 --- # Policy CSP - LocalPoliciesSecurityOptions @@ -999,17 +999,17 @@ This policy setting controls the behavior of the elevation prompt for administra The options are: -• Elevate without prompting: Allows privileged accounts to perform an operation that requires elevation without requiring consent or credentials. Note: Use this option only in the most constrained environments. +- 0 - Elevate without prompting: Allows privileged accounts to perform an operation that requires elevation without requiring consent or credentials. Note: Use this option only in the most constrained environments. -• Prompt for credentials on the secure desktop: When an operation requires elevation of privilege, the user is prompted on the secure desktop to enter a privileged user name and password. If the user enters valid credentials, the operation continues with the user's highest available privilege. +- 1 - Prompt for credentials on the secure desktop: When an operation requires elevation of privilege, the user is prompted on the secure desktop to enter a privileged user name and password. If the user enters valid credentials, the operation continues with the user's highest available privilege. -• Prompt for consent on the secure desktop: When an operation requires elevation of privilege, the user is prompted on the secure desktop to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege. +- 2 - Prompt for consent on the secure desktop: When an operation requires elevation of privilege, the user is prompted on the secure desktop to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege. -• Prompt for credentials: When an operation requires elevation of privilege, the user is prompted to enter an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. +- 3 - Prompt for credentials: When an operation requires elevation of privilege, the user is prompted to enter an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. -• Prompt for consent: When an operation requires elevation of privilege, the user is prompted to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege. +- 4 - Prompt for consent: When an operation requires elevation of privilege, the user is prompted to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege. -• Prompt for consent for non-Windows binaries: (Default) When an operation for a non-Microsoft application requires elevation of privilege, the user is prompted on the secure desktop to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege. +- 5 - Prompt for consent for non-Windows binaries: (Default) When an operation for a non-Microsoft application requires elevation of privilege, the user is prompted on the secure desktop to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege. Value type is integer. Supported operations are Add, Get, Replace, and Delete. @@ -1057,11 +1057,11 @@ This policy setting controls the behavior of the elevation prompt for standard u The options are: -• Prompt for credentials: (Default) When an operation requires elevation of privilege, the user is prompted to enter an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. +- 3 - Prompt for credentials: (Default) When an operation requires elevation of privilege, the user is prompted to enter an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. -• Automatically deny elevation requests: When an operation requires elevation of privilege, a configurable access denied error message is displayed. An enterprise that is running desktops as standard user may choose this setting to reduce help desk calls. +- 0 - Automatically deny elevation requests: When an operation requires elevation of privilege, a configurable access denied error message is displayed. An enterprise that is running desktops as standard user may choose this setting to reduce help desk calls. -• Prompt for credentials on the secure desktop: When an operation requires elevation of privilege, the user is prompted on the secure desktop to enter a different user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. +- 1 - Prompt for credentials on the secure desktop: When an operation requires elevation of privilege, the user is prompted on the secure desktop to enter a different user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. Value type is integer. Supported operations are Add, Get, Replace, and Delete. diff --git a/windows/client-management/mdm/policy-csp-notifications.md b/windows/client-management/mdm/policy-csp-notifications.md index f85714b12c..4b0a9b5e62 100644 --- a/windows/client-management/mdm/policy-csp-notifications.md +++ b/windows/client-management/mdm/policy-csp-notifications.md @@ -64,13 +64,6 @@ ms.date: 09/29/2017

Added in Windows 10, version 1607. Boolean value that turns off notification mirroring. -> [!IMPORTANT] -> This node must be accessed using the following paths: -> -> - **./User/Vendor/MSFT/Policy/Config/Notifications/DisallowNotificationMirroring** to set the policy. -> - **./User/Vendor/MSFT/Policy/Result/Notifications/DisallowNotificationMirroring** to get the result. - -

For each user logged into the device, if you enable this policy (set value to 1) the app and system notifications received by this user on this device will not get mirrored to other devices of the same logged in user. If you disable or do not configure this policy (set value to 0) the notifications received by this user on this device will be mirrored to other devices of the same logged in user. This feature can be turned off by apps that do not want to participate in Notification Mirroring. This feature can also be turned off by the user in the Cortana setting page.

No reboot or service restart is required for this policy to take effect. diff --git a/windows/client-management/mdm/policy-csp-start.md b/windows/client-management/mdm/policy-csp-start.md index f73f1b8331..03c3fb2ea4 100644 --- a/windows/client-management/mdm/policy-csp-start.md +++ b/windows/client-management/mdm/policy-csp-start.md @@ -1536,15 +1536,7 @@ ms.date: 09/29/2017 > [!IMPORTANT] -> This node is set on a per-user basis and must be accessed using the following paths: -> - **./User/Vendor/MSFT/Policy/Config/Start/StartLayout** to configure the policy. -> - **./User/Vendor/MSFT/Policy/Result/Start/StartLayout** to query the current value of the policy. -> -> -> Added in Windows 10 version 1703: In addition to being able to set this node on a per user-basis, it can now also be set on a per-device basis using the following paths: -> - **./Device/Vendor/MSFT/Policy/Config/Start/StartLayout** to configure the policy. -> - **./Device/Vendor/MSFT/Policy/Result/Start/StartLayout** to query the current value of the policy. - +> Added in Windows 10 version 1703: In addition to being able to set this node on a per user-basis, it can now also be set on a per-device basis. For more information, see [Policy scope](./policy-configuration-service-provider.md#policy-scope)

Allows you to override the default Start layout and prevents the user from changing it. If both user and device policies are set, the user policy will be used. Apps pinned to the taskbar can also be changed with this policy diff --git a/windows/client-management/mdm/policy-csp-wirelessdisplay.md b/windows/client-management/mdm/policy-csp-wirelessdisplay.md index 0d7ab2b543..e249ddea29 100644 --- a/windows/client-management/mdm/policy-csp-wirelessdisplay.md +++ b/windows/client-management/mdm/policy-csp-wirelessdisplay.md @@ -234,7 +234,12 @@ ms.date: 09/29/2017 -

Added in Windows 10, version 1703. +

Added in Windows 10, version 1703. Setting this policy controls whether or not the wireless display can send input—keyboard, mouse, pen, and touch input if the display supports it—back to the source device. + +

Allowed values: + +- 0 - Wireless display input disabled. +- 1 (default) - Wireless display input enabled. From 2fc6b0b6aa73e86000a4baf4197ab60dc2ca0dda Mon Sep 17 00:00:00 2001 From: Nicholas Brower Date: Tue, 10 Oct 2017 18:39:41 +0000 Subject: [PATCH 5/5] Merged PR 3678: Intro section added to Olympia enrollment guidelines. --- .../olympia/olympia-enrollment-guidelines.md | 28 ++++++++++++++++--- 1 file changed, 24 insertions(+), 4 deletions(-) diff --git a/windows/deployment/update/olympia/olympia-enrollment-guidelines.md b/windows/deployment/update/olympia/olympia-enrollment-guidelines.md index fddd959017..03d4f5f475 100644 --- a/windows/deployment/update/olympia/olympia-enrollment-guidelines.md +++ b/windows/deployment/update/olympia/olympia-enrollment-guidelines.md @@ -6,10 +6,30 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 09/14/2017 +ms.date: 09/15/2017 --- -# Olympia Corp enrollment guidelines +# Olympia Corp + +## What is Windows Insider Lab for Enterprise and Olympia Corp? + +Windows Insider Lab for Enterprise is intended for Windows Insiders who want to try new experimental and pre-release Enterprise Privacy and Security features*. To get the complete experience of these Enterprise features, Olympia Corp, a virtual corporation has been set up to reflect the IT infrastructure of real world business. Selected customers are invited to join Olympia Corp and try these features. + +As an Olympia user, you will have an opportunity to: + +- Use various Enterprise features like WIP (Windows Information Protection), ATP (Advanced Threat Protection), WDAG (Windows Defender Application Guard), and APP-V (Application virtualization). +- Learn how Microsoft is preparing for GDPR, as well as enabling enterprise customers to prepare for their own readiness. +- Validate and test pre-release software in your environment. +- Provide feedback. +- Interact with engineering team members through a variety of communication channels. + +\* Enterprise features may have reduced, or different security, privacy, accessibility, availability, and reliability standards relative to commercially provided services and software. We may change or discontinue any of the Enterprise features at any time without notice. + +For more information about Olympia Corp, please see [https://olympia.windows.com/Info/FAQ](https://olympia.windows.com/Info/FAQ). + +To request an Olympia Corp account, please fill out the survey at [https://aka.ms/RegisterOlympia](https://aka.ms/RegisterOlympia). + +## Enrollment guidelines Welcome to Olympia Corp. Here are the steps to add your account to your PC. @@ -23,7 +43,7 @@ Choose one of the following two enrollment options: -## Keep your current Windows 10 edition +### Keep your current Windows 10 edition 1. Go to **Start > Settings > Accounts > Access work or school**. To see this setting, you need to have administrator rights to your PC (see [local administrator](https://support.microsoft.com/en-us/instantanswers/5de907f1-f8ba-4fd9-a89d-efd23fee918c/create-a-local-user-or-administrator-account-in-windows-10)). @@ -57,7 +77,7 @@ Choose one of the following two enrollment options: -## Upgrade your Windows 10 edition from Pro to Enterprise +### Upgrade your Windows 10 edition from Pro to Enterprise 1. Go to **Start > Settings > Accounts > Access work or school**. To see this setting, you need to have administrator rights to your PC (see [local administrator](https://support.microsoft.com/en-us/instantanswers/5de907f1-f8ba-4fd9-a89d-efd23fee918c/create-a-local-user-or-administrator-account-in-windows-10)).