diff --git a/.openpublishing.publish.config.json b/.openpublishing.publish.config.json index 3562d6d9f1..2ffc227a40 100644 --- a/.openpublishing.publish.config.json +++ b/.openpublishing.publish.config.json @@ -8,7 +8,7 @@ "locale": "en-us", "monikers": [], "moniker_ranges": [], - "open_to_public_contributors": true, + "open_to_public_contributors": false, "type_mapping": { "Conceptual": "Content", "ManagedReference": "Content", @@ -40,7 +40,7 @@ "locale": "en-us", "monikers": [], "moniker_ranges": [], - "open_to_public_contributors": true, + "open_to_public_contributors": false, "type_mapping": { "Conceptual": "Content", "ManagedReference": "Content", @@ -56,7 +56,7 @@ "locale": "en-us", "monikers": [], "moniker_ranges": [], - "open_to_public_contributors": true, + "open_to_public_contributors": false, "type_mapping": { "Conceptual": "Content", "ManagedReference": "Content", @@ -88,7 +88,7 @@ "locale": "en-us", "monikers": [], "moniker_ranges": [], - "open_to_public_contributors": true, + "open_to_public_contributors": false, "type_mapping": { "Conceptual": "Content", "ManagedReference": "Content", @@ -120,7 +120,7 @@ "locale": "en-us", "monikers": [], "moniker_ranges": [], - "open_to_public_contributors": true, + "open_to_public_contributors": false, "type_mapping": { "Conceptual": "Content", "ManagedReference": "Content", @@ -136,7 +136,7 @@ "locale": "en-us", "monikers": [], "moniker_ranges": [], - "open_to_public_contributors": true, + "open_to_public_contributors": false, "type_mapping": { "Conceptual": "Content", "ManagedReference": "Content", @@ -200,7 +200,7 @@ "locale": "en-us", "monikers": [], "moniker_ranges": [], - "open_to_public_contributors": true, + "open_to_public_contributors": false, "type_mapping": { "Conceptual": "Content", "ManagedReference": "Content", @@ -232,7 +232,7 @@ "locale": "en-us", "monikers": [], "moniker_ranges": [], - "open_to_public_contributors": true, + "open_to_public_contributors": false, "type_mapping": { "Conceptual": "Content", "ManagedReference": "Content", @@ -280,7 +280,7 @@ "locale": "en-us", "monikers": [], "moniker_ranges": [], - "open_to_public_contributors": true, + "open_to_public_contributors": false, "type_mapping": { "Conceptual": "Content", "ManagedReference": "Content", @@ -481,4 +481,4 @@ }, "need_generate_pdf": false, "need_generate_intellisense": false -} \ No newline at end of file +} diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 9fa201861f..39a821b641 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -786,11 +786,6 @@ "redirect_document_id": true }, { -"source_path": "windows/security/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/controlled-folders", -"redirect_document_id": true -}, -{ "source_path": "windows/threat-protection/windows-defender-exploit-guard/customize-attack-surface-reduction.md", "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/customize-attack-surface-reduction", "redirect_document_id": true @@ -881,11 +876,6 @@ "redirect_document_id": true }, { -"source_path": "windows/security/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/network-protection", -"redirect_document_id": true -}, -{ "source_path": "windows/threat-protection/windows-defender-exploit-guard/prerelease.md", "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/prerelease", "redirect_document_id": true @@ -6046,6 +6036,11 @@ "redirect_url": "/hololens/hololens-recovery", "redirect_document_id": false }, +{ + "source_path": "devices/hololens/holographic-photos-and-video.md", + "redirect_url": "/hololens/holographic-photos-and-videos", + "redirect_document_id": false +}, { "source_path": "devices/surface-hub/provisioning-packages-for-certificates-surface-hub.md", "redirect_url": "https://docs.microsoft.com/surface-hub/provisioning-packages-for-surface-hub", @@ -15340,6 +15335,81 @@ "source_path": "windows/security/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md", "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exploit-protection", "redirect_document_id": false +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-application-control/create-path-based-rules.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create", +"redirect_document_id": false +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-mac", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-whatsnew.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-whatsnew", +"redirect_document_id": true +}, +{ +"source_path": "windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-intune", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-jamf", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-other-mdm.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-other-mdm", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-manually.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-install-manually", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-updates.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-updates", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-exclusions.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-exclusions", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-preferences.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-preferences", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-pua.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-pua", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-support-perf.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-support-perf", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-support-kext.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-support-kext", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-privacy.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-privacy", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-resources.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-resources", +"redirect_document_id": true } ] } diff --git a/browsers/edge/docfx.json b/browsers/edge/docfx.json index 730c9d7ac2..45cd5c2570 100644 --- a/browsers/edge/docfx.json +++ b/browsers/edge/docfx.json @@ -34,9 +34,8 @@ "ms.topic": "article", "manager": "laurawi", "ms.prod": "edge", - "feedback_system": "GitHub", - "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", - "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", + "feedback_system": "None", + "hideEdit": true, "_op_documentIdPathDepotMapping": { "./": { "depot_name": "Win.microsoft-edge", diff --git a/browsers/internet-explorer/docfx.json b/browsers/internet-explorer/docfx.json index 934ad0e5f6..1cec2c9694 100644 --- a/browsers/internet-explorer/docfx.json +++ b/browsers/internet-explorer/docfx.json @@ -30,9 +30,8 @@ "ms.topic": "article", "manager": "laurawi", "ms.date": "04/05/2017", - "feedback_system": "GitHub", - "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", - "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", + "feedback_system": "None", + "hideEdit": true, "_op_documentIdPathDepotMapping": { "./": { "depot_name": "Win.internet-explorer", diff --git a/devices/hololens/TOC.md b/devices/hololens/TOC.md index 03234dc869..8b12d44ca5 100644 --- a/devices/hololens/TOC.md +++ b/devices/hololens/TOC.md @@ -23,16 +23,16 @@ ## [Set up ring based updates for HoloLens](hololens-updates.md) ## [Enable Bitlocker device encryption for HoloLens](hololens-encryption.md) -# User management and access management -## [Share your HoloLens with multiple people](hololens-multiple-users.md) -## [Set up HoloLens as a kiosk (single application access)](hololens-kiosk.md) -## [Set up limited application access](hololens-kiosk.md) - # Navigating Windows Holographic ## [Start menu and mixed reality home](holographic-home.md) ## [Use your voice with HoloLens](hololens-cortana.md) ## [Find and save files](hololens-find-and-save-files.md) -## [Create, share, and view photos and video](holographic-photos-and-video.md) +## [Create, share, and view photos and video](holographic-photos-and-videos.md) + +# User management and access management +## [Share your HoloLens with multiple people](hololens-multiple-users.md) +## [Set up HoloLens as a kiosk (single application access)](hololens-kiosk.md) +## [Set up limited application access](hololens-kiosk.md) # Holographic Applications ## [Try 3D Viewer](holographic-3d-viewer-beta.md) @@ -53,6 +53,8 @@ # Update and recovery ## [Join the Windows Insider program](hololens-insider.md) ## [Restart, reset, or recover](hololens-recovery.md) +## [Known issues](hololens-known-issues.md) +## [Frequently asked questions](hololens-faq.md) # [Give us feedback](hololens-feedback.md) # [Change history for Microsoft HoloLens documentation](change-history-hololens.md) diff --git a/devices/hololens/docfx.json b/devices/hololens/docfx.json index 51b4a3afbb..4f53494c32 100644 --- a/devices/hololens/docfx.json +++ b/devices/hololens/docfx.json @@ -43,8 +43,9 @@ "./": { "depot_name": "Win.itpro-hololens", "folder_relative_path_in_docset": "./" + } + } - } }, "fileMetadata": {}, "template": [ @@ -52,5 +53,15 @@ ], "dest": "devices/hololens", "markdownEngineName": "markdig" - } + }, + "contributors_to_exclude": [ + "rjagiewich", + "traya1", + "rmca14", + "claydetels19", + "Kellylorenebaker", + "jborsecnik", + "tiburd", + "garycentric" + ] } diff --git a/devices/hololens/holographic-3d-viewer-beta.md b/devices/hololens/holographic-3d-viewer-beta.md index 0aada1fe55..14514a5133 100644 --- a/devices/hololens/holographic-3d-viewer-beta.md +++ b/devices/hololens/holographic-3d-viewer-beta.md @@ -6,8 +6,9 @@ ms.sitesec: library author: Teresa-Motiv ms.author: v-tea ms.topic: article +audience: ITPro ms.localizationpriority: medium -ms.date: 9/3/19 +ms.date: 10/30/2019 ms.reviewer: manager: jarrettr appliesto: @@ -59,22 +60,22 @@ If you're having trouble after reading these topics, see [Troubleshooting](#trou - Scale/rotation/translation animation on individual objects - Skeletal (rigged) animation with skinning - - Maximum of 4 influences per vertex + - Maximum of 4 influences per vertex ### Materials - Lambert and Phong materials are supported, with adjustable parameters - Supported material properties for Lambert - - Main Texture (RGB + Alpha Test) - - Diffuse Color (RGB) - - Ambient Color (RGB) + - Main Texture (RGB + Alpha Test) + - Diffuse Color (RGB) + - Ambient Color (RGB) - Supported material properties for Phong - - Main Texture (RGB + Alpha Test) - - Diffuse Color (RGB) - - Ambient Color (RGB) - - Specular Color (RGB) - - Shininess - - Reflectivity + - Main Texture (RGB + Alpha Test) + - Diffuse Color (RGB) + - Ambient Color (RGB) + - Specular Color (RGB) + - Shininess + - Reflectivity - Custom materials are not supported - Maximum of one material per mesh - Maximum of one material layer diff --git a/devices/hololens/holographic-custom-apps.md b/devices/hololens/holographic-custom-apps.md index 4936fab2b7..0a86a7b37a 100644 --- a/devices/hololens/holographic-custom-apps.md +++ b/devices/hololens/holographic-custom-apps.md @@ -35,7 +35,6 @@ You can install your own applications on HoloLens either by using the Device Por > Make sure to reference any associated dependency and certificate files. 1. Select **Go**. - ![Install app form in Windows Device Portal on Microsoft HoloLens](images/deviceportal-appmanager.jpg) ### Deploying from Microsoft Visual Studio 2015 @@ -44,7 +43,6 @@ You can install your own applications on HoloLens either by using the Device Por 1. Open the project's **Properties**. 1. Select the following build configuration: **Master/x86/Remote Machine**. 1. When you select **Remote Machine**: - - Make sure the address points to the Wi-Fi IP address of your HoloLens. - Set authentication to **Universal (Unencrypted Protocol)**. 1. Build your solution. diff --git a/devices/hololens/holographic-photos-and-video.md b/devices/hololens/holographic-photos-and-video.md deleted file mode 100644 index a02c1fb445..0000000000 --- a/devices/hololens/holographic-photos-and-video.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: Create, share, and view photos and video -description: Create, share, and view photos and video -ms.assetid: 1b636ec3-6186-4fbb-81b2-71155aef0593 -keywords: hololens -ms.prod: hololens -ms.sitesec: library -author: Teresa-Motiv -ms.author: v-tea -ms.topic: article -ms.localizationpriority: high -ms.date: 8/12/19 -ms.reviewer: -manager: jarrettr -appliesto: -- HoloLens (1st gen) -- HoloLens 2 ---- - -# Create, share, and view photos and video - -Use your HoloLens to take photos and videos that capture the holograms you've placed in your world. - -To sync your photos and videos to OneDrive, open the OneDrive app and select **Settings** > **Camera upload**, and then turn on **Camera upload**. - -## Take a photo on HoloLens (1st gen) - -Use the open the **Start** menu, and then select the Photos app. - -Use gaze to position the photo frame, then air tap to take the picture. The picture will be saved to your collection in the Photos app.

- -Want to snap a quick picture? Press the [volume up and volume down buttons](hololens1-hardware.md#hololens-components) at the same time. - -## Take a video on HoloLens (1st gen) - -Use the bloom gesture to go to **Start**, then select **Video**. Use gaze to position the video frame, then air tap to start recording. To stop recording, use bloom once. The video will be saved to your collection in the Photos app. - -To start recording more quickly, press and hold the volume up and volume down buttons simultaneously until a three-second countdown begins. To stop recording, tap both buttons. - -> [!TIP] -> You can always have Cortana take a photo or a video for you. Just say "Hey Cortana, take a photo" or "Hey Cortana, take a video." [What else can I say to Cortana?](hololens-cortana.md) - -## Find your photos and videos - -To see your photos from OneDrive, select **More** > **Settings**, and then turn on **Show my cloud-only content from OneDrive**. (You'll need to sign in to the Photos app with your Microsoft account, if you haven't already.) - -To pin a photo or video in your world, open it, then select **Place in mixed world**. Use tap and hold to move it to where you want it. - -## Share photos and videos - -To share images to a social network, in the Collection view, tap and hold the photo you want to share, then select **Share**. Select **Share Assistant**, then select the app that you want to share to. - -You can also share directly from the camera app right after you take a photo—at the top of the image, select **Share**. diff --git a/devices/hololens/holographic-photos-and-videos.md b/devices/hololens/holographic-photos-and-videos.md new file mode 100644 index 0000000000..10e6bb4756 --- /dev/null +++ b/devices/hololens/holographic-photos-and-videos.md @@ -0,0 +1,150 @@ +--- +title: Capture and manage mixed reality photos and videos +description: Learn how to capture, view, and share mixed reality photos and videos, using HoloLens. +keywords: hololens, photo, video, capture, mrc, mixed reality capture, photos, camera, stream, livestream, demo +ms.assetid: 1b636ec3-6186-4fbb-81b2-71155aef0593 +ms.prod: hololens +ms.sitesec: library +author: mattzmsft +ms.author: mazeller +ms.topic: article +audience: ITPro +ms.localizationpriority: medium +ms.date: 10/28/2019 +manager: jarrettr +appliesto: +- HoloLens (1st gen) +- HoloLens 2 +--- + +# Create mixed reality photos and videos + +HoloLens gives users the experience of mixing the real world with the digital world. Mixed reality capture (MRC) lets you capture that experience as a photo or video, or share what you see with others in real-time. + +Mixed reality capture uses a first-person point of view so other people can see holograms as you see them. For a third-person point of view, use [spectator view](https://docs.microsoft.com/windows/mixed-reality/spectator-view). Spectator view is especially useful for demos. + +While it's fun to share videos amongst friends and colleagues, videos can also help teach other people to use an app or to communicate problems with apps and experiences. + +> [!NOTE] +> If you can't launch mixed reality capture experiences and your HoloLens is a work device, check with your system administrator. Access to the camera can be restricted through company policy. + +## Capture a mixed reality photo + +There are several ways to take a photo of mixed reality on HoloLens; you can use hardware buttons, voice, or the Start menu. + +### Hardware buttons to take photos + +To take a quick photo of your current view, press the volume up and volume down buttons at the same time. This is a bit like the HoloLens version of a screenshot or print screen. + +- [Button locations on HoloLens 2](hololens2-hardware.md) +- [Button locations on HoloLens (1st gen)](hololens1-hardware.md#hololens-components) + +> [!NOTE] +> Holding the **volume up** and **volume down** buttons for three seconds will start recording a video rather than taking a photo. To stop recording, tap both **volume up** and **volume down** buttons simultaneously. + +### Voice commands to take photos + +Cortana can also take a picture. Say: "Hey Cortana, take a picture." + +### Start menu to take photos + +Use the Start gesture to go to **Start**, then select the **camera** icon. + +Point your head in the direction of what you want to capture, then [air tap](hololens2-basic-usage.md#touch-holograms-near-you) to take a photo. You can continue to air tap and capture additional photos. Any photos you capture will be saved to your device. + +Use the Start gesture again to end photo capture. + +## Capture a mixed reality video + +There are several ways to record a video of mixed reality on HoloLens; you can use hardware buttons, voice, or the Start menu. + +### Hardware buttons to record videos + +The quickest way to record a video is to press and hold the **volume up** and **volume down** buttons simultaneously until a three-second countdown begins. To stop recording, tap both buttons simultaneously. + +> [!NOTE] +> Quickly pressing the **volume up** and **volume down** buttons at the same time will take a photo rather than recording a video. + +### Voice to record videos + +Cortana can also record a video. Say: "Hey Cortana, start recording." To stop a video, say "Hey Cortana, stop recording." + +### Start menu to record videos + +Use the Start gesture to go to **Start**, then select the **video** icon. Point your head in the direction of what you want to capture, then [air tap](hololens2-basic-usage.md#touch-holograms-near-you) to start recording. There will be a three second countdown and your recording will begin. + +To stop recording, use the Start gesture and select the highlighted **video** icon. The video will be saved to your device. + +> [!NOTE] +> **Applies to HoloLens (1st gen) only** +> The [Windows 10 October 2018 Update](https://docs.microsoft.com/windows/mixed-reality/release-notes-october-2018) changes how the Start gesture and Windows button behave on HoloLens (1st gen). Before the update, the Start gesture or Windows button would stop a video recording. After the update, however, the Start gesture or Windows button opens the **Start** menu (or the **quick actions menu** if you are in an immersive app), from which you can select the highlighted **video** icon to stop recording. + +## Share what you see in real-time + +You can share what you see in HoloLens with friends and colleagues in real-time. There are a few methods available: + +1. Connecting to a Miracast-enabled device or adapter to watch on a TV. +1. Using [Windows Device Portal](https://docs.microsoft.com/windows/mixed-reality/using-the-windows-device-portal) to watch on a PC +1. Using the [Microsoft HoloLens companion app](https://www.microsoft.com/store/productId/9NBLGGH4QWNX) to watch on a PC. +1. Deploying the [Microsoft Dynamics 365 Remote Assist](https://dynamics.microsoft.com/en-us/mixed-reality/remote-assist) app, which enables front-line workers to stream what they see to a remote expert. The remote expert can then guide the front-line worker verbally or by annotating in their world. + +> [!NOTE] +> Sharing what you see via Windows Device Portal or Microsoft HoloLens companion app requires your HoloLens to be in [Developer mode](https://docs.microsoft.com/windows/mixed-reality/using-the-windows-device-portal#setting-up-hololens-to-use-windows-device-portal). + +### Stream video with Miracast + +Use the Start gesture to go to **Start**, then select the **connect** icon. From the picker that appears, select the Miracast-enabled device or adapter to which you want to connect. + +To stop sharing, use the Start gesture and select the highlighted **connect** icon. Because you were streaming, nothing will be saved to your device. + +> [!NOTE] +> Miracast support was enabled on HoloLens (1st gen) beginning with the [Windows 10 October 2018 Update](https://docs.microsoft.com/windows/mixed-reality/release-notes-october-2018). + +### Real time video with Windows Device Portal + +Because sharing via Windows Device Portal requires Developer mode to be enabled on HoloLens, follow the instructions in our developer documentation to [set up Developer mode and navigate Windows Device Portal](https://docs.microsoft.com/windows/mixed-reality/using-the-windows-device-portal). + +### Microsoft HoloLens companion app + +Because sharing via the Microsoft HoloLens companion app requires Developer mode to be enabled on HoloLens, follow the instructions in our developer documentation to [set up Developer mode](https://docs.microsoft.com/windows/mixed-reality/using-the-windows-device-portal). Then, download the [Microsoft HoloLens companion app](https://www.microsoft.com/store/productId/9NBLGGH4QWNX) and follow the instructions within the app to connect to your HoloLens. + +Once the app is set up with your HoloLens, select the **Live stream** option from the app's main menu. + +## View your mixed reality photos and videos + +Mixed reality photos and videos are saved to the device's "Camera Roll". You can browse the contents of this folder on your HoloLens with the File Explorer app (navigate to Pictures > Camera Roll). + +You can also view your mixed reality photos and videos in the Photos app, which is pre-installed on HoloLens. To pin a photo in your world, select it in the Photos app and choose **Place in mixed world**. You can move the photo around your world after it's been placed. + +To view and/or save your mixed reality photos and videos on a PC connected to HoloLens, you can use [Windows Device Portal](https://docs.microsoft.com/windows/mixed-reality/using-the-windows-device-portal#mixed-reality-capture) or your [PC's File Explorer via MTP](https://docs.microsoft.com/windows/mixed-reality/release-notes-april-2018#new-features-for-hololens). + +## Share your mixed reality photos and videos + +After capturing a mixed reality photo or video, a preview will appear. Select the **share** icon above the preview to bring up the share assistant. From there, you can select the end point to which you'd like to share that photo or video. + +You can also share mixed reality photos and videos from OneDrive, by automatically uploading your mixed reality photos and videos. Open the OneDrive app on HoloLens and sign in with a personal [Microsoft account](https://account.microsoft.com) if you haven't already. Select the **settings** icon and choose **Camera upload**. Turn Camera upload on. Your mixed reality photos and videos will now be uploaded to OneDrive each time you launch the app on HoloLens. + +> [!NOTE] +> You can only enable camera upload in OneDrive if you’re signed into OneDrive with a personal Microsoft account. If you set up HoloLens with a work or school account, you can add a personal Microsoft account in the OneDrive app to enable this feature. + +## Limitations of mixed reality capture + +- While using mixed reality capture, the framerate of HoloLens will be halved to 30 Hz. +- Videos have a maximum length of five minutes. +- The resolution of photos and videos may be reduced if the photo/video camera is already in use by another application, while live streaming, or when system resources are low. + +## Default file format and resolution + +### Default photo format and resolution + +| Device | Format | Extension | Resolution | +|----------|----------|----------|----------| +| HoloLens 2 | [JPEG](https://en.wikipedia.org/wiki/JPEG) | .jpg | 3904x2196px | +| HoloLens (1st gen) | [JPEG](https://en.wikipedia.org/wiki/JPEG) | .jpg | 1408x792px | + +### Recorded video format and resolution + +| Device | Format | Extension | Resolution | Speed | Audio | +|----------|----------|----------|----------|----------|----------| +| HoloLens 2 | [MPEG-4](https://en.wikipedia.org/wiki/MPEG-4) | .mp4 | 1920x1080px | 30fps | 48kHz Stereo | +| HoloLens (1st gen) | [MPEG-4](https://en.wikipedia.org/wiki/MPEG-4) | .mp4 | 1216x684px | 24fps | 48kHz Stereo | diff --git a/devices/hololens/hololens-FAQ.md b/devices/hololens/hololens-FAQ.md new file mode 100644 index 0000000000..203d5185f8 --- /dev/null +++ b/devices/hololens/hololens-FAQ.md @@ -0,0 +1,217 @@ +--- +title: Frequently asked questions about HoloLens and holograms +description: Do you have a quick question about HoloLens or interacting with holograms? This article provides a quick answer and more resources. +keywords: hololens, faq, known issue, help +ms.prod: hololens +ms.sitesec: library +author: Teresa-Motiv +ms.author: v-tea +ms.topic: article +audience: ITPro +ms.localizationpriority: medium +ms.date: 10/30/2019 +ms.reviewer: +manager: jarrettr +appliesto: +- HoloLens (1st gen) +- HoloLens 2 +--- + +# HoloLens and holograms: Frequently asked questions + +Here are some answers to questions you might have about using HoloLens, placing holograms, working with spaces, and more. + +Any time you're having problems, make sure HoloLens is [charged up](https://support.microsoft.com/help/12627/hololens-charge-your-hololens). Try [restarting it](hololens-restart-recover.md) to see if that fixes things. And please use the Feedback app to send us info about the issue—you'll find it on the [**Start** menu](holographic-home.md). + +For tips about wearing your HoloLens, see [HoloLens fit and comfort: FAQ](https://support.microsoft.com/help/13405/hololens-fit-and-comfort-faq). + +This FAQ addresses the following questions and issues: + + +- [My holograms don't look right or are moving around](#my-holograms-dont-look-right-or-are-moving-around) +- [I see a message that says "Finding your space"](#i-see-a-message-that-says-finding-your-space) +- [I'm not seeing the holograms I expect to see in my space](#im-not-seeing-the-holograms-i-expect-to-see-in-my-space) +- [I can't place holograms where I want](#i-cant-place-holograms-where-i-want) +- [Holograms disappear or are encased in other holograms or objects](#holograms-disappear-or-are-encased-in-other-holograms-or-objects) +- [I can see holograms that are on the other side of a wall](#i-can-see-holograms-that-are-on-the-other-side-of-a-wall) +- [When I place a hologram on a wall, it seems to float](#when-i-place-a-hologram-on-a-wall-it-seems-to-float) +- [Apps appear too close to me when I'm trying to move them](#apps-appear-too-close-to-me-when-im-trying-to-move-them) +- [I'm getting a low disk space error](#im-getting-a-low-disk-space-error) +- [HoloLens doesn't respond to my gestures](#hololens-doesnt-respond-to-my-gestures) +- [HoloLens doesn't respond to my voice](#hololens-doesnt-respond-to-my-voice) +- [I'm having problems pairing or using a Bluetooth device](#im-having-problems-pairing-or-using-a-bluetooth-device) +- [I'm having problems with the HoloLens clicker](#im-having-problems-with-the-hololens-clicker) +- [I can't connect to Wi-Fi](#i-cant-connect-to-wi-fi) +- [My HoloLens isn't running well, is unresponsive, or won't start](#my-hololens-isnt-running-well-is-unresponsive-or-wont-start) +- [How do I delete all spaces?](#how-do-i-delete-all-spaces) +- [I cannot find or use the keyboard to type in the HoloLens 2 Emulator](#i-cannot-find-or-use-the-keyboard-to-type-in-the-hololens-2-emulator) + +## My holograms don't look right or are moving around + +If your holograms don't look right (for example, they're jittery or shaky, or you see black patches on top of them), try one of these fixes: + +- [Clean your device visor](hololens1-hardware.md#care-and-cleaning) and make sure nothing is blocking the sensors. +- Make sure you're in a well-lit room without a lot of direct sunlight. +- Try walking around and gazing at your surroundings so HoloLens can scan them more completely. +- If you've placed a lot of holograms, try removing some. + +If you're still having problems, trying running the Calibration app, which calibrates your HoloLens just for you, to help keep your holograms looking their best. Go to **Settings **>** System **>** Utilities**. Under Calibration, select **Open Calibration**. + +[Back to list](#list) + +## I see a message that says Finding your space + +When HoloLens is learning or loading a space, you might see a brief message that says "Finding your space." If this message continues for more than a few seconds, you'll see another message under the Start menu that says "Still looking for your space." + +These messages mean that HoloLens is having trouble mapping your space. When this happens, you'll be able to open apps, but you won't be able to place holograms in your environment. + +If you see these messages often, try the following: + +- Make sure you're in a well-lit room without a lot of direct sunlight. +- Make sure your device visor is clean. [Learn how](hololens1-hardware.md#care-and-cleaning). +- Make sure you have a strong Wi-Fi signal. If you enter a new environment that has no Wi-Fi or a weak signal, HoloLens won't be able find your space. Check your Wi-Fi connection by going to **Settings **> **Network & Internet** >** Wi-Fi**. +- Try moving more slowly. + +[Back to list](#list) + +## I'm not seeing the holograms I expect to see in my space + +If you don't see holograms you placed, or you're seeing some you don't expect, try the following: + +- Try turning on some lights. HoloLens works best in a well-lit space. +- Remove holograms you don't need by going to **Settings** > **System** > **Holograms** > **Remove nearby holograms**. Or, if needed, select **Remove all holograms**. + + > [!NOTE] + > If the layout or lighting in your space changes significantly, your device might have trouble identifying your space and showing your holograms. + +[Back to list](#list) + +## I can't place holograms where I want + +Here are some things to try if you're having trouble placing holograms: + +- Stand about 1 to 3 meters from where you're trying to place the hologram. +- Don't place holograms on black or reflective surfaces. +- Make sure you're in a well-lit room without a lot of direct sunlight. +- Walk around the rooms so HoloLens can rescan your surroundings. To see what's already been scanned, air tap to reveal the mapping mesh graphic. + +[Back to list](#list) + +## Holograms disappear or are encased in other holograms or objects + +If you get too close to a hologram, it will temporarily disappear—just move away from it. Also, if you've placed a lot of holograms close together, some may disappear. Try removing a few. + +Holograms can also be blocked or encased by other holograms or by objects such as walls. If this happens, try one of the following: + +- If the hologram is encased in another hologram, move it to another location: select **Adjust**, then tap and hold to position it. +- If the hologram is encased in a wall, select **Adjust**, then walk toward the wall until the hologram appears. Tap and hold, then pull the hologram forward and out of the wall. +- If you can't move the hologram with gestures, use your voice to remove it. Gaze at the hologram, then say "Remove." Then reopen it and place it in a new location. + +[Back to list](#list) + +## I can see holograms that are on the other side of a wall + +If you're very close to a wall, or if HoloLens hasn't scanned the wall yet, you'll be able to see holograms that are in the next room. Stand 1 to 3 meters from the wall and gaze to scan it. + +If HoloLens has problems scanning the wall, it might be because there's a black or reflective object nearby (for example, a black couch or a stainless steel refrigerator). If there is, scan the other side of the wall. + +[Back to list](#list) + +## When I place a hologram on a wall, it seems to float + +Holograms placed on walls will appear to be an inch or so away from the wall. If they appear farther away, try the following: + +- Stand 1 to 3 meters from the wall when you place a hologram and face the wall straight on. +- Air tap the wall to reveal the mapping mesh graphic. Make sure the mesh is lined up with the wall. If it isn't, remove the hologram, rescan the wall, and try again. +- If the issue persists, run the Calibration app. You'll find it in **Settings** > **System** > **Utilities**. + +[Back to list](#list) + +## Apps appear too close to me when I'm trying to move them + +Try walking around and looking at the area where you're placing the app so HoloLens will scan it from different angles. [Cleaning your device visor](hololens1-hardware.md#care-and-cleaning) may also help. + +[Back to list](#list) + +## I'm getting a low disk space error + +Free up some storage space by doing one or more of the following: + +- Remove some of the holograms you've placed, or remove some saved data from within apps. [How do I find my data?](hololens-find-and-save-files.md) +- Delete some pictures and videos in the Photos app. +- Uninstall some apps from your HoloLens. In the All apps list, tap and hold the app you want to uninstall, then select **Uninstall**. (This will also delete any of the app's data stored on the device.) + +[Back to list](#list) + +## HoloLens doesn't respond to my gestures + +To make sure HoloLens can see your gestures, keep your hand in the gesture frame, which extends a couple of feet on either side of you. HoloLens can also best see your hand when you hold it about 18 inches in front of your body (though you don't have to be precise about this). When HoloLens can see your hand, the cursor will change from a dot to a ring. Learn more about [using gestures in HoloLens 2](hololens2-basic-usage.md) or [using gestures in HoloLens (1st gen)](hololens1-basic-usage.md). + +[Back to list](#list) + +## HoloLens doesn't respond to my voice + +If Cortana isn't responding to your voice, make sure Cortana is on. In the **All apps** list, select **Cortana** > **Menu** > **Notebook** > **Settings** to make changes. To learn more about what you can say, see [Use your voice with HoloLens](hololens-cortana.md). + +[Back to list](#list) + +## I'm having problems pairing or using a Bluetooth device + +If you're having problems [pairing a Bluetooth device](hololens-connect-devices.md), try the following: + +- Go to **Settings** > **Devices** and make sure Bluetooth is turned on. If it is, try turning if off and on again. +- Make sure your Bluetooth device is fully charged or has fresh batteries. +- If you still can't connect, [restart your HoloLens](hololens-recovery.md). + +If you're having trouble using a Bluetooth device, make sure it's a supported device. Supported devices include: + +- English-language QWERTY Bluetooth keyboards, which can be used anywhere you use the holographic keyboard. +- Bluetooth mice. +- The [HoloLens clicker](hololens1-clicker.md). + +Other Bluetooth HID and GATT devices can be paired, but they might require a companion app from Microsoft Store to work with HoloLens. + +HoloLens doesn't support Bluetooth audio profiles. Bluetooth audio devices, such as speakers and headsets, may appear as available in HoloLens settings, but they aren't supported. + +[Back to list](#list) + +## I'm having problems with the HoloLens clicker + +Use the [clicker](hololens1-clicker.md) to select, scroll, move, and resize holograms. Additional clicker gestures may vary from app to app. + +If you're having trouble using the clicker, make sure its charged and paired with your HoloLens. If the battery is low, the indicator light will blink amber. To see if its paired, go to **Settings** > **Devices** and see if it shows up there. [Pair the clicker](hololens-connect-devices.md#pair-the-clicker). + +If the clicker is charged and paired and you're still having problems, reset it by holding down the main button and the pairing button for 15 seconds. Then pair the clicker with your HoloLens again. + +If that doesn't help, see [Restart or recover the HoloLens clicker](hololens1-clicker.md#restart-or-recover-the-clicker). + +[Back to list](#list) + +## I can't connect to Wi-Fi + +Here are some things to try if you can't connect to Wi-Fi on HoloLens: + +- Make sure Wi-Fi is turned on. Bloom to go to Start, then select **Settings** > **Network & Internet** > **Wi-Fi** to check. If Wi-Fi is on, try turning it off and on again. +- Move closer to the router or access point. +- Restart your Wi-Fi router, then [restart HoloLens](hololens-recovery.md). Try connecting again. +- If none of these things work, check to make sure your router is using the latest firmware. You can find this information on the manufacturers website. + +[Back to list](#list) + +## My HoloLens isn't running well, is unresponsive, or won't start + +If your device isn't performing properly, see [Restart, reset, or recover HoloLens](hololens-recovery.md). + +[Back to list](#list) + +## How do I delete all spaces? + +*Coming soon* + +[Back to list](#list) + +## I cannot find or use the keyboard to type in the HoloLens 2 Emulator + +*Coming soon* + +[Back to list](#list) diff --git a/devices/hololens/hololens-commercial-features.md b/devices/hololens/hololens-commercial-features.md index 1b3fdcdcd4..309d81e904 100644 --- a/devices/hololens/hololens-commercial-features.md +++ b/devices/hololens/hololens-commercial-features.md @@ -1,11 +1,12 @@ --- title: Commercial features description: The Microsoft HoloLens Commercial Suite includes features that make it easier for businesses to manage HoloLens devices. HoloLens 2 devices are equipped with commercial features by default. +keywords: HoloLens, commercial, features, mdm, mobile device management, kiosk mode author: scooley ms.author: scooley -ms.date: 08/26/19 +ms.date: 08/26/2019 ms.topic: article -keywords: HoloLens, commercial, features, mdm, mobile device management, kiosk mode +audience: ITPro ms.prod: hololens ms.sitesec: library ms.localizationpriority: high @@ -53,7 +54,7 @@ HoloLens (1st gen) came with two licensing options, the developer license and a |Ability to block unenrollment | |✔️ |✔️ | |Cert-based corporate Wi-Fi access | |✔️ |✔️ | |Microsoft Store (Consumer) |Consumer |Filter by using MDM |Filter by using MDM | -[Business Store Portal](https://docs.microsoft.com/microsoft-store/working-with-line-of-business-apps) | |✔️ |✔️ | +|[Business Store Portal](https://docs.microsoft.com/microsoft-store/working-with-line-of-business-apps) | |✔️ |✔️ | |**Security and identity** | | | | |Sign in by using Azure Active Directory (AAD) account |✔️ |✔️ |✔️ | |Sign in by using Microsoft Account (MSA) |✔️ |✔️ |✔️ | diff --git a/devices/hololens/hololens-cortana.md b/devices/hololens/hololens-cortana.md index 5ffe60d2e1..f95a0321eb 100644 --- a/devices/hololens/hololens-cortana.md +++ b/devices/hololens/hololens-cortana.md @@ -106,7 +106,7 @@ Here are some things you can try saying (remember to say "Hey Cortana" first). - Stop recording. (Stops recording a video.) - Call <*contact*>. (Requires Skype.) - What time is it? -- Show me the latest NBA scores. +- Show me the latest NBA scores. - How much battery do I have left? - Tell me a joke. diff --git a/devices/hololens/hololens-encryption.md b/devices/hololens/hololens-encryption.md index 62352e9767..6c8b9118e6 100644 --- a/devices/hololens/hololens-encryption.md +++ b/devices/hololens/hololens-encryption.md @@ -50,6 +50,7 @@ Provisioning packages are files created by the Windows Configuration Designer to 1. Find the XML license file that was provided when you purchased the Commercial Suite. +1. Browse to and select the XML license file that was provided when you purchased the Commercial Suite. >[!NOTE] >You can configure [additional settings in the provisioning package](hololens-provisioning.md). @@ -87,7 +88,7 @@ Provisioning packages are files created by the Windows Configuration Designer to 1. You will see whether the package was applied successfully or not. If it failed, you can fix your package and try again. If it succeeded, proceed with device setup. >[!NOTE] ->If the device was purchased before August 2016, you will need to sign into the device with a Microsoft account, get the latest OS update, and then reset the OS in order to apply the provisioning package. +>If the device was purchased before August 2016, you will need to sign into the device with a Microsoft account, get the latest OS update, and then reset the OS in order to apply the provisioning package. ## Verify device encryption diff --git a/devices/hololens/hololens-enroll-mdm.md b/devices/hololens/hololens-enroll-mdm.md index 2fd5775041..dc042a0f9f 100644 --- a/devices/hololens/hololens-enroll-mdm.md +++ b/devices/hololens/hololens-enroll-mdm.md @@ -1,16 +1,19 @@ --- -title: Enroll HoloLens in MDM (HoloLens) +title: Enroll HoloLens in MDM description: Enroll HoloLens in mobile device management (MDM) for easier management of multiple devices. ms.prod: hololens -ms.mktglfcycl: manage ms.sitesec: library -author: dansimp -ms.author: dansimp +ms.assetid: 2a9b3fca-8370-44ec-8b57-fb98b8d317b0 +author: scooley +ms.author: scooley ms.topic: article ms.localizationpriority: medium -ms.date: 07/27/2017 +ms.date: 07/15/2019 ms.reviewer: manager: dansimp +appliesto: +- HoloLens (1st gen) +- HoloLens 2 --- # Enroll HoloLens in MDM @@ -39,3 +42,7 @@ When auto-enrollment is enabled, no additional manual enrollment is needed. When 1. Upon successful authentication to the MDM server, a success message is shown. Your device is now enrolled with your MDM server. The device will need to restart to acquire policies, certificates, and apps. The Settings app will now reflect that the device is enrolled in device management. + +## Unenroll HoloLens from Intune + +You cannot [unenroll](https://docs.microsoft.com/intune-user-help/unenroll-your-device-from-intune-windows) HoloLens from Intune remotely. If the administrator unenrolls the device using MDM, the device will age out of the Intune dashboard. \ No newline at end of file diff --git a/devices/hololens/hololens-environment-considerations.md b/devices/hololens/hololens-environment-considerations.md index fd573a27c0..e09691dddf 100644 --- a/devices/hololens/hololens-environment-considerations.md +++ b/devices/hololens/hololens-environment-considerations.md @@ -77,7 +77,7 @@ The cameras can see no closer than 15cm from an object. ### Surfaces in a space -Strongly reflective surfaces will likely look different depending on the angle, which affects tracking. Think of a brand new car—when you move around it, light reflects and you see different objects in the surface as you move. To the tracker, the different objects reflected in the surface represent a changing environment, and the device loses tracking. +Strongly reflective surfaces will likely look different depending on the angle, which affects tracking. Think of a brand new car - when you move around it, light reflects and you see different objects in the surface as you move. To the tracker, the different objects reflected in the surface represent a changing environment, and the device loses tracking. Less shiny objects are easier to track against. diff --git a/devices/hololens/hololens-feedback.md b/devices/hololens/hololens-feedback.md index 51509d0833..3199517a90 100644 --- a/devices/hololens/hololens-feedback.md +++ b/devices/hololens/hololens-feedback.md @@ -80,4 +80,3 @@ To easily direct other people (such as co-workers, Microsoft staff, [forum](http 1. Enter your feedback. 1. If you are reporting a reproducible issue, you can select **Reproduce**. Without closing Feedback Hub, reproduce the issue. After you finish, come back to Feedback Hub and select **I’m done**. The app adds a mixed reality capture of your repro and relevant diagnostic logs to your feedback. 1. Select **Post feedback**, and you’re done. - diff --git a/devices/hololens/hololens-find-and-save-files.md b/devices/hololens/hololens-find-and-save-files.md index 8a9687ea25..098b387e5b 100644 --- a/devices/hololens/hololens-find-and-save-files.md +++ b/devices/hololens/hololens-find-and-save-files.md @@ -12,6 +12,9 @@ author: v-miegge ms.author: v-miegge ms.topic: article ms.localizationpriority: medium +appliesto: +- HoloLens (1st gen) +- HoloLens 2 --- # Find and save files on HoloLens diff --git a/devices/hololens/hololens-insider.md b/devices/hololens/hololens-insider.md index 5eaf9ad296..604048e203 100644 --- a/devices/hololens/hololens-insider.md +++ b/devices/hololens/hololens-insider.md @@ -10,6 +10,9 @@ ms.localizationpriority: medium ms.date: 10/23/2018 ms.reviewer: manager: dansimp +appliesto: +- HoloLens (1st gen) +- HoloLens 2 --- # Insider preview for Microsoft HoloLens diff --git a/devices/hololens/hololens-known-issues.md b/devices/hololens/hololens-known-issues.md new file mode 100644 index 0000000000..2fa916f8d0 --- /dev/null +++ b/devices/hololens/hololens-known-issues.md @@ -0,0 +1,169 @@ +--- +title: HoloLens known issues +description: This is the list of known issues that may affect HoloLens developers. +keywords: troubleshoot, known issue, help +author: mattzmsft +ms.author: mazeller +ms.date: 8/30/2019 +ms.topic: article +HoloLens and holograms: Frequently asked questions +manager: jarrettr +ms.prod: hololens +appliesto: +- HoloLens 1 +--- + +# HoloLens known issues + +This is the current list of known issues for HoloLens that affect developers. Check here first if you are seeing an odd behavior. This list will be kept updated as new issues are discovered or reported, or as issues are addressed in future HoloLens software updates. + +## Unable to connect and deploy to HoloLens through Visual Studio + +>[!NOTE] +>Last Update: 8/8 @ 5:11PM - Visual Studio has released VS 2019 Version 16.2 which includes a fix to this issue. We recommend updating to this newest version to avoid experiencing this error. + +Visual Studio has released VS 2019 Version 16.2 which includes a fix to this issue. We recommend updating to this newest version to avoid experiencing this error. + +Issue root-cause: Users who used Visual Studio 2015 or early releases of Visual Studio 2017 to deploy and debug applications on their HoloLens and then subsequently used the latest versions of Visual Studio 2017 or Visual Studio 2019 with the same HoloLens will be affected. The newer releases of Visual Studio deploy a new version of a component, but files from the older version are left over on the device, causing the newer version to fail. This causes the following error message: DEP0100: Please ensure that target device has developer mode enabled. Could not obtain a developer license on \ due to error 80004005. + +### Workaround + +Our team is currently working on a fix. In the meantime, you can use the following steps to work around the issue and help unblock deployment and debugging: + +1. Open Visual Studio +1. Select **File** > **New** > **Project**. +1. Select **Visual C#** > **Windows Desktop** > **Console App (.NET Framework)**. +1. Give the project a name (such as "HoloLensDeploymentFix") and make sure the Framework is set to at least .NET Framework 4.5, then Select **OK**. +1. Right-click on the **References** node in Solution Explorer and add the following references (select to the **Browse** section and select **Browse**): + + ``` CMD + C:\Program Files (x86)\Windows Kits\10\bin\10.0.18362.0\x86\Microsoft.Tools.Deploy.dll + C:\Program Files (x86)\Windows Kits\10\bin\10.0.18362.0\x86\Microsoft.Tools.Connectivity.dll + C:\Program Files (x86)\Windows Kits\10\bin\10.0.18362.0\x86\SirepInterop.dll + ``` + + >[!NOTE] + >If you don't have 10.0.18362.0 installed, use the most recent version that you have. + +1. Right-click on the project in Solution Explorer and select **Add** > **Existing Item**. +1. Browse to C:\Program Files (x86)\Windows Kits\10\bin\10.0.18362.0\x86 and change the filter to **All Files (\*.\*)**. +1. Select both SirepClient.dll and SshClient.dll, and Select **Add**. +1. Locate and select both files in Solution Explorer (they should be at the bottom of the list of files) and change **Copy to Output Directory** in the **Properties** window to **Copy always**. +1. At the top of the file, add the following to the existing list of `using` statements: + + ``` CMD + using Microsoft.Tools.Deploy; + using System.Net; + ``` + +1. Inside of `static void Main(...)`, add the following code: + + ``` PowerShell + RemoteDeployClient client = RemoteDeployClient.CreateRemoteDeployClient(); + client.Connect(new ConnectionOptions() + { + Credentials = new NetworkCredential("DevToolsUser", string.Empty), + IPAddress = IPAddress.Parse(args[0]) + }); + client.RemoteDevice.DeleteFile(@"C:\Data\Users\DefaultAccount\AppData\Local\DevelopmentFiles\VSRemoteTools\x86\CoreCLR\mscorlib.ni.dll"); + ``` + +1. Select **Build** > **Build Solution**. +1. Open a Command Prompt Window and cd to the folder that contains the compiled .exe file (for example, C:\MyProjects\HoloLensDeploymentFix\bin\Debug) +1. Run the executable and provide the device's IP address as a command-line argument. (If connected using USB, you can use 127.0.0.1, otherwise use the device’s Wi-Fi IP address.) For example, "HoloLensDeploymentFix 127.0.0.1" + +1. After the tool has exited without any messages (this should only take a few seconds), you will now be able to deploy and debug from Visual Studio 2017 or newer. Continued use of the tool is not necessary. + +We will provide further updates as they become available. + +## Issues launching the Microsoft Store and apps on HoloLens + +> [!NOTE] +> Last Update: 4/2 @ 10 AM - Issue resolved. + +You may experience issues when trying to launch the Microsoft Store and apps on HoloLens. We've determined that the issue occurs when background app updates deploy a newer version of framework packages in specific sequences while one or more of their dependent apps are still running. In this case, an automatic app update delivered a new version of the .NET Native Framework (version 10.0.25531 to 10.0.27413) caused the apps that are running to not correctly update for all running apps consuming the prior version of the framework. The flow for framework update is as follows: + +1. The new framework package is downloaded from the store and installed +1. All apps using the older framework are ‘updated’ to use the newer version + +If step 2 is interrupted before completion then any apps for which the newer framework wasn’t registered will fail to launch from the start menu. We believe any app on HoloLens could be affected by this issue. + +Some users have reported that closing hung apps and launching other apps such as Feedback Hub, 3D Viewer or Photos resolves the issue for them—however, this does not work 100% of the time. + +We have root caused that this issue was not caused the update itself, but a bug in the OS that resulted in the .NET Native framework update being handled incorrectly. We are pleased to announce that we have identified a fix and have released an update (OS version 17763.380) containing the fix. + +To see if your device can take the update, please: + +1. Go to the Settings app and open **Update & Security**. +1. Select **Check for Updates**. +1. If update to 17763.380 is available, please update to this build to receive the fix for the App Hang bug +1. Upon updating to this version of the OS, the Apps should work as expected. + +Additionally, as we do with every HoloLens OS release, we have posted the FFU image to the [Microsoft Download Center](https://aka.ms/hololensdownload/10.0.17763.380). + +If you would not like to take the update, we have released a new version of the Microsoft Store UWP app as of 3/29. After you have the updated version of the Store: + +1. Open the Store and confirm that it loads. +1. Use the bloom gesture to open the menu. +1. Attempt to open previously broken apps. +1. If it still cannot be launched, tap and hold the icon of the broken app and select uninstall. +1. Resinstall these apps from the store. + +If your device is still unable to load apps, you can sideload a version of the .NET Native Framework and Runtime through the download center by following these steps: + +1. Please download [this zip file](https://download.microsoft.com/download/8/5/C/85C23745-794C-419D-B8D7-115FBCCD6DA7/netfx_1.7.zip) from the Microsoft Download Center. Unzipping will produce two files. Microsoft.NET.Native.Runtime.1.7.appx and Microsoft.NET.Native.Framework.1.7.appx +1. Please verify that your device is dev unlocked. If you haven’t done that before the instructions to do that are [here](https://docs.microsoft.com/windows/mixed-reality/using-the-windows-device-portal). +1. You then want to get into the Windows Device Portal. Our recommendation is to do this over USB and you would do that by typing http://127.0.0.1:10080 into your browser. +1. After you have the Windows Device Portal up we need you to “side load” the two files that you downloaded. To do that you need to go down the left side bar until you get to the **Apps** section and select **Apps**. +1. You will then see a screen that is similar to the below. You want to go to the section that says **Install App** and browse to where you unzipped those two APPX files. You can only do one at a time, so after you select the first one, then click on “Go” under the Deploy section. Then do this for the second APPX file. + + ![Windows Device Portal to Install Side-Loaded app](images/20190322-DevicePortal.png) +1. At this point we believe your applications should start working again and that you can also get to the Store. +1. In some cases, it is necessary run the additional step of launching the 3D Viewer app before affected apps will launch. + +We appreciate your patience as we have gone through the process to get this issue resolved, and we look forward to continued working with our community to create successful Mixed Reality experiences. + +## Connecting to WiFi + +During HoloLens Setup, there is a credential timeout of 2 minutes. The username/password needs to be entered within 2 minutes otherwise the username field will be automatically cleared. + +We recommend using a Bluetooth keyboard for entering long passwords. + +> [!NOTE] +> If the wrong network is selected during HoloLens Setup, the device will need to be fully reset. Instructions can be found [here.](hololens-restart-recover.md) + +## Device Update + +- 30 seconds after a new update, the shell may disappear one time. Please perform the **bloom** gesture to resume your session. + +## Visual Studio + +- See [Install the tools](https://docs.microsoft.com/windows/mixed-reality/install-the-tools) for the most up-to-date version of Visual Studio that is recommended for HoloLens development. +- When deploying an app from Visual Studio to your HoloLens, you may see the error: **The requested operation cannot be performed on a file with a user-mapped section open. (Exception from HRESULT: 0x800704C8)**. If this happens, try again and your deployment will generally succeed. + +## Emulator + +- Not all apps in the Microsoft Store are compatible with the emulator. For example, Young Conker and Fragments are not playable on the emulator. +- You cannot use the PC webcam in the Emulator. +- The Live Preview feature of the Windows Device Portal does not work with the emulator. You can still capture Mixed Reality videos and images. + +## Unity + +- See [Install the tools](https://docs.microsoft.com/windows/mixed-reality/install-the-tools) for the most up-to-date version of Unity recommended for HoloLens development. +- Known issues with the Unity HoloLens Technical Preview are documented in the [HoloLens Unity forums](https://forum.unity3d.com/threads/known-issues.394627/). + +## Windows Device Portal + +- The Live Preview feature in Mixed Reality capture may exhibit several seconds of latency. +- On the Virtual Input page, the Gesture and Scroll controls under the Virtual Gestures section are not functional. Using them will have no effect. The virtual keyboard on the same page works correctly. +- After enabling Developer Mode in Settings, it may take a few seconds before the switch to turn on the Device Portal is enabled. + +## API + +- If the application sets the [focus point](https://docs.microsoft.com/windows/mixed-reality/focus-point-in-unity) behind the user or the normal to camera.forward, holograms will not appear in Mixed Reality Capture photos or videos. Until this bug is fixed in Windows, if applications actively set the [focus point](https://docs.microsoft.com/windows/mixed-reality/focus-point-in-unity) they should ensure the plane normal is set opposite camera-forward (for example, normal = -camera.forward). + +## Xbox Wireless Controller + +- Xbox Wireless Controller S must be updated before it can be used with HoloLens. Ensure you are [up to date](https://support.xbox.com/xbox-one/accessories/update-controller-for-stereo-headset-adapter) before attempting to pair your controller with a HoloLens. +- If you reboot your HoloLens while the Xbox Wireless Controller is connected, the controller will not automatically reconnect to HoloLens. The Guide button light will flash slowly until the controller powers off after 3 minutes. To reconnect your controller immediately, power off the controller by holding the Guide button until the light turns off. When you power your controller on again, it will reconnect to HoloLens. +- If your HoloLens enters standby while the Xbox Wireless Controller is connected, any input on the controller will wake the HoloLens. You can prevent this by powering off your controller when you are done using it. diff --git a/devices/hololens/hololens-multiple-users.md b/devices/hololens/hololens-multiple-users.md index 70bee8bc2d..d9d6704c78 100644 --- a/devices/hololens/hololens-multiple-users.md +++ b/devices/hololens/hololens-multiple-users.md @@ -21,6 +21,8 @@ It's common to share one HoloLens with many people or to have many people share ## Share with multiple people, each using their own account +**Prerequisite**: The HoloLens device must be running Windows 10, version 1803 or later. HoloLens (1st gen) also need to be [upgraded to Windows Holographic for Business](hololens-upgrade-enterprise.md). + When they use their own Azure Active Directory (Azure AD) accounts, multiple users can each keep their own user settings and user data on the device. To make sure that multiple people can use their own accounts on your HoloLens, follow these steps to configure it: diff --git a/devices/hololens/hololens-status.md b/devices/hololens/hololens-status.md index 9438c6d9d2..ca4e503851 100644 --- a/devices/hololens/hololens-status.md +++ b/devices/hololens/hololens-status.md @@ -16,7 +16,7 @@ ms.sitesec: library ✔️ **All services are active** -**Key** ✔️ Good, ⓘ Information, ⚠ Warning, ❌ Critical +**Key** ✔️ Good, ⓘ Information, ⚠ Warning, ❌ Critical Area|HoloLens (1st gen)|HoloLens 2 ----|:----:|:----: @@ -27,10 +27,10 @@ Area|HoloLens (1st gen)|HoloLens 2 ## Notes and related topics -[Frequently asked questions about using Skype for HoloLens](https://support.skype.com/en/faq/FA34641/frequently-asked-questions-about-using-skype-for-hololens) +[Frequently asked questions about using Skype for HoloLens](https://support.skype.com/faq/FA34641/frequently-asked-questions-about-using-skype-for-hololens) For more details about the status of the myriad Azure Services that can connect to HoloLens, see [Azure status](https://azure.microsoft.com/status/). -For more details about current known issues, see [HoloLens known issues](https://docs.microsoft.com/windows/mixed-reality/hololens-known-issues). +For more details about current known issues, see [HoloLens known issues](hololens-known-issues.md). Follow HoloLens on [Twitter](https://twitter.com/HoloLens) and subscribe on [Reddit](https://www.reddit.com/r/HoloLens/). diff --git a/devices/hololens/hololens2-basic-usage.md b/devices/hololens/hololens2-basic-usage.md index e15003a8f4..d8cc60064a 100644 --- a/devices/hololens/hololens2-basic-usage.md +++ b/devices/hololens/hololens2-basic-usage.md @@ -28,7 +28,7 @@ This guide provides an intro to: On HoloLens, holograms blend the digital world with your physical environment to look and sound like they're part of your world. Even when holograms are all around you, you can always see your surroundings, move freely, and interact with people and objects. We call this experience "mixed reality". -The holographic frame positions your holograms where your eyes are most sensitive to detail and the see-through lenses leave your peripheral vision unobscured. With spatial sound, you can pinpoint a hologram by listening, even if it’s behind you. And, because HoloLens understands your physical environment, you can place holograms on and around real objects such as tables and walls. +The holographic frame positions your holograms where your eyes are most sensitive to detail and the see-through lenses leave your peripheral vision clear. With spatial sound, you can pinpoint a hologram by listening, even if it’s behind you. And, because HoloLens understands your physical environment, you can place holograms on and around real objects such as tables and walls. Getting around HoloLens is a lot like using your smart phone. You can use your hands to touch and manipulate holographic windows, menus, and buttons. @@ -54,6 +54,8 @@ To bring up a **context menu**, like the ones you'll find on an app tile in the ## Use hand ray for holograms out of reach +> [!VIDEO https://www.microsoft.com/videoplayer/embed/RE3ZOum] + When there are no holograms near your hands, the **touch cursor** will hide automatically and **hand rays** will appear from the palm of your hands. Hand rays allow you to interact with holograms from a distance. > [!TIP] @@ -71,6 +73,8 @@ To select something using **hand ray**, follow these steps: ### Grab using air tap and hold +> [!VIDEO https://www.microsoft.com/videoplayer/embed/RE3Wxnh] + To grab a hologram or scroll app window content using **hand ray**, start with an **air tap**, but keep your fingers together instead of releasing them. Use **air tap and hold** to perform the following actions with hand ray: @@ -81,7 +85,9 @@ Use **air tap and hold** to perform the following actions with hand ray: ## Start gesture -The Start gesture opens the **Start menu**. To perform the Start gesture, hold out your hand with your palm facing you. You’ll see a **Start icon** appear over your inner wrist. Tap this icon using your other hand. The Start menu will open **where you’re looking**. +> [!VIDEO https://www.microsoft.com/videoplayer/embed/RE3Wxng] + +The Start gesture opens the **Start menu**. To perform the Start gesture, hold out your hand with your palm facing you. You’ll see a **Start icon** appear over your inner wrist. Tap this icon using your other hand. The Start menu will open **where you’re looking**. > [!TIP] > @@ -135,6 +141,8 @@ Move a hologram or app by following these steps: ### Resizing holograms +> [!VIDEO https://www.microsoft.com/videoplayer/embed/RE3ZYIb] + Grab and use the **resize handles** that appear on the corners of 3D holograms and app windows to resize them. For an app window, when resized this way the window content correspondingly increases in size and becomes easier to read. diff --git a/devices/hololens/hololens2-hardware.md b/devices/hololens/hololens2-hardware.md index dd81a50803..3418e52e5e 100644 --- a/devices/hololens/hololens2-hardware.md +++ b/devices/hololens/hololens2-hardware.md @@ -75,6 +75,15 @@ Microsoft HoloLens 2 is an untethered holographic computer. It refines the holo | Bluetooth | 5.0 | | USB | USB Type-C | +### Power + +| | | +| - | - | +| Battery Life | 2-3 hours of active use. Up to 2 weeks of standby time. | +| Battery technology | [Lithium batteries](https://www.microsoft.com/download/details.aspx?id=43388) | +| Charging behavior | Fully functional when charging | +| Cooling type | Passively cooled (no fans) | + ### Fit | | | diff --git a/devices/hololens/hololens2-setup.md b/devices/hololens/hololens2-setup.md index 7b662a76b4..9f8edd7758 100644 --- a/devices/hololens/hololens2-setup.md +++ b/devices/hololens/hololens2-setup.md @@ -1,6 +1,7 @@ --- title: Prepare a new HoloLens 2 description: This guide walks through first time set up and hardware guide. +keywords: hololens, lights, fit, comfort, parts ms.assetid: 02692dcf-aa22-4d1e-bd00-f89f51048e32 ms.date: 9/17/2019 keywords: hololens @@ -68,14 +69,14 @@ Not sure what the indicator lights on your HoloLens mean? Want to know how HoloL ### Charging behavior -| State of the Device | Action | HoloLens 2 will do this | +| State of the Device | Action | HoloLens 2 will do this | | - | - | - | -| OFF | Plug in USB Cable | Device transitions to ON with indicator lights showing battery level and device starts charging. -| ON | Remove USB Cable | Device stops charging -| ON | Plug in USB Cable | Device starts charging -| SLEEP | Plug in USB Cable | Device starts charging -| SLEEP | Remove USB Cable | Device stops charging -| ON with USB cable pluged in | Turn off Device | Device transitions to ON with indicator lights showing battery level and device will start charging | +| OFF | Plug in USB Cable | Device transitions to ON with indicator lights showing battery level and device starts charging. +| ON | Remove USB Cable | Device stops charging +| ON | Plug in USB Cable | Device starts charging +| SLEEP | Plug in USB Cable | Device starts charging +| SLEEP | Remove USB Cable | Device stops charging +| ON with USB cable plugged in | Turn off Device | Device transitions to ON with indicator lights showing battery level and device will start charging | ### Lights that indicate the battery level @@ -89,18 +90,19 @@ Not sure what the indicator lights on your HoloLens mean? Want to know how HoloL ### Sleep Behavior -| State of the Device | Action | HoloLens 2 will do this | +| State of the Device | Action | HoloLens 2 will do this | | - | - | - | -| ON | Single Power button press | Device transitions to SLEEP and turns off all indicator lights | -| ON | No movement for 3 minutes | Device transition to SLEEP and turns off all indicator lights | -| SLEEP | Single Power button Press | Device transitions to ON and turns on indicator lights | +| ON | Single Power button press | Device transitions to SLEEP and turns off all indicator lights | +| ON | No movement for 3 minutes | Device transition to SLEEP and turns off all indicator lights | +| SLEEP | Single Power button Press | Device transitions to ON and turns on indicator lights | ### Lights to indicate problems | When you do this | The lights do this | It means this | | - | - | - | | You press the Power button. | One light flashes five times, then turns off. | The HoloLens battery is critically low. Charge your HoloLens. | -| You press the Power button. | All five lights flash five times, then turn off. | HoloLens cannot start correctly and is in an error state. | +| You press the Power button. | All five lights flash five times, then turn off. | HoloLens cannot start correctly and is in an error state. [Reinstall the operating system](hololens-recovery.md) to recover your device. | +| You press the Power button. | The 1st, 3rd, and 5th lights flash together continually. | HoloLens may have a hardware failure. To be sure, [reinstall the OS](hololens-recovery.md#hololens-2), and try again. After reinstalling the OS, if the light-flash pattern persists, contact [support](https://support.microsoft.com/en-us/supportforbusiness/productselection?sapid=3ec35c62-022f-466b-3a1e-dbbb7b9a55fb). | ## Safety and comfort diff --git a/devices/hololens/images/20190322-DevicePortal.png b/devices/hololens/images/20190322-DevicePortal.png new file mode 100644 index 0000000000..7fdd2e34b3 Binary files /dev/null and b/devices/hololens/images/20190322-DevicePortal.png differ diff --git a/devices/hololens/index.md b/devices/hololens/index.md index 2db4f6d0c9..6725da5e81 100644 --- a/devices/hololens/index.md +++ b/devices/hololens/index.md @@ -1,6 +1,6 @@ --- -title: Microsoft HoloLens (HoloLens) -description: Landing page for HoloLens commercial and enterprise management. +title: Microsoft HoloLens +description: Landing page Microsoft HoloLens. ms.prod: hololens ms.sitesec: library ms.assetid: 0947f5b3-8f0f-42f0-aa27-6d2cad51d040 @@ -8,7 +8,12 @@ author: scooley ms.author: scooley ms.topic: article ms.localizationpriority: medium -ms.date: 07/14/2019 +ms.date: 10/14/2019 +audience: ITPro +appliesto: +- HoloLens 1 +- HoloLens 2 + --- # Microsoft HoloLens @@ -21,33 +26,33 @@ ms.date: 07/14/2019

To learn more about HoloLens 2 for developers, check out the mixed reality developer documentation.

-HoloLens 2 side view +

To buy HoloLens, check out HoloLens pricing and sales on microsoft.com/HoloLens.

+ + +HoloLens 2 side view ## Guides in this section | Guide | Description | | --- | --- | -| [Get started with HoloLens](hololens1-setup.md) | Set up HoloLens for the first time. | -| [Deploy HoloLens in a commercial environment](hololens-requirements.md) | Configure HoloLens for scale enterprise deployment and ongoing device management. | -| [Recover and troubleshoot HoloLens issues](https://support.microsoft.com/products/hololens) | Learn how to gather logs from HoloLens, recover a misbehaving device, or reset HoloLens when necessary. | -| [Get support](https://support.microsoft.com/products/hololens) |Connect with Microsoft support resources for HoloLens in enterprise. | +| [Get started with HoloLens 2](hololens2-setup.md) | Set up HoloLens 2 for the first time. | +| [Get started with HoloLens (1st gen)](hololens1-setup.md) | Set up HoloLens (1st gen) for the first time. | +| [Get started with HoloLens in a commercial or classroom environment](hololens-requirements.md) | Plan for a multi-device HoloLens deployment and create a strategy for ongoing device management.
This section is tailored to IT professionals managing devices with existing device management infrastructure. | ## Quick reference by topic | Topic | Description | | --- | --- | -| [What's new in Microsoft HoloLens](hololens-whats-new.md) | Discover new features in the latest updates. | -| [Configure HoloLens using a provisioning package](hololens-provisioning.md) | Provisioning packages make it easy for IT administrators to configure HoloLens devices without imaging | -| [HoloLens MDM support](hololens-enroll-mdm.md) | Manage multiple HoloLens devices simultaneously using Mobile Device Management (MDM) solutions like Microsoft Intune. | +| [What's new in HoloLens](hololens-whats-new.md) | Discover new features in the latest updates via HoloLens release notes. | +| [Install and manage applications on HoloLens](hololens-install-apps.md) | Install and manage important applications on HoloLens at scale. | | [HoloLens update management](hololens-updates.md) | Use mobile device management (MDM) policies to configure settings for updates. | | [HoloLens user management](hololens-multiple-users.md) | Multiple users can shared a HoloLens device by using their Azure Active Directory accounts. | | [HoloLens application access management](hololens-kiosk.md) | Manage application access for different user groups. | -| [Enable Bitlocker device encryption for HoloLens](hololens-encryption.md) | Learn how to use Bitlocker device encryption to protect files and information stored on the HoloLens. | -| [Install localized version of HoloLens](hololens1-install-localized.md) | Configure HoloLens for different locale. | +| [Recover and troubleshoot HoloLens issues](https://support.microsoft.com/products/hololens) | Learn how to gather logs from HoloLens, recover a misbehaving device, or reset HoloLens when necessary. | +| [Get support](https://support.microsoft.com/products/hololens) | Connect with Microsoft support resources for HoloLens in enterprise. | ## Related resources * [Documentation for Holographic app development](https://developer.microsoft.com/windows/mixed-reality/development) -* [HoloLens Commercial Suite](https://www.microsoft.com/microsoft-hololens/hololens-commercial) * [HoloLens release notes](https://developer.microsoft.com/windows/mixed-reality/release_notes) diff --git a/devices/surface-hub/TOC.md b/devices/surface-hub/TOC.md index 2f7fc9fd1f..aa2c651d1a 100644 --- a/devices/surface-hub/TOC.md +++ b/devices/surface-hub/TOC.md @@ -22,6 +22,8 @@ ## Deploy ### [Surface Hub 2S adoption and training](surface-hub-2s-adoption-kit.md) +### [Surface Hub 2S adoption videos](surface-hub-2s-adoption-videos.md) + ### [First time setup for Surface Hub 2S](surface-hub-2s-setup.md) ### [Connect devices to Surface Hub 2S](surface-hub-2s-connect.md) ### [Surface Hub 2S deployment checklist](surface-hub-2s-deploy-checklist.md) diff --git a/devices/surface-hub/surface-hub-2s-adoption-kit.md b/devices/surface-hub/surface-hub-2s-adoption-kit.md index 2058fcd918..78ec22ee3d 100644 --- a/devices/surface-hub/surface-hub-2s-adoption-kit.md +++ b/devices/surface-hub/surface-hub-2s-adoption-kit.md @@ -9,7 +9,7 @@ ms.author: greglin manager: laurawi audience: Admin ms.topic: article -ms.date: 08/22/2019 +ms.date: 11/04/2019 ms.localizationpriority: Medium --- @@ -17,6 +17,10 @@ ms.localizationpriority: Medium Whether you are a small or large business, a Surface Hub adoption plan is critical in generating the right use cases and helping your users become comfortable with the device. Check out these downloadable guides designed to help you deliver training across your organization. +## On-demand training + +- [Surface Hub 2S adoption and training videos](surface-hub-2s-adoption-videos.md) + ## Adoption toolkit - [Surface Hub adoption toolkit](downloads/SurfaceHubAdoptionToolKit.pdf) @@ -28,7 +32,7 @@ Whether you are a small or large business, a Surface Hub adoption plan is critic - [Training guide – help desk](downloads/TrainingGuide-SurfaceHub2S-HelpDesk.pdf) - [Training guide – Microsoft Teams desktop](downloads/Guide-SurfaceHub2S-Teams.pptx) -[Download all training guides](http://download.microsoft.com/download/2/2/3/2234F70E-E65A-4790-93DF-F4C373A75B8E/SurfaceHub2S-TrainerGuides-July2019.zip) +[Download all training guides](https://download.microsoft.com/download/2/2/3/2234F70E-E65A-4790-93DF-F4C373A75B8E/SurfaceHub2S-TrainerGuides-July2019.zip) ## End user guides @@ -37,7 +41,7 @@ Whether you are a small or large business, a Surface Hub adoption plan is critic - [Guide to Microsoft Whiteboard on Surface Hub](downloads/Guide-SurfaceHub2S-Whiteboard.pptx) - [Guide to Microsoft Teams on Surface Hub](downloads/Guide-SurfaceHub2S-Teams.pptx) -[Download all end user guides](http://download.microsoft.com/download/E/7/F/E7FC6611-BB55-43E1-AF36-7BD5CE6E0FE0/SurfaceHub2S-EndUserGuides-July2019.zip) +[Download all end user guides](https://download.microsoft.com/download/E/7/F/E7FC6611-BB55-43E1-AF36-7BD5CE6E0FE0/SurfaceHub2S-EndUserGuides-July2019.zip) ## Quick reference cards @@ -52,4 +56,4 @@ Whether you are a small or large business, a Surface Hub adoption plan is critic - [Whiteboard advanced](downloads/QRCWhiteboardAdvanced.pdf) - [Whiteboard tools](downloads/QRCWhiteboardTools.pdf) -[Download all quick reference cards](http://download.microsoft.com/download/E/7/F/E7FC6611-BB55-43E1-AF36-7BD5CE6E0FE0/SurfaceHub2S-EndUserGuides-July2019.zip) +[Download all quick reference cards](https://download.microsoft.com/download/E/7/F/E7FC6611-BB55-43E1-AF36-7BD5CE6E0FE0/SurfaceHub2S-EndUserGuides-July2019.zip) diff --git a/devices/surface-hub/surface-hub-2s-adoption-videos.md b/devices/surface-hub/surface-hub-2s-adoption-videos.md new file mode 100644 index 0000000000..67fa4e4570 --- /dev/null +++ b/devices/surface-hub/surface-hub-2s-adoption-videos.md @@ -0,0 +1,137 @@ +--- +title: "Surface Hub 2S on-demand adoption and training videos" +description: "This page contains comprehensive training for Surface Hub 2S via on-demand streaming" +keywords: separate values with commas +ms.prod: surface-hub +ms.sitesec: library +author: greg-lindsay +ms.author: greglin +manager: laurawi +audience: Admin +ms.topic: article +ms.date: 11/04/2019 +ms.localizationpriority: Medium +--- + +# Surface Hub 2S on-demand adoption and training videos + +This page contains comprehensive training for Surface Hub 2S, available on demand. + +## Chapter 1 - Training overview + +> ![VIDEO ]
+ +- Welcome and introduction +- Training overview and agenda +- Software and technology reference +- Surface Hub messaging +- Industries and user roles +- Overview of training services +- Training best practices + +## Chapter 2 - Getting started with Surface Hub + +> ![VIDEO ]
+ +- What is Surface Hub? +- Technical overview +- Steelcase Roam and the mobility story +- Surface Hub services +- Getting started with Surface Hub +- Gathering expectations + +## Chapter 3 - Navigating Surface Hub + +> ![VIDEO ]
+ +- Welcome screen +- Start menu +- Full screen +- Clip to Whiteboard +- Task bar menu +- Teams/Skype +- End Session + +## Chapter 4 - Whiteboarding and collaboration + +> ![VIDEO ]
+ +- Whiteboard introduction +- Starting the Whiteboard +- Whiteboard tools +- Inserting pictures +- Changing the background +- Sharing the whiteboard +- Export the Whiteboard + +## Chapter 5 - Exploring Surface Hub apps + +> ![VIDEO ]
+ +- Surface Hub apps introduction +- PowerPoint overview +- Microsoft Word +- Microsoft Excel +- Microsoft Edge + +## Chapter 6 - Advanced apps and Office 365 + +> ![VIDEO ]
+ +- Advanced apps introduction +- Microsoft Maps +- Photos +- Power BI +- Sign in to Office 365 +- OneDrive +- CoAuthor documents + +## Chapter 7 - Connecting devices + +> ![VIDEO ]
+ +- Connect introduction +- Miracast overview +- Touch and Pen Input +- Wired connect overview +- Line of Business app workflows +- Troubleshooting Miracast and wired connect + +## Chapter 8 - Skype for Business meetings + +> ![VIDEO ]
+ +- Introduction to Skype for Business +-Scheduling Skype for Business meetings +- Start a meeting +- Start an ad hoc meeting +- Join a meeting on your calendar +- Managing a Skype for Business meeting +- Present content + +## Chapter 9 - Microsoft Teams meetings + +> ![VIDEO ]
+ +- Introduction to Microsoft Teams +- Scheduling Microsoft Teams meetings +- Start a meeting +- Start an ad hoc meeting +- Join a meeting on your calendar +- Managing a Microsoft Teams meeting +- Present content +- Conclusion + +## Chapter 10 - Basic troubleshooting + +> ![VIDEO ]
+ +- Introduction to Surface Hub troubleshooting +- Application troubleshooting +- End Session +- Restart the device +- Power cycle the device +- Factory reset +- Settings +- Manage Surface Hub +- Conclusion \ No newline at end of file diff --git a/devices/surface/battery-limit.md b/devices/surface/battery-limit.md index 48b26edcc5..c5d75cda00 100644 --- a/devices/surface/battery-limit.md +++ b/devices/surface/battery-limit.md @@ -6,22 +6,26 @@ ms.mktglfcycl: manage ms.pagetype: surface, devices ms.sitesec: library author: dansimp -ms.date: 10/02/2018 +ms.date: 10/31/2019 ms.reviewer: manager: dansimp ms.author: dansimp ms.topic: article +ms.localizationpriority: medium +ms.audience: itpro --- # Battery Limit setting Battery Limit option is a UEFI setting that changes how the Surface device battery is charged and may prolong its longevity. This setting is recommended in cases in which the device is continuously connected to power, for example when devices are integrated into kiosk solutions. -## Battery Limit information +## How Battery Limit works Setting the device on Battery Limit changes the protocol for charging the device battery. When Battery Limit is enabled, the battery charge will be limited to 50% of its maximum capacity. The charge level reported in Windows will reflect this limit. Therefore, it will show that the battery is charged up to 50% and will not charge beyond this limit. If you enable Battery Limit while the device is above 50% charge, the Battery icon will show that the device is plugged in but discharging until the device reaches 50% of its maximum charge capacity. -Adding the Battery Limit option to Surface UEFI requires a [Surface UEFI firmware update](update.md), available through Windows Update or via the MSI driver and firmware packages on the Microsoft Download Center. Check [Enable "Battery Limit" for Surface devices that have to be plugged in for extended periods of time](https://support.microsoft.com/help/4464941) for the specific Surface UEFI version required for each supported device. Currently, Battery Limit is supported on a subset of Surface devices and will be available in the future on other Surface device models. +## Supported devices +The Battery Limit UEFI setting is built into the latest Surface devices including Surface Pro 7 and Surface Laptop 3. Earlier devices require a + [Surface UEFI firmware update](update.md), available through Windows Update or via the MSI driver and firmware packages on the [Surface Support site](https://support.microsoft.com/help/4023482/surface-download-drivers-and-firmware-for-surface). Check [Enable "Battery Limit" for Surface devices that have to be plugged in for extended periods of time](https://support.microsoft.com/help/4464941) for the specific Surface UEFI version required for each supported device. ## Enabling Battery Limit in Surface UEFI (Surface Pro 4 and later) diff --git a/devices/surface/deploy.md b/devices/surface/deploy.md index 08149e26b7..68749b654c 100644 --- a/devices/surface/deploy.md +++ b/devices/surface/deploy.md @@ -11,6 +11,8 @@ ms.reviewer: manager: dansimp ms.author: dansimp ms.topic: article +ms.localizationpriority: medium +ms.audience: itpro --- # Deploy Surface devices @@ -39,19 +41,7 @@ Learn about about deploying ARM- and Intel-based Surface devices. | [Surface Deployment Accelerator](microsoft-surface-deployment-accelerator.md)| See how Microsoft Surface Deployment Accelerator provides a quick and simple deployment mechanism for organizations to reimage Surface devices. | [Battery Limit setting](battery-limit.md) | Learn how to use Battery Limit, a UEFI setting that changes how the Surface device battery is charged and may prolong its longevity. - - -  - ## Related topics -[Surface for IT pros blog](http://blogs.technet.com/b/surface/) - -  - -  - - - - +[Surface IT Pro Blog](https://techcommunity.microsoft.com/t5/Surface-IT-Pro-Blog/bg-p/SurfaceITPro) diff --git a/devices/surface/enable-surface-keyboard-for-windows-pe-deployment.md b/devices/surface/enable-surface-keyboard-for-windows-pe-deployment.md index 3fa2512ccf..855d637526 100644 --- a/devices/surface/enable-surface-keyboard-for-windows-pe-deployment.md +++ b/devices/surface/enable-surface-keyboard-for-windows-pe-deployment.md @@ -9,12 +9,15 @@ ms.sitesec: library author: Teresa-Motiv ms.author: v-tea ms.topic: article -ms.date: 10/2/2019 +ms.date: 10/31/2019 ms.reviewer: scottmca +ms.localizationpriority: medium +ms.audience: itpro manager: jarrettr appliesto: - Surface Laptop (1st Gen) - Surface Laptop 2 +- Surface Laptop 3 --- # How to enable the Surface Laptop keyboard during MDT deployment @@ -30,44 +33,77 @@ On most types of Surface devices, the keyboard should work during Lite Touch Ins To add the keyboard drivers to the selection profile, follow these steps: 1. Download the latest Surface Laptop MSI file from the appropriate locations: - - [Surface Laptop (1st Gen) Drivers and Firmware](https://www.microsoft.com/download/details.aspx?id=55489) - - [Surface Laptop 2 Drivers and Firmware](https://www.microsoft.com/download/details.aspx?id=57515) + - [Surface Laptop (1st Gen) Drivers and Firmware](https://www.microsoft.com/download/details.aspx?id=55489) + - [Surface Laptop 2 Drivers and Firmware](https://www.microsoft.com/download/details.aspx?id=57515) + - [Surface Laptop 3 with Intel Processor Drivers and Firmware](https://www.microsoft.com/download/details.aspx?id=100429) -1. Extract the contents of the Surface Laptop MSI file to a folder that you can easily locate (for example, c:\surface_laptop_drivers). To extract the contents, open an elevated Command Prompt window and run the following command: +2. Extract the contents of the Surface Laptop MSI file to a folder that you can easily locate (for example, c:\surface_laptop_drivers). To extract the contents, open an elevated Command Prompt window and run the command from the following example: ```cmd Msiexec.exe /a SurfaceLaptop_Win10_15063_1703008_1.msi targetdir=c:\surface_laptop_drivers /qn ``` -1. Open the Deployment Workbench and expand the **Deployment Shares** node and your deployment share, then navigate to the **WindowsPEX64** folder. +3. Open the Deployment Workbench and expand the **Deployment Shares** node and your deployment share, then navigate to the **WindowsPEX64** folder. ![Image that shows the location of the WindowsPEX64 folder in the Deployment Workbench](./images/surface-laptop-keyboard-1.png) -1. Right-click the **WindowsPEX64** folder and select **Import Drivers**. -1. Follow the instructions in the Import Driver Wizard to import the driver folders into the WindowsPEX64 folder. - - To support Surface Laptop (1st Gen), import the following folders: - - SurfacePlatformInstaller\Drivers\System\GPIO - - SurfacePlatformInstaller\Drivers\System\SurfaceHidMiniDriver - - SurfacePlatformInstaller\Drivers\System\SurfaceSerialHubDriver - - To support Surface Laptop 2, import the following folders: - - SurfacePlatformInstaller\Drivers\System\GPIO - - SurfacePlatformInstaller\Drivers\System\SurfaceHIDMiniDriver - - SurfacePlatformInstaller\Drivers\System\SurfaceSerialHubDriver - - SurfacePlatformInstaller\Drivers\System\I2C - - SurfacePlatformInstaller\Drivers\System\SPI - - SurfacePlatformInstaller\Drivers\System\UART +4. Right-click the **WindowsPEX64** folder and select **Import Drivers**. +5. Follow the instructions in the Import Driver Wizard to import the driver folders into the WindowsPEX64 folder. -1. Verify that the WindowsPEX64 folder now contains the imported drivers. The folder should resemble the following: +> [!NOTE] +> Check the downloaded MSI package to determine the format and directory structure. The directory structure will start with either SurfacePlatformInstaller (older MSI files) or SurfaceUpdate (Newer MSI files) depending on when the MSI was released. + +To support Surface Laptop (1st Gen), import the following folders: + + - SurfacePlatformInstaller\Drivers\System\GPIO + - SurfacePlatformInstaller\Drivers\System\SurfaceHidMiniDriver + - SurfacePlatformInstaller\Drivers\System\SurfaceSerialHubDriver + +Or for newer MSI files beginning with "SurfaceUpdate", use: + +- SurfaceUpdate\SerialIOGPIO +- SurfaceUpdate\SurfaceHidMiniDriver +- SurfaceUpdate\SurfaceSerialHubDriver + +To support Surface Laptop 2, import the following folders: + + - SurfacePlatformInstaller\Drivers\System\GPIO + - SurfacePlatformInstaller\Drivers\System\SurfaceHIDMiniDriver + - SurfacePlatformInstaller\Drivers\System\SurfaceSerialHubDriver + - SurfacePlatformInstaller\Drivers\System\I2C + - SurfacePlatformInstaller\Drivers\System\SPI + - SurfacePlatformInstaller\Drivers\System\UART + +Or for newer MSI files beginning with "SurfaceUpdate", use: + +- SurfaceUpdate\SerialIOGPIO +- SurfaceUpdate\IclSerialIOI2C +- SurfaceUpdate\IclSerialIOSPI +- SurfaceUpdate\IclSerialIOUART +- SurfaceUpdate\SurfaceHidMini +- SurfaceUpdate\SurfaceSerialHub + + +To support Surface Laptop 3 with Intel Processor, import the following folders: + +- SurfaceUpdate\IclSerialIOGPIO +- SurfaceUpdate\IclSerialIOI2C +- SurfaceUpdate\IclSerialIOSPI +- SurfaceUpdate\IclSerialIOUART +- SurfaceUpdate\SurfaceHidMini +- SurfaceUpdate\SurfaceSerialHub +- SurfaceUpdate\SurfaceHotPlug + + +6. Verify that the WindowsPEX64 folder now contains the imported drivers. The folder should resemble the following: ![Image that shows the newly imported drivers in the WindowsPEX64 folder of the Deployment Workbench](./images/surface-laptop-keyboard-2.png) -1. Configure a selection profile that uses the WindowsPEX64 folder. The selection profile should resemble the following: +7. Configure a selection profile that uses the WindowsPEX64 folder. The selection profile should resemble the following: ![Image that shows the WindowsPEX64 folder selected as part of a selection profile](./images/surface-laptop-keyboard-3.png) -1. Configure the Windows PE properties of the MDT deployment share to use the new selection profile, as follows: +8. Configure the Windows PE properties of the MDT deployment share to use the new selection profile, as follows: - For **Platform**, select **x64**. - For **Selection profile**, select the new profile. @@ -75,7 +111,7 @@ To add the keyboard drivers to the selection profile, follow these steps: ![Image that shows the Windows PE properties of the MDT Deployment Share](./images/surface-laptop-keyboard-4.png) -1. Verify that you have configured the remaining Surface Laptop drivers by using either a selection profile or a **DriverGroup001** variable. +9. Verify that you have configured the remaining Surface Laptop drivers by using either a selection profile or a **DriverGroup001** variable. - For Surface Laptop (1st Gen), the model is **Surface Laptop**. The remaining Surface Laptop drivers should reside in the \MDT Deployment Share\Out-of-Box Drivers\Windows10\X64\Surface Laptop folder as shown in the figure that follows this list. - For Surface Laptop 2, the model is **Surface Laptop 2**. The remaining Surface Laptop drivers should reside in the \MDT Deployment Share\Out-of-Box Drivers\Windows10\X64\Surface Laptop 2 folder. diff --git a/devices/surface/images/manage-surface-uefi-fig5a.png b/devices/surface/images/manage-surface-uefi-fig5a.png new file mode 100644 index 0000000000..7baecb2fff Binary files /dev/null and b/devices/surface/images/manage-surface-uefi-fig5a.png differ diff --git a/devices/surface/images/manage-surface-uefi-fig7a.png b/devices/surface/images/manage-surface-uefi-fig7a.png new file mode 100644 index 0000000000..62e6536ea8 Binary files /dev/null and b/devices/surface/images/manage-surface-uefi-fig7a.png differ diff --git a/devices/surface/ltsb-for-surface.md b/devices/surface/ltsb-for-surface.md index 225135d993..5e14c8444d 100644 --- a/devices/surface/ltsb-for-surface.md +++ b/devices/surface/ltsb-for-surface.md @@ -10,6 +10,8 @@ ms.author: dansimp ms.topic: article ms.reviewer: manager: dansimp +ms.localizationpriority: medium +ms.audience: itpro --- # Long-Term Servicing Channel (LTSC) for Surface devices @@ -28,23 +30,7 @@ General-purpose Surface devices are intended to run on the Semi-Annual Channel t Surface devices in specialized scenarios–such as PCs that control medical equipment, point-of-sale systems, and ATMs–might consider the use of LTSC. These special-purpose systems typically perform a single task and do not require feature updates as frequently as other devices in the organization. - - - - ## Related topics -- [Surface TechCenter](https://technet.microsoft.com/windows/surface) - -- [Surface for IT pros blog](http://blogs.technet.com/b/surface/) - - - -  - -  - - - - +- [Surface IT Pro Blog](https://techcommunity.microsoft.com/t5/Surface-IT-Pro-Blog/bg-p/SurfaceITPro) diff --git a/devices/surface/maintain-optimal-power-settings-on-Surface-devices.md b/devices/surface/maintain-optimal-power-settings-on-Surface-devices.md index ede174d674..e43a14a63b 100644 --- a/devices/surface/maintain-optimal-power-settings-on-Surface-devices.md +++ b/devices/surface/maintain-optimal-power-settings-on-Surface-devices.md @@ -1,6 +1,6 @@ --- title: Best practice power settings for Surface devices -description: This topic provides best practice recommendations for maintaining optimal power settings and explains how Surface streamlines the power management experience. +description: This topic provides best practice recommendations for maintaining optimal power settings and explains how Surface streamlines the power management experience. This article applies to all currently supported Surface devices including Surface Pro 7, Surface Pro X, and Surface Laptop 3. ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library @@ -9,7 +9,9 @@ ms.author: dansimp ms.topic: article ms.reviewer: manager: dansimp -ms.date: 08/21/2019 +ms.localizationpriority: medium +ms.audience: itpro +ms.date: 10/28/2019 --- # Best practice power settings for Surface devices @@ -49,7 +51,7 @@ module (SAM). The SAM chip functions as the Surface device power-policy owner, using algorithms to calculate optimal power requirements. It works in conjunction with Windows power manager to allocate or throttle only the exact amount of power required for hardware components to -function. +function. This article applies to all currently supported Surface devices including Surface Pro 7, Surface Pro X, and Surface Laptop 3. ## Utilizing the custom power profile in Surface diff --git a/devices/surface/manage-surface-uefi-settings.md b/devices/surface/manage-surface-uefi-settings.md index 4de1914275..d205908048 100644 --- a/devices/surface/manage-surface-uefi-settings.md +++ b/devices/surface/manage-surface-uefi-settings.md @@ -17,22 +17,25 @@ manager: dansimp # Manage Surface UEFI settings -Current and future generations of Surface devices, including Surface Pro 7, Surface Book 2, and Surface Studio 2,use a unique UEFI firmware engineered by Microsoft specifically for these devices. This firmware allows for significantly greater control of the device’s operation over firmware versions in earlier generation Surface devices, including the support for touch, mouse, and keyboard operation. By using the Surface UEFI settings you can easily enable or disable internal devices or components, configure security to protect UEFI settings from being changed, and adjust the Surface device boot settings. - ->[!NOTE] ->Surface Pro 3, Surface 3, Surface Pro 2, Surface 2, Surface Pro, and Surface do not use the Surface UEFI and instead use firmware provided by third-party manufacturers, such as AMI. - -You can enter the Surface UEFI settings on your Surface device by pressing the **Volume Up** button and the **Power** button simultaneously. Hold the **Volume Up** button until the Surface logo is displayed, which indicates that the device has begun to boot. +All current and future generations of Surface devices use a unique Unified Extensible Firmware Interface (UEFI) engineered by Microsoft specifically for these devices. Surface UEFI settings provide the ability to enable or disable built-in devices and components, protect UEFI settings from being changed, and adjust the Surface device boot settings. ## Support for cloud-based management + With Device Firmware Configuration Interface (DFCI) profiles built into Microsoft Intune (now available in public preview), Surface UEFI management extends the modern management stack down to the UEFI hardware level. DFCI supports zero-touch provisioning, eliminates BIOS passwords, provides control of security settings including boot options and built-in peripherals, and lays the groundwork for advanced security scenarios in the future. DFCI is currently available for Surface Pro 7, Surface Pro X, and Surface Laptop 3. For more information, refer to [Intune management of Surface UEFI settings](surface-manage-dfci-guide.md). +## Open Surface UEFI menu -## PC information +To adjust UEFI settings during system startup: -On the **PC information** page, detailed information about your Surface device is provided: +1. Shut down your Surface and wait about 10 seconds to make sure it's off. +2. Press and hold the **Volume-up** button and - at the same time - press and release the **Power button.** +3. As the Microsoft or Surface logo appears on your screen, continue to hold the **Volume-up** button until the UEFI screen appears. -- **Model** – Your Surface device’s model will be displayed here, such as Surface Book or Surface Pro 4. The exact configuration of your device is not shown, (such as processor, disk size, or memory size). +## UEFI PC information page + +The PC information page includes detailed information about your Surface device: + +- **Model** – Your Surface device’s model will be displayed here, such as Surface Book 2 or Surface Pro 7. The exact configuration of your device is not shown, (such as processor, disk size, or memory size). - **UUID** – This Universally Unique Identification number is specific to your device and is used to identify the device during deployment or management. - **Serial Number** – This number is used to identify this specific Surface device for asset tagging and support scenarios. @@ -56,9 +59,9 @@ You will also find detailed information about the firmware of your Surface devic You can find up-to-date information about the latest firmware version for your Surface device in the [Surface Update History](https://www.microsoft.com/surface/support/install-update-activate/surface-update-history) for your device. -## Security +## UEFI Security page -On the **Security** page of Surface UEFI settings, you can set a password to protect UEFI settings. This password must be entered when you boot the Surface device to UEFI. The password can contain the following characters (as shown in Figure 2): +The Security page allows you to set a password to protect UEFI settings. This password must be entered when you boot the Surface device to UEFI. The password can contain the following characters (as shown in Figure 2): - Uppercase letters: A-Z @@ -74,21 +77,21 @@ The password must be at least 6 characters and is case sensitive. *Figure 2. Add a password to protect Surface UEFI settings* -On the **Security** page you can also change the configuration of Secure Boot on your Surface device. Secure Boot technology prevents unauthorized boot code from booting on your Surface device, which protects against bootkit and rootkit-type malware infections. You can disable Secure Boot to allow your Surface device to boot third-party operating systems or bootable media. You can also configure Secure Boot to work with third-party certificates, as shown in Figure 3. Read more about [Secure Boot](https://msdn.microsoft.com/windows/hardware/commercialize/manufacture/desktop/secure-boot-overview) in the TechNet Library. +On the Security page you can also change the configuration of Secure Boot on your Surface device. Secure Boot technology prevents unauthorized boot code from booting on your Surface device, which protects against bootkit and rootkit-type malware infections. You can disable Secure Boot to allow your Surface device to boot third-party operating systems or bootable media. You can also configure Secure Boot to work with third-party certificates, as shown in Figure 3. Read more about [Secure Boot](https://msdn.microsoft.com/windows/hardware/commercialize/manufacture/desktop/secure-boot-overview) in the TechNet Library. ![Configure Secure Boot](images/manage-surface-uefi-fig3.png "Configure Secure Boot") *Figure 3. Configure Secure Boot* -You can also enable or disable the Trusted Platform Module (TPM) device on the **Security** page, as shown in Figure 4. The TPM is used to authenticate encryption for your device’s data with BitLocker. Read more about [BitLocker](https://technet.microsoft.com/itpro/windows/keep-secure/bitlocker-overview) in the TechNet Library. +You can also enable or disable the Trusted Platform Module (TPM) device on the Security page, as shown in Figure 4. The TPM is used to authenticate encryption for your device’s data with BitLocker. Read more about [BitLocker](https://technet.microsoft.com/itpro/windows/keep-secure/bitlocker-overview) in the TechNet Library. ![Configure Surface UEFI security settings](images/manage-surface-uefi-fig4.png "Configure Surface UEFI security settings") *Figure 4. Configure Surface UEFI security settings* -## Devices +## UEFI menu: Devices -On the **Devices** page you can enable or disable specific devices and components of your Surface device. Devices that you can enable or disable on this page include: +The Devices page allows you to enable or disable specific devices and components including: - Docking and USB Ports @@ -106,13 +109,13 @@ On the **Devices** page you can enable or disable specific devices and component Each device is listed with a slider button that you can move to **On** (enabled) or **Off** (disabled) position, as shown in Figure 5. -![Enable and disable specific devices](images/manage-surface-uefi-fig5.png "Enable and disable specific devices") +![Enable and disable specific devices](images/manage-surface-uefi-fig5a.png "Enable and disable specific devices") *Figure 5. Enable and disable specific devices* -## Boot configuration +## UEFI menu: Boot configuration -On the **Boot Configuration** page, you can change the order of your boot devices and/or enable or disable boot of the following devices: +The Boot Configuration page allows you to change the order of your boot devices as well as enable or disable boot of the following devices: - Windows Boot Manager @@ -132,68 +135,83 @@ For the specified boot order to take effect, you must set the **Enable Alternate You can also turn on and off IPv6 support for PXE with the **Enable IPv6 for PXE Network Boot** option, for example when performing a Windows deployment using PXE where the PXE server is configured for IPv4 only. +## UEFI menu: Management +The Management page allows you to manage use of Zero Touch UEFI Management and other features on eligible devices including Surface Pro 7, Surface Pro X, and Surface Laptop 3. -## Exit +![Manage access to Zero Touch UEFI Management and other features](images/manage-surface-uefi-fig7a.png "Manage access to Zero Touch UEFI Management and other features") +*Figure 7. Manage access to Zero Touch UEFI Management and other features* -Use the **Restart Now** button on the **Exit** page to exit UEFI settings, as shown in Figure 7. + +Zero Touch UEFI Management lets you remotely manage UEFI settings by using a device profile within Intune called Device Firmware Configuration Interface (DFCI). If you do not configure this setting, the ability to manage eligible devices with DFCI is set to **Ready**. To prevent DFCI, select **Opt-Out**. + +> [!NOTE] +> The UEFI Management settings page and use of DFCI is only available on Surface Pro 7, Surface Pro X, and Surface Laptop 3. + +For more information, refer to [Intune management of Surface UEFI settings](surface-manage-dfci-guide.md). + +## UEFI menu: Exit + +Use the **Restart Now** button on the **Exit** page to exit UEFI settings, as shown in Figure 8. ![Exit Surface UEFI and restart the device](images/manage-surface-uefi-fig7.png "Exit Surface UEFI and restart the device") -*Figure 7. Click Restart Now to exit Surface UEFI and restart the device* +*Figure 8. Click Restart Now to exit Surface UEFI and restart the device* ## Surface UEFI boot screens -When you update Surface device firmware, by using either Windows Update or manual installation, the updates are not applied immediately to the device, but instead during the next reboot cycle. You can find out more about the Surface firmware update process in [Manage Surface driver and firmware updates](https://docs.microsoft.com/surface/manage-surface-pro-3-firmware-updates). The progress of the firmware update is displayed on a screen with progress bars of differing colors to indicate the firmware for each component. Each component’s progress bar is shown in Figures 8 through 17. +When you update Surface device firmware, by using either Windows Update or manual installation, the updates are not applied immediately to the device, but instead during the next reboot cycle. You can find out more about the Surface firmware update process in [Manage Surface driver and firmware updates](https://docs.microsoft.com/surface/manage-surface-pro-3-firmware-updates). The progress of the firmware update is displayed on a screen with progress bars of differing colors to indicate the firmware for each component. Each component’s progress bar is shown in Figures 9 through 18. ![Surface UEFI firmware update with blue progress bar](images/manage-surface-uefi-fig8.png "Surface UEFI firmware update with blue progress bar") -*Figure 8. The Surface UEFI firmware update displays a blue progress bar* +*Figure 9. The Surface UEFI firmware update displays a blue progress bar* ![System Embedded Controller firmware with green progress bar](images/manage-surface-uefi-fig9.png "System Embedded Controller firmware with green progress bar") -*Figure 9. The System Embedded Controller firmware update displays a green progress bar* +*Figure 10. The System Embedded Controller firmware update displays a green progress bar* ![SAM Controller firmware update with orange progress bar](images/manage-surface-uefi-fig10.png "SAM Controller firmware update with orange progress bar") -*Figure 10. The SAM Controller firmware update displays an orange progress bar* +*Figure 11. The SAM Controller firmware update displays an orange progress bar* ![Intel Management Engine firmware with red progress bar](images/manage-surface-uefi-fig11.png "Intel Management Engine firmware with red progress bar") -*Figure 11. The Intel Management Engine firmware update displays a red progress bar* +*Figure 12. The Intel Management Engine firmware update displays a red progress bar* ![Surface touch firmware with gray progress bar](images/manage-surface-uefi-fig12.png "Surface touch firmware with gray progress bar") -*Figure 12. The Surface touch firmware update displays a gray progress bar* +*Figure 13. The Surface touch firmware update displays a gray progress bar* ![Surface KIP firmware with light green progress bar](images/manage-surface-uefi-fig13.png "Surface touch firmware with light green progress bar") -*Figure 13. The Surface KIP firmware update displays a light green progress bar* +*Figure 14. The Surface KIP firmware update displays a light green progress bar* ![Surface ISH firmware with pink progress bar](images/manage-surface-uefi-fig14.png "Surface ISH firmware with pink progress bar") -*Figure 14. The Surface ISH firmware update displays a light pink progress bar* +*Figure 15. The Surface ISH firmware update displays a light pink progress bar* ![Surface Trackpad firmware with gray progress bar](images/manage-surface-uefi-fig15.png "Surface Trackpad firmware with gray progress bar") -*Figure 15. The Surface Trackpad firmware update displays a pink progress bar* +*Figure 16. The Surface Trackpad firmware update displays a pink progress bar* ![Surface TCON firmware with light gray progress bar](images/manage-surface-uefi-fig16.png "Surface TCON firmware with light gray progress bar") -*Figure 16. The Surface TCON firmware update displays a light gray progress bar* +*Figure 17. The Surface TCON firmware update displays a light gray progress bar* ![Surface TPM firmware with light purple progress bar](images/manage-surface-uefi-fig17.png "Surface TPM firmware with purple progress bar") -*Figure 17. The Surface TPM firmware update displays a purple progress bar* +*Figure 18. The Surface TPM firmware update displays a purple progress bar* >[!NOTE] ->An additional warning message that indicates Secure Boot is disabled is displayed, as shown in Figure 18. +>An additional warning message that indicates Secure Boot is disabled is displayed, as shown in Figure 19. ![Surface boot screen that indicates Secure Boot has been disabled](images/manage-surface-uefi-fig18.png "Surface boot screen that indicates Secure Boot has been disabled") -*Figure 18. Surface boot screen that indicates Secure Boot has been disabled in Surface UEFI settings* +*Figure 19. Surface boot screen that indicates Secure Boot has been disabled in Surface UEFI settings* ## Related topics -[Advanced UEFI security features for Surface Pro 3](advanced-uefi-security-features-for-surface-pro-3.md) +- [Intune management of Surface UEFI settings](surface-manage-dfci-guide.md) + +- [Surface Enterprise Management Mode](surface-enterprise-management-mode.md) \ No newline at end of file diff --git a/devices/surface/microsoft-surface-brightness-control.md b/devices/surface/microsoft-surface-brightness-control.md index 4a37b1fd9d..8c512f48c2 100644 --- a/devices/surface/microsoft-surface-brightness-control.md +++ b/devices/surface/microsoft-surface-brightness-control.md @@ -8,9 +8,11 @@ ms.sitesec: library author: dansimp ms.author: dansimp ms.topic: article -ms.date: 1/15/2019 +ms.date: 10/31/2019 ms.reviewer: hachidan manager: dansimp +ms.localizationpriority: medium +ms.audience: itpro --- # Surface Brightness Control diff --git a/devices/surface/microsoft-surface-deployment-accelerator.md b/devices/surface/microsoft-surface-deployment-accelerator.md index 1cfe727788..7fbd031cf5 100644 --- a/devices/surface/microsoft-surface-deployment-accelerator.md +++ b/devices/surface/microsoft-surface-deployment-accelerator.md @@ -4,7 +4,7 @@ description: Microsoft Surface Deployment Accelerator provides a quick and simpl ms.assetid: E7991E90-4AAE-44B6-8822-58BFDE3EADE4 ms.reviewer: hachidan manager: dansimp -ms.date: 07/27/2017 +ms.date: 10/31/2019 ms.localizationpriority: medium keywords: deploy, install, tool ms.prod: w10 @@ -19,7 +19,6 @@ ms.audience: itpro # Microsoft Surface Deployment Accelerator - Microsoft Surface Deployment Accelerator (SDA) automates the creation and configuration of a Microsoft recommended deployment experience by using free Microsoft deployment tools. > [!NOTE] diff --git a/devices/surface/step-by-step-surface-deployment-accelerator.md b/devices/surface/step-by-step-surface-deployment-accelerator.md index 0fac7db7a9..488bd63a15 100644 --- a/devices/surface/step-by-step-surface-deployment-accelerator.md +++ b/devices/surface/step-by-step-surface-deployment-accelerator.md @@ -13,7 +13,7 @@ ms.sitesec: library author: dansimp ms.author: dansimp ms.topic: article -ms.date: 07/27/2017 +ms.date: 10/31/2019 --- # Step by step: Surface Deployment Accelerator diff --git a/devices/surface/support-solutions-surface.md b/devices/surface/support-solutions-surface.md index 39f66879fb..8dd12ede7c 100644 --- a/devices/surface/support-solutions-surface.md +++ b/devices/surface/support-solutions-surface.md @@ -14,6 +14,7 @@ ms.author: dansimp ms.topic: article ms.date: 09/26/2019 ms.localizationpriority: medium +ms.audience: itpro --- # Top support solutions for Surface devices diff --git a/devices/surface/surface-diagnostic-toolkit-business.md b/devices/surface/surface-diagnostic-toolkit-business.md index 28726e9c2d..62c4129d08 100644 --- a/devices/surface/surface-diagnostic-toolkit-business.md +++ b/devices/surface/surface-diagnostic-toolkit-business.md @@ -3,12 +3,12 @@ title: Deploy Surface Diagnostic Toolkit for Business description: This topic explains how to use the Surface Diagnostic Toolkit for Business. ms.prod: w10 ms.mktglfcycl: manage -ms.localizationpriority: normal +ms.localizationpriority: medium ms.sitesec: library author: dansimp ms.author: dansimp ms.topic: article -ms.date: 09/27/2019 +ms.date: 10/31/2019 ms.reviewer: hachidan manager: dansimp ms.audience: itpro @@ -172,9 +172,10 @@ You can select to run a wide range of logs across applications, drivers, hardwar ## Changes and updates ### Version 2.43.139.0 *Release date: October 21, 2019*
-This version of Surface Diagnostic Toolkit for Business adds support for the following: --Surface Pro 7 --Surface Laptop 3 +This version of Surface Diagnostic Toolkit for Business adds support for the following: + +- Surface Pro 7 +- Surface Laptop 3 ### Version 2.42.139.0 *Release date: September 24, 2019*
diff --git a/devices/surface/surface-diagnostic-toolkit-command-line.md b/devices/surface/surface-diagnostic-toolkit-command-line.md index 7359067813..f1e3460df4 100644 --- a/devices/surface/surface-diagnostic-toolkit-command-line.md +++ b/devices/surface/surface-diagnostic-toolkit-command-line.md @@ -16,7 +16,7 @@ ms.audience: itpro # Run Surface Diagnostic Toolkit for Business using commands -Running the Surface Diagnostic Toolkit (SDT) at a command prompt requires downloading the STD app console. After it's installed, you can run SDT at a command prompt via the Windows command console (cmd.exe) or using Windows PowerShell, including PowerShell Integrated Scripting Environment (ISE), which provides support for autocompletion of commands, copy/paste, and other features. +Running the Surface Diagnostic Toolkit (SDT) at a command prompt requires downloading the STD app console. After it's installed, you can run SDT at a command prompt via the Windows command console (cmd.exe) or using Windows PowerShell, including PowerShell Integrated Scripting Environment (ISE), which provides support for autocompletion of commands, copy/paste, and other features. For a list of supported Surface devices in SDT, refer to [Deploy Surface Diagnostic Toolkit for Business](surface-diagnostic-toolkit-business.md). >[!NOTE] >To run SDT using commands, you must be signed in to the Administrator account or signed in to an account that is a member of the Administrator group on your Surface device. diff --git a/devices/surface/surface-diagnostic-toolkit-desktop-mode.md b/devices/surface/surface-diagnostic-toolkit-desktop-mode.md index 4d8b505670..738ec1ecae 100644 --- a/devices/surface/surface-diagnostic-toolkit-desktop-mode.md +++ b/devices/surface/surface-diagnostic-toolkit-desktop-mode.md @@ -7,36 +7,34 @@ ms.sitesec: library author: dansimp ms.author: dansimp ms.topic: article -ms.date: 11/15/2018 +ms.date: 10/31/2019 ms.reviewer: hachidan manager: dansimp -ms.localizationpriority: normal +ms.localizationpriority: medium ms.audience: itpro --- # Use Surface Diagnostic Toolkit for Business in desktop mode -This topic explains how to use the Surface Diagnostic Toolkit (SDT) to help users in your organization run the tool to identify and diagnose issues with the Surface device. Successfully running SDT can quickly determine if a reported issue is caused by failed hardware or user error. +This topic explains how to use the Surface Diagnostic Toolkit (SDT) to help users in your organization run the tool to identify and diagnose issues with the Surface device. Successfully running SDT can quickly determine if a reported issue is caused by failed hardware or user error. For a list of supported Surface devices in SDT, refer to [Deploy Surface Diagnostic Toolkit for Business](surface-diagnostic-toolkit-business.md). + 1. Direct the user to install [the SDT package](surface-diagnostic-toolkit-business.md#create-custom-sdt) from a software distribution point or network share. After it is installed, you’re ready to guide the user through a series of tests. 2. Begin at the home page, which allows users to enter a description of the issue, and click **Continue**, as shown in figure 1. ![Start SDT in desktop mode](images/sdt-desk-1.png) - - *Figure 1. SDT in desktop mode* +*Figure 1. SDT in desktop mode* 3. When SDT indicates the device has the latest updates, click **Continue** to advance to the catalog of available tests, as shown in figure 2. ![Select from SDT options](images/sdt-desk-2.png) - - *Figure 2. Select from SDT options* +*Figure 2. Select from SDT options* 4. You can choose to run all the diagnostic tests. Or, if you already suspect a particular issue such as a faulty display or a power supply problem, click **Select** to choose from the available tests and click **Run Selected**, as shown in figure 3. See the following table for details of each test. ![Select hardware tests](images/sdt-desk-3.png) - - *Figure 3. Select hardware tests* +*Figure 3. Select hardware tests* Hardware test | Description --- | --- @@ -55,6 +53,7 @@ This topic explains how to use the Surface Diagnostic Toolkit (SDT) to help user + ## Running multiple hardware tests to troubleshoot issues SDT is designed as an interactive tool that runs a series of tests. For each test, SDT provides instructions summarizing the nature of the test and what users should expect or look for in order for the test to be successful. For example, to diagnose if the display brightness is working properly, SDT starts at zero and increases the brightness to 100 percent, asking users to confirm – by answering **Yes** or **No** -- that brightness is functioning as expected, as shown in figure 4. @@ -62,7 +61,6 @@ SDT is designed as an interactive tool that runs a series of tests. For each tes For each test, if functionality does not work as expected and the user clicks **No**, SDT generates a report of the possible causes and ways to troubleshoot it. ![Running hardware diagnostics](images/sdt-desk-4.png) - *Figure 4. Running hardware diagnostics* 1. If the brightness successfully adjusts from 0-100 percent as expected, direct the user to click **Yes** and then click **Continue**. @@ -75,24 +73,18 @@ For each test, if functionality does not work as expected and the user clicks ** SDT enables you to diagnose and repair applications that may be causing issues, as shown in figure 5. ![Running repairs](images/sdt-desk-5.png) - *Figure 5. Running repairs* - - - - + ### Generating logs for analyzing issues SDT provides extensive log-enabled diagnosis support across applications, drivers, hardware, and operating system issues, as shown in figure 6. ![Generating logs](images/sdt-desk-6.png) - *Figure 6. Generating logs* - - + ### Generating detailed report comparing device vs. optimal configuration Based on the logs, SDT generates a report for software- and firmware-based issues that you can save to a preferred location. diff --git a/devices/surface/surface-diagnostic-toolkit-for-business-intro.md b/devices/surface/surface-diagnostic-toolkit-for-business-intro.md index 35c9b5f49f..df3918d715 100644 --- a/devices/surface/surface-diagnostic-toolkit-for-business-intro.md +++ b/devices/surface/surface-diagnostic-toolkit-for-business-intro.md @@ -10,7 +10,7 @@ ms.topic: article ms.date: 06/11/2019 ms.reviewer: cottmca manager: dansimp -ms.localizationpriority: normal +ms.localizationpriority: medium ms.audience: itpro --- diff --git a/devices/surface/surface-dock-firmware-update.md b/devices/surface/surface-dock-firmware-update.md index ffd159f4a1..8fa4e11515 100644 --- a/devices/surface/surface-dock-firmware-update.md +++ b/devices/surface/surface-dock-firmware-update.md @@ -8,7 +8,7 @@ ms.sitesec: library author: dansimp ms.author: dansimp ms.topic: article -ms.date: 09/18/2019 +ms.date: 10/09/2019 ms.reviewer: scottmca manager: dansimp ms.audience: itpro @@ -47,8 +47,14 @@ You can use Windows Installer commands (Msiexec.exe) to deploy Surface Dock Firm - **Msiexec.exe /i /quiet /norestart** +> [!NOTE] +> A log file is not created by default. In order to create a log file, you will need to append "/l*v [path]" + For more information, refer to [Command line options](https://docs.microsoft.com/windows/win32/msi/command-line-options) documentation. +> [!IMPORTANT] +> If you want to keep your Surface Dock updated using any other method, refer to [Update your Surface Dock](https://support.microsoft.com/help/4023478/surface-update-your-surface-dock) for details. + ## Intune deployment You can use Intune to distribute Surface Dock Firmware Update to your devices. First you will need to convert the MSI file to the .intunewin format, as described in the following documentation: [Intune Standalone - Win32 app management](https://docs.microsoft.com/intune/apps/apps-win32-app-management). @@ -84,8 +90,8 @@ Successful completion of Surface Dock Firmware Update results in new registry ke | Log | Location | Notes | | -------------------------------- | -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| Surface Dock Firmware Update log | /l*v %windir%\logs\Applications\SurfaceDockFWI.log | Earlier versions of this tool wrote events to Applications and Services Logs\Microsoft Surface Dock Updater. | -| Windows Device Install log | %windir%\inf\ setupapi.dev.log | For more information about using Device Install Log, refer [to SetupAPI Logging](https://docs.microsoft.com/windows-hardware/drivers/install/setupapi-logging--windows-vista-and-later-) documentation. | +| Surface Dock Firmware Update log | Path needs to be specified (see note) | Earlier versions of this tool wrote events to Applications and Services Logs\Microsoft Surface Dock Updater. | +| Windows Device Install log | %windir%\inf\setupapi.dev.log | For more information about using Device Install Log, refer to [SetupAPI Logging](https://docs.microsoft.com/windows-hardware/drivers/install/setupapi-logging--windows-vista-and-later-). | **Table 2. Event log IDs for Surface Dock Firmware Update** @@ -97,6 +103,10 @@ Successful completion of Surface Dock Firmware Update results in new registry ke | 2003 | Dock firmware update failed to get firmware version. | | 2004 | Querying the firmware version. | | 2005 | Dock firmware failed to start update. | +| 2006 | Failed to send offer/payload pairs. | +| 2007 | Firmware update finished. | +| 2008 | BEGIN dock telemetry. | +| 2011 | END dock telemetry. | ## Troubleshooting tips diff --git a/devices/surface/surface-enterprise-management-mode.md b/devices/surface/surface-enterprise-management-mode.md index 32c1f38406..de1879bcba 100644 --- a/devices/surface/surface-enterprise-management-mode.md +++ b/devices/surface/surface-enterprise-management-mode.md @@ -9,9 +9,11 @@ ms.sitesec: library author: dansimp ms.author: dansimp ms.topic: article -ms.date: 01/06/2017 -ms.reviewer: +ms.date: 10/31/2019 +ms.reviewer: scottmca manager: dansimp +ms.localizationpriority: medium +ms.audience: itpro --- # Microsoft Surface Enterprise Management Mode @@ -19,12 +21,14 @@ manager: dansimp Microsoft Surface Enterprise Management Mode (SEMM) is a feature of Surface devices with Surface UEFI that allows you to secure and manage firmware settings within your organization. With SEMM, IT professionals can prepare configurations of UEFI settings and install them on a Surface device. In addition to the ability to configure UEFI settings, SEMM also uses a certificate to protect the configuration from unauthorized tampering or removal. >[!NOTE] ->SEMM is only available on devices with Surface UEFI firmware such as Surface Pro 4 and later, Surface Go, Surface Laptop, Surface Book, and Surface Studio. For more information about Surface UEFI, see [Manage Surface UEFI Settings](https://technet.microsoft.com/itpro/surface/manage-surface-uefi-settings). +>SEMM is only available on devices with Surface UEFI firmware. + When Surface devices are configured by SEMM and secured with the SEMM certificate, they are considered *enrolled* in SEMM. When the SEMM certificate is removed and control of UEFI settings is returned to the user of the device, the Surface device is considered *unenrolled* in SEMM. There are two administrative options you can use to manage SEMM and enrolled Surface devices – a standalone tool or integration with System Center Configuration Manager. The SEMM standalone tool, called the Microsoft Surface UEFI Configurator, is described in this article. For more information about how to manage SEMM with System Center Configuration Manager, see [Use System Center Configuration Manager to manage devices with SEMM](https://technet.microsoft.com/itpro/surface/use-system-center-configuration-manager-to-manage-devices-with-semm). + ## Microsoft Surface UEFI Configurator The primary workspace of SEMM is Microsoft Surface UEFI Configurator, as shown in Figure 1. Microsoft Surface UEFI Configurator is a tool that is used to create Windows Installer (.msi) packages or WinPE images that are used to enroll, configure, and unenroll SEMM on a Surface device. These packages contain a configuration file where the settings for UEFI are specified. SEMM packages also contain a certificate that is installed and stored in firmware and used to verify the signature of configuration files before UEFI settings are applied. @@ -33,8 +37,6 @@ The primary workspace of SEMM is Microsoft Surface UEFI Configurator, as shown i *Figure 1. Microsoft Surface UEFI Configurator* ->[!NOTE] ->Windows 10 is required to run Microsoft Surface UEFI Configurator You can use the Microsoft Surface UEFI Configurator tool in three modes: @@ -62,17 +64,9 @@ See the [Surface Enterprise Management Mode certificate requirements](#surface-e After a device is enrolled in SEMM, the configuration file is read and the settings specified in the file are applied to UEFI. When you run a configuration package on a device that is already enrolled in SEMM, the signature of the configuration file is checked against the certificate that is stored in the device firmware. If the signature does not match, no changes are applied to the device. -You can use Surface UEFI settings to enable or disable the operation of individual components, such as cameras, wireless communication, or docking USB port (as shown in Figure 3), and configure advanced settings (as shown in Figure 4). +### Enable or disable devices in Surface UEFI with SEMM -![Enable or disable devices in Surface UEFI with SEMM](images/surface-ent-mgmt-fig3-enabledisable.png "Enable or disable devices in Surface UEFI with SEMM") - -*Figure 3. Enable or disable devices in Surface UEFI with SEMM* - -![Configure advanced settings in SEMM](images/surface-ent-mgmt-fig4-advancedsettings.png "Configure advanced settings in SEMM") - -*Figure 4. Configure advanced settings with SEMM* - -You can enable or disable the following devices with SEMM: +The following list shows all the available devices you can manage in SEMM: * Docking USB Port * On-board Audio @@ -86,31 +80,40 @@ You can enable or disable the following devices with SEMM: * Wi-Fi and Bluetooth * LTE -You can configure the following advanced settings with SEMM: + >[!NOTE] +>The built-in devices that appear in the UEFI Devices page may vary depending on your device or corporate environment. For example, the UEFI Devices page is not supported on Surface Pro X; LTE only appears on LTE-equipped devices. +### Configure advanced settings with SEMM +**Table 1. Advanced settings** + +| Setting | Description | +| ---------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| IPv6 for PXE Boot | Allows you to manage Ipv6 support for PXE boot. If you do not configure this setting, IPv6 support for PXE boot is disabled. | +| Alternate Boot | Allows you to manage use of an Alternate boot order to boot directly to a USB or Ethernet device by pressing both the Volume Down button and Power button during boot. If you do not configure this setting, Alternate boot is enabled. | +| Boot Order Lock | Allows you to lock the boot order to prevent changes. If you do not configure this setting, Boot Order Lock is disabled. | +| USB Boot | Allows you to manage booting to USB devices. If you do not configure this setting, USB Boot is enabled. | +| Network Stack | Allows you to manage Network Stack boot settings. If you do not configure this setting, the ability to manage Network Stack boot settings is enabled. | +| Auto Power On | Allows you to manage Auto Power On boot settings. If you do not configure this setting, Auto Power on is enabled. | +| Simultaneous Multi-Threading (SMT) | Allows you to manage Simultaneous Multi-Threading (SMT) to enable or disable hyperthreading. If you do not configure this setting, SMT is enabled. | +|Enable Battery limit| Allows you to manage Battery limit functionality. If you do not configure this setting, Battery limit is enabled | +| Security | Displays the Surface UEFI **Security** page. If you do not configure this setting, the Security page is displayed. | +| Devices | Displays the Surface UEFI **Devices** page. If you do not configure this setting, the Devices page is displayed. | +| Boot | Displays the Surface UEFI **Boot** page. If you do not configure this setting, the DateTime page is displayed. | +| DateTime | Displays the Surface UEFI **DateTime** page. If you do not configure this setting, the DateTime page is displayed. | + -* IPv6 support for PXE boot -* Alternate boot order, where the Volume Down button and Power button can be pressed together during boot, to boot directly to a USB or Ethernet device -* Lock the boot order to prevent changes -* Support for booting to USB devices -* Enable Network Stack boot settings -* Enable Auto Power On boot settings -* Display of the Surface UEFI **Security** page -* Display of the Surface UEFI **Devices** page -* Display of the Surface UEFI **Boot** page -* Display of the Surface UEFI **DateTime** page >[!NOTE] ->When you create a SEMM configuration package, two characters are shown on the **Successful** page, as shown in Figure 5. +>When you create a SEMM configuration package, two characters are shown on the **Successful** page, as shown in Figure 3. ![Certificate thumbprint display](images/surface-ent-mgmt-fig5-success.png "Certificate thumbprint display") -*Figure 5. Display of the last two characters of the certificate thumbprint on the Successful page* +*Figure 3. Display of the last two characters of the certificate thumbprint on the Successful page* -These characters are the last two characters of the certificate thumbprint and should be written down or recorded. The characters are required to confirm enrollment in SEMM on a Surface device, as shown in Figure 6. +These characters are the last two characters of the certificate thumbprint and should be written down or recorded. The characters are required to confirm enrollment in SEMM on a Surface device, as shown in Figure 4. ![Enrollment confirmation in SEMM](images/surface-ent-mgmt-fig6-enrollconfirm.png "Enrollment confirmation in SEMM") -*Figure 6. Enrollment confirmation in SEMM with the SEMM certificate thumbprint* +*Figure 4. Enrollment confirmation in SEMM with the SEMM certificate thumbprint* >[!NOTE] >Administrators with access to the certificate file (.pfx) can read the thumbprint at any time by opening the .pfx file in CertMgr. To view the thumbprint with CertMgr, follow this process: @@ -132,11 +135,11 @@ A Surface UEFI reset package is used to perform only one task — to unenroll a ### Recovery request -In some scenarios, it may be impossible to use a Surface UEFI reset package. (For example, if Windows becomes unusable on the Surface device.) In these scenarios you can unenroll the Surface device from SEMM through the **Enterprise Management** page of Surface UEFI (shown in Figure 7) with a Recovery Request operation. +In some scenarios, it may be impossible to use a Surface UEFI reset package. (For example, if Windows becomes unusable on the Surface device.) In these scenarios you can unenroll the Surface device from SEMM through the **Enterprise Management** page of Surface UEFI (shown in Figure 5) with a Recovery Request operation. ![Initiate a SEMM recovery request](images/surface-ent-mgmt-fig7-semmrecovery.png "Initiate a SEMM recovery request") -*Figure 7. Initiate a SEMM recovery request on the Enterprise Management page* +*Figure 5. Initiate a SEMM recovery request on the Enterprise Management page* When you use the process on the **Enterprise Management** page to reset SEMM on a Surface device, you are provided with a Reset Request. This Reset Request can be saved as a file to a USB drive, copied as text, or read as a QR Code with a mobile device to be easily emailed or messaged. Use the Microsoft Surface UEFI Configurator Reset Request option to load a Reset Request file or enter the Reset Request text or QR Code. Microsoft Surface UEFI Configurator will generate a verification code that can be entered on the Surface device. If you enter the code on the Surface device and click **Restart**, the device will be unenrolled from SEMM. diff --git a/devices/surface/surface-manage-dfci-guide.md b/devices/surface/surface-manage-dfci-guide.md index b2988422c1..19a91301f7 100644 --- a/devices/surface/surface-manage-dfci-guide.md +++ b/devices/surface/surface-manage-dfci-guide.md @@ -17,7 +17,7 @@ ms.audience: itpro ## Introduction -The ability to manage devices from the cloud has dramatically simplified IT deployment and provisioning across the lifecycle. With Device Firmware Configuration Interface (DFCI) profiles built into Microsoft Intune (now available in public preview), Surface UEFI management extends the modern management stack down to the UEFI hardware level. DFCI supports zero-touch provisioning, eliminates BIOS passwords, provides control of security settings including boot options and built-in peripherals, and lays the groundwork for advanced security scenarios in the future. +The ability to manage devices from the cloud has dramatically simplified IT deployment and provisioning across the lifecycle. With Device Firmware Configuration Interface (DFCI) profiles built into Microsoft Intune (now available in [public preview](https://docs.microsoft.com/intune/configuration/device-firmware-configuration-interface-windows)), Surface UEFI management extends the modern management stack down to the UEFI hardware level. DFCI supports zero-touch provisioning, eliminates BIOS passwords, provides control of security settings including boot options and built-in peripherals, and lays the groundwork for advanced security scenarios in the future. For answers to frequently asked questions, see [Ignite 2019: Announcing remote management of Surface UEFI settings from Intune](https://techcommunity.microsoft.com/t5/Surface-IT-Pro-Blog/Ignite-2019-Announcing-remote-management-of-Surface-UEFI/ba-p/978333). ### Background @@ -167,6 +167,7 @@ If the original DFCI profile has been deleted, you can remove policy settings by 6. Validate DFCI is removed from the device in the UEFI. ## Learn more -- [Windows Autopilot](https://www.microsoft.com/microsoft-365/windows/windows-autopilot) +- [Ignite 2019: Announcing remote management of Surface UEFI settings from Intune](https://techcommunity.microsoft.com/t5/Surface-IT-Pro-Blog/Ignite-2019-Announcing-remote-management-of-Surface-UEFI/ba-p/978333) +[Windows Autopilot](https://www.microsoft.com/microsoft-365/windows/windows-autopilot) - [Windows Autopilot and Surface devices](windows-autopilot-and-surface-devices.md) - [Use DFCI profiles on Windows devices in Microsoft Intune](https://docs.microsoft.com/intune/configuration/device-firmware-configuration-interface-windows) diff --git a/devices/surface/surface-system-sku-reference.md b/devices/surface/surface-system-sku-reference.md index 6b6e75f7d4..74c348d2d1 100644 --- a/devices/surface/surface-system-sku-reference.md +++ b/devices/surface/surface-system-sku-reference.md @@ -9,9 +9,11 @@ ms.sitesec: library author: dansimp ms.author: dansimp ms.topic: article -ms.date: 03/20/2019 +ms.date: 10/31/2019 ms.reviewer: manager: dansimp +ms.localizationpriority: medium +ms.audience: itpro --- # System SKU reference @@ -39,6 +41,11 @@ System Model and System SKU are variables that are stored in the System Manageme | Surface Pro 6 Commercial | Surface Pro 6 | Surface_Pro_6_1796_Commercial | | Surface Laptop 2 Consumer | Surface Laptop 2 | Surface_Laptop_2_1769_Consumer | | Surface Laptop 2 Commercial | Surface Laptop 2 | Surface_Laptop_2_1769_Commercial | +| Surface Pro 7 | Surface Pro 7 | Surface_Pro_7_1866 | +| Surface Pro X | Surface Pro X | Surface_Pro_X_1876 | +| Surface Laptop 3 13" Intel | Surface Laptop 3 | Surface_Laptop_3_1867:1868 | +| Surface Laptop 3 15" Intel | Surface Laptop 3 | Surface_Laptop_3_1872 | +| Surface Laptop 3 15" AMD | Surface Laptop 3 | Surface_Laptop_3_1873 | ## Examples diff --git a/devices/surface/surface-wireless-connect.md b/devices/surface/surface-wireless-connect.md index fbbaec21e8..6e225137c2 100644 --- a/devices/surface/surface-wireless-connect.md +++ b/devices/surface/surface-wireless-connect.md @@ -6,16 +6,15 @@ ms.mktglfcycl: manage ms.sitesec: library author: dansimp ms.audience: itpro -ms.localizationpriority: normal +ms.localizationpriority: medium ms.author: dansimp ms.topic: article -ms.date: 08/15/2019 +ms.date: 10/31/2019 ms.reviewer: tokatz manager: dansimp --- # Optimize Wi-Fi connectivity for Surface devices -## Introduction To stay connected with all-day battery life, Surface devices implement wireless connectivity settings that balance performance and power conservation. Outside of the most demanding mobility scenarios, users can maintain sufficient wireless connectivity without modifying default network adapter or related settings. @@ -32,7 +31,7 @@ If you’re managing a wireless network that’s typically accessed by many diff - **802.11r.** “**Fast BSS Transition”** accelerates connecting to new wireless access points by reducing the number of frames required before your device can access another AP as you move around with your device. - **802.11k.** **“Neighbor Reports”** provides devices with information on current conditions at neighboring access points. It can help your Surface device choose the best AP using criteria other than signal strength such as AP utilization. -Surface Go devices can also use 802.11v “BSS Transition Management Frames,” which functions much like 802.11k in providing information on nearby candidate APs. +Specific Surface devices can also use 802.11v “BSS Transition Management Frames,” which functions much like 802.11k in providing information on nearby candidate APs. These include Surface Go, Surface Pro 7, Surface Pro X, and Surface Laptop 3. ## Managing user settings diff --git a/devices/surface/unenroll-surface-devices-from-semm.md b/devices/surface/unenroll-surface-devices-from-semm.md index edcfcdf120..39b70f6006 100644 --- a/devices/surface/unenroll-surface-devices-from-semm.md +++ b/devices/surface/unenroll-surface-devices-from-semm.md @@ -12,6 +12,8 @@ ms.topic: article ms.date: 01/06/2017 ms.reviewer: manager: dansimp +ms.localizationpriority: medium +ms.audience: itpro --- # Unenroll Surface devices from SEMM diff --git a/devices/surface/use-system-center-configuration-manager-to-manage-devices-with-semm.md b/devices/surface/use-system-center-configuration-manager-to-manage-devices-with-semm.md index 0432c65257..6c29966521 100644 --- a/devices/surface/use-system-center-configuration-manager-to-manage-devices-with-semm.md +++ b/devices/surface/use-system-center-configuration-manager-to-manage-devices-with-semm.md @@ -9,9 +9,11 @@ ms.sitesec: library author: dansimp ms.author: dansimp ms.topic: article -ms.date: 02/01/2017 +ms.date: 10/31/2019 ms.reviewer: manager: dansimp +ms.localizationpriority: medium +ms.audience: itpro --- # Use System Center Configuration Manager to manage devices with SEMM @@ -382,7 +384,7 @@ To configure Surface UEFI settings or permissions for Surface UEFI settings, you The computer where ShowSettingsOptions.ps1 is run must have Microsoft Surface UEFI Manager installed, but the script does not require a Surface device. -The following tables show the available settings for Surface Pro 4 and Surface Book: +The following tables show the available settings for Surface Pro 4 and later including Surface Pro 7, Surface Book, Surface Laptop 3, and Surface Go. *Table 1. Surface UEFI settings for Surface Pro 4* diff --git a/education/developers.yml b/education/developers.yml new file mode 100644 index 0000000000..5c73169853 --- /dev/null +++ b/education/developers.yml @@ -0,0 +1,33 @@ +### YamlMime:Hub + +title: M365 Education Documentation for developers +summary: Are you an app developer looking for information about developing solutions on Microsoft Education products? Start here. + +metadata: + title: M365 Education Documentation for developers + description: Are you an app developer looking for information about developing solutions on Microsoft Education products? Start here. + ms.service: help + ms.topic: hub-page + author: LaurenMoynihan + ms.author: v-lamoyn + ms.date: 10/24/2019 + +additionalContent: + sections: + - items: + # Card + - title: UWP apps for education + summary: Learn how to write universal apps for education. + url: https://docs.microsoft.com/en-us/windows/uwp/apps-for-education/ + # Card + - title: Take a test API + summary: Learn how web applications can use the API to provide a locked down experience for taking tests. + url: https://docs.microsoft.com/en-us/windows/uwp/apps-for-education/take-a-test-api + # Card + - title: Office Education Dev center + summary: Integrate with Office 365 across devices and services to extend Microsoft enterprise-scale compliance and security to students, teachers, and staff in your education app + url: https://dev.office.com/industry-verticals/edu + # Card + - title: Data Streamer + summary: Bring new STEM experiences into the classroom with real-time data in Excel using Data Streamer. Data Streamer can send data to Excel from a sensor or application. + url: https://docs.microsoft.com/en-us/microsoft-365/education/data-streamer \ No newline at end of file diff --git a/education/docfx.json b/education/docfx.json index 15587928ef..91c875c200 100644 --- a/education/docfx.json +++ b/education/docfx.json @@ -32,9 +32,8 @@ "audience": "ITPro", "breadcrumb_path": "/education/breadcrumb/toc.json", "ms.date": "05/09/2017", - "feedback_system": "GitHub", - "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", - "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", + "feedback_system": "None", + "hideEdit": true, "_op_documentIdPathDepotMapping": { "./": { "depot_name": "Win.education", diff --git a/education/images/EDU-Apps-Mgmt.svg b/education/images/EDU-Apps-Mgmt.svg new file mode 100644 index 0000000000..862f0e12ff --- /dev/null +++ b/education/images/EDU-Apps-Mgmt.svg @@ -0,0 +1 @@ +EDU-Apps-Mgmt-50px \ No newline at end of file diff --git a/education/images/EDU-Deploy.svg b/education/images/EDU-Deploy.svg new file mode 100644 index 0000000000..1a0d67fd67 --- /dev/null +++ b/education/images/EDU-Deploy.svg @@ -0,0 +1 @@ +EDU-Deploy-50px \ No newline at end of file diff --git a/education/images/EDU-Device-Mgmt.svg b/education/images/EDU-Device-Mgmt.svg new file mode 100644 index 0000000000..92fb95141f --- /dev/null +++ b/education/images/EDU-Device-Mgmt.svg @@ -0,0 +1 @@ +EDU-Device-Mgmt-50px \ No newline at end of file diff --git a/education/images/EDU-Education.svg b/education/images/EDU-Education.svg new file mode 100644 index 0000000000..146dd00257 --- /dev/null +++ b/education/images/EDU-Education.svg @@ -0,0 +1 @@ +EDU-Education-50px \ No newline at end of file diff --git a/education/images/EDU-Lockbox.svg b/education/images/EDU-Lockbox.svg new file mode 100644 index 0000000000..8133127433 --- /dev/null +++ b/education/images/EDU-Lockbox.svg @@ -0,0 +1 @@ +EDU-Lockbox-50px \ No newline at end of file diff --git a/education/images/EDU-Tasks.svg b/education/images/EDU-Tasks.svg new file mode 100644 index 0000000000..f1339ea705 --- /dev/null +++ b/education/images/EDU-Tasks.svg @@ -0,0 +1 @@ +EDU-Tasks-50px \ No newline at end of file diff --git a/education/images/EDUAdmins.svg b/education/images/EDUAdmins.svg new file mode 100644 index 0000000000..d512fb942f --- /dev/null +++ b/education/images/EDUAdmins.svg @@ -0,0 +1 @@ +EDUAdmins-50px \ No newline at end of file diff --git a/education/images/EDUDevelopers.svg b/education/images/EDUDevelopers.svg new file mode 100644 index 0000000000..900159699a --- /dev/null +++ b/education/images/EDUDevelopers.svg @@ -0,0 +1 @@ +EDUDevelopers-50px \ No newline at end of file diff --git a/education/images/EDUPartners.svg b/education/images/EDUPartners.svg new file mode 100644 index 0000000000..01b80c9a42 --- /dev/null +++ b/education/images/EDUPartners.svg @@ -0,0 +1 @@ +EDUPartners-50px \ No newline at end of file diff --git a/education/index.md b/education/index.md deleted file mode 100644 index c36a33ee36..0000000000 --- a/education/index.md +++ /dev/null @@ -1,253 +0,0 @@ ---- -layout: HubPage -hide_bc: true -title: Microsoft 365 Education documentation and resources | Microsoft Docs -description: Learn about product documentation and resources available for school IT administrators, teachers, students, and education app developers. -author: dansimp -ms.topic: hub-page -ms.author: dansimp -ms.collection: ITAdminEDU -ms.date: 10/30/2017 -ms.prod: w10 ---- -
-
-

Microsoft Education documentation and resources

-
-
diff --git a/education/index.yml b/education/index.yml new file mode 100644 index 0000000000..9d3a74a32c --- /dev/null +++ b/education/index.yml @@ -0,0 +1,35 @@ +### YamlMime:Hub + +title: M365 Education Documentation +summary: Microsoft 365 Education empowers educators to unlock creativity, promote teamwork, and provide a simple and safe experience in a single, affordable solution built for education. + +metadata: + title: M365 Education Documentation + description: Learn about product documentation and resources available for school IT administrators, teachers, students, and education app developers. + ms.service: help + ms.topic: hub-page + author: LaurenMoynihan + ms.author: v-lamoyn + ms.date: 10/24/2019 + +productDirectory: + items: + # Card + - title: IT Admins + # imageSrc should be square in ratio with no whitespace + imageSrc: ./images/EDUAdmins.svg + links: + - url: itadmins.yml + text: Get started with deploying and managing a full cloud IT solution for your school. + # Card + - title: Developers + imageSrc: ./images/EDUDevelopers.svg + links: + - url: developers.yml + text: Looking for information about developing solutions on Microsoft Education products? Start here. + # Card + - title: Partners + imageSrc: ./images/EDUPartners.svg + links: + - url: partners.yml + text: Looking for resources available to Microsoft Education partners? Start here. \ No newline at end of file diff --git a/education/itadmins.yml b/education/itadmins.yml new file mode 100644 index 0000000000..25eabd906a --- /dev/null +++ b/education/itadmins.yml @@ -0,0 +1,96 @@ +### YamlMime:Hub + +title: M365 Education Documentation for IT admins +summary: M365 Education consists of Office 365 Education, Windows 10 Education, and security and management tools such as Intune for Education and School Data Sync. + +metadata: + title: M365 Education Documentation for IT admins + description: M365 Education consists of Office 365 Education, Windows 10 Education, and security and management tools such as Intune for Education and School Data Sync. + ms.service: help + ms.topic: hub-page + author: LaurenMoynihan + ms.author: v-lamoyn + ms.date: 10/24/2019 + +productDirectory: + summary: This guide is designed for IT admins looking for the simplest way to move their platform to the cloud. It does not capture all the necessary steps for large scale or complex deployments. Check out at https://edujourney.microsoft.com/. Find help now at https://docs.microsoft.com/microsoft-365/education/deploy/find-deployment-help. + items: + # Card + - title: Phase 1 - Cloud deployment + imageSrc: ./images/EDU-Deploy.svg + links: + - url: https://docs.microsoft.com/microsoft-365/education/deploy/create-your-office-365-tenant + text: 1. Create your Office 365 tenant + - url: https://docs.microsoft.com/microsoft-365/education/deploy/secure-and-configure-your-network + text: 2. Secure and configure your network + - url: https://docs.microsoft.com/microsoft-365/education/deploy/aad-connect-and-adfs + text: 3. Sync your active directory + - url: https://docs.microsoft.com/microsoft-365/education/deploy/school-data-sync + text: 4. Sync you SIS using School Data Sync + - url: https://docs.microsoft.com/microsoft-365/education/deploy/license-users + text: 5. License users + # Card + - title: Phase 2 - Device management + imageSrc: ./images/EDU-Device-Mgmt.svg + links: + - url: https://docs.microsoft.com/en-us/education/windows/ + text: 1. Get started with Windows 10 for Education + - url: https://docs.microsoft.com/microsoft-365/education/deploy/set-up-windows-10-education-devices + text: 2. Set up Windows 10 devices + - url: https://docs.microsoft.com/microsoft-365/education/deploy/intune-for-education + text: 3. Get started with Intune for Education + - url: https://docs.microsoft.com/microsoft-365/education/deploy/use-intune-for-education + text: 4. Use Intune to manage groups, apps, and settings + - url: https://docs.microsoft.com/en-us/intune/enrollment/enrollment-autopilot + text: 5. Enroll devices using Windows Autopilot + # Card + - title: Phase 3 - Apps management + imageSrc: ./images/EDU-Apps-Mgmt.svg + links: + - url: https://docs.microsoft.com/microsoft-365/education/deploy/configure-admin-settings + text: 1. Configure admin settings + - url: https://docs.microsoft.com/microsoft-365/education/deploy/set-up-teams-for-education + text: 2. Set up Teams for Education + - url: https://docs.microsoft.com/microsoft-365/education/deploy/deploy-office-365 + text: 3. Set up Office 365 + - url: https://docs.microsoft.com/microsoft-365/education/deploy/microsoft-store-for-education + text: 4. Install apps from Microsoft Store for Education + - url: https://docs.microsoft.com/microsoft-365/education/deploy/minecraft-for-education + text: 5. Install Minecraft - Education Edition + # Card + - title: Complete your deployment + # imageSrc should be square in ratio with no whitespace + imageSrc: ./images/EDU-Tasks.svg + links: + - url: https://docs.microsoft.com/microsoft-365/education/deploy/deploy-exchange-online + text: Deploy Exchange Online + - url: https://docs.microsoft.com/microsoft-365/education/deploy/deploy-sharepoint-online-and-onedrive + text: Deploy SharePoint Online and OneDrive + - url: https://docs.microsoft.com/microsoft-365/education/deploy/deploy-exchange-server-hybrid + text: Deploy Exchange Server hybrid + - url: https://docs.microsoft.com/microsoft-365/education/deploy/deploy-sharepoint-server-hybrid + text: Deploy SharePoint Server Hybrid + # Card + - title: Security & Compliance + imageSrc: ./images/EDU-Lockbox.svg + links: + - url: https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-deployment-checklist-p2 + text: AAD feature deployment guide + - url: https://techcommunity.microsoft.com/t5/Azure-Information-Protection/Azure-Information-Protection-Deployment-Acceleration-Guide/ba-p/334423 + text: Azure information protection deployment acceleration guide + - url: https://docs.microsoft.com/en-us/cloud-app-security/getting-started-with-cloud-app-security + text: Microsoft Cloud app security + - url: https://docs.microsoft.com/microsoft-365/compliance/create-test-tune-dlp-policy + text: Office 365 data loss prevention + - url: https://docs.microsoft.com/microsoft-365/compliance/ + text: Office 365 advanced compliance + - url: https://social.technet.microsoft.com/wiki/contents/articles/35748.office-365-what-is-customer-lockbox-and-how-to-enable-it.aspx + text: Deploying Lockbox + # Card + - title: Analytics & Insights + imageSrc: ./images/EDU-Education.svg + links: + - url: https://docs.microsoft.com/en-us/power-bi/service-admin-administering-power-bi-in-your-organization + text: Power BI for IT admins + - url: https://docs.microsoft.com/en-us/dynamics365/#pivot=get-started + text: Dynamics 365 \ No newline at end of file diff --git a/education/partners.yml b/education/partners.yml new file mode 100644 index 0000000000..05d585f5f5 --- /dev/null +++ b/education/partners.yml @@ -0,0 +1,33 @@ +### YamlMime:Hub + +title: M365 Education Documentation for partners +summary: Looking for resources available to Microsoft Education partners? Start here. + +metadata: + title: M365 Education Documentation for partners + description: Looking for resources available to Microsoft Education partners? Start here. + ms.service: help + ms.topic: hub-page + author: LaurenMoynihan + ms.author: v-lamoyn + ms.date: 10/24/2019 + +additionalContent: + sections: + - items: + # Card + - title: Microsoft Partner Network + summary: Discover the latest news and resources for Microsoft Education products, solutions, licensing and readiness. + url: https://partner.microsoft.com/solutions/education + # Card + - title: Authorized Education Partner (AEP) program + summary: Become authorized to purchase and resell academic priced offers and products to Qualified Educational Users (QEUs). + url: https://www.mepn.com/ + # Card + - title: Authorized Education Partner Directory + summary: Search through the list of Authorized Education Partners worldwide who can deliver on customer licensing requirements, and provide solutions and services to current and future school needs. + url: https://www.mepn.com/MEPN/AEPSearch.aspx + # Card + - title: Education Partner community Yammer group + summary: Sign in with your Microsoft Partner account and join the Education Partner community private group on Yammer. + url: https://www.yammer.com/mepn/ \ No newline at end of file diff --git a/mdop/agpm/whats-new-in-agpm-40-sp3.md b/mdop/agpm/whats-new-in-agpm-40-sp3.md index dbe0512e16..d60031b011 100644 --- a/mdop/agpm/whats-new-in-agpm-40-sp3.md +++ b/mdop/agpm/whats-new-in-agpm-40-sp3.md @@ -189,7 +189,7 @@ The following table describes the behavior of AGPM 4.0 SP3 Client and Server in ## How to Get MDOP Technologies -AGPM 4.0 SP3 is a part of the Microsoft Desktop Optimization Pack (MDOP). MDOP is part of Microsoft Software Assurance. For more information about Microsoft Software Assurance and acquiring MDOP, see [How Do I Get MDOP](https://go.microsoft.com/fwlink/?LinkId=322049) (https://go.microsoft.com/fwlink/?LinkId=322049). +AGPM 4.0 SP3 is a part of the Microsoft Desktop Optimization Pack (MDOP) since MDOP 2015. MDOP is part of Microsoft Software Assurance. For more information about Microsoft Software Assurance and acquiring MDOP, see [How Do I Get MDOP](https://go.microsoft.com/fwlink/?LinkId=322049) (https://go.microsoft.com/fwlink/?LinkId=322049). ## Related topics diff --git a/smb/docfx.json b/smb/docfx.json index f4e4a7783a..14448aa33c 100644 --- a/smb/docfx.json +++ b/smb/docfx.json @@ -30,9 +30,8 @@ "externalReference": [], "globalMetadata": { "breadcrumb_path": "/windows/smb/breadcrumb/toc.json", - "feedback_system": "GitHub", - "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", - "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", + "feedback_system": "None", + "hideEdit": true, "_op_documentIdPathDepotMapping": { "./": { "depot_name": "TechNet.smb", diff --git a/store-for-business/docfx.json b/store-for-business/docfx.json index 2825ff309d..760a988add 100644 --- a/store-for-business/docfx.json +++ b/store-for-business/docfx.json @@ -40,9 +40,8 @@ "searchScope": [ "Store" ], - "feedback_system": "GitHub", - "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", - "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", + "feedback_system": "None", + "hideEdit": true, "_op_documentIdPathDepotMapping": { "./": { "depot_name": "MSDN.store-for-business", diff --git a/windows/application-management/change-history-for-application-management.md b/windows/application-management/change-history-for-application-management.md index b7fda33af3..2ae0e03c13 100644 --- a/windows/application-management/change-history-for-application-management.md +++ b/windows/application-management/change-history-for-application-management.md @@ -7,7 +7,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: msfttracyp +author: dansimp ms.author: dansimp ms.topic: article ms.date: 10/24/2017 diff --git a/windows/application-management/docfx.json b/windows/application-management/docfx.json index ee08c91bcf..6f3c2b6c50 100644 --- a/windows/application-management/docfx.json +++ b/windows/application-management/docfx.json @@ -36,9 +36,7 @@ "audience": "ITPro", "ms.topic": "article", "ms.author": "elizapo", - "feedback_system": "GitHub", - "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", - "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", + "feedback_system": "None", "_op_documentIdPathDepotMapping": { "./": { "depot_name": "MSDN.win-app-management", diff --git a/windows/application-management/enterprise-background-activity-controls.md b/windows/application-management/enterprise-background-activity-controls.md index a9bdc7b123..dc56d686c7 100644 --- a/windows/application-management/enterprise-background-activity-controls.md +++ b/windows/application-management/enterprise-background-activity-controls.md @@ -1,5 +1,5 @@ --- -author: msfttracyp +author: dansimp title: Remove background task resource restrictions description: Allow enterprise background tasks unrestricted access to computer resources. ms.author: dansimp @@ -8,7 +8,6 @@ ms.reviewer: manager: dansimp ms.topic: article ms.prod: w10 -ms.technology: uwp keywords: windows 10, uwp, enterprise, background task, resources --- diff --git a/windows/application-management/manage-windows-mixed-reality.md b/windows/application-management/manage-windows-mixed-reality.md index 74edf682a0..205e2c3711 100644 --- a/windows/application-management/manage-windows-mixed-reality.md +++ b/windows/application-management/manage-windows-mixed-reality.md @@ -8,7 +8,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.localizationpriority: medium -author: msfttracyp +author: dansimp ms.author: dansimp ms.topic: article --- @@ -33,7 +33,7 @@ Organizations that use Windows Server Update Services (WSUS) must take action to 2. Windows Mixed Reality Feature on Demand (FOD) is downloaded from Windows Update. If access to Windows Update is blocked, you must manually install the Windows Mixed Reality FOD. - a. Download the FOD .cab file for [Windows 10, version 1903](https://software-download.microsoft.com/download/pr/Microsoft-Windows-Holographic-Desktop-FOD-Package-31bf3856ad364e35-amd64.cab), [Windows 10, version 1809](https://software-download.microsoft.com/download/pr/microsoft-windows-holographic-desktop-fod-package31bf3856ad364e35amd64_1.cab), [Windows 10, version 1803](https://download.microsoft.com/download/9/9/3/9934B163-FA01-4108-A38A-851B4ACD1244/Microsoft-Windows-Holographic-Desktop-FOD-Package~31bf3856ad364e35~amd64~~.cab), or [Windows 10, version 1709](http://download.microsoft.com/download/6/F/8/6F816172-AC7D-4F45-B967-D573FB450CB7/Microsoft-Windows-Holographic-Desktop-FOD-Package.cab). + a. Download the FOD .cab file for [Windows 10, version 1903](https://software-download.microsoft.com/download/pr/Microsoft-Windows-Holographic-Desktop-FOD-Package-31bf3856ad364e35-amd64.cab), [Windows 10, version 1809](https://software-download.microsoft.com/download/pr/microsoft-windows-holographic-desktop-fod-package31bf3856ad364e35amd64_1.cab), [Windows 10, version 1803](https://download.microsoft.com/download/9/9/3/9934B163-FA01-4108-A38A-851B4ACD1244/Microsoft-Windows-Holographic-Desktop-FOD-Package~31bf3856ad364e35~amd64~~.cab), or [Windows 10, version 1709](https://download.microsoft.com/download/6/F/8/6F816172-AC7D-4F45-B967-D573FB450CB7/Microsoft-Windows-Holographic-Desktop-FOD-Package.cab). >[!NOTE] >You must download the FOD .cab file that matches your operating system version. diff --git a/windows/client-management/administrative-tools-in-windows-10.md b/windows/client-management/administrative-tools-in-windows-10.md index 84c3b8c3d2..35c0f225b0 100644 --- a/windows/client-management/administrative-tools-in-windows-10.md +++ b/windows/client-management/administrative-tools-in-windows-10.md @@ -4,11 +4,11 @@ description: Administrative Tools is a folder in Control Panel that contains too ms.assetid: FDC63933-C94C-43CB-8373-629795926DC8 ms.reviewer: manager: dansimp -ms.author: tracyp +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -author: msfttracyp +author: dansimp ms.localizationpriority: medium ms.date: 07/27/2017 ms.topic: article diff --git a/windows/client-management/advanced-troubleshooting-802-authentication.md b/windows/client-management/advanced-troubleshooting-802-authentication.md index 878b065aa7..267386adc6 100644 --- a/windows/client-management/advanced-troubleshooting-802-authentication.md +++ b/windows/client-management/advanced-troubleshooting-802-authentication.md @@ -5,9 +5,9 @@ manager: dansimp description: Learn how 802.1X Authentication works keywords: advanced troubleshooting, 802.1X authentication, troubleshooting, authentication, Wi-Fi ms.prod: w10 -ms.mktglfcycl: +ms.mktglfcycl: ms.sitesec: library -author: msfttracyp +author: dansimp ms.localizationpriority: medium ms.author: tracyp ms.topic: troubleshooting diff --git a/windows/client-management/advanced-troubleshooting-boot-problems.md b/windows/client-management/advanced-troubleshooting-boot-problems.md index 4acac6acd7..a9442e6fe9 100644 --- a/windows/client-management/advanced-troubleshooting-boot-problems.md +++ b/windows/client-management/advanced-troubleshooting-boot-problems.md @@ -1,11 +1,11 @@ --- title: Advanced troubleshooting for Windows boot problems -description: Learn how to troubleshoot when Windows is unable to boot +description: Learn how to troubleshoot when Windows is unable to boot ms.prod: w10 ms.sitesec: library -author: msfttracyp +author: dansimp ms.localizationpriority: medium -ms.author: tracyp +ms.author: dansimp ms.date: 11/16/2018 ms.reviewer: manager: dansimp diff --git a/windows/client-management/advanced-troubleshooting-wireless-network-connectivity.md b/windows/client-management/advanced-troubleshooting-wireless-network-connectivity.md index dbd429f2e5..c04dae805a 100644 --- a/windows/client-management/advanced-troubleshooting-wireless-network-connectivity.md +++ b/windows/client-management/advanced-troubleshooting-wireless-network-connectivity.md @@ -5,11 +5,11 @@ manager: dansimp description: Learn how troubleshooting of establishing Wi-Fi connections keywords: troubleshooting, wireless network connectivity, wireless, Wi-Fi ms.prod: w10 -ms.mktglfcycl: +ms.mktglfcycl: ms.sitesec: library -author: msfttracyp +author: dansimp ms.localizationpriority: medium -ms.author: tracyp +ms.author: dansimp ms.topic: troubleshooting --- @@ -92,7 +92,7 @@ The following is a high-level view of the main wifi components in Windows. - Scanning for wireless networks in range - Managing connectivity of wireless networks The Media Specific Module (MSM) handles security aspects of connection being established. -The Native Wifi stack consists of drivers and wireless APIs to interact with wireless miniports and the supporting user-mode Wlansvc. +The Native WiFi stack consists of drivers and wireless APIs to interact with wireless miniports and the supporting user-mode Wlansvc. Third-party wireless miniport drivers interface with the upper wireless stack to provide notifications to and receive commands from Windows. diff --git a/windows/client-management/change-history-for-client-management.md b/windows/client-management/change-history-for-client-management.md index 771366616a..4f2cab1d56 100644 --- a/windows/client-management/change-history-for-client-management.md +++ b/windows/client-management/change-history-for-client-management.md @@ -7,8 +7,8 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: msfttracyp -ms.author: tracyp +author: dansimp +ms.author: dansimp ms.date: 12/06/2018 ms.reviewer: manager: dansimp diff --git a/windows/client-management/connect-to-remote-aadj-pc.md b/windows/client-management/connect-to-remote-aadj-pc.md index e1365a820c..c265525536 100644 --- a/windows/client-management/connect-to-remote-aadj-pc.md +++ b/windows/client-management/connect-to-remote-aadj-pc.md @@ -32,7 +32,8 @@ From its release, Windows 10 has supported remote connections to PCs that are jo ## Set up - Both PCs (local and remote) must be running Windows 10, version 1607 (or later). Remote connection to an Azure AD-joined PC that is running earlier versions of Windows 10 is not supported. -- Ensure [Remote Credential Guard](/windows/access-protection/remote-credential-guard), a new feature in Windows 10, version 1607, is turned off on the client PC that you are using to connect to the remote PC. +- Your local PC (where you are connecting from) must be either Azure AD joined or Hybrid Azure AD joined. Remote connection to an Azure AD joined PC from an unjoined device or a non-Windows 10 device is not supported. +Ensure [Remote Credential Guard](/windows/access-protection/remote-credential-guard), a new feature in Windows 10, version 1607, is turned off on the client PC that you are using to connect to the remote PC. - On the PC that you want to connect to: 1. Open system properties for the remote PC. 2. Enable **Allow remote connections to this computer** and select **Allow connections only from computers running Remote Desktop with Network Level Authentication**. diff --git a/windows/client-management/mdm/applicationcontrol-csp.md b/windows/client-management/mdm/applicationcontrol-csp.md index 052d05d6a0..cb636ce3ef 100644 --- a/windows/client-management/mdm/applicationcontrol-csp.md +++ b/windows/client-management/mdm/applicationcontrol-csp.md @@ -117,16 +117,7 @@ Value type is char. To use ApplicationControl CSP, you must: - Know a generated policy’s GUID, which can be found in the policy xml as ``. - Convert the policies to binary format using the ConvertFrom-CIPolicy cmdlet in order to be deployed. The binary policy may be signed or unsigned. -- Create a policy node (a Base64-encoded blob of the binary policy representation) using the [certutil -encode](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732443(v=ws.11)#BKMK_encode) command line tool. -Here is a sample certutil invocation: -``` -certutil -encode WinSiPolicy.p7b WinSiPolicy.cer -``` -An alternative to using certutil would be to use the following PowerShell invocation: -``` -[Convert]::ToBase64String($(Get-Content -Encoding Byte -ReadCount 0 -Path )) -``` If you are using hybrid MDM management with System Center Configuration Manager or using Intune, ensure that you are using Base64 as the Data type when using Custom OMA-URI functionality to apply the Code Integrity policy. diff --git a/windows/client-management/mdm/get-product-details.md b/windows/client-management/mdm/get-product-details.md index 9ab64f1f8b..18a0174509 100644 --- a/windows/client-management/mdm/get-product-details.md +++ b/windows/client-management/mdm/get-product-details.md @@ -1,6 +1,6 @@ --- title: Get product details -description: The Get product details operation retrieves the product information from the Micosoft Store for Business for a specific application. +description: The Get product details operation retrieves the product information from the Microsoft Store for Business for a specific application. ms.assetid: BC432EBA-CE5E-43BD-BD54-942774767286 ms.reviewer: manager: dansimp @@ -14,7 +14,7 @@ ms.date: 09/18/2017 # Get product details -The **Get product details** operation retrieves the product information from the Micosoft Store for Business for a specific application. +The **Get product details** operation retrieves the product information from the Microsoft Store for Business for a specific application. ## Request diff --git a/windows/client-management/mdm/images/custom-profile-prevent-device-instance-ids.png b/windows/client-management/mdm/images/custom-profile-prevent-device-instance-ids.png new file mode 100644 index 0000000000..226f4850aa Binary files /dev/null and b/windows/client-management/mdm/images/custom-profile-prevent-device-instance-ids.png differ diff --git a/windows/client-management/mdm/policy-csp-deviceinstallation.md b/windows/client-management/mdm/policy-csp-deviceinstallation.md index 5a33e8eda5..4ced8ce8ab 100644 --- a/windows/client-management/mdm/policy-csp-deviceinstallation.md +++ b/windows/client-management/mdm/policy-csp-deviceinstallation.md @@ -777,7 +777,7 @@ ADMX Info: -To enable this policy, use the following SyncML. +To enable this policy, use the following SyncML. This example prevents Windows from installing compatible devices with device instance IDs of USB\VID_1F75 and USB\VID_0781. To configure multiple classes, use `` as a delimiter. ``` xml @@ -805,6 +805,25 @@ To verify the policy is applied, check C:\windows\INF\setupapi.dev.log and see i <<< Section end 2018/11/15 12:26:41.751 <<< [Exit status: SUCCESS] ``` + +You can also block installation and usage of prohibited peripherals by using a custom profile in Intune. + +For example, this custom profile prevents installation of devices with matching device instance IDs. + +![Custom profile](images/custom-profile-prevent-device-instance-ids.png) + +To prevent installation of devices with matching device instance IDs by using custom profile in Intune: +1. Locate the device instance ID. +2. Replace `&` in the device instance IDs with `&`. +For example: +Replace +```USBSTOR\DISK&VEN_SAMSUNG&PROD_FLASH_DRIVE&REV_1100\0376319020002347&0``` +with +```USBSTOR\DISK&VEN_SAMSUNG&PROD_FLASH_DRIVE&REV_1100\0376319020002347&0``` + > [!Note] + > Do not use spaces in the value. +3. Replace the device instance IDs with `&` into the sample SyncML. Add the SyncML into the Intune custom device configuration profile. + diff --git a/windows/client-management/mdm/reboot-csp.md b/windows/client-management/mdm/reboot-csp.md index 9711b4b2a4..70668fa9de 100644 --- a/windows/client-management/mdm/reboot-csp.md +++ b/windows/client-management/mdm/reboot-csp.md @@ -38,9 +38,11 @@ The following diagram shows the Reboot configuration service provider management

The supported operation is Get.

**Schedule/Single** -

This node will execute a reboot at a scheduled date and time. Setting a null (empty) date will delete the existing schedule. The date and time value is ISO8601, and both the date and time are required.
+

This node will execute a reboot at a scheduled date and time. The date and time value is **ISO 8601**, and both the date and time are required.
Example to configure: 2018-10-25T18:00:00

+Setting a null (empty) date will delete the existing schedule. In accordance with the ISO 8601 format, the date and time representation needs to be 0000-00-00T00:00:00. +

The supported operations are Get, Add, Replace, and Delete.

**Schedule/DailyRecurrent** @@ -53,13 +55,3 @@ Example to configure: 2018-10-25T18:00:00

[Configuration service provider reference](configuration-service-provider-reference.md) - - - - - - - - - - diff --git a/windows/client-management/mdm/win32-and-centennial-app-policy-configuration.md b/windows/client-management/mdm/win32-and-centennial-app-policy-configuration.md index cb2908dda2..7b4f4424be 100644 --- a/windows/client-management/mdm/win32-and-centennial-app-policy-configuration.md +++ b/windows/client-management/mdm/win32-and-centennial-app-policy-configuration.md @@ -25,7 +25,13 @@ manager: dansimp ## Overview -Starting in Windows 10, version 1703, you can import ADMX files (also called ADMX ingestion) and set those ADMX-backed policies for Win32 and Desktop Bridge apps by using Windows 10 Mobile Device Management (MDM) on desktop SKUs. The ADMX files that define policy information can be ingested to your device by using the Policy CSP URI, `./Device/Vendor/MSFT/Policy/ConfigOperations/ADMXInstall`. The ingested ADMX file is then processed into MDM policies. +Starting in Windows 10, version 1703, you can import ADMX files (also called ADMX ingestion) and set those ADMX-backed policies for Win32 and Desktop Bridge apps by using Windows 10 Mobile Device Management (MDM) on desktop SKUs. The ADMX files that define policy information can be ingested to your device by using the Policy CSP URI, `./Device/Vendor/MSFT/Policy/ConfigOperations/ADMXInstall`. The ingested ADMX file is then processed into MDM policies. + +NOTE: Starting from the following Windows 10 version Replace command is supported +- Windows 10, version 1903 with KB4512941 and KB4517211 installed +- Windows 10, version 1809 with KB4512534 and KB installed +- Windows 10, version 1803 with KB4512509 and KB installed +- Windows 10, version 1709 with KB4516071 and KB installed When the ADMX policies are imported, the registry keys to which each policy is written are checked so that known system registry keys, or registry keys that are used by existing inbox policies or system components, are not overwritten. This precaution helps to avoid security concerns over opening the entire registry. Currently, the ingested policies are not allowed to write to locations within the **System**, **Software\Microsoft**, and **Software\Policies\Microsoft** keys, except for the following locations: @@ -48,6 +54,8 @@ When the ADMX policies are imported, the registry keys to which each policy is w - software\microsoft\exchange\ - software\policies\microsoft\vba\security\ - software\microsoft\onedrive +- software\Microsoft\Edge +- Software\Microsoft\EdgeUpdate\ > [!Warning] > Some operating system components have built in functionality to check devices for domain membership. MDM enforces the configured policy values only if the devices are domain joined, otherwise it does not. However, you can still import ADMX files and set ADMX-backed policies regardless of whether the device is domain joined or non-domain joined. diff --git a/windows/configuration/docfx.json b/windows/configuration/docfx.json index af378be469..4986e61b5d 100644 --- a/windows/configuration/docfx.json +++ b/windows/configuration/docfx.json @@ -35,9 +35,8 @@ "ms.technology": "windows", "audience": "ITPro", "ms.topic": "article", - "feedback_system": "GitHub", - "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", - "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", + "feedback_system": "None", + "hideEdit": true, "_op_documentIdPathDepotMapping": { "./": { "depot_name": "MSDN.win-configuration", diff --git a/windows/configure/docfx.json b/windows/configure/docfx.json index 564f47ae8b..3dcf319a94 100644 --- a/windows/configure/docfx.json +++ b/windows/configure/docfx.json @@ -30,6 +30,8 @@ "overwrite": [], "externalReference": [], "globalMetadata": { + "feedback_system": "None", + "hideEdit": true, "_op_documentIdPathDepotMapping": { "./": { "depot_name": "MSDN.windows-configure" diff --git a/windows/deployment/update/WIP4Biz-intro.md b/windows/deployment/update/WIP4Biz-intro.md index 9022265138..3534c08c5c 100644 --- a/windows/deployment/update/WIP4Biz-intro.md +++ b/windows/deployment/update/WIP4Biz-intro.md @@ -49,7 +49,7 @@ Windows 10 Insider Preview builds offer organizations a valuable and exciting op |Release channel |**Fast Ring:** Insider Preview builds in the Fast Ring are released approximately once a week and contain the very latest features. This makes them ideal for feature exploration.| |Users | Because Fast Ring builds are released so early in the development cycle, we recommend limiting feature exploration in your organization to IT administrators and developers running Insider Preview builds on secondary devices. | |Tasks | - Install and manage Insider Preview builds on devices (per device or centrally across multiple devices)
- Explore new features in Windows designed for organizations, including new features related to current and planned line of business applications
- Before running an Insider Preview build, check our [Windows Insider blog](https://blogs.windows.com/windowsexperience/tag/windows-insider-program/#k3WWwxKCTWHCO82H.97) for a summary of current features. | -|Feedback | - Provide feedback via [Feedback Hub app](insiderhub://home/). This helps us make adjustments to features as quickly as possible.
- Encourage users to sign into the Feedback Hub using their AAD work accounts. This enables both you and Microsoft to track feedback submitted by users within your specific organization. (Note: This tracking is only visible to Microsoft and registered Insiders within your organization’s domain.)
- [Learn how to provide effective feedback in the Feedback Hub](https://insider.windows.com/en-us/how-to-feedback/) | +|Feedback | - Provide feedback via [Feedback Hub app](insiderhub://home/). This helps us make adjustments to features as quickly as possible.
- Encourage users to sign into the Feedback Hub using their AAD work accounts. This enables both you and Microsoft to track feedback submitted by users within your specific organization. (Note: This tracking is only visible to Microsoft and registered Insiders within your organization’s domain.)
- [Learn how to provide effective feedback in the Feedback Hub](https://insider.windows.com/how-to-feedback/) | ## Validate Insider Preview builds Along with exploring new features, you also have the option to validate your apps and infrastructure on Insider Preview builds. This activity can play an important role in your [Windows 10 deployment strategy](https://docs.microsoft.com/windows/deployment/update/waas-windows-insider-for-business). Early validation has several benefits: diff --git a/windows/deployment/update/device-health-get-started.md b/windows/deployment/update/device-health-get-started.md index a7386012df..e716dce744 100644 --- a/windows/deployment/update/device-health-get-started.md +++ b/windows/deployment/update/device-health-get-started.md @@ -18,7 +18,7 @@ ms.topic: article # Get started with Device Health >[!IMPORTANT] ->The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Update Compliance](update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement). +>The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Update Compliance](update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/help/4521815/windows-analytics-retirement). This topic explains the steps necessary to configure your environment for Windows Analytics Device Health. @@ -29,7 +29,7 @@ This topic explains the steps necessary to configure your environment for Window - [Related topics](#related-topics) >[!IMPORTANT] ->The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Update Compliance](update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement). +>The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Update Compliance](update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/help/4521815/windows-analytics-retirement). ## Add the Device Health solution to your Azure subscription diff --git a/windows/deployment/update/device-health-monitor.md b/windows/deployment/update/device-health-monitor.md index 49b2c735d9..7274c2a591 100644 --- a/windows/deployment/update/device-health-monitor.md +++ b/windows/deployment/update/device-health-monitor.md @@ -19,7 +19,7 @@ ms.topic: article # Monitor the health of devices with Device Health >[!IMPORTANT] ->The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Update Compliance](update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement). +>The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Update Compliance](update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/help/4521815/windows-analytics-retirement). ## Introduction diff --git a/windows/deployment/update/device-health-using.md b/windows/deployment/update/device-health-using.md index 8ca94aa1a8..2bdfae2338 100644 --- a/windows/deployment/update/device-health-using.md +++ b/windows/deployment/update/device-health-using.md @@ -18,7 +18,7 @@ ms.topic: article # Using Device Health >[!IMPORTANT] ->The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Update Compliance](update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement). +>The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Update Compliance](update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/help/4521815/windows-analytics-retirement). This section describes how to use Device Health to monitor devices deployed on your network and troubleshoot the causes if they crash. diff --git a/windows/deployment/update/olympia/olympia-enrollment-guidelines.md b/windows/deployment/update/olympia/olympia-enrollment-guidelines.md index 396ef254fd..adb1e56155 100644 --- a/windows/deployment/update/olympia/olympia-enrollment-guidelines.md +++ b/windows/deployment/update/olympia/olympia-enrollment-guidelines.md @@ -88,6 +88,9 @@ This is the Bring Your Own Device (BYOD) method--your device will receive Olympi - This method will upgrade your Windows 10 Pro license to Enterprise and create a new account. See [Set up Azure Active Directory joined devices](https://docs.microsoft.com/azure/active-directory/device-management-azuread-joined-devices-setup) for more information. + > [!NOTE] + > Make sure that you save your Pro license key before upgrading to the Enterprise edition. If the device gets disconnected from Olympia, you can use the Pro key to reactivate the license manually in the unlikely event that the license fails to downgrade back to Pro automatically. To reactivate manually, see [Upgrade by manually entering a product key](https://docs.microsoft.com/windows/deployment/upgrade/windows-10-edition-upgrades#upgrade-by-manually-entering-a-product-key). + 1. Go to **Start > Settings > Accounts > Access work or school**. To see this setting, you need to have administrator rights to your device (see [local administrator](https://support.microsoft.com/instantanswers/5de907f1-f8ba-4fd9-a89d-efd23fee918c/create-a-local-user-or-administrator-account-in-windows-10)). ![Settings -> Accounts](images/1-1.png) diff --git a/windows/deployment/update/servicing-stack-updates.md b/windows/deployment/update/servicing-stack-updates.md index 95179814aa..b13b1e355c 100644 --- a/windows/deployment/update/servicing-stack-updates.md +++ b/windows/deployment/update/servicing-stack-updates.md @@ -33,7 +33,7 @@ Servicing stack updates improve the reliability of the update process to mitigat Servicing stack update are released depending on new issues or vulnerabilities. In rare occasions a servicing stack update may need to be released on demand to address an issue impacting systems installing the monthly security update. Starting in November 2018 new servicing stack updates will be classified as "Security" with a severity rating of "Critical." >[!NOTE] ->You can find a list of servicing stack updates at [Latest servicing stack updates](https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV990001). +>You can find a list of servicing stack updates at [Latest servicing stack updates](https://portal.msrc.microsoft.com/security-guidance/advisory/ADV990001). ## What's the difference between a servicing stack update and a cumulative update? @@ -53,4 +53,5 @@ Typically, the improvements are reliability and performance improvements that do * Servicing stack updates contain the full servicing stack; as a result, typically administrators only need to install the latest servicing stack update for the operating system. * Installing servicing stack update does not require restarting the device, so installation should not be disruptive. * Servicing stack update releases are specific to the operating system version (build number), much like quality updates. -* Search to install latest available [Servicing stack update for Windows 10](https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV990001). +* Search to install latest available [Servicing stack update for Windows 10](https://portal.msrc.microsoft.com/security-guidance/advisory/ADV990001). +* Once a servicing stack update is installed, it cannot be removed or uninstalled from the machine. \ No newline at end of file diff --git a/windows/deployment/update/update-compliance-get-started.md b/windows/deployment/update/update-compliance-get-started.md index 0413187d35..5e81c8e5a0 100644 --- a/windows/deployment/update/update-compliance-get-started.md +++ b/windows/deployment/update/update-compliance-get-started.md @@ -49,7 +49,7 @@ Update Compliance is offered as a solution which is linked to a new or existing ![Update Compliance solution creation](images/UC_01_marketplace_create.png) 4. Choose an existing workspace or create a new workspace that will be assigned to the Update Compliance solution. - - [Desktop Analytics](https://docs.microsoft.com/en-us/sccm/desktop-analytics/overview) customers are advised to use the same workspace for Update Compliance. + - [Desktop Analytics](https://docs.microsoft.com/sccm/desktop-analytics/overview) customers are advised to use the same workspace for Update Compliance. - If you are creating a new workspace, and your organization does not have policies governing naming conventions and structure, consider the following workspace settings to get started: - Choose a workspace name which reflects the scope of planned usage in your organization, for example *PC-Analytics*. - For the resource group setting select **Create new** and use the same name you chose for your new workspace. @@ -89,7 +89,7 @@ Commercial ID can be deployed using Group Policy. The Group Policy for Commercia ![Commercial ID Group Policy location](images/UC_commercialID_GP.png) #### Deploying Commercial ID using MDM -Commercial ID can be deployed through a [Mobile Device Management](https://docs.microsoft.com/en-us/windows/client-management/mdm/) (MDM) policy beginning with Windows 10, version 1607. Commercial ID is under the [DMClient configuration service provider](https://docs.microsoft.com/en-us/windows/client-management/mdm/dmclient-csp). +Commercial ID can be deployed through a [Mobile Device Management](https://docs.microsoft.com/windows/client-management/mdm/) (MDM) policy beginning with Windows 10, version 1607. Commercial ID is under the [DMClient configuration service provider](https://docs.microsoft.com/windows/client-management/mdm/dmclient-csp). ### Ensure endpoints are whitelisted To enable data sharing between devices, your network, and Microsoft's Diagnostic Data Service, configure your proxy to whitelist the following endpoints. You may need security group approval to do this. @@ -105,7 +105,7 @@ To enable data sharing between devices, your network, and Microsoft's Diagnostic | `https://login.live.com` | This endpoint is optional but allows for the Update Compliance service to more reliably identify and process devices. If you want to disable end-user managed service account (MSA) access, you should apply the appropriate [policy](https://docs.microsoft.com/windows/security/identity-protection/access-control/microsoft-accounts#block-all-consumer-microsoft-account-user-authentication) instead of blocking this endpoint. | ### Set diagnostic data levels -Update Compliance requires that devices are configured to send Microsoft at least the Basic level of diagnostic data in order to function. For more information on Windows diagnostic data, see [Configure Windows diagnostic data in your organization](https://docs.microsoft.com/en-us/windows/privacy/configure-windows-diagnostic-data-in-your-organization). +Update Compliance requires that devices are configured to send Microsoft at least the Basic level of diagnostic data in order to function. For more information on Windows diagnostic data, see [Configure Windows diagnostic data in your organization](https://docs.microsoft.com/windows/privacy/configure-windows-diagnostic-data-in-your-organization). #### Configuring Telemetry level using Group Policy You can set Allow Telemetry through Group Policy, this setting is in the same place as the Commercial ID policy, under **Computer Configuration\Administrative Templates\Windows Components\Data Collection and Preview Builds\Allow Telemetry**. Update Compliance requires at least Basic (level 1) to function. @@ -113,7 +113,7 @@ You can set Allow Telemetry through Group Policy, this setting is in the same pl ![Allow Telemetry in Group Policy](images/UC_telemetrylevel.png) #### Configuring Telemetry level using MDM -Telemetry level can additionally be configured through a [Mobile Device Management](https://docs.microsoft.com/en-us/windows/client-management/mdm/) (MDM) policy. Allow Telemetry is under the [Policy Configuration Service Provider](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-configuration-service-provider) as [System/AllowTelemetry](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-system#system-allowtelemetry). +Telemetry level can additionally be configured through a [Mobile Device Management](https://docs.microsoft.com/windows/client-management/mdm/) (MDM) policy. Allow Telemetry is under the [Policy Configuration Service Provider](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider) as [System/AllowTelemetry](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-system#system-allowtelemetry). ### Enabling Device Name in telemetry Beginning with Windows 10, version 1803, Device Name is no longer collected as part of normal Windows Diagnostic Data and must explicitly be allowed to be sent to Microsoft. If devices do not have this policy enabled, their device name will appear as '#' instead. @@ -122,7 +122,7 @@ Beginning with Windows 10, version 1803, Device Name is no longer collected as p Allow Device Name in Telemetry is under the same node as Commercial ID and Allow Telemetry policies in Group Policy, listed as **Allow device name to be sent in Windows diagnostic data**. #### Allow Device Name in Telemetry with MDM -Allow Device Name in Telemetry is under the [Policy Configuration Service Provider](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-configuration-service-provider) as [System/AllowTelemetry](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-system#system-allowtelemetry). +Allow Device Name in Telemetry is under the [Policy Configuration Service Provider](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider) as [System/AllowTelemetry](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-system#system-allowtelemetry). >[!NOTE] >After enrolling your devices (by deploying your CommercialID and Windows Diagnostic Data settings), it might take 48-72 hours for the first data to appear in the solution. Until then, Update Compliance will indicate it is still assessing devices. \ No newline at end of file diff --git a/windows/deployment/update/update-compliance-monitor.md b/windows/deployment/update/update-compliance-monitor.md index e41b2f365b..8996c05986 100644 --- a/windows/deployment/update/update-compliance-monitor.md +++ b/windows/deployment/update/update-compliance-monitor.md @@ -18,7 +18,7 @@ ms.topic: article # Monitor Windows Updates with Update Compliance >[!IMPORTANT] ->The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Update Compliance](update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement). +>The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Update Compliance](update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/help/4521815/windows-analytics-retirement). ## Introduction diff --git a/windows/deployment/update/waas-delivery-optimization-reference.md b/windows/deployment/update/waas-delivery-optimization-reference.md index ab1a485ac8..e7d8d21550 100644 --- a/windows/deployment/update/waas-delivery-optimization-reference.md +++ b/windows/deployment/update/waas-delivery-optimization-reference.md @@ -132,7 +132,8 @@ Starting in Windows 10, version 1803, set this policy to restrict peer selection - 1 = AD Site - 2 = Authenticated domain SID - 3 = DHCP Option ID (with this option, the client will query DHCP Option ID 234 and use the returned GUID value as the Group ID) -- 4 = DNS Suffix +- 4 = DNS Suffix +- 5 = Starting with Windows 10, version 1903, you can use the Azure Active Directory (AAD) Tenant ID as a means to define groups. To do this set the value for DOGroupIdSource to its new maximum value of 5. When set, the Group ID is assigned automatically from the selected source. If you set this policy, the GroupID policy will be ignored. The option set in this policy only applies to Group (2) download mode. If Group (2) isn't set as Download mode, this policy will be ignored. If you set the value to anything other than 0-4, the policy is ignored. diff --git a/windows/deployment/update/waas-manage-updates-wufb.md b/windows/deployment/update/waas-manage-updates-wufb.md index 96e833ec0a..479877ca3a 100644 --- a/windows/deployment/update/waas-manage-updates-wufb.md +++ b/windows/deployment/update/waas-manage-updates-wufb.md @@ -46,14 +46,14 @@ Windows Update for Business provides management policies for several types of up ## Offering -You can control when updates are applied, for example by deferring when an update is installed on a device or by pausing updates for a certain period of time. +You can control when updates are applied, for example by deferring when an update is installed on a device or by pausing updates for a certain period. ### Manage which updates are offered Windows Update for Business offers you the ability to turn on or off both driver and Microsoft product updates. - Drivers (on/off): When "on," this policy will not include drivers with Windows Update. -- Microsoft product updates (on/off): When "on" this policy will install udpates for other Microsoft products. +- Microsoft product updates (on/off): When "on" this policy will install updates for other Microsoft products. ### Manage when updates are offered @@ -90,11 +90,19 @@ The branch readiness level enables administrators to specify which channel of fe Prior to Windows 10, version 1903, there are two channels for released updates: Semi-annual Channel and Semi-annual Channel (Targeted). Deferral days are calculated against the release date of the chosen channel. Starting with Windows 10, version 1903 there is only the one release channel: Semi-annual Channel. All deferral days will be calculated against a release’s Semi-annual Channel release date. To see release dates, visit [Windows Release Information](https://docs.microsoft.com/windows/release-information/). You can set the branch readiness level by using the **Select when Preview Builds and Feature Updates are Received** policy. In order to use this to manage pre-release builds, first enable preview builds by using the **Manage preview Builds** policy. +### Recommendations + +For the best experience with Windows Update, follow these guidelines: + +- Use devices for at least 6 hours per month, including at least 2 hours of continuous use. +- Keep devices regularly charged. Plugging in devices overnight enables them to automatically update outside of active hours. +- Make sure that devices have at least 10 GB of free space. +- Give devices unobstructed access to the Windows Update service. ## Monitor Windows Updates by using Update Compliance -Update Compliance provides a holistic view of operating system update compliance, update deployment progress, and failure troubleshooting for Windows 10 devices. This service uses diagnostic data including installation progress, Windows Update configuration, and other information to provide such insights, at no extra cost and without additional infrastructure requirements. Whether used with Windows Update for Business or other management tools, you can be assured that your devices are properly updated. +Update Compliance provides a holistic view of operating system update compliance, update deployment progress, and failure troubleshooting for Windows 10 devices. This service uses diagnostic data including installation progress, Windows Update configuration, and other information to provide such insights, at no extra cost and without extra infrastructure requirements. Whether used with Windows Update for Business or other management tools, you can be assured that your devices are properly updated. ![Update Compliance Dashboard](images/waas-wufb-update-compliance.png) diff --git a/windows/deployment/update/waas-morenews.md b/windows/deployment/update/waas-morenews.md index ecc49de5af..cbfbcdff46 100644 --- a/windows/deployment/update/waas-morenews.md +++ b/windows/deployment/update/waas-morenews.md @@ -7,7 +7,6 @@ audience: itpro itproauthor: jaimeo author: jaimeo ms.author: jaimeo -ms.date: 12/19/2018 ms.reviewer: manager: laurawi ms.localizationpriority: high @@ -18,6 +17,12 @@ ms.topic: article Here's more news about [Windows as a service](windows-as-a-service.md):
    +
  • Windows 10 Enterprise vs. Windows 10 Pro: Modern management considerations for your organization - June 25, 2019
    • +
  • Updating Windows 10, version 1903 using Configuration Manager or WSUS - May 23, 2019
    • +
  • What’s new in Windows Update for Business in Windows 10, version 1903 - May 21, 2019
    • +
  • What’s new for IT pros in Windows 10, version 1903 - May 21, 2019
    • +
  • How to get the Windows 10 May 2019 Update - May 21, 2019
    • +
  • The benefits of Windows 10 Dynamic Update - April 17, 2019
  • Improving the Windows 10 update experience with control, quality and transparency - April 4, 2019
  • Call to action: review your Windows Update for Business deferral values - April 3, 2019
  • Windows 10, version 1809 designated for broad deployment - March 28, 2019
    • diff --git a/windows/deployment/update/waas-servicing-channels-windows-10-updates.md b/windows/deployment/update/waas-servicing-channels-windows-10-updates.md index 453488ddf0..2f891c98c0 100644 --- a/windows/deployment/update/waas-servicing-channels-windows-10-updates.md +++ b/windows/deployment/update/waas-servicing-channels-windows-10-updates.md @@ -57,14 +57,14 @@ The Semi-Annual Channel is the default servicing channel for all Windows 10 devi 1. Go to **Settings** > **Update & security** > **Windows Update** > **Advanced options**. 2. Select **Defer feature updates**. -**To assign devicess to the Semi-Annual Channel by using Group Policy** +**To assign devices to the Semi-Annual Channel by using Group Policy** - In Windows 10, version 1607 and later releases: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Defer Windows Updates > **Select when Feature Updates are received** - enable policy and set branch readiness level to the Semi-Annual Channel -**To assign devicess to to the Semi-Annual Channel by using MDM** +**To assign devices to to the Semi-Annual Channel by using MDM** - In Windows 10, version 1607 and later releases: @@ -82,8 +82,8 @@ The Semi-Annual Channel is the default servicing channel for all Windows 10 devi To get started with the Windows Insider Program for Business, you will need to follow a few simple steps: -1. On the [Windows Insider](https://insider.windows.com) website, go to **For Business > Getting Started** to [register your organizational Azure AD account](https://insider.windows.com/en-us/insidersigninaad/). -2. **Register your domain**. Rather than have each user register individually for Insider Preview builds, administrators can simply [register their domain](https://insider.windows.com/en-us/for-business-organization-admin/) and control settings centrally.
    **Note:** The signed-in user needs to be a **Global Administrator** of the Azure AD domain in order to be able to register the domain. +1. On the [Windows Insider](https://insider.windows.com) website, go to **For Business > Getting Started** to [register your organizational Azure AD account](https://insider.windows.com/insidersigninaad/). +2. **Register your domain**. Rather than have each user register individually for Insider Preview builds, administrators can simply [register their domain](https://insider.windows.com/for-business-organization-admin/) and control settings centrally.
    **Note:** The signed-in user needs to be a **Global Administrator** of the Azure AD domain in order to be able to register the domain. 3. Make sure the **Allow Telemetry** setting is set to **2** or higher. 4. Starting with Windows 10, version 1709, set policies to manage preview builds and their delivery: diff --git a/windows/deployment/update/windows-analytics-FAQ-troubleshooting.md b/windows/deployment/update/windows-analytics-FAQ-troubleshooting.md index 4f04e51290..5898646433 100644 --- a/windows/deployment/update/windows-analytics-FAQ-troubleshooting.md +++ b/windows/deployment/update/windows-analytics-FAQ-troubleshooting.md @@ -19,7 +19,7 @@ ms.topic: article # Frequently asked questions and troubleshooting Windows Analytics >[!IMPORTANT] ->The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Update Compliance](update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement). +>The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Update Compliance](update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/help/4521815/windows-analytics-retirement). >[!IMPORTANT] >**The OMS portal has been deprecated; you should start using the [Azure portal](https://portal.azure.com) instead as soon as possible.** Many experiences are the same in the two portals, but there are some key differences. See [Windows Analytics in the Azure Portal](windows-analytics-azure-portal.md) for steps to use Windows Analytics in the Azure portal. For much more information about the transition from OMS to Azure, see [OMS portal moving to Azure](https://docs.microsoft.com/azure/log-analytics/log-analytics-oms-portal-transition). diff --git a/windows/deployment/update/windows-analytics-azure-portal.md b/windows/deployment/update/windows-analytics-azure-portal.md index 610deb2695..5b1310a627 100644 --- a/windows/deployment/update/windows-analytics-azure-portal.md +++ b/windows/deployment/update/windows-analytics-azure-portal.md @@ -19,7 +19,7 @@ ms.topic: article # Windows Analytics in the Azure Portal >[!IMPORTANT] ->The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Update Compliance](update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement). +>The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Update Compliance](update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/help/4521815/windows-analytics-retirement). Windows Analytics uses Azure Log Analytics workspaces (formerly known as Operations Management Suite or OMS), a collection of cloud-based services for monitoring and automating your on-premises and cloud environments. diff --git a/windows/deployment/update/windows-analytics-get-started.md b/windows/deployment/update/windows-analytics-get-started.md index 8b3ebe0b50..18a4d35cd9 100644 --- a/windows/deployment/update/windows-analytics-get-started.md +++ b/windows/deployment/update/windows-analytics-get-started.md @@ -17,7 +17,7 @@ ms.topic: article # Enrolling devices in Windows Analytics >[!IMPORTANT] ->The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Update Compliance](update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement). +>The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Update Compliance](update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/help/4521815/windows-analytics-retirement). If you have not already done so, consult the topics for any of the three Windows Analytics solutions (Update Compliance, Upgrade Readiness, and Device Health) you intend to use and follow the steps there to add the solutions to Azure Portal. @@ -101,8 +101,8 @@ The compatibility update scans your devices and enables application usage tracki | **Operating System** | **Updates** | |----------------------|-----------------------------------------------------------------------------| | Windows 10 | Windows 10 includes the compatibility update, so you will automatically have the latest compatibility update so long as you continue to keep your Windows 10 devices up to date with cumulative updates. | -| Windows 8.1 | The compatibility update is included in monthly quality updates for Windows 8.1. We recommend installing the latest [Windows Monthly Rollup](http://www.catalog.update.microsoft.com/Search.aspx?q=security%20monthly%20quality%20rollup%20for%20windows%208) before attempting to enroll devices into Windows Analytics. | -| Windows 7 SP1 | The compatibility update is included in monthly quality updates for Windows 7. We recommend installing the latest [Windows Monthly Rollup](http://www.catalog.update.microsoft.com/Search.aspx?q=security%20monthly%20quality%20rollup%20for%20windows%207) before attempting to enroll devices into Windows Analytics. | +| Windows 8.1 | The compatibility update is included in monthly quality updates for Windows 8.1. We recommend installing the latest [Windows Monthly Rollup](https://www.catalog.update.microsoft.com/Search.aspx?q=security%20monthly%20quality%20rollup%20for%20windows%208) before attempting to enroll devices into Windows Analytics. | +| Windows 7 SP1 | The compatibility update is included in monthly quality updates for Windows 7. We recommend installing the latest [Windows Monthly Rollup](https://www.catalog.update.microsoft.com/Search.aspx?q=security%20monthly%20quality%20rollup%20for%20windows%207) before attempting to enroll devices into Windows Analytics. | ### Connected User Experiences and Telemetry service diff --git a/windows/deployment/update/windows-analytics-overview.md b/windows/deployment/update/windows-analytics-overview.md index 43531d972c..5d63af3e36 100644 --- a/windows/deployment/update/windows-analytics-overview.md +++ b/windows/deployment/update/windows-analytics-overview.md @@ -21,7 +21,7 @@ ms.topic: article Windows Analytics is a set of solutions for Azure Portal that provide you with extensive data about the state of devices in your deployment. There are currently three solutions which you can use singly or in any combination: >[!IMPORTANT] ->The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Update Compliance](update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement). +>The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Update Compliance](update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/help/4521815/windows-analytics-retirement). ## Device Health diff --git a/windows/deployment/update/windows-analytics-privacy.md b/windows/deployment/update/windows-analytics-privacy.md index f0b2a4f3af..fcfe1d41f9 100644 --- a/windows/deployment/update/windows-analytics-privacy.md +++ b/windows/deployment/update/windows-analytics-privacy.md @@ -19,7 +19,7 @@ ms.topic: article # Windows Analytics and privacy >[!IMPORTANT] ->The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Update Compliance](update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement). +>The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Update Compliance](update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/help/4521815/windows-analytics-retirement). Windows Analytics is fully committed to privacy, centering on these tenets: diff --git a/windows/deployment/update/windows-as-a-service.md b/windows/deployment/update/windows-as-a-service.md index 91ff545345..3acd3f759a 100644 --- a/windows/deployment/update/windows-as-a-service.md +++ b/windows/deployment/update/windows-as-a-service.md @@ -29,13 +29,16 @@ Everyone wins when transparency is a top priority. We want you to know when upda The latest news: [See more news](waas-morenews.md). You can also check out the [Windows 10 blog](https://techcommunity.microsoft.com/t5/Windows-10-Blog/bg-p/Windows10Blog). diff --git a/windows/deployment/update/windows-update-error-reference.md b/windows/deployment/update/windows-update-error-reference.md index fd014ccd65..044398b870 100644 --- a/windows/deployment/update/windows-update-error-reference.md +++ b/windows/deployment/update/windows-update-error-reference.md @@ -17,351 +17,351 @@ ms.topic: article # Windows Update error codes by component ->Applies to: Windows 10 +> Applies to: Windows 10 This section lists the error codes for Microsoft Windows Update. + +## Automatic Update Errors + +| Error code | Message | Description | +|------------|---------------------------------|--------------------------------------------------------------------------------------------------------| +| 0x80243FFF | `WU_E_AUCLIENT_UNEXPECTED` | There was a user interface error not covered by another `WU_E_AUCLIENT_*` error code. | +| 0x8024A000 | `WU_E_AU_NOSERVICE` | Automatic Updates was unable to service incoming requests. | +| 0x8024A002 | `WU_E_AU_NONLEGACYSERVER` | The old version of the Automatic Updates client has stopped because the WSUS server has been upgraded. | +| 0x8024A003 | `WU_E_AU_LEGACYCLIENTDISABLED` | The old version of the Automatic Updates client was disabled. | +| 0x8024A004 | `WU_E_AU_PAUSED` | Automatic Updates was unable to process incoming requests because it was paused. | +| 0x8024A005 | `WU_E_AU_NO_REGISTERED_SERVICE` | No unmanaged service is registered with `AU`. | +| 0x8024AFFF | `WU_E_AU_UNEXPECTED` | An Automatic Updates error not covered by another `WU_E_AU*` code. | + +## Windows Update UI errors + +| Error code | Message | Description | +|------------|---------------------------------------------|--------------------------------------------------------------------------------------------------------------------------| +| 0x80243001 | `WU_E_INSTALLATION_RESULTS_UNKNOWN_VERSION` | The results of download and installation could not be read from the registry due to an unrecognized data format version. | +| 0x80243002 | `WU_E_INSTALLATION_RESULTS_INVALID_DATA` | The results of download and installation could not be read from the registry due to an invalid data format. | +| 0x80243003 | `WU_E_INSTALLATION_RESULTS_NOT_FOUND` | The results of download and installation are not available; the operation may have failed to start. | +| 0x80243004 | `WU_E_TRAYICON_FAILURE` | A failure occurred when trying to create an icon in the taskbar notification area. | +| 0x80243FFD | `WU_E_NON_UI_MODE` | Unable to show UI when in non-UI mode; WU client UI modules may not be installed. | +| 0x80243FFE | `WU_E_WUCLTUI_UNSUPPORTED_VERSION` | Unsupported version of WU client UI exported functions. | +| 0x80243FFF | `WU_E_AUCLIENT_UNEXPECTED` | There was a user interface error not covered by another `WU_E_AUCLIENT_*` error code. | + +## Inventory errors + +| Error code | Message | Description | +|------------|--------------------------------------------|-------------------------------------------------------------------------------| +| 0x80249001 | `WU_E_INVENTORY_PARSEFAILED` | Parsing of the rule file failed. | +| 0x80249002 | `WU_E_INVENTORY_GET_INVENTORY_TYPE_FAILED` | Failed to get the requested inventory type from the server. | +| 0x80249003 | `WU_E_INVENTORY_RESULT_UPLOAD_FAILED` | Failed to upload inventory result to the server. | +| 0x80249004 | `WU_E_INVENTORY_UNEXPECTED` | There was an inventory error not covered by another error code. | +| 0x80249005 | `WU_E_INVENTORY_WMI_ERROR` | A WMI error occurred when enumerating the instances for a particular class. | + +## Expression evaluator errors + +| Error code | Message | Description | +|------------|---------------------------------|--------------------------------------------------------------------------------------------------------------------------------| +| 0x8024E001 | `WU_E_EE_UNKNOWN_EXPRESSION` | An expression evaluator operation could not be completed because an expression was unrecognized. | +| 0x8024E002 | `WU_E_EE_INVALID_EXPRESSION` | An expression evaluator operation could not be completed because an expression was invalid. | +| 0x8024E003 | `WU_E_EE_MISSING_METADATA` | An expression evaluator operation could not be completed because an expression contains an incorrect number of metadata nodes. | +| 0x8024E004 | `WU_E_EE_INVALID_VERSION` | An expression evaluator operation could not be completed because the version of the serialized expression data is invalid. | +| 0x8024E005 | `WU_E_EE_NOT_INITIALIZED` | The expression evaluator could not be initialized. | +| 0x8024E006 | `WU_E_EE_INVALID_ATTRIBUTEDATA` | An expression evaluator operation could not be completed because there was an invalid attribute. | +| 0x8024E007 | `WU_E_EE_CLUSTER_ERROR` | An expression evaluator operation could not be completed because the cluster state of the computer could not be determined. | +| 0x8024EFFF | `WU_E_EE_UNEXPECTED` | There was an expression evaluator error not covered by another `WU_E_EE_*` error code. | -## Automatic Update Errors +## Reporter errors -| Error code | Message | Description | -|------------|-------------------------------|--------------------------------------------------------------------------------------------------------| -| 0x80243FFF | WU_E_AUCLIENT_UNEXPECTED | There was a user interface error not covered by another WU_E_AUCLIENT_\* error code. | -| 0x8024A000 | WU_E_AU_NOSERVICE | Automatic Updates was unable to service incoming requests.  | -| 0x8024A002 | WU_E_AU_NONLEGACYSERVER | The old version of the Automatic Updates client has stopped because the WSUS server has been upgraded. | -| 0x8024A003 | WU_E_AU_LEGACYCLIENTDISABLED |  The old version of the Automatic Updates client was disabled. | -| 0x8024A004 | WU_E_AU_PAUSED | Automatic Updates was unable to process incoming requests because it was paused. | -| 0x8024A005 | WU_E_AU_NO_REGISTERED_SERVICE |  No unmanaged service is registered with AU. | -| 0x8024AFFF | WU_E_AU_UNEXPECTED |  An Automatic Updates error not covered by another WU_E_AU \* code. | - -## Windows Update UI errors +| Error code | Message | Description | +|------------|-------------------------------------------|----------------------------------------------------------------------------------------------------------------------| +| 0x80247001 | `WU_E_OL_INVALID_SCANFILE` | An operation could not be completed because the scan package was invalid. | +| 0x80247002 | `WU_E_OL_NEWCLIENT_REQUIRED` | An operation could not be completed because the scan package requires a greater version of the Windows Update Agent. | +| 0x80247FFF | `WU_E_OL_UNEXPECTED` | Search using the scan package failed. | +| 0x8024F001 | `WU_E_REPORTER_EVENTCACHECORRUPT` | The event cache file was defective. | +| 0x8024F002 | `WU_E_REPORTER_EVENTNAMESPACEPARSEFAILED` | The XML in the event namespace descriptor could not be parsed. | +| 0x8024F003 | `WU_E_INVALID_EVENT` | The XML in the event namespace descriptor could not be parsed. | +| 0x8024F004 | `WU_E_SERVER_BUSY` | The server rejected an event because the server was too busy. | +| 0x8024FFFF | `WU_E_REPORTER_UNEXPECTED` | There was a reporter error not covered by another error code. | -| Error code | Message | Description | -|------------|-------------------------------------------|--------------------------------------------------------------------------------------------------------------------------| -| 0x80243001 | WU_E_INSTALLATION_RESULTS_UNKNOWN_VERSION | The results of download and installation could not be read from the registry due to an unrecognized data format version. | -| 0x80243002 | WU_E_INSTALLATION_RESULTS_INVALID_DATA | The results of download and installation could not be read from the registry due to an invalid data format. | -| 0x80243003 | WU_E_INSTALLATION_RESULTS_NOT_FOUND | The results of download and installation are not available; the operation may have failed to start. | -| 0x80243004 |  WU_E_TRAYICON_FAILURE |  A failure occurred when trying to create an icon in the taskbar notification area. | -| 0x80243FFD |  WU_E_NON_UI_MODE |  Unable to show UI when in non-UI mode; WU client UI modules may not be installed.  | -| 0x80243FFE |  WU_E_WUCLTUI_UNSUPPORTED_VERSION |  Unsupported version of WU client UI exported functions.  | -| 0x80243FFF |  WU_E_AUCLIENT_UNEXPECTED |  There was a user interface error not covered by another WU_E_AUCLIENT_\* error code.  | - -## Inventory errors +## Redirector errors +The components that download the `Wuredir.cab` file and then parse the `Wuredir.cab` file generate the following errors. -| Error code | Message | Description | -|------------|-------------------------------------------|-------------------------------------------------------------------------------| -| 0x80249001 |  WU_E_INVENTORY_PARSEFAILED |  Parsing of the rule file failed.  | -| 0x80249002 |  WU_E_INVENTORY_GET_INVENTORY_TYPE_FAILED |  Failed to get the requested inventory type from the server.  | -| 0x80249003 |  WU_E_INVENTORY_RESULT_UPLOAD_FAILED |  Failed to upload inventory result to the server.  | -| 0x80249004 |  WU_E_INVENTORY_UNEXPECTED |  There was an inventory error not covered by another error code. | -| 0x80249005 |  WU_E_INVENTORY_WMI_ERROR |  A WMI error occurred when enumerating the instances for a particular class.  | - -## Expression evaluator errors +| Error code | Message | Description | +|----------- |------------------------------|------------------------------------------------------------------------------------------| +| 0x80245001 | `WU_E_REDIRECTOR_LOAD_XML` | The redirector XML document could not be loaded into the DOM class. | +| 0x80245002 | `WU_E_REDIRECTOR_S_FALSE` | The redirector XML document is missing some required information. | +| 0x80245003 | `WU_E_REDIRECTOR_ID_SMALLER` | The redirectorId in the downloaded redirector cab is less than in the cached cab. | +| 0x80245FFF | `WU_E_REDIRECTOR_UNEXPECTED` | The redirector failed for reasons not covered by another `WU_E_REDIRECTOR_*` error code. | -| Error code | Message | Description | -|-------------|--------------------------------|----------------------------------------------------------------------------------------------------------------------------------| -| 0x8024E001 |  WU_E_EE_UNKNOWN_EXPRESSION |  An expression evaluator operation could not be completed because an expression was unrecognized. | -| 0x8024E002 |  WU_E_EE_INVALID_EXPRESSION |  An expression evaluator operation could not be completed because an expression was invalid.  | -| 0x8024E003 |  WU_E_EE_MISSING_METADATA |  An expression evaluator operation could not be completed because an expression contains an incorrect number of metadata nodes.  | -| 0x8024E004 |  WU_E_EE_INVALID_VERSION |  An expression evaluator operation could not be completed because the version of the serialized expression data is invalid.  | -|  0x8024E005 |  WU_E_EE_NOT_INITIALIZED |  The expression evaluator could not be initialized. | -|  0x8024E006 |  WU_E_EE_INVALID_ATTRIBUTEDATA |  An expression evaluator operation could not be completed because there was an invalid attribute. | -|  0x8024E007 |  WU_E_EE_CLUSTER_ERROR |  An expression evaluator operation could not be completed because the cluster state of the computer could not be determined.  | -|  0x8024EFFF |  WU_E_EE_UNEXPECTED |  There was an expression evaluator error not covered by another WU_E_EE_\* error code.  | - -## Reporter errors - -| Error code | Message | Description | -|-------------|------------------------------------------|-----------------------------------------------------------------------------------------------------------------------| -|  0x80247001 |  WU_E_OL_INVALID_SCANFILE |  An operation could not be completed because the scan package was invalid. | -| 0x80247002 |  WU_E_OL_NEWCLIENT_REQUIRED |  An operation could not be completed because the scan package requires a greater version of the Windows Update Agent. | -|  0x80247FFF |  WU_E_OL_UNEXPECTED |  Search using the scan package failed.  | -|  0x8024F001 |  WU_E_REPORTER_EVENTCACHECORRUPT |  The event cache file was defective.  | -|  0x8024F002 |  WU_E_REPORTER_EVENTNAMESPACEPARSEFAILED |  The XML in the event namespace descriptor could not be parsed. | -|  0x8024F003 |  WU_E_INVALID_EVENT |  The XML in the event namespace descriptor could not be parsed. | -|  0x8024F004 |  WU_E_SERVER_BUSY |  The server rejected an event because the server was too busy. | -|  0x8024FFFF |  WU_E_REPORTER_UNEXPECTED |  There was a reporter error not covered by another error code.  | - -## Redirector errors -The components that download the Wuredir.cab file and then parse the Wuredir.cab file generate the following errors. - -|Error code|Message|Description | -|-|-|-| -| 0x80245001| WU_E_REDIRECTOR_LOAD_XML| The redirector XML document could not be loaded into the DOM class.  | -| 0x80245002| WU_E_REDIRECTOR_S_FALSE| The redirector XML document is missing some required information. | -| 0x80245003| WU_E_REDIRECTOR_ID_SMALLER| The redirectorId in the downloaded redirector cab is less than in the cached cab.  | -| 0x80245FFF| WU_E_REDIRECTOR_UNEXPECTED| The redirector failed for reasons not covered by another WU_E_REDIRECTOR_* error code.  | - -## Protocol Talker errors -The following errors map to SOAPCLIENT_ERRORs through the Atlsoap.h file. These errors are obtained when the CClientWebService object calls the GetClientError() method. +## Protocol Talker errors +The following errors map to `SOAPCLIENT_ERROR`s through the `Atlsoap.h` file. These errors are obtained when the `CClientWebService` object calls the `GetClientError()` method. -| Error code | Message | Description | -|-------------|---------------------------------|------------------------------------------------------------------------------------------------------------------------------------| -|  0x80244000 |  WU_E_PT_SOAPCLIENT_BASE |  WU_E_PT_SOAPCLIENT_\* error codes map to the SOAPCLIENT_ERROR enum of the ATL Server Library. | -| 0x80244001 |  WU_E_PT_SOAPCLIENT_INITIALIZE |  Same as SOAPCLIENT_INITIALIZE_ERROR - initialization of the SOAP client failed possibly because of an MSXML installation failure. | -|  0x80244002 |  WU_E_PT_SOAPCLIENT_OUTOFMEMORY |  Same as SOAPCLIENT_OUTOFMEMORY - SOAP client failed because it ran out of memory.  | -|  0x80244003 |  WU_E_PT_SOAPCLIENT_GENERATE |  Same as SOAPCLIENT_GENERATE_ERROR - SOAP client failed to generate the request. | -|  0x80244004 |  WU_E_PT_SOAPCLIENT_CONNECT |  Same as SOAPCLIENT_CONNECT_ERROR - SOAP client failed to connect to the server.  | -|  0x80244005 |  WU_E_PT_SOAPCLIENT_SEND |  Same as SOAPCLIENT_SEND_ERROR - SOAP client failed to send a message for reasons of WU_E_WINHTTP_\* error codes. | -|  0x80244006 |  WU_E_PT_SOAPCLIENT_SERVER |  Same as SOAPCLIENT_SERVER_ERROR - SOAP client failed because there was a server error.  | -|  0x80244007 |  WU_E_PT_SOAPCLIENT_SOAPFAULT |  Same as SOAPCLIENT_SOAPFAULT - SOAP client failed because there was a SOAP fault for reasons of WU_E_PT_SOAP_\* error codes. | -|  0x80244008 |  WU_E_PT_SOAPCLIENT_PARSEFAULT |  Same as SOAPCLIENT_PARSEFAULT_ERROR - SOAP client failed to parse a SOAP fault. | -|  0x80244009 |  WU_E_PT_SOAPCLIENT_READ |  Same as SOAPCLIENT_READ_ERROR - SOAP client failed while reading the response from the server. | -|  0x8024400A |  WU_E_PT_SOAPCLIENT_PARSE |  Same as SOAPCLIENT_PARSE_ERROR - SOAP client failed to parse the response from the server.  | - -## Other Protocol Talker errors -The following errors map to SOAP_ERROR_CODEs from the Atlsoap.h file. These errors are obtained from the m_fault.m_soapErrCode member of the CClientWebService object when GetClientError() returns SOAPCLIENT_SOAPFAULT. +| Error code | Message | Description | +|------------|----------------------------------|---------------------------------------------------------------------------------------------------------------------------------------| +| 0x80244000 | `WU_E_PT_SOAPCLIENT_BASE` | `WU_E_PT_SOAPCLIENT_*` error codes map to the `SOAPCLIENT_ERROR` enum of the ATL Server Library. | +| 0x80244001 | `WU_E_PT_SOAPCLIENT_INITIALIZE` | Same as `SOAPCLIENT_INITIALIZE_ERROR` - initialization of the `SOAP` client failed possibly because of an MSXML installation failure. | +| 0x80244002 | `WU_E_PT_SOAPCLIENT_OUTOFMEMORY` | Same as `SOAPCLIENT_OUTOFMEMORY` - `SOAP` client failed because it ran out of memory. | +| 0x80244003 | `WU_E_PT_SOAPCLIENT_GENERATE` | Same as `SOAPCLIENT_GENERATE_ERROR` - `SOAP` client failed to generate the request. | +| 0x80244004 | `WU_E_PT_SOAPCLIENT_CONNECT` | Same as `SOAPCLIENT_CONNECT_ERROR` - `SOAP` client failed to connect to the server. | +| 0x80244005 | `WU_E_PT_SOAPCLIENT_SEND` | Same as `SOAPCLIENT_SEND_ERROR` - `SOAP` client failed to send a message for reasons of `WU_E_WINHTTP_*` error codes. | +| 0x80244006 | `WU_E_PT_SOAPCLIENT_SERVER` | Same as `SOAPCLIENT_SERVER_ERROR` - `SOAP` client failed because there was a server error. | +| 0x80244007 | `WU_E_PT_SOAPCLIENT_SOAPFAULT` | Same as `SOAPCLIENT_SOAPFAULT` - `SOAP` client failed because there was a SOAP fault for reasons of `WU_E_PT_SOAP_*` error codes. | +| 0x80244008 | `WU_E_PT_SOAPCLIENT_PARSEFAULT` | Same as `SOAPCLIENT_PARSEFAULT_ERROR` - `SOAP` client failed to parse a `SOAP` fault. | +| 0x80244009 | `WU_E_PT_SOAPCLIENT_READ` | Same as `SOAPCLIENT_READ_ERROR` - `SOAP` client failed while reading the response from the server. | +| 0x8024400A | `WU_E_PT_SOAPCLIENT_PARSE` | Same as `SOAPCLIENT_PARSE_ERROR` - `SOAP` client failed to parse the response from the server. | + +## Other Protocol Talker errors +The following errors map to `SOAP_ERROR_CODE`s from the `Atlsoap.h` file. These errors are obtained from the `m_fault.m_soapErrCode` member of the `CClientWebService` object when `GetClientError()` returns `SOAPCLIENT_SOAPFAULT`. -| Error code | Message | Description | -|-------------|---------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -|  0x8024400B |  WU_E_PT_SOAP_VERSION |  Same as SOAP_E_VERSION_MISMATCH - SOAP client found an unrecognizable namespace for the SOAP envelope. | -|  0x8024400C |  WU_E_PT_SOAP_MUST_UNDERSTAND |  Same as SOAP_E_MUST_UNDERSTAND - SOAP client was unable to understand a header.  | -|  0x8024400D |  WU_E_PT_SOAP_CLIENT |  Same as SOAP_E_CLIENT - SOAP client found the message was malformed; fix before resending.  | -|  0x8024400E |  WU_E_PT_SOAP_SERVER |  Same as SOAP_E_SERVER - The SOAP message could not be processed due to a server error; resend later.  | -|  0x8024400F |  WU_E_PT_WMI_ERROR |  There was an unspecified Windows Management Instrumentation (WMI) error. | -|  0x80244010 |  WU_E_PT_EXCEEDED_MAX_SERVER_TRIPS |  The number of round trips to the server exceeded the maximum limit.  | -|  0x80244011 |  WU_E_PT_SUS_SERVER_NOT_SET |  WUServer policy value is missing in the registry.  | -|  0x80244012 |  WU_E_PT_DOUBLE_INITIALIZATION |  Initialization failed because the object was already initialized.  | -|  0x80244013 |  WU_E_PT_INVALID_COMPUTER_NAME |  The computer name could not be determined.  | -|  0x80244015 |  WU_E_PT_REFRESH_CACHE_REQUIRED |  The reply from the server indicates that the server was changed or the cookie was invalid; refresh the state of the internal cache and retry. | -|  0x80244016 |  WU_E_PT_HTTP_STATUS_BAD_REQUEST |  Same as HTTP status 400 - the server could not process the request due to invalid syntax.  | -|  0x80244017 |  WU_E_PT_HTTP_STATUS_DENIED |  Same as HTTP status 401 - the requested resource requires user authentication.  | -|  0x80244018 |  WU_E_PT_HTTP_STATUS_FORBIDDEN |  Same as HTTP status 403 - server understood the request but declined to fulfill it. | -|  0x80244019 |  WU_E_PT_HTTP_STATUS_NOT_FOUND |  Same as HTTP status 404 - the server cannot find the requested URI (Uniform Resource Identifier).  | -|  0x8024401A |  WU_E_PT_HTTP_STATUS_BAD_METHOD |  Same as HTTP status 405 - the HTTP method is not allowed.  | -|  0x8024401B |  WU_E_PT_HTTP_STATUS_PROXY_AUTH_REQ |  Same as HTTP status 407 - proxy authentication is required.  | -|  0x8024401C |  WU_E_PT_HTTP_STATUS_REQUEST_TIMEOUT |  Same as HTTP status 408 - the server timed out waiting for the request.  | -|  0x8024401D |  WU_E_PT_HTTP_STATUS_CONFLICT |  Same as HTTP status 409 - the request was not completed due to a conflict with the current state of the resource.  | -|  0x8024401E |  WU_E_PT_HTTP_STATUS_GONE |  Same as HTTP status 410 - requested resource is no longer available at the server. | -|  0x8024401F |  WU_E_PT_HTTP_STATUS_SERVER_ERROR |  Same as HTTP status 500 - an error internal to the server prevented fulfilling the request.  | -|  0x80244020 |  WU_E_PT_HTTP_STATUS_NOT_SUPPORTED |  Same as HTTP status 500 - server does not support the functionality required to fulfill the request.  | -|  0x80244021 |  WU_E_PT_HTTP_STATUS_BAD_GATEWAY | Same as HTTP status 502 - the server while acting as a gateway or a proxy received an invalid response from the upstream server it accessed in attempting to fulfil the request. | -|  0x80244022 |  WU_E_PT_HTTP_STATUS_SERVICE_UNAVAIL |  Same as HTTP status 503 - the service is temporarily overloaded.  | -|  0x80244023 |  WU_E_PT_HTTP_STATUS_GATEWAY_TIMEOUT |  Same as HTTP status 503 - the request was timed out waiting for a gateway.  | -|  0x80244024 |  WU_E_PT_HTTP_STATUS_VERSION_NOT_SUP |  Same as HTTP status 505 - the server does not support the HTTP protocol version used for the request.  | -|  0x80244025 |  WU_E_PT_FILE_LOCATIONS_CHANGED |  Operation failed due to a changed file location; refresh internal state and resend. | -|  0x80244026 |  WU_E_PT_REGISTRATION_NOT_SUPPORTED |  Operation failed because Windows Update Agent does not support registration with a non-WSUS server.  | -|  0x80244027 |  WU_E_PT_NO_AUTH_PLUGINS_REQUESTED |  The server returned an empty authentication information list.  | -|  0x80244028 |  WU_E_PT_NO_AUTH_COOKIES_CREATED |  Windows Update Agent was unable to create any valid authentication cookies.  | -|  0x80244029 |  WU_E_PT_INVALID_CONFIG_PROP |  A configuration property value was wrong.  | -|  0x8024402A |  WU_E_PT_CONFIG_PROP_MISSING |  A configuration property value was missing.  | -|  0x8024402B |  WU_E_PT_HTTP_STATUS_NOT_MAPPED |  The HTTP request could not be completed and the reason did not correspond to any of the WU_E_PT_HTTP_\* error codes.  | -|  0x8024402C |  WU_E_PT_WINHTTP_NAME_NOT_RESOLVED |  Same as ERROR_WINHTTP_NAME_NOT_RESOLVED - the proxy server or target server name cannot be resolved.  | -|  0x8024402F |  WU_E_PT_ECP_SUCCEEDED_WITH_ERRORS |  External cab file processing completed with some errors. | -|  0x80244030 |  WU_E_PT_ECP_INIT_FAILED |  The external cab processor initialization did not complete.  | -|  0x80244031 |  WU_E_PT_ECP_INVALID_FILE_FORMAT |  The format of a metadata file was invalid.  | -|  0x80244032 |  WU_E_PT_ECP_INVALID_METADATA |  External cab processor found invalid metadata.  | -|  0x80244033 |  WU_E_PT_ECP_FAILURE_TO_EXTRACT_DIGEST |  The file digest could not be extracted from an external cab file.  | -|  0x80244034 |  WU_E_PT_ECP_FAILURE_TO_DECOMPRESS_CAB_FILE |  An external cab file could not be decompressed.  | -|  0x80244035 |  WU_E_PT_ECP_FILE_LOCATION_ERROR |  External cab processor was unable to get file locations.  | -|  0x80244FFF |  WU_E_PT_UNEXPECTED |  A communication error not covered by another WU_E_PT_\* error code.  | -|  0x8024502D |  WU_E_PT_SAME_REDIR_ID |  Windows Update Agent failed to download a redirector cabinet file with a new redirectorId value from the server during the recovery.  | -|  0x8024502E |  WU_E_PT_NO_MANAGED_RECOVER |  A redirector recovery action did not complete because the server is managed.  | - -## Download Manager errors +| Error code | Message | Description | +|------------|----------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| 0x8024400B | `WU_E_PT_SOAP_VERSION` | Same as `SOAP_E_VERSION_MISMATCH` - `SOAP` client found an unrecognizable namespace for the `SOAP` envelope. | +| 0x8024400C | `WU_E_PT_SOAP_MUST_UNDERSTAND` | Same as `SOAP_E_MUST_UNDERSTAND` - `SOAP` client was unable to understand a header. | +| 0x8024400D | `WU_E_PT_SOAP_CLIENT` | Same as `SOAP_E_CLIENT` - `SOAP` client found the message was malformed; fix before resending. | +| 0x8024400E | `WU_E_PT_SOAP_SERVER` | Same as `SOAP_E_SERVER` - The `SOAP` message could not be processed due to a server error; resend later. | +| 0x8024400F | `WU_E_PT_WMI_ERROR` | There was an unspecified Windows Management Instrumentation (WMI) error. | +| 0x80244010 | `WU_E_PT_EXCEEDED_MAX_SERVER_TRIPS` | The number of round trips to the server exceeded the maximum limit. | +| 0x80244011 | `WU_E_PT_SUS_SERVER_NOT_SET` | WUServer policy value is missing in the registry. | +| 0x80244012 | `WU_E_PT_DOUBLE_INITIALIZATION` | Initialization failed because the object was already initialized. | +| 0x80244013 | `WU_E_PT_INVALID_COMPUTER_NAME` | The computer name could not be determined. | +| 0x80244015 | `WU_E_PT_REFRESH_CACHE_REQUIRED` | The reply from the server indicates that the server was changed or the cookie was invalid; refresh the state of the internal cache and retry. | +| 0x80244016 | `WU_E_PT_HTTP_STATUS_BAD_REQUEST` | Same as HTTP status 400 - the server could not process the request due to invalid syntax. | +| 0x80244017 | `WU_E_PT_HTTP_STATUS_DENIED` | Same as HTTP status 401 - the requested resource requires user authentication. | +| 0x80244018 | `WU_E_PT_HTTP_STATUS_FORBIDDEN` | Same as HTTP status 403 - server understood the request but declined to fulfill it. | +| 0x80244019 | `WU_E_PT_HTTP_STATUS_NOT_FOUND` | Same as HTTP status 404 - the server cannot find the requested URI (Uniform Resource Identifier). | +| 0x8024401A | `WU_E_PT_HTTP_STATUS_BAD_METHOD` | Same as HTTP status 405 - the HTTP method is not allowed. | +| 0x8024401B | `WU_E_PT_HTTP_STATUS_PROXY_AUTH_REQ` | Same as HTTP status 407 - proxy authentication is required. | +| 0x8024401C | `WU_E_PT_HTTP_STATUS_REQUEST_TIMEOUT` | Same as HTTP status 408 - the server timed out waiting for the request. | +| 0x8024401D | `WU_E_PT_HTTP_STATUS_CONFLICT` | Same as HTTP status 409 - the request was not completed due to a conflict with the current state of the resource. | +| 0x8024401E | `WU_E_PT_HTTP_STATUS_GONE` | Same as HTTP status 410 - requested resource is no longer available at the server. | +| 0x8024401F | `WU_E_PT_HTTP_STATUS_SERVER_ERROR` | Same as HTTP status 500 - an error internal to the server prevented fulfilling the request. | +| 0x80244020 | `WU_E_PT_HTTP_STATUS_NOT_SUPPORTED` | Same as HTTP status 500 - server does not support the functionality required to fulfill the request. | +| 0x80244021 | `WU_E_PT_HTTP_STATUS_BAD_GATEWAY` | Same as HTTP status 502 - the server while acting as a gateway or a proxy received an invalid response from the upstream server it accessed in attempting to fulfill the request. | +| 0x80244022 | `WU_E_PT_HTTP_STATUS_SERVICE_UNAVAIL` | Same as HTTP status 503 - the service is temporarily overloaded. | +| 0x80244023 | `WU_E_PT_HTTP_STATUS_GATEWAY_TIMEOUT` | Same as HTTP status 503 - the request was timed out waiting for a gateway. | +| 0x80244024 | `WU_E_PT_HTTP_STATUS_VERSION_NOT_SUP` | Same as HTTP status 505 - the server does not support the HTTP protocol version used for the request. | +| 0x80244025 | `WU_E_PT_FILE_LOCATIONS_CHANGED` | Operation failed due to a changed file location; refresh internal state and resend. | +| 0x80244026 | `WU_E_PT_REGISTRATION_NOT_SUPPORTED` | Operation failed because Windows Update Agent does not support registration with a non-WSUS server. | +| 0x80244027 | `WU_E_PT_NO_AUTH_PLUGINS_REQUESTED` | The server returned an empty authentication information list. | +| 0x80244028 | `WU_E_PT_NO_AUTH_COOKIES_CREATED` | Windows Update Agent was unable to create any valid authentication cookies. | +| 0x80244029 | `WU_E_PT_INVALID_CONFIG_PROP` | A configuration property value was wrong. | +| 0x8024402A | `WU_E_PT_CONFIG_PROP_MISSING` | A configuration property value was missing. | +| 0x8024402B | `WU_E_PT_HTTP_STATUS_NOT_MAPPED` | The HTTP request could not be completed and the reason did not correspond to any of the `WU_E_PT_HTTP_*` error codes. | +| 0x8024402C | `WU_E_PT_WINHTTP_NAME_NOT_RESOLVED` | Same as ERROR_WINHTTP_NAME_NOT_RESOLVED - the proxy server or target server name cannot be resolved. | +| 0x8024402F | `WU_E_PT_ECP_SUCCEEDED_WITH_ERRORS` | External cab file processing completed with some errors. | +| 0x80244030 | `WU_E_PT_ECP_INIT_FAILED` | The external cab processor initialization did not complete. | +| 0x80244031 | `WU_E_PT_ECP_INVALID_FILE_FORMAT` | The format of a metadata file was invalid. | +| 0x80244032 | `WU_E_PT_ECP_INVALID_METADATA` | External cab processor found invalid metadata. | +| 0x80244033 | `WU_E_PT_ECP_FAILURE_TO_EXTRACT_DIGEST` | The file digest could not be extracted from an external cab file. | +| 0x80244034 | `WU_E_PT_ECP_FAILURE_TO_DECOMPRESS_CAB_FILE` | An external cab file could not be decompressed. | +| 0x80244035 | `WU_E_PT_ECP_FILE_LOCATION_ERROR` | External cab processor was unable to get file locations. | +| 0x80244FFF | `WU_E_PT_UNEXPECTED` | A communication error not covered by another `WU_E_PT_*` error code. | +| 0x8024502D | `WU_E_PT_SAME_REDIR_ID` | Windows Update Agent failed to download a redirector cabinet file with a new redirectorId value from the server during the recovery. | +| 0x8024502E | `WU_E_PT_NO_MANAGED_RECOVER` | A redirector recovery action did not complete because the server is managed. | -| Error code | Message | Description | -|-------------|----------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------| -|  0x80246001 |  WU_E_DM_URLNOTAVAILABLE |  A download manager operation could not be completed because the requested file does not have a URL.  | -|  0x80246002 |  WU_E_DM_INCORRECTFILEHASH |  A download manager operation could not be completed because the file digest was not recognized.  | -|  0x80246003 |  WU_E_DM_UNKNOWNALGORITHM |  A download manager operation could not be completed because the file metadata requested an unrecognized hash algorithm.  | -|  0x80246004 |  WU_E_DM_NEEDDOWNLOADREQUEST |  An operation could not be completed because a download request is required from the download handler.  | -|  0x80246005 |  WU_E_DM_NONETWORK |  A download manager operation could not be completed because the network connection was unavailable.  | -|  0x80246006 |  WU_E_DM_WRONGBITSVERSION |  A download manager operation could not be completed because the version of Background Intelligent Transfer Service (BITS) is incompatible. | -|  0x80246007 |  WU_E_DM_NOTDOWNLOADED |  The update has not been downloaded.  | -|  0x80246008 |  WU_E_DM_FAILTOCONNECTTOBITS |  A download manager operation failed because the download manager was unable to connect the Background Intelligent Transfer Service (BITS). | -|  0x80246009 | WU_E_DM_BITSTRANSFERERROR |  A download manager operation failed because there was an unspecified Background Intelligent Transfer Service (BITS) transfer error.  | -|  0x8024600A |  WU_E_DM_DOWNLOADLOCATIONCHANGED |  A download must be restarted because the location of the source of the download has changed. | -|  0x8024600B |  WU_E_DM_CONTENTCHANGED |  A download must be restarted because the update content changed in a new revision.  | -|  0x80246FFF |  WU_E_DM_UNEXPECTED |  There was a download manager error not covered by another WU_E_DM_\* error code.  | - -## Update Handler errors +## Download Manager errors -| Error code | Message | Description | -|-------------|---------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------| -|  0x80242000 |  WU_E_UH_REMOTEUNAVAILABLE | 9 A request for a remote update handler could not be completed because no remote process is available.  | -|  0x80242001 |  WU_E_UH_LOCALONLY |  A request for a remote update handler could not be completed because the handler is local only.  | -|  0x80242002 |  WU_E_UH_UNKNOWNHANDLER |  A request for an update handler could not be completed because the handler could not be recognized.  | -|  0x80242003 |  WU_E_UH_REMOTEALREADYACTIVE |  A remote update handler could not be created because one already exists.  | -|  0x80242004 |  WU_E_UH_DOESNOTSUPPORTACTION |  A request for the handler to install (uninstall) an update could not be completed because the update does not support install (uninstall). | -|  0x80242005 |  WU_E_UH_WRONGHANDLER |  An operation did not complete because the wrong handler was specified.  | -|  0x80242006 |  WU_E_UH_INVALIDMETADATA |  A handler operation could not be completed because the update contains invalid metadata.  | -|  0x80242007 |  WU_E_UH_INSTALLERHUNG |  An operation could not be completed because the installer exceeded the time limit.  | -|  0x80242008 |  WU_E_UH_OPERATIONCANCELLED |  An operation being done by the update handler was cancelled.  | -|  0x80242009 |  WU_E_UH_BADHANDLERXML |  An operation could not be completed because the handler-specific metadata is invalid.  | -| 0x8024200A |  WU_E_UH_CANREQUIREINPUT |  A request to the handler to install an update could not be completed because the update requires user input.  | -|  0x8024200B |  WU_E_UH_INSTALLERFAILURE |  The installer failed to install (uninstall) one or more updates.  | -|  0x8024200C |  WU_E_UH_FALLBACKTOSELFCONTAINED |  The update handler should download self-contained content rather than delta-compressed content for the update.  | -|  0x8024200D |  WU_E_UH_NEEDANOTHERDOWNLOAD |  The update handler did not install the update because it needs to be downloaded again.  | -|  0x8024200E |  WU_E_UH_NOTIFYFAILURE |  The update handler failed to send notification of the status of the install (uninstall) operation.  | -|  0x8024200F | WU_E_UH_INCONSISTENT_FILE_NAMES |  The file names contained in the update metadata and in the update package are inconsistent.  | -|  0x80242010 |  WU_E_UH_FALLBACKERROR |  The update handler failed to fall back to the self-contained content.  | -|  0x80242011 |  WU_E_UH_TOOMANYDOWNLOADREQUESTS |  The update handler has exceeded the maximum number of download requests.  | -|  0x80242012 |  WU_E_UH_UNEXPECTEDCBSRESPONSE |  The update handler has received an unexpected response from CBS.  | -|  0x80242013 |  WU_E_UH_BADCBSPACKAGEID |  The update metadata contains an invalid CBS package identifier.  | -|  0x80242014 |  WU_E_UH_POSTREBOOTSTILLPENDING |  The post-reboot operation for the update is still in progress.  | -|  0x80242015 |  WU_E_UH_POSTREBOOTRESULTUNKNOWN |  The result of the post-reboot operation for the update could not be determined.  | -|  0x80242016 |  WU_E_UH_POSTREBOOTUNEXPECTEDSTATE |  The state of the update after its post-reboot operation has completed is unexpected.  | -|  0x80242017 |  WU_E_UH_NEW_SERVICING_STACK_REQUIRED |  The OS servicing stack must be updated before this update is downloaded or installed.  | -|  0x80242FFF |  WU_E_UH_UNEXPECTED |  An update handler error not covered by another WU_E_UH_\* code.  | - -## Data Store errors +| Error code | Message | Description | +|------------|-----------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------| +| 0x80246001 | `WU_E_DM_URLNOTAVAILABLE` | A download manager operation could not be completed because the requested file does not have a URL. | +| 0x80246002 | `WU_E_DM_INCORRECTFILEHASH` | A download manager operation could not be completed because the file digest was not recognized. | +| 0x80246003 | `WU_E_DM_UNKNOWNALGORITHM` | A download manager operation could not be completed because the file metadata requested an unrecognized hash algorithm. | +| 0x80246004 | `WU_E_DM_NEEDDOWNLOADREQUEST` | An operation could not be completed because a download request is required from the download handler. | +| 0x80246005 | `WU_E_DM_NONETWORK` | A download manager operation could not be completed because the network connection was unavailable. | +| 0x80246006 | `WU_E_DM_WRONGBITSVERSION` | A download manager operation could not be completed because the version of Background Intelligent Transfer Service (BITS) is incompatible. | +| 0x80246007 | `WU_E_DM_NOTDOWNLOADED` | The update has not been downloaded. | +| 0x80246008 | `WU_E_DM_FAILTOCONNECTTOBITS` | A download manager operation failed because the download manager was unable to connect the Background Intelligent Transfer Service (BITS). | +| 0x80246009 | `WU_E_DM_BITSTRANSFERERROR` | A download manager operation failed because there was an unspecified Background Intelligent Transfer Service (BITS) transfer error. | +| 0x8024600A | `WU_E_DM_DOWNLOADLOCATIONCHANGED` | A download must be restarted because the location of the source of the download has changed. | +| 0x8024600B | `WU_E_DM_CONTENTCHANGED` | A download must be restarted because the update content changed in a new revision. | +| 0x80246FFF | `WU_E_DM_UNEXPECTED` | There was a download manager error not covered by another `WU_E_DM_*` error code. | -| Error code | Message | Description | -|-------------|-------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -|  0x80248000 |  WU_E_DS_SHUTDOWN |  An operation failed because Windows Update Agent is shutting down.  | -|  0x80248001 |  WU_E_DS_INUSE |  An operation failed because the data store was in use. | -|  0x80248002 |  WU_E_DS_INVALID |  The current and expected states of the data store do not match. | -|  0x80248003 |  WU_E_DS_TABLEMISSING |  The data store is missing a table.  | -|  0x80248004 |  WU_E_DS_TABLEINCORRECT |  The data store contains a table with unexpected columns.  | -|  0x80248005 |  WU_E_DS_INVALIDTABLENAME |  A table could not be opened because the table is not in the data store.  | -|  0x80248006 |  WU_E_DS_BADVERSION |  The current and expected versions of the data store do not match.  | -|  0x80248007 |  WU_E_DS_NODATA |  The information requested is not in the data store.  | -|  0x80248008 |  WU_E_DS_MISSINGDATA |  The data store is missing required information or has a NULL in a table column that requires a non-null value.  | -|  0x80248009 |  WU_E_DS_MISSINGREF |  The data store is missing required information or has a reference to missing license terms file localized property or linked row. | -|  0x8024800A |  WU_E_DS_UNKNOWNHANDLER |  The update was not processed because its update handler could not be recognized.  | -|  0x8024800B |  WU_E_DS_CANTDELETE |  The update was not deleted because it is still referenced by one or more services.  | -|  0x8024800C |  WU_E_DS_LOCKTIMEOUTEXPIRED |  The data store section could not be locked within the allotted time.  | -|  0x8024800D |  WU_E_DS_NOCATEGORIES |  The category was not added because it contains no parent categories and is not a top-level category itself.  | -|  0x8024800E |  WU_E_DS_ROWEXISTS |  The row was not added because an existing row has the same primary key.  | -|  0x8024800F |  WU_E_DS_STOREFILELOCKED |  The data store could not be initialized because it was locked by another process.  | -|  0x80248010 |  WU_E_DS_CANNOTREGISTER |  The data store is not allowed to be registered with COM in the current process.  | -|  0x80248011 | WU_E_DS_UNABLETOSTART |  Could not create a data store object in another process.  | -|  0x80248013 |  WU_E_DS_DUPLICATEUPDATEID | The server sent the same update to the client with two different revision IDs.  | -|  0x80248014 | WU_E_DS_UNKNOWNSERVICE |  An operation did not complete because the service is not in the data store.  | -| 0x80248015 | WU_E_DS_SERVICEEXPIRED | An operation did not complete because the registration of the service has expired.  | -| 0x80248016 |  WU_E_DS_DECLINENOTALLOWED |  A request to hide an update was declined because it is a mandatory update or because it was deployed with a deadline.  | -| 0x80248017 |  WU_E_DS_TABLESESSIONMISMATCH |  A table was not closed because it is not associated with the session.  | -| 0x80248018 |  WU_E_DS_SESSIONLOCKMISMATCH |  A table was not closed because it is not associated with the session.  | -| 0x80248019 |  WU_E_DS_NEEDWINDOWSSERVICE |  A request to remove the Windows Update service or to unregister it with Automatic Updates was declined because it is a built-in service and/or Automatic Updates cannot fall back to another service.  | -| 0x8024801A |  WU_E_DS_INVALIDOPERATION |  A request was declined because the operation is not allowed.  | -| 0x8024801B |  WU_E_DS_SCHEMAMISMATCH |  The schema of the current data store and the schema of a table in a backup XML document do not match.  | -| 0x8024801C |  WU_E_DS_RESETREQUIRED |  The data store requires a session reset; release the session and retry with a new session.  | -| 0x8024801D |  WU_E_DS_IMPERSONATED |  A data store operation did not complete because it was requested with an impersonated identity.  | -| 0x80248FFF |  WU_E_DS_UNEXPECTED |  A data store error not covered by another WU_E_DS_\* code.  | - -## Driver Util errors +## Update Handler errors + +| Error code | Message | Description | +|------------|----------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------| +| 0x80242000 | `WU_E_UH_REMOTEUNAVAILABLE` | A request for a remote update handler could not be completed because no remote process is available. | +| 0x80242001 | `WU_E_UH_LOCALONLY` | A request for a remote update handler could not be completed because the handler is local only. | +| 0x80242002 | `WU_E_UH_UNKNOWNHANDLER` | A request for an update handler could not be completed because the handler could not be recognized. | +| 0x80242003 | `WU_E_UH_REMOTEALREADYACTIVE` | A remote update handler could not be created because one already exists. | +| 0x80242004 | `WU_E_UH_DOESNOTSUPPORTACTION` | A request for the handler to install (uninstall) an update could not be completed because the update does not support install (uninstall). | +| 0x80242005 | `WU_E_UH_WRONGHANDLER` | An operation did not complete because the wrong handler was specified. | +| 0x80242006 | `WU_E_UH_INVALIDMETADATA` | A handler operation could not be completed because the update contains invalid metadata. | +| 0x80242007 | `WU_E_UH_INSTALLERHUNG` | An operation could not be completed because the installer exceeded the time limit. | +| 0x80242008 | `WU_E_UH_OPERATIONCANCELLED` | An operation being done by the update handler was canceled. | +| 0x80242009 | `WU_E_UH_BADHANDLERXML` | An operation could not be completed because the handler-specific metadata is invalid. | +| 0x8024200A | `WU_E_UH_CANREQUIREINPUT` | A request to the handler to install an update could not be completed because the update requires user input. | +| 0x8024200B | `WU_E_UH_INSTALLERFAILURE` | The installer failed to install (uninstall) one or more updates. | +| 0x8024200C | `WU_E_UH_FALLBACKTOSELFCONTAINED` | The update handler should download self-contained content rather than delta-compressed content for the update. | +| 0x8024200D | `WU_E_UH_NEEDANOTHERDOWNLOAD` | The update handler did not install the update because it needs to be downloaded again. | +| 0x8024200E | `WU_E_UH_NOTIFYFAILURE` | The update handler failed to send notification of the status of the install (uninstall) operation. | +| 0x8024200F | `WU_E_UH_INCONSISTENT_FILE_NAMES` | The file names contained in the update metadata and in the update package are inconsistent. | +| 0x80242010 | `WU_E_UH_FALLBACKERROR` | The update handler failed to fall back to the self-contained content. | +| 0x80242011 | `WU_E_UH_TOOMANYDOWNLOADREQUESTS` | The update handler has exceeded the maximum number of download requests. | +| 0x80242012 | `WU_E_UH_UNEXPECTEDCBSRESPONSE` | The update handler has received an unexpected response from CBS. | +| 0x80242013 | `WU_E_UH_BADCBSPACKAGEID` | The update metadata contains an invalid CBS package identifier. | +| 0x80242014 | `WU_E_UH_POSTREBOOTSTILLPENDING` | The post-reboot operation for the update is still in progress. | +| 0x80242015 | `WU_E_UH_POSTREBOOTRESULTUNKNOWN` | The result of the post-reboot operation for the update could not be determined. | +| 0x80242016 | `WU_E_UH_POSTREBOOTUNEXPECTEDSTATE` | The state of the update after its post-reboot operation has completed is unexpected. | +| 0x80242017 | `WU_E_UH_NEW_SERVICING_STACK_REQUIRED` | The OS servicing stack must be updated before this update is downloaded or installed. | +| 0x80242FFF | `WU_E_UH_UNEXPECTED` | An update handler error not covered by another `WU_E_UH_*` code. | + +## Data Store errors + +| Error code | Message | Description | +|------------|--------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| 0x80248000 | `WU_E_DS_SHUTDOWN` | An operation failed because Windows Update Agent is shutting down. | +| 0x80248001 | `WU_E_DS_INUSE` | An operation failed because the data store was in use. | +| 0x80248002 | `WU_E_DS_INVALID` | The current and expected states of the data store do not match. | +| 0x80248003 | `WU_E_DS_TABLEMISSING` | The data store is missing a table. | +| 0x80248004 | `WU_E_DS_TABLEINCORRECT` | The data store contains a table with unexpected columns. | +| 0x80248005 | `WU_E_DS_INVALIDTABLENAME` | A table could not be opened because the table is not in the data store. | +| 0x80248006 | `WU_E_DS_BADVERSION` | The current and expected versions of the data store do not match. | +| 0x80248007 | `WU_E_DS_NODATA` | The information requested is not in the data store. | +| 0x80248008 | `WU_E_DS_MISSINGDATA` | The data store is missing required information or has a NULL in a table column that requires a non-null value. | +| 0x80248009 | `WU_E_DS_MISSINGREF` | The data store is missing required information or has a reference to missing license terms file localized property or linked row. | +| 0x8024800A | `WU_E_DS_UNKNOWNHANDLER` | The update was not processed because its update handler could not be recognized. | +| 0x8024800B | `WU_E_DS_CANTDELETE` | The update was not deleted because it is still referenced by one or more services. | +| 0x8024800C | `WU_E_DS_LOCKTIMEOUTEXPIRED` | The data store section could not be locked within the allotted time. | +| 0x8024800D | `WU_E_DS_NOCATEGORIES` | The category was not added because it contains no parent categories and is not a top-level category itself. | +| 0x8024800E | `WU_E_DS_ROWEXISTS` | The row was not added because an existing row has the same primary key. | +| 0x8024800F | `WU_E_DS_STOREFILELOCKED` | The data store could not be initialized because it was locked by another process. | +| 0x80248010 | `WU_E_DS_CANNOTREGISTER` | The data store is not allowed to be registered with COM in the current process. | +| 0x80248011 | `WU_E_DS_UNABLETOSTART` | Could not create a data store object in another process. | +| 0x80248013 | `WU_E_DS_DUPLICATEUPDATEID` | The server sent the same update to the client with two different revision IDs. | +| 0x80248014 | `WU_E_DS_UNKNOWNSERVICE` | An operation did not complete because the service is not in the data store. | +| 0x80248015 | `WU_E_DS_SERVICEEXPIRED` | An operation did not complete because the registration of the service has expired. | +| 0x80248016 | `WU_E_DS_DECLINENOTALLOWED` | A request to hide an update was declined because it is a mandatory update or because it was deployed with a deadline. | +| 0x80248017 | `WU_E_DS_TABLESESSIONMISMATCH` | A table was not closed because it is not associated with the session. | +| 0x80248018 | `WU_E_DS_SESSIONLOCKMISMATCH` | A table was not closed because it is not associated with the session. | +| 0x80248019 | `WU_E_DS_NEEDWINDOWSSERVICE` | A request to remove the Windows Update service or to unregister it with Automatic Updates was declined because it is a built-in service and/or Automatic Updates cannot fall back to another service. | +| 0x8024801A | `WU_E_DS_INVALIDOPERATION` | A request was declined because the operation is not allowed. | +| 0x8024801B | `WU_E_DS_SCHEMAMISMATCH` | The schema of the current data store and the schema of a table in a backup XML document do not match. | +| 0x8024801C | `WU_E_DS_RESETREQUIRED` | The data store requires a session reset; release the session and retry with a new session. | +| 0x8024801D | `WU_E_DS_IMPERSONATED` | A data store operation did not complete because it was requested with an impersonated identity. | +| 0x80248FFF | `WU_E_DS_UNEXPECTED` | A data store error not covered by another `WU_E_DS_*` code. | + +## Driver Util errors The PnP enumerated device is removed from the System Spec because one of the hardware IDs or the compatible IDs matches an installed printer driver. This is not a fatal error, and the device is merely skipped. -|Error code|Message|Description -|-|-|-| -| 0x8024C001 | WU_E_DRV_PRUNED| A driver was skipped.  -| 0x8024C002 |WU_E_DRV_NOPROP_OR_LEGACY| A property for the driver could not be found. It may not conform with required specifications.  -| 0x8024C003 | WU_E_DRV_REG_MISMATCH| The registry type read for the driver does not match the expected type.  -| 0x8024C004 | WU_E_DRV_NO_METADATA| The driver update is missing metadata.  -| 0x8024C005 | WU_E_DRV_MISSING_ATTRIBUTE| The driver update is missing a required attribute.  -| 0x8024C006| WU_E_DRV_SYNC_FAILED| Driver synchronization failed.  -| 0x8024C007 | WU_E_DRV_NO_PRINTER_CONTENT| Information required for the synchronization of applicable printers is missing.  -| 0x8024CFFF | WU_E_DRV_UNEXPECTED| A driver error not covered by another WU_E_DRV_* code.  - -## Windows Update error codes +| Error code | Message | Description | +|------------|-------------------------------|------------------------------------------------------------------------------------------------| +| 0x8024C001 | `WU_E_DRV_PRUNED` | A driver was skipped. | +| 0x8024C002 | `WU_E_DRV_NOPROP_OR_LEGACY` | A property for the driver could not be found. It may not conform with required specifications. | +| 0x8024C003 | `WU_E_DRV_REG_MISMATCH` | The registry type read for the driver does not match the expected type. | +| 0x8024C004 | `WU_E_DRV_NO_METADATA` | The driver update is missing metadata. | +| 0x8024C005 | `WU_E_DRV_MISSING_ATTRIBUTE` | The driver update is missing a required attribute. | +| 0x8024C006 | `WU_E_DRV_SYNC_FAILED` | Driver synchronization failed. | +| 0x8024C007 | `WU_E_DRV_NO_PRINTER_CONTENT` | Information required for the synchronization of applicable printers is missing. | +| 0x8024CFFF | `WU_E_DRV_UNEXPECTED` | A driver error not covered by another `WU_E_DRV_*` code. | -|Error code|Message|Description -|-|-|-| -| 0x80240001 | WU_E_NO_SERVICE| Windows Update Agent was unable to provide the service.  -| 0x80240002 | WU_E_MAX_CAPACITY_REACHED | The maximum capacity of the service was exceeded.  -| 0x80240003 | WU_E_UNKNOWN_ID| An ID cannot be found.  -| 0x80240004 | WU_E_NOT_INITIALIZED| The object could not be initialized.  -| 0x80240005 | WU_E_RANGEOVERLAP |The update handler requested a byte range overlapping a previously requested range.  -| 0x80240006 | WU_E_TOOMANYRANGES| The requested number of byte ranges exceeds the maximum number (2^31 - 1).  -| 0x80240007 | WU_E_INVALIDINDEX| The index to a collection was invalid.  -| 0x80240008 | WU_E_ITEMNOTFOUND| The key for the item queried could not be found.  -| 0x80240009 | WU_E_OPERATIONINPROGRESS| Another conflicting operation was in progress. Some operations such as installation cannot be performed twice simultaneously.  -| 0x8024000A | WU_E_COULDNOTCANCEL| Cancellation of the operation was not allowed.  -| 0x8024000B | WU_E_CALL_CANCELLED| Operation was cancelled.  -| 0x8024000C | WU_E_NOOP| No operation was required.  -| 0x8024000D | WU_E_XML_MISSINGDATA| Windows Update Agent could not find required information in the update's XML data.  -| 0x8024000E | WU_E_XML_INVALID| Windows Update Agent found invalid information in the update's XML data.  -| 0x8024000F | WU_E_CYCLE_DETECTED | Circular update relationships were detected in the metadata.  -| 0x80240010 | WU_E_TOO_DEEP_RELATION| Update relationships too deep to evaluate were evaluated.  -| 0x80240011 | WU_E_INVALID_RELATIONSHIP| An invalid update relationship was detected.  -| 0x80240012 | WU_E_REG_VALUE_INVALID| An invalid registry value was read.  -| 0x80240013 | WU_E_DUPLICATE_ITEM| Operation tried to add a duplicate item to a list.  -| 0x80240016 | WU_E_INSTALL_NOT_ALLOWED| Operation tried to install while another installation was in progress or the system was pending a mandatory restart.  -| 0x80240017 | WU_E_NOT_APPLICABLE| Operation was not performed because there are no applicable updates.  -| 0x80240018 | WU_E_NO_USERTOKEN| Operation failed because a required user token is missing.  -| 0x80240019 | WU_E_EXCLUSIVE_INSTALL_CONFLICT| An exclusive update cannot be installed with other updates at the same time.  -| 0x8024001A | WU_E_POLICY_NOT_SET | A policy value was not set.  -| 0x8024001B | WU_E_SELFUPDATE_IN_PROGRESS| The operation could not be performed because the Windows Update Agent is self-updating.  -| 0x8024001D | WU_E_INVALID_UPDATE| An update contains invalid metadata.  -| 0x8024001E | WU_E_SERVICE_STOP| Operation did not complete because the service or system was being shut down.  -| 0x8024001F | WU_E_NO_CONNECTION| Operation did not complete because the network connection was unavailable.  -| 0x80240020 | WU_E_NO_INTERACTIVE_USER| Operation did not complete because there is no logged-on interactive user.  -| 0x80240021 | WU_E_TIME_OUT| Operation did not complete because it timed out.  -| 0x80240022 | WU_E_ALL_UPDATES_FAILED| Operation failed for all the updates.  -| 0x80240023 | WU_E_EULAS_DECLINED| The license terms for all updates were declined.  -| 0x80240024 | WU_E_NO_UPDATE| There are no updates.  -| 0x80240025 | WU_E_USER_ACCESS_DISABLED| Group Policy settings prevented access to Windows Update.  -| 0x80240026 | WU_E_INVALID_UPDATE_TYPE| The type of update is invalid.  -| 0x80240027 | WU_E_URL_TOO_LONG| The URL exceeded the maximum length.  -| 0x80240028 | WU_E_UNINSTALL_NOT_ALLOWED| The update could not be uninstalled because the request did not originate from a WSUS server.  -| 0x80240029 | WU_E_INVALID_PRODUCT_LICENSE| Search may have missed some updates before there is an unlicensed application on the system.  -| 0x8024002A | WU_E_MISSING_HANDLER| A component required to detect applicable updates was missing.  -| 0x8024002B | WU_E_LEGACYSERVER| An operation did not complete because it requires a newer version of server.  -| 0x8024002C | WU_E_BIN_SOURCE_ABSENT| A delta-compressed update could not be installed because it required the source.  -| 0x8024002D | WU_E_SOURCE_ABSENT| A full-file update could not be installed because it required the source.  -| 0x8024002E | WU_E_WU_DISABLED| Access to an unmanaged server is not allowed.  -| 0x8024002F | WU_E_CALL_CANCELLED_BY_POLICY| Operation did not complete because the DisableWindowsUpdateAccess policy was set.  -| 0x80240030 | WU_E_INVALID_PROXY_SERVER| The format of the proxy list was invalid.  -| 0x80240031 | WU_E_INVALID_FILE| The file is in the wrong format.  -| 0x80240032 | WU_E_INVALID_CRITERIA| The search criteria string was invalid.  -| 0x80240033 | WU_E_EULA_UNAVAILABLE| License terms could not be downloaded.  -| 0x80240034 | WU_E_DOWNLOAD_FAILED| Update failed to download.  -| 0x80240035 | WU_E_UPDATE_NOT_PROCESSED| The update was not processed.  -| 0x80240036 | WU_E_INVALID_OPERATION| The object's current state did not allow the operation.  -| 0x80240037 | WU_E_NOT_SUPPORTED| The functionality for the operation is not supported.  -| 0x80240038 | WU_E_WINHTTP_INVALID_FILE| The downloaded file has an unexpected content type.  -| 0x80240039 | WU_E_TOO_MANY_RESYNC| Agent is asked by server to resync too many times.  -| 0x80240040 | WU_E_NO_SERVER_CORE_SUPPORT| WUA API method does not run on Server Core installation.  -| 0x80240041 | WU_E_SYSPREP_IN_PROGRESS| Service is not available while sysprep is running.  -| 0x80240042 | WU_E_UNKNOWN_SERVICE| The update service is no longer registered with AU.  -| 0x80240043 | WU_E_NO_UI_SUPPORT| There is no support for WUA UI.  -| 0x80240FFF | WU_E_UNEXPECTED| An operation failed due to reasons not covered by another error code.  - -## Windows Update success codes +## Windows Update error codes -|Error code|Message|Description -|-|-|-| -| 0x00240001| WU_S_SERVICE_STOP| Windows Update Agent was stopped successfully.  -| 0x00240002 | WU_S_SELFUPDATE| Windows Update Agent updated itself.  -| 0x00240003 | WU_S_UPDATE_ERROR| Operation completed successfully but there were errors applying the updates.  -| 0x00240004 | WU_S_MARKED_FOR_DISCONNECT| A callback was marked to be disconnected later because the request to disconnect the operation came while a callback was executing.  -| 0x00240005 | WU_S_REBOOT_REQUIRED| The system must be restarted to complete installation of the update.  -| 0x00240006 | WU_S_ALREADY_INSTALLED| The update to be installed is already installed on the system.  -| 0x00240007 | WU_S_ALREADY_UNINSTALLED | The update to be removed is not installed on the system.  -| 0x00240008 | WU_S_ALREADY_DOWNLOADED| The update to be downloaded has already been downloaded.  - -## Windows Installer minor errors +| Error code | Message | Description | +|------------|-----------------------------------|--------------------------------------------------------------| +| 0x80240001 | `WU_E_NO_SERVICE` | Windows Update Agent was unable to provide the service. +| 0x80240002 | `WU_E_MAX_CAPACITY_REACHED` | The maximum capacity of the service was exceeded. +| 0x80240003 | `WU_E_UNKNOWN_ID` | An ID cannot be found. +| 0x80240004 | `WU_E_NOT_INITIALIZED` | The object could not be initialized. +| 0x80240005 | `WU_E_RANGEOVERLAP` | The update handler requested a byte range overlapping a previously requested range. +| 0x80240006 | `WU_E_TOOMANYRANGES` | The requested number of byte ranges exceeds the maximum number (2^31 - 1). +| 0x80240007 | `WU_E_INVALIDINDEX` | The index to a collection was invalid. +| 0x80240008 | `WU_E_ITEMNOTFOUND` | The key for the item queried could not be found. +| 0x80240009 | `WU_E_OPERATIONINPROGRESS` | Another conflicting operation was in progress. Some operations such as installation cannot be performed twice simultaneously. +| 0x8024000A | `WU_E_COULDNOTCANCEL` | Cancellation of the operation was not allowed. +| 0x8024000B | `WU_E_CALL_CANCELLED` | Operation was canceled. +| 0x8024000C | `WU_E_NOOP` | No operation was required. +| 0x8024000D | `WU_E_XML_MISSINGDATA` | Windows Update Agent could not find required information in the update's XML data. +| 0x8024000E | `WU_E_XML_INVALID` | Windows Update Agent found invalid information in the update's XML data. +| 0x8024000F | `WU_E_CYCLE_DETECTED` | Circular update relationships were detected in the metadata. +| 0x80240010 | `WU_E_TOO_DEEP_RELATION` | Update relationships too deep to evaluate were evaluated. +| 0x80240011 | `WU_E_INVALID_RELATIONSHIP` | An invalid update relationship was detected. +| 0x80240012 | `WU_E_REG_VALUE_INVALID` | An invalid registry value was read. +| 0x80240013 | `WU_E_DUPLICATE_ITEM` | Operation tried to add a duplicate item to a list. +| 0x80240016 | `WU_E_INSTALL_NOT_ALLOWED` | Operation tried to install while another installation was in progress or the system was pending a mandatory restart. +| 0x80240017 | `WU_E_NOT_APPLICABLE` | Operation was not performed because there are no applicable updates. +| 0x80240018 | `WU_E_NO_USERTOKEN` | Operation failed because a required user token is missing. +| 0x80240019 | `WU_E_EXCLUSIVE_INSTALL_CONFLICT` | An exclusive update cannot be installed with other updates at the same time. +| 0x8024001A | `WU_E_POLICY_NOT_SET` | A policy value was not set. +| 0x8024001B | `WU_E_SELFUPDATE_IN_PROGRESS` | The operation could not be performed because the Windows Update Agent is self-updating. +| 0x8024001D | `WU_E_INVALID_UPDATE` | An update contains invalid metadata. +| 0x8024001E | `WU_E_SERVICE_STOP` | Operation did not complete because the service or system was being shut down. +| 0x8024001F | `WU_E_NO_CONNECTION` | Operation did not complete because the network connection was unavailable. +| 0x80240020 | `WU_E_NO_INTERACTIVE_USER` | Operation did not complete because there is no logged-on interactive user. +| 0x80240021 | `WU_E_TIME_OUT` | Operation did not complete because it timed out. +| 0x80240022 | `WU_E_ALL_UPDATES_FAILED` | Operation failed for all the updates. +| 0x80240023 | `WU_E_EULAS_DECLINED` | The license terms for all updates were declined. +| 0x80240024 | `WU_E_NO_UPDATE` | There are no updates. +| 0x80240025 | `WU_E_USER_ACCESS_DISABLED` | Group Policy settings prevented access to Windows Update. +| 0x80240026 | `WU_E_INVALID_UPDATE_TYPE` | The type of update is invalid. +| 0x80240027 | `WU_E_URL_TOO_LONG` | The URL exceeded the maximum length. +| 0x80240028 | `WU_E_UNINSTALL_NOT_ALLOWED` | The update could not be uninstalled because the request did not originate from a WSUS server. +| 0x80240029 | `WU_E_INVALID_PRODUCT_LICENSE` | Search may have missed some updates before there is an unlicensed application on the system. +| 0x8024002A | `WU_E_MISSING_HANDLER` | A component required to detect applicable updates was missing. +| 0x8024002B | `WU_E_LEGACYSERVER` | An operation did not complete because it requires a newer version of server. +| 0x8024002C | `WU_E_BIN_SOURCE_ABSENT` | A delta-compressed update could not be installed because it required the source. +| 0x8024002D | `WU_E_SOURCE_ABSENT` | A full-file update could not be installed because it required the source. +| 0x8024002E | `WU_E_WU_DISABLED` | Access to an unmanaged server is not allowed. +| 0x8024002F | `WU_E_CALL_CANCELLED_BY_POLICY` | Operation did not complete because the DisableWindowsUpdateAccess policy was set. +| 0x80240030 | `WU_E_INVALID_PROXY_SERVER` | The format of the proxy list was invalid. +| 0x80240031 | `WU_E_INVALID_FILE` | The file is in the wrong format. +| 0x80240032 | `WU_E_INVALID_CRITERIA` | The search criteria string was invalid. +| 0x80240033 | `WU_E_EULA_UNAVAILABLE` | License terms could not be downloaded. +| 0x80240034 | `WU_E_DOWNLOAD_FAILED` | Update failed to download. +| 0x80240035 | `WU_E_UPDATE_NOT_PROCESSED` | The update was not processed. +| 0x80240036 | `WU_E_INVALID_OPERATION` | The object's current state did not allow the operation. +| 0x80240037 | `WU_E_NOT_SUPPORTED` | The functionality for the operation is not supported. +| 0x80240038 | `WU_E_WINHTTP_INVALID_FILE` | The downloaded file has an unexpected content type. +| 0x80240039 | `WU_E_TOO_MANY_RESYNC` | Agent is asked by server to resync too many times. +| 0x80240040 | `WU_E_NO_SERVER_CORE_SUPPORT` | `WUA API` method does not run on Server Core installation. +| 0x80240041 | `WU_E_SYSPREP_IN_PROGRESS` | Service is not available while sysprep is running. +| 0x80240042 | `WU_E_UNKNOWN_SERVICE` | The update service is no longer registered with `AU`. +| 0x80240043 | `WU_E_NO_UI_SUPPORT` | There is no support for `WUA UI`. +| 0x80240FFF | `WU_E_UNEXPECTED` | An operation failed due to reasons not covered by another error code. + +## Windows Update success codes + +| Error code | Message | Description | +|------------|------------------------------|-------------------------------------------------------------------------------------------------------------------------------------| +| 0x00240001 | `WU_S_SERVICE_STOP` | Windows Update Agent was stopped successfully. | +| 0x00240002 | `WU_S_SELFUPDATE` | Windows Update Agent updated itself. | +| 0x00240003 | `WU_S_UPDATE_ERROR` | Operation completed successfully but there were errors applying the updates. | +| 0x00240004 | `WU_S_MARKED_FOR_DISCONNECT` | A callback was marked to be disconnected later because the request to disconnect the operation came while a callback was executing. | +| 0x00240005 | `WU_S_REBOOT_REQUIRED` | The system must be restarted to complete installation of the update. | +| 0x00240006 | `WU_S_ALREADY_INSTALLED` | The update to be installed is already installed on the system. | +| 0x00240007 | `WU_S_ALREADY_UNINSTALLED` | The update to be removed is not installed on the system. | +| 0x00240008 | `WU_S_ALREADY_DOWNLOADED` | The update to be downloaded has already been downloaded. | + +## Windows Installer minor errors The following errors are used to indicate that part of a search fails because of Windows Installer problems. Another part of the search may successfully return updates. All Windows Installer minor codes must share the same error code range so that the caller can tell that they are related to Windows Installer. -|Error code|Message|Description -|-|-|-| -| 0x80241001 |WU_E_MSI_WRONG_VERSION| Search may have missed some updates because the Windows Installer is less than version 3.1.  -| 0x80241002 | WU_E_MSI_NOT_CONFIGURED| Search may have missed some updates because the Windows Installer is not configured.  -| 0x80241003 | WU_E_MSP_DISABLED| Search may have missed some updates because policy has disabled Windows Installer patching.  -| 0x80241004 | WU_E_MSI_WRONG_APP_CONTEXT| An update could not be applied because the application is installed per-user.  -| 0x80241FFF | WU_E_MSP_UNEXPECTED| Search may have missed some updates because there was a failure of the Windows Installer.  +| Error code | Message | Description | +|------------|------------------------------|---------------------------------------------------------------------------------------------| +| 0x80241001 | `WU_E_MSI_WRONG_VERSION` | Search may have missed some updates because the Windows Installer is less than version 3.1. | +| 0x80241002 | `WU_E_MSI_NOT_CONFIGURED` | Search may have missed some updates because the Windows Installer is not configured. | +| 0x80241003 | `WU_E_MSP_DISABLED` | Search may have missed some updates because policy has disabled Windows Installer patching. | +| 0x80241004 | `WU_E_MSI_WRONG_APP_CONTEXT` | An update could not be applied because the application is installed per-user. | +| 0x80241FFF | `WU_E_MSP_UNEXPECTED` | Search may have missed some updates because there was a failure of the Windows Installer. | -## Windows Update Agent update and setup errors +## Windows Update Agent update and setup errors -|Error code|Message|Description -|-|-|-| -| 0x8024D001 | WU_E_SETUP_INVALID_INFDATA| Windows Update Agent could not be updated because an INF file contains invalid information.  -| 0x8024D002 | WU_E_SETUP_INVALID_IDENTDATA| Windows Update Agent could not be updated because the wuident.cab file contains invalid information.  -| 0x8024D003 | WU_E_SETUP_ALREADY_INITIALIZED| Windows Update Agent could not be updated because of an internal error that caused setup initialization to be performed twice.  -| 0x8024D004 | WU_E_SETUP_NOT_INITIALIZED| Windows Update Agent could not be updated because setup initialization never completed successfully.  -| 0x8024D005 | WU_E_SETUP_SOURCE_VERSION_MISMATCH| Windows Update Agent could not be updated because the versions specified in the INF do not match the actual source file versions.  -| 0x8024D006 | WU_E_SETUP_TARGET_VERSION_GREATER| Windows Update Agent could not be updated because a WUA file on the target system is newer than the corresponding source file.  -| 0x8024D007 | WU_E_SETUP_REGISTRATION_FAILED| Windows Update Agent could not be updated because regsvr32.exe returned an error.  -| 0x8024D009 | WU_E_SETUP_SKIP_UPDATE| An update to the Windows Update Agent was skipped due to a directive in the wuident.cab file.  -| 0x8024D00A | WU_E_SETUP_UNSUPPORTED_CONFIGURATION| Windows Update Agent could not be updated because the current system configuration is not supported.  -| 0x8024D00B | WU_E_SETUP_BLOCKED_CONFIGURATION| Windows Update Agent could not be updated because the system is configured to block the update.  -| 0x8024D00C | WU_E_SETUP_REBOOT_TO_FIX| Windows Update Agent could not be updated because a restart of the system is required.  -| 0x8024D00D | WU_E_SETUP_ALREADYRUNNING| Windows Update Agent setup is already running.  -| 0x8024D00E | WU_E_SETUP_REBOOTREQUIRED| Windows Update Agent setup package requires a reboot to complete installation.  -| 0x8024D00F | WU_E_SETUP_HANDLER_EXEC_FAILURE| Windows Update Agent could not be updated because the setup handler failed during execution.  -| 0x8024D010 | WU_E_SETUP_INVALID_REGISTRY_DATA| Windows Update Agent could not be updated because the registry contains invalid information.  -| 0x8024D013 | WU_E_SETUP_WRONG_SERVER_VERSION| Windows Update Agent could not be updated because the server does not contain update information for this version.  -| 0x8024DFFF | WU_E_SETUP_UNEXPECTED| Windows Update Agent could not be updated because of an error not covered by another WU_E_SETUP_* error code.  +| Error code | Message | Description | +|------------|----------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------| +| 0x8024D001 | `WU_E_SETUP_INVALID_INFDATA` | Windows Update Agent could not be updated because an INF file contains invalid information. | +| 0x8024D002 | `WU_E_SETUP_INVALID_IDENTDATA` | Windows Update Agent could not be updated because the `wuident.cab` file contains invalid information. | +| 0x8024D003 | `WU_E_SETUP_ALREADY_INITIALIZED` | Windows Update Agent could not be updated because of an internal error that caused setup initialization to be performed twice. | +| 0x8024D004 | `WU_E_SETUP_NOT_INITIALIZED` | Windows Update Agent could not be updated because setup initialization never completed successfully. | +| 0x8024D005 | `WU_E_SETUP_SOURCE_VERSION_MISMATCH` | Windows Update Agent could not be updated because the versions specified in the INF do not match the actual source file versions. | +| 0x8024D006 | `WU_E_SETUP_TARGET_VERSION_GREATER` | Windows Update Agent could not be updated because a WUA file on the target system is newer than the corresponding source file. | +| 0x8024D007 | `WU_E_SETUP_REGISTRATION_FAILED` | Windows Update Agent could not be updated because `regsvr32.exe` returned an error. | +| 0x8024D009 | `WU_E_SETUP_SKIP_UPDATE` | An update to the Windows Update Agent was skipped due to a directive in the `wuident.cab` file. | +| 0x8024D00A | `WU_E_SETUP_UNSUPPORTED_CONFIGURATION` | Windows Update Agent could not be updated because the current system configuration is not supported. | +| 0x8024D00B | `WU_E_SETUP_BLOCKED_CONFIGURATION` | Windows Update Agent could not be updated because the system is configured to block the update. | +| 0x8024D00C | `WU_E_SETUP_REBOOT_TO_FIX` | Windows Update Agent could not be updated because a restart of the system is required. | +| 0x8024D00D | `WU_E_SETUP_ALREADYRUNNING` | Windows Update Agent setup is already running. | +| 0x8024D00E | `WU_E_SETUP_REBOOTREQUIRED` | Windows Update Agent setup package requires a reboot to complete installation. | +| 0x8024D00F | `WU_E_SETUP_HANDLER_EXEC_FAILURE` | Windows Update Agent could not be updated because the setup handler failed during execution. | +| 0x8024D010 | `WU_E_SETUP_INVALID_REGISTRY_DATA` | Windows Update Agent could not be updated because the registry contains invalid information. | +| 0x8024D013 | `WU_E_SETUP_WRONG_SERVER_VERSION` | Windows Update Agent could not be updated because the server does not contain update information for this version. | +| 0x8024DFFF | `WU_E_SETUP_UNEXPECTED` | Windows Update Agent could not be updated because of an error not covered by another `WU_E_SETUP_*` error code. | diff --git a/windows/deployment/update/windows-update-troubleshooting.md b/windows/deployment/update/windows-update-troubleshooting.md index a1784e6a6e..7fd5fb5a6e 100644 --- a/windows/deployment/update/windows-update-troubleshooting.md +++ b/windows/deployment/update/windows-update-troubleshooting.md @@ -48,7 +48,7 @@ The update that is offered to a device depends on several factors. Some of the m If the update you're offered isn't the most current available, it might be because your device is being managed by a WSUS server, and you're being offered the updates available on that server. It's also possible, if your device is part of a Windows as a Service deployment ring, that your admin is intentionally slowing the rollout of updates. Since the WaaS rollout is slow and measured to begin with, all devices will not receive the update on the same day. -## My machine is frozen at scan. Why? +## My device is frozen at scan. Why? The Settings UI is talking to the Update Orchestrator service which in turn is talking to Windows Update service. If these services stop unexpectedly then you might see this behavior. In such cases, do the following: 1. Close the Settings app and reopen it. 2. Launch Services.msc and check if the following services are running: @@ -145,7 +145,23 @@ Go to Services.msc and ensure that Windows Firewall Service is enabled. Stopping Windows Update provides a wide range configuration policies to control the behavior of WU service in a managed environment. While these policies let you configure the settings at a granular level, misconfiguration or setting conflicting polices may lead to unexpected behaviors. See [How to configure automatic updates by using Group Policy or registry settings](https://support.microsoft.com/help/328010/how-to-configure-automatic-updates-by-using-group-policy-or-registry-s) for more information. + +## Device cannot access update files +Check that your device can access these Windows Update endpoints: + +- http://windowsupdate.microsoft.com +- http://*.windowsupdate.microsoft.com +- https://*.windowsupdate.microsoft.com +- http://*.update.microsoft.com +- https://*.update.microsoft.com +- http://*.windowsupdate.com +- http://download.windowsupdate.com +- https://download.microsoft.com +- http://*.download.windowsupdate.com +- http://wustat.windows.com +- http://ntservicepack.microsoft.com + Whitelist these endpoints for future use. ## Updates aren't downloading from the intranet endpoint (WSUS/SCCM) Windows 10 devices can receive updates from a variety of sources, including Windows Update online, a Windows Server Update Services server, and others. To determine the source of Windows Updates currently being used on a device, follow these steps: diff --git a/windows/deployment/upgrade/log-files.md b/windows/deployment/upgrade/log-files.md index 0214e53ad8..ddb3d63a10 100644 --- a/windows/deployment/upgrade/log-files.md +++ b/windows/deployment/upgrade/log-files.md @@ -9,7 +9,8 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: deploy -audience: itpro author: greg-lindsay +audience: itpro +author: greg-lindsay ms.localizationpriority: medium ms.topic: article --- @@ -159,6 +160,93 @@ Therefore, Windows Setup failed because it was not able to migrate the corrupt f 27:08, Error SP SPDoFrameworkGather: Gather operation failed. Error: 0x0000002C +
    setupapi.dev.log content: + +
    +>>>  [Device Install (UpdateDriverForPlugAndPlayDevices) - PCI\VEN_8086&DEV_8C4F]
+>>>  Section start 2019/09/26 20:13:01.623
+      cmd: rundll32.exe "C:\WINDOWS\Installer\MSI6E4C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_95972906 484 ChipsetWiX.CustomAction!Intel.Deployment.ChipsetWiX.CustomActions.InstallDrivers
+     ndv: INF path: C:\WINDOWS\TEMP\{15B1CD41-69F5-48EA-9F45-0560A40FE2D8}\Drivers\lynxpoint\LynxPointSystem.inf
+     ndv: Install flags: 0x00000000
+     ndv: {Update Device Driver - PCI\VEN_8086&DEV_8C4F&SUBSYS_05BE1028&REV_04\3&11583659&0&F8}
+     ndv:      Search options: 0x00000081
+     ndv:      Searching single INF 'C:\WINDOWS\TEMP\{15B1CD41-69F5-48EA-9F45-0560A40FE2D8}\Drivers\lynxpoint\LynxPointSystem.inf'
+     dvi:      {Build Driver List} 20:13:01.643
+     dvi:           Searching for hardware ID(s):
+     dvi:                pci\ven_8086&dev_8c4f&subsys_05be1028&rev_04
+     dvi:                pci\ven_8086&dev_8c4f&subsys_05be1028
+     dvi:                pci\ven_8086&dev_8c4f&cc_060100
+     dvi:                pci\ven_8086&dev_8c4f&cc_0601
+     dvi:           Searching for compatible ID(s):
+     dvi:                pci\ven_8086&dev_8c4f&rev_04
+     dvi:                pci\ven_8086&dev_8c4f
+     dvi:                pci\ven_8086&cc_060100
+     dvi:                pci\ven_8086&cc_0601
+     dvi:                pci\ven_8086
+     dvi:                pci\cc_060100
+     dvi:                pci\cc_0601
+     sig:           {_VERIFY_FILE_SIGNATURE} 20:13:01.667
+     sig:                Key      = lynxpointsystem.inf
+     sig:                FilePath = c:\windows\temp\{15b1cd41-69f5-48ea-9f45-0560a40fe2d8}\drivers\lynxpoint\lynxpointsystem.inf
+     sig:                Catalog  = c:\windows\temp\{15b1cd41-69f5-48ea-9f45-0560a40fe2d8}\drivers\lynxpoint\LynxPoint.cat
+     sig:                Success: File is signed in catalog.
+     sig:           {_VERIFY_FILE_SIGNATURE exit(0x00000000)} 20:13:01.683
+     dvi:           Created Driver Node:
+     dvi:                HardwareID   - PCI\VEN_8086&DEV_8C4F
+     dvi:                InfName      - c:\windows\temp\{15b1cd41-69f5-48ea-9f45-0560a40fe2d8}\drivers\lynxpoint\lynxpointsystem.inf
+     dvi:                DevDesc      - Intel(R) QM87 LPC Controller - 8C4F
+     dvi:                Section      - Needs_ISAPNP_DRV
+     dvi:                Rank         - 0x00ff2001
+     dvi:                Signer Score - WHQL
+     dvi:                DrvDate      - 04/04/2016
+     dvi:                Version      - 10.1.1.18
+     dvi:      {Build Driver List - exit(0x00000000)} 20:13:01.699
+     ndv:      Searching currently installed INF
+     dvi:      {Build Driver List} 20:13:01.699
+     dvi:           Searching for hardware ID(s):
+     dvi:                pci\ven_8086&dev_8c4f&subsys_05be1028&rev_04
+     dvi:                pci\ven_8086&dev_8c4f&subsys_05be1028
+     dvi:                pci\ven_8086&dev_8c4f&cc_060100
+     dvi:                pci\ven_8086&dev_8c4f&cc_0601
+     dvi:           Searching for compatible ID(s):
+     dvi:                pci\ven_8086&dev_8c4f&rev_04
+     dvi:                pci\ven_8086&dev_8c4f
+     dvi:                pci\ven_8086&cc_060100
+     dvi:                pci\ven_8086&cc_0601
+     dvi:                pci\ven_8086
+     dvi:                pci\cc_060100
+     dvi:                pci\cc_0601
+     dvi:           Created Driver Node:
+     dvi:                HardwareID   - PCI\VEN_8086&DEV_8C4F
+     dvi:                InfName      - C:\WINDOWS\System32\DriverStore\FileRepository\lynxpointsystem.inf_amd64_cd1e518d883ecdfe\lynxpointsystem.inf
+     dvi:                DevDesc      - Intel(R) QM87 LPC Controller - 8C4F
+     dvi:                Section      - Needs_ISAPNP_DRV
+     dvi:                Rank         - 0x00ff2001
+     dvi:                Signer Score - WHQL
+     dvi:                DrvDate      - 10/03/2016
+     dvi:                Version      - 10.1.1.38
+     dvi:      {Build Driver List - exit(0x00000000)} 20:13:01.731
+     dvi:      {DIF_SELECTBESTCOMPATDRV} 20:13:01.731
+     dvi:           Default installer: Enter 20:13:01.735
+     dvi:                {Select Best Driver}
+     dvi:                     Class GUID of device changed to: {4d36e97d-e325-11ce-bfc1-08002be10318}.
+     dvi:                     Selected Driver:
+     dvi:                          Description - Intel(R) QM87 LPC Controller - 8C4F
+     dvi:                          InfFile     - c:\windows\system32\driverstore\filerepository\lynxpointsystem.inf_amd64_cd1e518d883ecdfe\lynxpointsystem.inf
+     dvi:                          Section     - Needs_ISAPNP_DRV
+     dvi:                {Select Best Driver - exit(0x00000000)}
+     dvi:           Default installer: Exit
+     dvi:      {DIF_SELECTBESTCOMPATDRV - exit(0x00000000)} 20:13:01.743
+     ndv:      Currently Installed Driver:
+     ndv:           Inf Name       - oem1.inf
+     ndv:           Driver Date    - 10/03/2016
+     ndv:           Driver Version - 10.1.1.38
+     ndv: {Update Device Driver - exit(00000103)}
+!    ndv: No better matching drivers found for device 'PCI\VEN_8086&DEV_8C4F&SUBSYS_05BE1028&REV_04\3&11583659&0&F8'.
+!    ndv: No devices were updated.
+<<<  Section end 2019/09/26 20:13:01.759
+<<<  [Exit status: FAILURE(0xC1900101)]
+

    This analysis indicates that the Windows upgrade error can be resolved by deleting the C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\[CN] file. Note: In this example, the full, unshortened file name is C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\be8228fb2d3cb6c6b0ccd9ad51b320b4_a43d512c-69f2-42de-aef9-7a88fabdaa3f. diff --git a/windows/deployment/upgrade/resolution-procedures.md b/windows/deployment/upgrade/resolution-procedures.md index 15c4156866..64f031f72e 100644 --- a/windows/deployment/upgrade/resolution-procedures.md +++ b/windows/deployment/upgrade/resolution-procedures.md @@ -9,7 +9,8 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: deploy -audience: itpro author: greg-lindsay +audience: itpro +author: greg-lindsay ms.localizationpriority: medium ms.topic: article --- @@ -294,7 +295,7 @@ This error has more than one possible cause. Attempt [quick fixes](quick-fixes.m 0x80073BC3 - 0x20009
    -0x8007002 - 0x20009
    +0x80070002 - 0x20009
    0x80073B92 - 0x20009 @@ -593,7 +594,7 @@ Download and run the media creation tool. See hotfix 3095113, WSUS doesn't recognize the Upgrades classification and instead treats the upgrade like a regular update. - You can prevent this by installing hotfix 3095113 before you enable update synchronization. However, if you have already run into this problem, do the following: + You can prevent this by installing hotfix 3095113 before you enable update synchronization. However, if you have already run into this problem, do the following:
    1. Disable the Upgrades classification.
      2. @@ -602,7 +603,7 @@ Download and run the media creation tool. See How to delete upgrades in WSUS.

      +
      For detailed information on how to run these steps check out How to delete upgrades in WSUS.

      @@ -698,12 +699,12 @@ Also see the following sequential list of modern setup (mosetup) error codes wit | 0XC1900105 | MOSETUP_E_TEST_MODE | The installation process is being used in a test environment. | | 0XC1900106 | MOSETUP_E_TERMINATE_PROCESS | The installation process was terminated. | | 0XC1900107 | MOSETUP_E_CLEANUP_PENDING | A cleanup operation from a previous installation attempt is still pending. A system reboot is required. | -| 0XC1900108 | MOSETUP_E_REPORTING | An error has occured and the result value must be consolidated for telemetry purposes. | +| 0XC1900108 | MOSETUP_E_REPORTING | An error has occurred and the result value must be consolidated for telemetry purposes. | | 0XC1900109 | MOSETUP_E_COMPAT_TERMINATE | The installation process was terminated during the actionable compatibility phase. | -| 0XC190010a | MOSETUP_E_UNKNOWN_CMD_LINE | The installation process was launched with an unknown command line argument. | +| 0XC190010a | MOSETUP_E_UNKNOWN_CMD_LINE | The installation process was launched with an unknown command-line argument. | | 0XC190010b | MOSETUP_E_INSTALL_IMAGE_NOT_FOUND | The installation image was not found. | | 0XC190010c | MOSETUP_E_AUTOMATION_INVALID | The provided automation information was invalid. | -| 0XC190010d | MOSETUP_E_INVALID_CMD_LINE | The installation process was launched with an invalid command line argument. | +| 0XC190010d | MOSETUP_E_INVALID_CMD_LINE | The installation process was launched with an invalid command-line argument. | | 0XC190010e | MOSETUP_E_EULA_ACCEPT_REQUIRED | The installation process requires that the user accept the license agreement. | | 0XC1900110 | MOSETUP_E_EULA_CANCEL | The user has chosen to cancel for license agreement. | | 0XC1900111 | MOSETUP_E_ADVERTISE_CANCEL | The user has chosen to cancel for advertisement. | diff --git a/windows/deployment/upgrade/troubleshoot-upgrade-errors.md b/windows/deployment/upgrade/troubleshoot-upgrade-errors.md index c9509188a3..e06f80e04b 100644 --- a/windows/deployment/upgrade/troubleshoot-upgrade-errors.md +++ b/windows/deployment/upgrade/troubleshoot-upgrade-errors.md @@ -1,97 +1,98 @@ ---- -title: Troubleshoot Windows 10 upgrade errors - Windows IT Pro -ms.reviewer: -manager: laurawi -ms.author: greglin -description: Resolve Windows 10 upgrade errors for ITPros. Technical information for IT professionals to help diagnose Windows setup errors. -keywords: deploy, error, troubleshoot, windows, 10, upgrade, code, rollback, ITPro -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: deploy -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.topic: article ---- - -# Troubleshooting upgrade errors - -**Applies to** -- Windows 10 - ->[!NOTE] ->This is a 300 level topic (moderately advanced).
      ->See [Resolve Windows 10 upgrade errors](resolve-windows-10-upgrade-errors.md) for a full list of topics in this article. - -If a Windows 10 upgrade is not successful, it can be very helpful to understand *when* an error occurred in the upgrade process. - -Briefly, the upgrade process consists of four phases: **Downlevel**, **SafeOS**, **First boot**, and **Second boot**. The computer will reboot once between each phase. Note: Progress is tracked in the registry during the upgrade process using the following key: **HKLM\System\Setup\mosetup\volatile\SetupProgress**. This key is volatile and only present during the upgrade process; it contains a binary value in the range 0-100. - -These phases are explained in greater detail [below](#the-windows-10-upgrade-process). First, let's summarize the actions performed during each phase because this affects the type of errors that can be encountered. - -1. **Downlevel phase**: Because this phase runs on the source OS, upgrade errors are not typically seen. If you do encounter an error, ensure the source OS is stable. Also ensure the Windows setup source and the destination drive are accessible. - -2. **SafeOS phase**: Errors most commonly occur during this phase due to hardware issues, firmware issues, or non-microsoft disk encryption software. - - Since the computer is booted into Windows PE during the SafeOS phase, a useful troubleshooting technique is to boot into [Windows PE](https://docs.microsoft.com/windows-hardware/manufacture/desktop/winpe-intro) using installation media. You can use the [media creation tool](https://www.microsoft.com/software-download/windows10) to create bootable media, or you can use tools such as the [Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit), and then boot your device from this media to test for hardware and firmware compatibility issues. - - >[!TIP] - >If you attempt to use the media creation tool with a USB drive and this fails with error 0x80004005 - 0xa001a, this is because the USB drive is using GPT partition style. The tool requires that you use MBR partition style. You can use the DISKPART command to convert the USB drive from GPT to MBR. For more information, see [Change a GUID Partition Table Disk into a Master Boot Record Disk](https://go.microsoft.com/fwlink/?LinkId=207050). - - **Do not proceed with the Windows 10 installation after booting from this media**. This method can only be used to perform a clean install which will not migrate any of your apps and settings, and you will be required re-enter your Windows 10 license information. - - If the computer does not successfully boot into Windows PE using the media that you created, this is likely due to a hardware or firmware issue. Check with your hardware manufacturer and apply any recommended BIOS and firmware updates. If you are still unable to boot to installation media after applying updates, disconnect or replace legacy hardware. - - If the computer successfully boots into Windows PE, but you are not able to browse the system drive on the computer, it is possible that non-Microsoft disk encryption software is blocking your ability to perform a Windows 10 upgrade. Update or temporarily remove the disk encryption. - -3. **First boot phase**: Boot failures in this phase are relatively rare, and almost exclusively caused by device drivers. Disconnect all peripheral devices except for the mouse, keyboard, and display. Obtain and install updated device drivers, then retry the upgrade. - -4. **Second boot phase**: In this phase, the system is running under the target OS with new drivers. Boot failures are most commonly due to anti-virus software or filter drivers. Disconnect all peripheral devices except for the mouse, keyboard, and display. Obtain and install updated device drivers, temporarily uninstall anti-virus software, then retry the upgrade. - -If the general troubleshooting techniques described above or the [quick fixes](quick-fixes.md) detailed below do not resolve your issue, you can attempt to analyze [log files](log-files.md) and interpret [upgrade error codes](upgrade-error-codes.md). You can also [Submit Windows 10 upgrade errors using Feedback Hub](submit-errors.md) so that Microsoft can diagnose your issue. - -## The Windows 10 upgrade process - -The **Windows Setup** application is used to upgrade a computer to Windows 10, or to perform a clean installation. Windows Setup starts and restarts the computer, gathers information, copies files, and creates or adjusts configuration settings. - -When performing an operating system upgrade, Windows Setup uses phases described below. A reboot occurs between each of the phases. After the first reboot, the user interface will remain the same until the upgrade is completed. Percent progress is displayed and will advance as you move through each phase, reaching 100% at the end of the second boot phase. - -1. **Downlevel phase**: The downlevel phase is run within the previous operating system. Windows files are copied and installation components are gathered. - - ![downlevel phase](../images/downlevel.png) - -2. **Safe OS phase**: A recovery partition is configured, Windows files are expanded, and updates are installed. An OS rollback is prepared if needed. Example error codes: 0x2000C, 0x20017. - - ![safeOS phase](../images/safeos.png) - -3. **First boot phase**: Initial settings are applied. Example error codes: 0x30018, 0x3000D. - - ![first boot phase](../images/firstboot.png) - -4. **Second boot phase**: Final settings are applied. This is also called the **OOBE boot phase**. Example error codes: 0x4000D, 0x40017. - - At the end of the second boot phase, the **Welcome to Windows 10** screen is displayed, preferences are configured, and the Windows 10 sign-in prompt is displayed. - - ![second boot phase](../images/secondboot.png) - - ![second boot phase](../images/secondboot2.png) - - ![second boot phase](../images/secondboot3.png) - -5. **Uninstall phase**: This phase occurs if upgrade is unsuccessful (image not shown). Example error codes: 0x50000, 0x50015. - -**Figure 1**: Phases of a successful Windows 10 upgrade (uninstall is not shown): - -![Upgrade process](../images/upgrade-process.png) - -DU = Driver/device updates.
      -OOBE = Out of box experience.
      -WIM = Windows image (Microsoft) - -## Related topics - -[Windows 10 FAQ for IT professionals](https://technet.microsoft.com/windows/dn798755.aspx) -
      [Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx) -
      [Windows 10 Specifications](https://www.microsoft.com/windows/Windows-10-specifications) -
      [Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro) -
      [Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821) +--- +title: Troubleshoot Windows 10 upgrade errors - Windows IT Pro +ms.reviewer: +manager: laurawi +ms.author: greglin +description: Resolve Windows 10 upgrade errors for ITPros. Technical information for IT professionals to help diagnose Windows setup errors. +keywords: deploy, error, troubleshoot, windows, 10, upgrade, code, rollback, ITPro +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: deploy +audience: itpro +author: greg-lindsay +ms.localizationpriority: medium +ms.topic: article +--- + +# Troubleshooting upgrade errors + +**Applies to** +- Windows 10 + +>[!NOTE] +>This is a 300 level topic (moderately advanced).
      +>See [Resolve Windows 10 upgrade errors](resolve-windows-10-upgrade-errors.md) for a full list of topics in this article. + +If a Windows 10 upgrade is not successful, it can be very helpful to understand *when* an error occurred in the upgrade process. + +Briefly, the upgrade process consists of four phases: **Downlevel**, **SafeOS**, **First boot**, and **Second boot**. The computer will reboot once between each phase. Note: Progress is tracked in the registry during the upgrade process using the following key: **HKLM\System\Setup\mosetup\volatile\SetupProgress**. This key is volatile and only present during the upgrade process; it contains a binary value in the range 0-100. + +These phases are explained in greater detail [below](#the-windows-10-upgrade-process). First, let's summarize the actions performed during each phase because this affects the type of errors that can be encountered. + +1. **Downlevel phase**: Because this phase runs on the source OS, upgrade errors are not typically seen. If you do encounter an error, ensure the source OS is stable. Also ensure the Windows setup source and the destination drive are accessible. + +2. **SafeOS phase**: Errors most commonly occur during this phase due to hardware issues, firmware issues, or non-microsoft disk encryption software. + + Since the computer is booted into Windows PE during the SafeOS phase, a useful troubleshooting technique is to boot into [Windows PE](https://docs.microsoft.com/windows-hardware/manufacture/desktop/winpe-intro) using installation media. You can use the [media creation tool](https://www.microsoft.com/software-download/windows10) to create bootable media, or you can use tools such as the [Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit), and then boot your device from this media to test for hardware and firmware compatibility issues. + + >[!TIP] + >If you attempt to use the media creation tool with a USB drive and this fails with error 0x80004005 - 0xa001a, this is because the USB drive is using GPT partition style. The tool requires that you use MBR partition style. You can use the DISKPART command to convert the USB drive from GPT to MBR. For more information, see [Change a GUID Partition Table Disk into a Master Boot Record Disk](https://go.microsoft.com/fwlink/?LinkId=207050). + + **Do not proceed with the Windows 10 installation after booting from this media**. This method can only be used to perform a clean install which will not migrate any of your apps and settings, and you will be required re-enter your Windows 10 license information. + + If the computer does not successfully boot into Windows PE using the media that you created, this is likely due to a hardware or firmware issue. Check with your hardware manufacturer and apply any recommended BIOS and firmware updates. If you are still unable to boot to installation media after applying updates, disconnect or replace legacy hardware. + + If the computer successfully boots into Windows PE, but you are not able to browse the system drive on the computer, it is possible that non-Microsoft disk encryption software is blocking your ability to perform a Windows 10 upgrade. Update or temporarily remove the disk encryption. + +3. **First boot phase**: Boot failures in this phase are relatively rare, and almost exclusively caused by device drivers. Disconnect all peripheral devices except for the mouse, keyboard, and display. Obtain and install updated device drivers, then retry the upgrade. + +4. **Second boot phase**: In this phase, the system is running under the target OS with new drivers. Boot failures are most commonly due to anti-virus software or filter drivers. Disconnect all peripheral devices except for the mouse, keyboard, and display. Obtain and install updated device drivers, temporarily uninstall anti-virus software, then retry the upgrade. + +If the general troubleshooting techniques described above or the [quick fixes](quick-fixes.md) detailed below do not resolve your issue, you can attempt to analyze [log files](log-files.md) and interpret [upgrade error codes](upgrade-error-codes.md). You can also [Submit Windows 10 upgrade errors using Feedback Hub](submit-errors.md) so that Microsoft can diagnose your issue. + +## The Windows 10 upgrade process + +The **Windows Setup** application is used to upgrade a computer to Windows 10, or to perform a clean installation. Windows Setup starts and restarts the computer, gathers information, copies files, and creates or adjusts configuration settings. + +When performing an operating system upgrade, Windows Setup uses phases described below. A reboot occurs between each of the phases. After the first reboot, the user interface will remain the same until the upgrade is completed. Percent progress is displayed and will advance as you move through each phase, reaching 100% at the end of the second boot phase. + +1. **Downlevel phase**: The downlevel phase is run within the previous operating system. Windows files are copied and installation components are gathered. + + ![downlevel phase](../images/downlevel.png) + +2. **Safe OS phase**: A recovery partition is configured, Windows files are expanded, and updates are installed. An OS rollback is prepared if needed. Example error codes: 0x2000C, 0x20017. + + ![safeOS phase](../images/safeos.png) + +3. **First boot phase**: Initial settings are applied. Example error codes: 0x30018, 0x3000D. + + ![first boot phase](../images/firstboot.png) + +4. **Second boot phase**: Final settings are applied. This is also called the **OOBE boot phase**. Example error codes: 0x4000D, 0x40017. + + At the end of the second boot phase, the **Welcome to Windows 10** screen is displayed, preferences are configured, and the Windows 10 sign-in prompt is displayed. + + ![second boot phase](../images/secondboot.png) + + ![second boot phase](../images/secondboot2.png) + + ![second boot phase](../images/secondboot3.png) + +5. **Uninstall phase**: This phase occurs if upgrade is unsuccessful (image not shown). Example error codes: 0x50000, 0x50015. + +**Figure 1**: Phases of a successful Windows 10 upgrade (uninstall is not shown): + +![Upgrade process](../images/upgrade-process.png) + +DU = Driver/device updates.
      +OOBE = Out of box experience.
      +WIM = Windows image (Microsoft) + +## Related topics + +[Windows 10 FAQ for IT professionals](https://technet.microsoft.com/windows/dn798755.aspx) +
      [Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx) +
      [Windows 10 Specifications](https://www.microsoft.com/windows/Windows-/ifications) +
      [Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro) +
      [Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821) diff --git a/windows/deployment/upgrade/upgrade-error-codes.md b/windows/deployment/upgrade/upgrade-error-codes.md index 0dd0d042c6..7f4624ce3a 100644 --- a/windows/deployment/upgrade/upgrade-error-codes.md +++ b/windows/deployment/upgrade/upgrade-error-codes.md @@ -1,159 +1,160 @@ ---- -title: Upgrade error codes - Windows IT Pro -ms.reviewer: -manager: laurawi -ms.author: greglin -description: Resolve Windows 10 upgrade errors for ITPros. Technical information for IT professionals to help diagnose Windows setup errors. -keywords: deploy, error, troubleshoot, windows, 10, upgrade, code, rollback, ITPro -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: deploy -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.topic: article ---- - -# Upgrade error codes - -**Applies to** -- Windows 10 - ->[!NOTE] ->This is a 400 level topic (advanced).
      ->See [Resolve Windows 10 upgrade errors](resolve-windows-10-upgrade-errors.md) for a full list of topics in this article. - - -If the upgrade process is not successful, Windows Setup will return two codes: - -1. **A result code**: The result code corresponds to a specific Win32 or NTSTATUS error. -2. **An extend code**: The extend code contains information about both the *phase* in which an error occurred, and the *operation* that was being performed when the error occurred. - ->For example, a result code of **0xC1900101** with an extend code of **0x4000D** will be returned as: **0xC1900101 - 0x4000D**. - -Note: If only a result code is returned, this can be because a tool is being used that was not able to capture the extend code. For example, if you are using the [Windows 10 Upgrade Assistant](https://support.microsoft.com/kb/3159635) then only a result code might be returned. - ->[!TIP] ->If you are unable to locate the result and extend error codes, you can attempt to find these codes using Event Viewer. For more information, see [Windows Error Reporting](windows-error-reporting.md). - -## Result codes - ->A result code of **0xC1900101** is generic and indicates that a rollback occurred. In most cases, the cause is a driver compatibility issue.
      To troubleshoot a failed upgrade that has returned a result code of 0xC1900101, analyze the extend code to determine the Windows Setup phase, and see the [Resolution procedures](resolution-procedures.md) section later in this article. - -The following set of result codes are associated with [Windows Setup](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-command-line-options) compatibility warnings: - -| Result code | Message | Description | -| --- | --- | --- | -| 0xC1900210 | MOSETUP_E_COMPAT_SCANONLY | Setup did not find any compat issue | -| 0xC1900208 | MOSETUP_E_COMPAT_INSTALLREQ_BLOCK | Setup found an actionable compat issue, such as an incompatible app | -| 0xC1900204 | MOSETUP_E_COMPAT_MIGCHOICE_BLOCK | The migration choice selected is not available (ex: Enterprise to Home) | -| 0xC1900200 | MOSETUP_E_COMPAT_SYSREQ_BLOCK | The computer is not eligible for Windows 10 | -| 0xC190020E | MOSETUP_E_INSTALLDISKSPACE_BLOCK | The computer does not have enough free space to install | - -A list of modern setup (mosetup) errors with descriptions in the range is available in the [Resolution procedures](resolution-procedures.md#modern-setup-errors) topic in this article. - -Other result codes can be matched to the specific type of error encountered. To match a result code to an error: - -1. Identify the error code type as either Win32 or NTSTATUS using the first hexadecimal digit: -
      **8** = Win32 error code (ex: 0x**8**0070070) -
      **C** = NTSTATUS value (ex: 0x**C**1900107) -2. Write down the last 4 digits of the error code (ex: 0x8007**0070** = 0070). These digits are the actual error code type as defined in the [HRESULT](https://msdn.microsoft.com/library/cc231198.aspx) or the [NTSTATUS](https://msdn.microsoft.com/library/cc231200.aspx) structure. Other digits in the code identify things such as the device type that produced the error. -3. Based on the type of error code determined in the first step (Win32 or NTSTATUS), match the 4 digits derived from the second step to either a Win32 error code or NTSTATUS value using the following links: - - [Win32 error code](https://msdn.microsoft.com/library/cc231199.aspx) - - [NTSTATUS value](https://msdn.microsoft.com/library/cc704588.aspx) - -Examples: -- 0x80070070 - - Based on the "8" this is a Win32 error code - - The last four digits are 0070, so look up 0x00000070 in the [Win32 error code](https://msdn.microsoft.com/library/cc231199.aspx) table - - The error is: **ERROR_DISK_FULL** -- 0xC1900107 - - Based on the "C" this is an NTSTATUS error code - - The last four digits are 0107, so look up 0x00000107 in the [NTSTATUS value](https://msdn.microsoft.com/library/cc704588.aspx) table - - The error is: **STATUS_SOME_NOT_MAPPED** - -Some result codes are self-explanatory, whereas others are more generic and require further analysis. In the examples shown above, ERROR_DISK_FULL indicates that the hard drive is full and additional room is needed to complete Windows upgrade. The message STATUS_SOME_NOT_MAPPED is more ambiguous, and means that an action is pending. In this case, the action pending is often the cleanup operation from a previous installation attempt, which can be resolved with a system reboot. - -## Extend codes - ->**Important**: Extend codes reflect the current Windows 10 upgrade process, and might change in future releases of Windows 10. The codes discussed in this section apply to Windows 10 version 1607, also known as the Anniversary Update. - -Extend codes can be matched to the phase and operation when an error occurred. To match an extend code to the phase and operation: - -1. Use the first digit to identify the phase (ex: 0x4000D = 4). -2. Use the last two digits to identify the operation (ex: 0x4000D = 0D). -3. Match the phase and operation to values in the tables provided below. - -The following tables provide the corresponding phase and operation for values of an extend code: - -
      - - - -
      Extend code: phase
      HexPhase -
      0SP_EXECUTION_UNKNOWN -
      1SP_EXECUTION_DOWNLEVEL -
      2SP_EXECUTION_SAFE_OS -
      3SP_EXECUTION_FIRST_BOOT -
      4SP_EXECUTION_OOBE_BOOT -
      5SP_EXECUTION_UNINSTALL -
      - - - - - - - -
      Extend code: operation
      - -
      HexOperation -
      0SP_EXECUTION_OP_UNKNOWN -
      1SP_EXECUTION_OP_COPY_PAYLOAD -
      2SP_EXECUTION_OP_DOWNLOAD_UPDATES -
      3SP_EXECUTION_OP_INSTALL_UPDATES -
      4SP_EXECUTION_OP_INSTALL_RECOVERY_ENVIRONMENT -
      5SP_EXECUTION_OP_INSTALL_RECOVERY_IMAGE -
      6SP_EXECUTION_OP_REPLICATE_OC -
      7SP_EXECUTION_OP_INSTALL_DRVIERS -
      8SP_EXECUTION_OP_PREPARE_SAFE_OS -
      9SP_EXECUTION_OP_PREPARE_ROLLBACK -
      ASP_EXECUTION_OP_PREPARE_FIRST_BOOT -
      BSP_EXECUTION_OP_PREPARE_OOBE_BOOT -
      CSP_EXECUTION_OP_APPLY_IMAGE -
      DSP_EXECUTION_OP_MIGRATE_DATA -
      ESP_EXECUTION_OP_SET_PRODUCT_KEY -
      FSP_EXECUTION_OP_ADD_UNATTEND -
      -      		 - -
      HexOperation -
      10SP_EXECUTION_OP_ADD_DRIVER -
      11SP_EXECUTION_OP_ENABLE_FEATURE -
      12SP_EXECUTION_OP_DISABLE_FEATURE -
      13SP_EXECUTION_OP_REGISTER_ASYNC_PROCESS -
      14SP_EXECUTION_OP_REGISTER_SYNC_PROCESS -
      15SP_EXECUTION_OP_CREATE_FILE -
      16SP_EXECUTION_OP_CREATE_REGISTRY -
      17SP_EXECUTION_OP_BOOT -
      18SP_EXECUTION_OP_SYSPREP -
      19SP_EXECUTION_OP_OOBE -
      1ASP_EXECUTION_OP_BEGIN_FIRST_BOOT -
      1BSP_EXECUTION_OP_END_FIRST_BOOT -
      1CSP_EXECUTION_OP_BEGIN_OOBE_BOOT -
      1DSP_EXECUTION_OP_END_OOBE_BOOT -
      1ESP_EXECUTION_OP_PRE_OOBE -
      1FSP_EXECUTION_OP_POST_OOBE -
      20SP_EXECUTION_OP_ADD_PROVISIONING_PACKAGE -
      -
      - -For example: An extend code of **0x4000D**, represents a problem during phase 4 (**0x4**) with data migration (**000D**). - -## Related topics - -[Windows 10 FAQ for IT professionals](https://technet.microsoft.com/windows/dn798755.aspx) -
      [Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx) -
      [Windows 10 Specifications](https://www.microsoft.com/windows/Windows-10-specifications) -
      [Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro) -
      [Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821) +--- +title: Upgrade error codes - Windows IT Pro +ms.reviewer: +manager: laurawi +ms.author: greglin +description: Resolve Windows 10 upgrade errors for ITPros. Technical information for IT professionals to help diagnose Windows setup errors. +keywords: deploy, error, troubleshoot, windows, 10, upgrade, code, rollback, ITPro +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: deploy +audience: itpro +author: greg-lindsay +ms.localizationpriority: medium +ms.topic: article +--- + +# Upgrade error codes + +**Applies to** +- Windows 10 + +>[!NOTE] +>This is a 400 level topic (advanced).
      +>See [Resolve Windows 10 upgrade errors](resolve-windows-10-upgrade-errors.md) for a full list of topics in this article. + + +If the upgrade process is not successful, Windows Setup will return two codes: + +1. **A result code**: The result code corresponds to a specific Win32 or NTSTATUS error. +2. **An extend code**: The extend code contains information about both the *phase* in which an error occurred, and the *operation* that was being performed when the error occurred. + +>For example, a result code of **0xC1900101** with an extend code of **0x4000D** will be returned as: **0xC1900101 - 0x4000D**. + +Note: If only a result code is returned, this can be because a tool is being used that was not able to capture the extend code. For example, if you are using the [Windows 10 Upgrade Assistant](https://support.microsoft.com/kb/3159635) then only a result code might be returned. + +>[!TIP] +>If you are unable to locate the result and extend error codes, you can attempt to find these codes using Event Viewer. For more information, see [Windows Error Reporting](windows-error-reporting.md). + +## Result codes + +>A result code of **0xC1900101** is generic and indicates that a rollback occurred. In most cases, the cause is a driver compatibility issue.
      To troubleshoot a failed upgrade that has returned a result code of 0xC1900101, analyze the extend code to determine the Windows Setup phase, and see the [Resolution procedures](resolution-procedures.md) section later in this article. + +The following set of result codes are associated with [Windows Setup](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-command-line-options) compatibility warnings: + +| Result code | Message | Description | +| --- | --- | --- | +| 0xC1900210 | MOSETUP_E_COMPAT_SCANONLY | Setup did not find any compat issue | +| 0xC1900208 | MOSETUP_E_COMPAT_INSTALLREQ_BLOCK | Setup found an actionable compat issue, such as an incompatible app | +| 0xC1900204 | MOSETUP_E_COMPAT_MIGCHOICE_BLOCK | The migration choice selected is not available (ex: Enterprise to Home) | +| 0xC1900200 | MOSETUP_E_COMPAT_SYSREQ_BLOCK | The computer is not eligible for Windows 10 | +| 0xC190020E | MOSETUP_E_INSTALLDISKSPACE_BLOCK | The computer does not have enough free space to install | + +A list of modern setup (mosetup) errors with descriptions in the range is available in the [Resolution procedures](resolution-procedures.md#modern-setup-errors) topic in this article. + +Other result codes can be matched to the specific type of error encountered. To match a result code to an error: + +1. Identify the error code type as either Win32 or NTSTATUS using the first hexadecimal digit: +
      **8** = Win32 error code (ex: 0x**8**0070070) +
      **C** = NTSTATUS value (ex: 0x**C**1900107) +2. Write down the last 4 digits of the error code (ex: 0x8007**0070** = 0070). These digits are the actual error code type as defined in the [HRESULT](https://msdn.microsoft.com/library/cc231198.aspx) or the [NTSTATUS](https://msdn.microsoft.com/library/cc231200.aspx) structure. Other digits in the code identify things such as the device type that produced the error. +3. Based on the type of error code determined in the first step (Win32 or NTSTATUS), match the 4 digits derived from the second step to either a Win32 error code or NTSTATUS value using the following links: + - [Win32 error code](https://msdn.microsoft.com/library/cc231199.aspx) + - [NTSTATUS value](https://msdn.microsoft.com/library/cc704588.aspx) + +Examples: +- 0x80070070 + - Based on the "8" this is a Win32 error code + - The last four digits are 0070, so look up 0x00000070 in the [Win32 error code](https://msdn.microsoft.com/library/cc231199.aspx) table + - The error is: **ERROR_DISK_FULL** +- 0xC1900107 + - Based on the "C" this is an NTSTATUS error code + - The last four digits are 0107, so look up 0x00000107 in the [NTSTATUS value](https://msdn.microsoft.com/library/cc704588.aspx) table + - The error is: **STATUS_SOME_NOT_MAPPED** + +Some result codes are self-explanatory, whereas others are more generic and require further analysis. In the examples shown above, ERROR_DISK_FULL indicates that the hard drive is full and additional room is needed to complete Windows upgrade. The message STATUS_SOME_NOT_MAPPED is more ambiguous, and means that an action is pending. In this case, the action pending is often the cleanup operation from a previous installation attempt, which can be resolved with a system reboot. + +## Extend codes + +>**Important**: Extend codes reflect the current Windows 10 upgrade process, and might change in future releases of Windows 10. The codes discussed in this section apply to Windows 10 version 1607, also known as the Anniversary Update. + +Extend codes can be matched to the phase and operation when an error occurred. To match an extend code to the phase and operation: + +1. Use the first digit to identify the phase (ex: 0x4000D = 4). +2. Use the last two digits to identify the operation (ex: 0x4000D = 0D). +3. Match the phase and operation to values in the tables provided below. + +The following tables provide the corresponding phase and operation for values of an extend code: + +
      + + + +
      Extend code: phase
      HexPhase +
      0SP_EXECUTION_UNKNOWN +
      1SP_EXECUTION_DOWNLEVEL +
      2SP_EXECUTION_SAFE_OS +
      3SP_EXECUTION_FIRST_BOOT +
      4SP_EXECUTION_OOBE_BOOT +
      5SP_EXECUTION_UNINSTALL +
      + + + + + + + +
      Extend code: operation
      + +
      HexOperation +
      0SP_EXECUTION_OP_UNKNOWN +
      1SP_EXECUTION_OP_COPY_PAYLOAD +
      2SP_EXECUTION_OP_DOWNLOAD_UPDATES +
      3SP_EXECUTION_OP_INSTALL_UPDATES +
      4SP_EXECUTION_OP_INSTALL_RECOVERY_ENVIRONMENT +
      5SP_EXECUTION_OP_INSTALL_RECOVERY_IMAGE +
      6SP_EXECUTION_OP_REPLICATE_OC +
      7SP_EXECUTION_OP_INSTALL_DRVIERS +
      8SP_EXECUTION_OP_PREPARE_SAFE_OS +
      9SP_EXECUTION_OP_PREPARE_ROLLBACK +
      ASP_EXECUTION_OP_PREPARE_FIRST_BOOT +
      BSP_EXECUTION_OP_PREPARE_OOBE_BOOT +
      CSP_EXECUTION_OP_APPLY_IMAGE +
      DSP_EXECUTION_OP_MIGRATE_DATA +
      ESP_EXECUTION_OP_SET_PRODUCT_KEY +
      FSP_EXECUTION_OP_ADD_UNATTEND +
      +      		 + +
      HexOperation +
      10SP_EXECUTION_OP_ADD_DRIVER +
      11SP_EXECUTION_OP_ENABLE_FEATURE +
      12SP_EXECUTION_OP_DISABLE_FEATURE +
      13SP_EXECUTION_OP_REGISTER_ASYNC_PROCESS +
      14SP_EXECUTION_OP_REGISTER_SYNC_PROCESS +
      15SP_EXECUTION_OP_CREATE_FILE +
      16SP_EXECUTION_OP_CREATE_REGISTRY +
      17SP_EXECUTION_OP_BOOT +
      18SP_EXECUTION_OP_SYSPREP +
      19SP_EXECUTION_OP_OOBE +
      1ASP_EXECUTION_OP_BEGIN_FIRST_BOOT +
      1BSP_EXECUTION_OP_END_FIRST_BOOT +
      1CSP_EXECUTION_OP_BEGIN_OOBE_BOOT +
      1DSP_EXECUTION_OP_END_OOBE_BOOT +
      1ESP_EXECUTION_OP_PRE_OOBE +
      1FSP_EXECUTION_OP_POST_OOBE +
      20SP_EXECUTION_OP_ADD_PROVISIONING_PACKAGE +
      +
      + +For example: An extend code of **0x4000D**, represents a problem during phase 4 (**0x4**) with data migration (**000D**). + +## Related topics + +[Windows 10 FAQ for IT professionals](https://technet.microsoft.com/windows/dn798755.aspx) +
      [Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx) +
      [Windows 10 Specifications](https://www.microsoft.com/windows/Windows-/ifications) +
      [Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro) +
      [Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821) diff --git a/windows/deployment/upgrade/upgrade-readiness-additional-insights.md b/windows/deployment/upgrade/upgrade-readiness-additional-insights.md index 253142dec4..43bc14033a 100644 --- a/windows/deployment/upgrade/upgrade-readiness-additional-insights.md +++ b/windows/deployment/upgrade/upgrade-readiness-additional-insights.md @@ -14,7 +14,7 @@ ms.collection: M365-analytics # Upgrade Readiness - Additional insights >[!IMPORTANT] ->The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Get started with Update Compliance](../update/update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement). +>The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Get started with Update Compliance](../update/update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/help/4521815/windows-analytics-retirement). This topic provides information on additional features that are available in Upgrade Readiness to provide insights into your environment. These include: diff --git a/windows/deployment/upgrade/upgrade-readiness-architecture.md b/windows/deployment/upgrade/upgrade-readiness-architecture.md index d9bc229c23..73b74906d7 100644 --- a/windows/deployment/upgrade/upgrade-readiness-architecture.md +++ b/windows/deployment/upgrade/upgrade-readiness-architecture.md @@ -14,7 +14,7 @@ ms.collection: M365-analytics # Upgrade Readiness architecture >[!IMPORTANT] ->The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Get started with Update Compliance](../update/update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement). +>The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Get started with Update Compliance](../update/update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/help/4521815/windows-analytics-retirement). Microsoft analyzes system, application, and driver diagnostic data to help you determine when computers are upgrade-ready, allowing you to simplify and accelerate Windows upgrades in your organization. The diagram below illustrates how Upgrade Readiness components work together in a typical installation. diff --git a/windows/deployment/upgrade/upgrade-readiness-data-sharing.md b/windows/deployment/upgrade/upgrade-readiness-data-sharing.md index 322316fb07..af934eec08 100644 --- a/windows/deployment/upgrade/upgrade-readiness-data-sharing.md +++ b/windows/deployment/upgrade/upgrade-readiness-data-sharing.md @@ -17,7 +17,7 @@ ms.collection: M365-analytics # Upgrade Readiness data sharing >[!IMPORTANT] ->The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Get started with Update Compliance](../update/update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement). +>The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Get started with Update Compliance](../update/update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/help/4521815/windows-analytics-retirement). To enable data sharing with the Upgrade Readiness solution, double-check the endpoints list in [Enrolling devices in Windows Analytics](../update/windows-analytics-get-started.md#enable-data-sharing) to be sure they are whitelisted. diff --git a/windows/deployment/upgrade/upgrade-readiness-deploy-windows.md b/windows/deployment/upgrade/upgrade-readiness-deploy-windows.md index eb4c1d88d8..7ae486f5d3 100644 --- a/windows/deployment/upgrade/upgrade-readiness-deploy-windows.md +++ b/windows/deployment/upgrade/upgrade-readiness-deploy-windows.md @@ -14,7 +14,7 @@ ms.collection: M365-analytics # Upgrade Readiness - Step 3: Deploy Windows >[!IMPORTANT] ->The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Get started with Update Compliance](../update/update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement). +>The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Get started with Update Compliance](../update/update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/help/4521815/windows-analytics-retirement). All of your work up to now involved reviewing and resolving application and driver issues. Along the way, as you’ve resolved issues and decided which applications and drivers are ready to upgrade, you’ve been building a list of computers that are upgrade ready. The blades in the **Deploy** section are: diff --git a/windows/deployment/upgrade/upgrade-readiness-deployment-script.md b/windows/deployment/upgrade/upgrade-readiness-deployment-script.md index a56896ded3..47787f4477 100644 --- a/windows/deployment/upgrade/upgrade-readiness-deployment-script.md +++ b/windows/deployment/upgrade/upgrade-readiness-deployment-script.md @@ -17,7 +17,7 @@ ms.collection: M365-analytics # Upgrade Readiness deployment script >[!IMPORTANT] ->The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Get started with Update Compliance](../update/update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement). +>The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Get started with Update Compliance](../update/update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/help/4521815/windows-analytics-retirement). To automate the steps provided in [Get started with Upgrade Readiness](upgrade-readiness-get-started.md), and to troubleshoot data sharing issues, you can run the [Upgrade Readiness deployment script](https://go.microsoft.com/fwlink/?LinkID=822966&clcid=0x409), developed by Microsoft. diff --git a/windows/deployment/upgrade/upgrade-readiness-get-started.md b/windows/deployment/upgrade/upgrade-readiness-get-started.md index bbac04bea3..0e4b6350ae 100644 --- a/windows/deployment/upgrade/upgrade-readiness-get-started.md +++ b/windows/deployment/upgrade/upgrade-readiness-get-started.md @@ -19,7 +19,7 @@ ms.collection: M365-analytics # Get started with Upgrade Readiness >[!IMPORTANT] ->The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Get started with Update Compliance](../update/update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement). +>The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Get started with Update Compliance](../update/update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/help/4521815/windows-analytics-retirement). This topic explains how to obtain and configure Upgrade Readiness for your organization. diff --git a/windows/deployment/upgrade/upgrade-readiness-identify-apps.md b/windows/deployment/upgrade/upgrade-readiness-identify-apps.md index 61818a5efc..d726afe37b 100644 --- a/windows/deployment/upgrade/upgrade-readiness-identify-apps.md +++ b/windows/deployment/upgrade/upgrade-readiness-identify-apps.md @@ -14,7 +14,7 @@ ms.collection: M365-analytics # Upgrade Readiness - Step 1: Identify important apps >[!IMPORTANT] ->The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Get started with Update Compliance](../update/update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement). +>The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Get started with Update Compliance](../update/update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/help/4521815/windows-analytics-retirement). This is the first step of the Upgrade Readiness workflow. In this step, applications are listed and grouped by importance level. Setting the importance level enables you to prioritize applications for upgrade. diff --git a/windows/deployment/upgrade/upgrade-readiness-monitor-deployment.md b/windows/deployment/upgrade/upgrade-readiness-monitor-deployment.md index 7fdb58ffe0..76c3f064ee 100644 --- a/windows/deployment/upgrade/upgrade-readiness-monitor-deployment.md +++ b/windows/deployment/upgrade/upgrade-readiness-monitor-deployment.md @@ -16,7 +16,7 @@ ms.collection: M365-analytics # Upgrade Readiness - Step 4: Monitor >[!IMPORTANT] ->The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Get started with Update Compliance](../update/update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement). +>The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Get started with Update Compliance](../update/update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/help/4521815/windows-analytics-retirement). Now that you have started deploying an update with Upgrade Readiness, you can use it to monitor important elements. diff --git a/windows/deployment/upgrade/upgrade-readiness-requirements.md b/windows/deployment/upgrade/upgrade-readiness-requirements.md index 5de1e052e6..b200bd292e 100644 --- a/windows/deployment/upgrade/upgrade-readiness-requirements.md +++ b/windows/deployment/upgrade/upgrade-readiness-requirements.md @@ -16,7 +16,7 @@ ms.collection: M365-analytics # Upgrade Readiness requirements >[!IMPORTANT] ->The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Get started with Update Compliance](../update/update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement). +>The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Get started with Update Compliance](../update/update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/help/4521815/windows-analytics-retirement). This article introduces concepts and steps needed to get up and running with Upgrade Readiness. We recommend that you review this list of requirements before getting started as you may need to collect information, such as account credentials, and get approval from internal IT groups, such as your network security group, before you can start using Upgrade Readiness. diff --git a/windows/deployment/upgrade/upgrade-readiness-resolve-issues.md b/windows/deployment/upgrade/upgrade-readiness-resolve-issues.md index 2c58536bd5..d657b61baa 100644 --- a/windows/deployment/upgrade/upgrade-readiness-resolve-issues.md +++ b/windows/deployment/upgrade/upgrade-readiness-resolve-issues.md @@ -16,7 +16,7 @@ ms.collection: M365-analytics # Upgrade Readiness - Step 2: Resolve app and driver issues >[!IMPORTANT] ->The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Get started with Update Compliance](../update/update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement). +>The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Get started with Update Compliance](../update/update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/help/4521815/windows-analytics-retirement). This section of the Upgrade Readiness workflow reports application and driver inventory and shows you which applications have known issues, which applications have no known issues, and which drivers have issues. We identify applications and drivers that need attention and suggest fixes when we know about them. @@ -107,7 +107,7 @@ If you query with RollupLevel="NamePublisher", each version of the application c > > Upgrade Readiness also has a roll up level of **NamePublisher**, This level enables you to ignore different app versions within your organization for a particular app. In other words, **NamePublisher** displays statistics about a given app, aggregated across all versions. -The following table lists possible values for **ReadyForWindows** and what they mean. For more information, see [What does the Adoption Status mean?](https://developer.microsoft.com/en-us/windows/ready-for-windows#/faq/?scrollTo=faqStatuses) +The following table lists possible values for **ReadyForWindows** and what they mean. For more information, see [What does the Adoption Status mean?](https://developer.microsoft.com/windows/ready-for-windows#/faq/?scrollTo=faqStatuses) | Ready for Windows Status | Query rollup level | What this means | Guidance | |-------------------|--------------------------|-----------------|----------| @@ -174,7 +174,7 @@ Planning and executing an OS upgrade project can be overwhelming. When you are t The Upgrade Readiness proposed action plan is an optimally ordered list of apps and drivers that are in need of review. By testing apps and drivers in the order suggested by the proposed action plan, you are able to increase your number of “Ready to upgrade” computers in an efficient manner. The action plan can be a very powerful tool during upgrade planning – but it’s most helpful when it’s used correctly. This topic explains the proposed action plan, describes how to use it, and calls out a few misconceptions and invalid use cases that you should avoid. -The proposed action plan represents the order thath Microsoft recommends you rationalize the upgrade-readiness of your apps and drivers. By validating apps and drivers in the order proposed, you can ensure that you are testing efficiently. +The proposed action plan represents the order that Microsoft recommends you rationalize the upgrade-readiness of your apps and drivers. By validating apps and drivers in the order proposed, you can ensure that you are testing efficiently. Each item in the proposed action plan represents either an application or a driver that you have not yet marked “Ready to upgrade.” diff --git a/windows/deployment/upgrade/upgrade-readiness-target-new-OS.md b/windows/deployment/upgrade/upgrade-readiness-target-new-OS.md index 78c11d1569..314fd7a5a2 100644 --- a/windows/deployment/upgrade/upgrade-readiness-target-new-OS.md +++ b/windows/deployment/upgrade/upgrade-readiness-target-new-OS.md @@ -14,7 +14,7 @@ ms.collection: M365-analytics # Targeting a new operating system version >[!IMPORTANT] ->The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Get started with Update Compliance](../update/update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement). +>The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Get started with Update Compliance](../update/update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/help/4521815/windows-analytics-retirement). After you've used Upgrade Readiness to help deploy a given version of Windows 10, you might want to use it again to help deploy a newer version of Windows 10. When you change the target operating system version (as described in [Use Upgrade Readiness to manage Windows upgrades](use-upgrade-readiness-to-manage-windows-upgrades.md#target-version)), the app states (Importance, AppOwner, UpgradeDecision, TestPlan, and TestResult) are not reset. Follow this guidance to preserve or reset these states as needed: diff --git a/windows/deployment/upgrade/upgrade-readiness-upgrade-overview.md b/windows/deployment/upgrade/upgrade-readiness-upgrade-overview.md index 78ad55ad25..5a4b7b9357 100644 --- a/windows/deployment/upgrade/upgrade-readiness-upgrade-overview.md +++ b/windows/deployment/upgrade/upgrade-readiness-upgrade-overview.md @@ -14,7 +14,7 @@ ms.collection: M365-analytics # Upgrade Readiness - Upgrade overview >[!IMPORTANT] ->The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Get started with Update Compliance](../update/update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement). +>The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Get started with Update Compliance](../update/update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/help/4521815/windows-analytics-retirement). The first blade in the Upgrade Readiness solution is the upgrade overview blade. This blade displays the total count of computers sharing data with Microsoft, and the count of computers upgraded. As you successfully upgrade computers, the count of computers upgraded increases. diff --git a/windows/deployment/upgrade/use-upgrade-readiness-to-manage-windows-upgrades.md b/windows/deployment/upgrade/use-upgrade-readiness-to-manage-windows-upgrades.md index 8faa48539f..f2fffff9ad 100644 --- a/windows/deployment/upgrade/use-upgrade-readiness-to-manage-windows-upgrades.md +++ b/windows/deployment/upgrade/use-upgrade-readiness-to-manage-windows-upgrades.md @@ -15,7 +15,7 @@ ms.topic: article # Use Upgrade Readiness to manage Windows upgrades >[!IMPORTANT] ->The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Get started with Update Compliance](../update/update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement). +>The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Get started with Update Compliance](../update/update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/help/4521815/windows-analytics-retirement). >[!IMPORTANT] >>**The OMS portal has been deprecated, so you need to switch to the [Azure portal](https://portal.azure.com) now.** The two portals offer the same experience, with some key differences. Learn how to use [Windows Analytics in the Azure Portal](../update/windows-analytics-azure-portal.md). Find out more about the [OMS portal moving to Azure](https://docs.microsoft.com/azure/log-analytics/log-analytics-oms-portal-transition), or jump right in and [Get started with Upgrade Readiness](https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-get-started). diff --git a/windows/deployment/upgrade/windows-error-reporting.md b/windows/deployment/upgrade/windows-error-reporting.md index 77f1ae38b0..499fef06bd 100644 --- a/windows/deployment/upgrade/windows-error-reporting.md +++ b/windows/deployment/upgrade/windows-error-reporting.md @@ -9,7 +9,8 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: deploy -audience: itpro author: greg-lindsay +audience: itpro +author: greg-lindsay ms.localizationpriority: medium ms.topic: article --- @@ -19,7 +20,7 @@ ms.topic: article **Applies to** - Windows 10 ->[!NOTE] +> [!NOTE] > This is a 300 level topic (moderately advanced). > See [Resolve Windows 10 upgrade errors](resolve-windows-10-upgrade-errors.md) for a full list of topics in this article. @@ -28,8 +29,8 @@ When Windows Setup fails, the result and extend code are recorded as an informat To use Windows PowerShell, type the following commands from an elevated Windows PowerShell prompt: ->[!IMPORTANT] ->}The following source will be available only if you have updated from a previous version of Windows 10 to a new version. If you installed the current version and have not updated, the source named **WinSetupDiag02** will be unavailable. +> [!IMPORTANT] +> The following source will be available only if you have updated from a previous version of Windows 10 to a new version. If you installed the current version and have not updated, the source named **WinSetupDiag02** will be unavailable. ```Powershell $events = Get-WinEvent -FilterHashtable @{LogName="Application";ID="1001";Data="WinSetupDiag02"} diff --git a/windows/deployment/windows-10-deployment-posters.md b/windows/deployment/windows-10-deployment-posters.md index 62e8a14537..f36dea21ef 100644 --- a/windows/deployment/windows-10-deployment-posters.md +++ b/windows/deployment/windows-10-deployment-posters.md @@ -25,12 +25,17 @@ The following posters step through various options for deploying Windows 10 with ## Deploy Windows 10 with Autopilot -The Windows Autopilot poster is two pages in portrait mode (11x17). Click the image below to view a PDF in your browser. +The Windows Autopilot poster is two pages in portrait mode (11x17). Click the image to view a PDF in your browser. You can also download this poster in [PDF](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/deployment/media/Windows10AutopilotFlowchart.pdf) or [Visio](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/deployment/media/Windows10Autopilotflowchart.vsdx) format. [![Deploy Windows 10 with Autopilot](./media/windows10-autopilot-flowchart.png)](./media/Windows10AutopilotFlowchart.pdf) ## Deploy Windows 10 with System Center Configuration Manager -The Configuration Manager poster is one page in landscape mode (17x11). Click the image below to view a PDF in your browser. +The Configuration Manager poster is one page in landscape mode (17x11). Click the image to view a PDF in your browser. You can also download this poster in [PDF](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/deployment/media/Windows10DeploymentConfigManager.pdf) or [Visio](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/deployment/media/Windows10DeploymentConfigManager.vsdx) format. -[![Deploy Windows 10 with Configuration Manager](./media/windows10-deployment-config-manager.png)](./media/Windows10DeploymentConfigManager.pdf) \ No newline at end of file +[![Deploy Windows 10 with Configuration Manager](./media/windows10-deployment-config-manager.png)](./media/Windows10DeploymentConfigManager.pdf) + +## See also + +[Overview of Windows Autopilot](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot)
      +[Scenarios to deploy enterprise operating systems with Configuration Manager](https://docs.microsoft.com/sccm/osd/deploy-use/scenarios-to-deploy-enterprise-operating-systems) \ No newline at end of file diff --git a/windows/deployment/windows-autopilot/add-devices.md b/windows/deployment/windows-autopilot/add-devices.md index b76cb0ec72..096ebe1151 100644 --- a/windows/deployment/windows-autopilot/add-devices.md +++ b/windows/deployment/windows-autopilot/add-devices.md @@ -27,7 +27,7 @@ Before deploying a device using Windows Autopilot, the device must be registered ## OEM registration -When you purchase devices directly from an OEM, that OEM can automatically register the devices with the Windows Autopilot deployment service. For the list of OEMs that currently support this, see the "Participant device manufacturers" section of the [Windows Autopilot information page](https://www.microsoft.com/windowsforbusiness/windows-autopilot). +When you purchase devices directly from an OEM, that OEM can automatically register the devices with the Windows Autopilot deployment service. For the list of OEMs that currently support this, see the "Participant device manufacturers and resellers" section of the [Windows Autopilot information page](https://aka.ms/windowsautopilot). Before an OEM can register devices on behalf of an organization, the organization must grant the OEM permission to do so. This process is initiated by the OEM, with approval granted by an Azure AD global administrator from the organization. See the "Customer Consent" section of the [Customer consent page](https://docs.microsoft.com/windows/deployment/windows-autopilot/registration-auth#oem-authorization). diff --git a/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md b/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md index 294a31c04b..42b356bd61 100644 --- a/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md +++ b/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md @@ -653,7 +653,7 @@ Before we can pull an application into Intune to make it part of our AP profile, For the purposes of this lab, we’ll use the Notepad++ tool as our Win32 app. -Download the Notepad++ msi package [here](https://www.hass.de/content/notepad-msi-package-enterprise-deployment-available) and then opy the file to a known location, such as C:\Notepad++msi. +Download the Notepad++ msi package [here](https://www.hass.de/content/notepad-msi-package-enterprise-deployment-available) and then copy the file to a known location, such as C:\Notepad++msi. Run the IntuneWinAppUtil tool, supplying answers to the three questions, for example: @@ -736,7 +736,7 @@ In the **Intune > Client Apps > Apps** pane, select the app package you already Select **Add Group** to open the **Add group** pane that is related to the app. -For our purposes, select *8Required** from the **Assignment type** dropdown menu: +For our purposes, select **Required** from the **Assignment type** dropdown menu: >**Available for enrolled devices** means users install the app from the Company Portal app or Company Portal website. @@ -758,7 +758,7 @@ In the app **Assignments** pane, select **Save**. At this point, you have completed steps to add a Win32 app to Intune. -For more information on adding adds to Intune, see [Intune Standalone - Win32 app management](https://docs.microsoft.com/intune/apps-win32-app-management). +For more information on adding apps to Intune, see [Intune Standalone - Win32 app management](https://docs.microsoft.com/intune/apps-win32-app-management). ### Add Office 365 diff --git a/windows/docfx.json b/windows/docfx.json index 1bac183185..afb77d1e77 100644 --- a/windows/docfx.json +++ b/windows/docfx.json @@ -20,7 +20,17 @@ "_op_documentIdPathDepotMapping": { "./": { "depot_name": "Win.windows" - } + }, + "contributors_to_exclude": [ + "rjagiewich", + "traya1", + "rmca14", + "claydetels19", + "Kellylorenebaker", + "jborsecnik", + "tiburd", + "garycentric" + ], } }, "externalReference": [ diff --git a/windows/keep-secure/docfx.json b/windows/keep-secure/docfx.json index 49eb6c151a..884e478dcb 100644 --- a/windows/keep-secure/docfx.json +++ b/windows/keep-secure/docfx.json @@ -30,6 +30,7 @@ "overwrite": [], "externalReference": [], "globalMetadata": { + "feedback_system": "None", "_op_documentIdPathDepotMapping": { "./": { "depot_name": "MSDN.keep-secure", diff --git a/windows/privacy/gdpr-it-guidance.md b/windows/privacy/gdpr-it-guidance.md index eaa4b6a095..b268fb53f1 100644 --- a/windows/privacy/gdpr-it-guidance.md +++ b/windows/privacy/gdpr-it-guidance.md @@ -26,7 +26,7 @@ Applies to: - Windows 10 Team Edition, version 1703 for Surface Hub - Windows Server 2019 - Windows Server 2016 -- Windows Analytics +- Desktop Analytics This topic provides IT Decision Makers with a basic understanding of the relationship between users in an organization and Microsoft in the context of the GDPR (General Data Protection Regulation). You will also learn what role an IT organization plays for that relationship. @@ -112,8 +112,8 @@ Some examples of diagnostic data include: Diagnostic data is categorized into the levels "Security", "Basic", "Enhanced", and "Full". For a detailed discussion about these diagnostic data levels please see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md). To find more about what information is collected and how it is handled, see [Understanding Windows diagnostic data](configure-windows-diagnostic-data-in-your-organization.md#understanding-windows-diagnostic-data). ->[!IMPORTANT] ->Other Microsoft services as well as 3rd party applications and drivers running on Windows devices may implement their own functionality, independently from Windows, to transport their diagnostic data. Please contact the publisher for further guidance on how to control the diagnostic data collection level and transmission of these applications and services. +> [!IMPORTANT] +> Other Microsoft services as well as 3rd party applications and drivers running on Windows devices may implement their own functionality, independently from Windows, to transport their diagnostic data. Please contact the publisher for further guidance on how to control the diagnostic data collection level and transmission of these applications and services. ### Windows services where Microsoft is the processor under the GDPR @@ -133,11 +133,11 @@ Most Windows 10 services are controller services in terms of the GDPR – for bo Windows [transmits Windows diagnostic data](enhanced-diagnostic-data-windows-analytics-events-and-fields.md) to Microsoft datacenters, where that data is analyzed and stored. With Desktop Analytics, the IT organization can then view the analyzed data to detect and fix issues or to improve their processes for upgrading to Windows 10. As a result, in terms of the GDPR, the organization that has subscribed to Desktop Analytics is acting as the controller, while Microsoft is the processor for Desktop Analytics. ->[!NOTE] ->The IT organization must explicitly enable Desktop Analytics for a device after the organization subscribes. +> [!NOTE] +> The IT organization must explicitly enable Desktop Analytics for a device after the organization subscribes. ->[!IMPORTANT] ->Desktop Analytics does not collect Windows Diagnostic data by itself. Instead, Desktop Analytics only uses a subset of Windows Diagnostic data that is collected by Windows for an enrolled device. The Windows Diagnostic data collection is controlled by the IT department of an organization or the user of a device. See [Enable data sharing for Desktop Analytics](https://docs.microsoft.com/sccm/desktop-analytics/enable-data-sharing) +> [!IMPORTANT] +> Desktop Analytics does not collect Windows Diagnostic data by itself. Instead, Desktop Analytics only uses a subset of Windows Diagnostic data that is collected by Windows for an enrolled device. The Windows Diagnostic data collection is controlled by the IT department of an organization or the user of a device. See [Enable data sharing for Desktop Analytics](https://docs.microsoft.com/sccm/desktop-analytics/enable-data-sharing) #### Windows Defender ATP @@ -145,8 +145,8 @@ As a result, in terms of the GDPR, the organization that has subscribed to Deskt As a result, in terms of the GDPR, the organization that has subscribed to Windows Defender ATP is acting as the controller, while Microsoft is the processor for Windows Defender ATP. ->[!NOTE] ->The IT organization must explicitly enable Windows Defender ATP for a device after the organization subscribes. +> [!NOTE] +> The IT organization must explicitly enable Windows Defender ATP for a device after the organization subscribes. #### At a glance – Windows 10 services GDPR mode of operations @@ -156,7 +156,7 @@ The following table lists in what GDPR mode – controller or processor – Wind | --- | --- | | Windows Functional data | Controller or Processor* | | Windows Diagnostic data | Controller | -| Windows Analytics | Processor | +| Desktop Analytics | Processor | | Windows Defender Advanced Threat Detection (ATP) | Processor | *Table 1: Windows 10 GDPR modes of operations for different Windows 10 services* @@ -178,17 +178,16 @@ Windows diagnostic data collection level for Windows 10 can be set by a user in * For Windows 10, version 1709, and Windows 10, version 1703, the recommended Windows diagnostic level configuration for EEA and Switzerland commercial users is “Basic”. >[!NOTE] ->For Windows 7, Microsoft recommends [configuring enterprise devices for Windows Analytics](/windows/deployment/update/windows-analytics-get-started) to facilitate upgrade planning to Windows 10. +>For Windows 7, Microsoft recommends [using Commercial Data Opt-in setting](/previous-versions/windows/it-pro/windows-7/ee126127(v=ws.10)) to facilitate upgrade planning to Windows 10. -### Additional information for Windows Analytics +### Additional information for Desktop Analytics -Some Windows Analytics solutions and functionality, such as Update Compliance, works with “Basic” as minimum Windows diagnostic level. Other solutions and functionality of Windows Analytics, such as Device Health, require “Enhanced”. +The basic functionality of Desktop Analytics works at the “Basic” diagnostic data level. Other functionality of Desktop Analytics, such as usage or health data for updated devices, require “Enhanced”. -Those organizations who wish to share the smallest set of events for Windows Analytics and have set the Windows diagnostic level to “Enhanced” can use the “Limit Enhanced diagnostic data to the minimum required by Windows Analytics” setting. This filtering mechanism was that Microsoft introduced in Windows 10, version 1709. When enabled, this feature limits the operating system diagnostic data events included in the Enhanced level to the smallest set of data required by Windows Analytics. +Those organizations who wish to share the smallest set of events for Desktop Analytics and have set the Windows diagnostic level to “Enhanced” can use the [“Limit Enhanced diagnostic data to the minimum required by Desktop Analytics”](/windows/privacy/configure-windows-diagnostic-data-in-your-organization#limit-enhanced-diagnostic-data-to-the-minimum-required-by-desktop-analytics) setting. This filtering mechanism was that Microsoft introduced in Windows 10, version 1709. When enabled, this feature limits the operating system diagnostic data events included in the Enhanced level to the smallest set of data required by Desktop Analytics. ->[!NOTE] ->Additional information can be found at [Windows Analytics and privacy](/windows/deployment/update/windows-analytics-privacy -). +> [!NOTE] +> Additional information can be found at [Desktop Analytics and privacy](/sccm/desktop-analytics/privacy). ## Controlling Windows 10 data collection and notification about it @@ -262,8 +261,8 @@ Backups, including live backups and backups that are stored locally within an or Surface Hub is a shared device used within an organization. The device identifier collected as part of diagnostic data is not connected to a user. For removing Windows diagnostic data sent to Microsoft for a Surface Hub, Microsoft created the Surface Hub Delete Diagnostic Data tool available in the Microsoft Store. ->[!NOTE] ->Additional apps running on the device, that are not delivered as part of the in-box experience of Surface Hub, may implement their own diagnostic data collection and transmission functionality independently to collect and process personal data. Please contact the app publisher for further guidance on how to control this. +> [!NOTE] +> Additional apps running on the device, that are not delivered as part of the in-box experience of Surface Hub, may implement their own diagnostic data collection and transmission functionality independently to collect and process personal data. Please contact the app publisher for further guidance on how to control this. An IT administrator can configure privacy- related settings, such as setting the Windows diagnostic data level to Basic. Surface Hub does not support group policy for centralized management; however, IT administrators can use MDM to apply these settings to Surface Hub. For more information about Surface Hub and MDM, please see [Manage settings with an MDM provider](https://docs.microsoft.com/surface-hub/manage-settings-with-mdm-for-surface-hub). @@ -273,8 +272,8 @@ An IT administrator can configure privacy- related settings, such as setting the Personal data protection is one of the goals of the GDPR. One way of improving personal data protection is to use the modern and advanced security features of Windows 10. An IT organization can learn more at [Mitigate threats by using Windows 10 security features](/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10) and [Standards for a highly secure Windows 10 device](https://docs.microsoft.com/windows-hardware/design/device-experiences/oem-highly-secure). ->[!NOTE] ->Some of these features might require a particular Windows hardware, such as a computer with a Trusted Platform Module (TPM) chip, and can depend on a particular Windows product (such as Windows 10 E5). +> [!NOTE] +> Some of these features might require a particular Windows hardware, such as a computer with a Trusted Platform Module (TPM) chip, and can depend on a particular Windows product (such as Windows 10 E5). ### Windows Security Baselines diff --git a/windows/release-information/index.md b/windows/release-information/index.md index 5f7b5e22f9..c6eba252f9 100644 --- a/windows/release-information/index.md +++ b/windows/release-information/index.md @@ -3,7 +3,7 @@ title: Windows 10 - release information description: Learn release information for Windows 10 releases keywords: ["Windows 10", "Windows 10 October 2018 Update"] ms.prod: w10 -layout: LandingPage +layout: LandingPage ms.topic: landing-page ms.mktglfcycl: deploy ms.sitesec: library @@ -11,6 +11,7 @@ author: lizap ms.author: elizapo ms.localizationpriority: high --- + # Windows 10 release information Feature updates for Windows 10 are released twice a year, around March and September, via the Semi-Annual Channel. They will be serviced with monthly quality updates for 18 or 30 months from the date of the release, depending on the lifecycle policy. @@ -19,14 +20,11 @@ We recommend that you begin deployment of each Semi-Annual Channel release immed For information about servicing timelines, see the [Windows lifecycle fact sheet](https://support.microsoft.com/help/13853). ->[!NOTE] ->Beginning with Windows 10, version 1903, this page will no longer list Semi-Annual Channel (Targeted) information for version 1903 and future feature updates. Instead, you will find a single entry for each Semi-Annual Channel release. For more information, see [this blog post](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-Update-for-Business-and-the-retirement-of-SAC-T/ba-p/339523). - +> [!NOTE] +> Beginning with Windows 10, version 1903, you will find a [single entry for each SAC release](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-Update-for-Business-and-the-retirement-of-SAC-T/ba-p/339523).
      - - diff --git a/windows/release-information/resolved-issues-windows-10-1809-and-windows-server-2019.yml b/windows/release-information/resolved-issues-windows-10-1809-and-windows-server-2019.yml index d8ce5f8d4a..fb8c792d7a 100644 --- a/windows/release-information/resolved-issues-windows-10-1809-and-windows-server-2019.yml +++ b/windows/release-information/resolved-issues-windows-10-1809-and-windows-server-2019.yml @@ -54,7 +54,6 @@ sections:
      Zone transfers over TCP may fail
      Zone transfers between primary and secondary DNS servers over the Transmission Control Protocol (TCP) may fail.

      See details >OS Build 17763.475

      May 03, 2019
      KB4495667Resolved
      KB4494441May 14, 2019
      10:00 AM PT
      Latest cumulative update (KB 4495667) installs automatically
      Reports that the optional cumulative update (KB 4495667) installs automatically.

      See details >OS Build 17763.475

      May 03, 2019
      KB4495667Resolved
      May 08, 2019
      03:37 PM PT
      System may be unresponsive after restart if ArcaBit antivirus software installed
      After further investigation ArcaBit has confirmed this issue is not applicable to Windows 10, version 1809

      See details >OS Build 17763.437

      April 09, 2019
      KB4493509Resolved
      May 08, 2019
      03:30 PM PT -
      Custom URI schemes may not start corresponding application
      Custom URI schemes for application protocol handlers may not start the corresponding application.

      See details >OS Build 17763.379

      March 12, 2019
      KB4489899Resolved
      KB4495667May 03, 2019
      10:00 AM PT " @@ -140,7 +139,6 @@ sections: text: " -
      DetailsOriginating updateStatusHistory
      Issue using PXE to start a device from WDS
      After installing KB4489899, there may be issues using the Preboot Execution Environment (PXE) to start a device from a Windows Deployment Services (WDS) server configured to use Variable Window Extension. This may cause the connection to the WDS server to terminate prematurely while downloading the image. This issue does not affect clients or devices that are not using Variable Window Extension. 

      Affected platforms:
      • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 8.1
      • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
      Resolution: This issue was resolved in KB4503327.

      Back to top      		OS Build 17763.379

      March 12, 2019
      KB4489899      		Resolved
      KB4503327      		Resolved:
      June 11, 2019
      10:00 AM PT

      Opened:
      March 12, 2019
      10:00 AM PT
      Custom URI schemes may not start corresponding application
      After installing KB4489899, custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites security zones on Internet Explorer.

      Affected platforms:
      • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 
      • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2008 R2 SP1
      Workaround: Right-click the URL link to open it in a new window or tab, or enable Protected Mode in Internet Explorer for local intranet and trusted sites
      1. Go to Tools > Internet options > Security.
      2. Within Select a zone to view of change security settings, select Local intranet and then select Enable Protected Mode.
      3. Select Trusted Sites and then select Enable Protected Mode. 
      4. Select OK.
      You must restart the browser after making these changes.

      Resolution: This issue is resolved in KB4495667.

      Back to top      		OS Build 17763.379

      March 12, 2019
      KB4489899      		Resolved
      KB4495667      		Resolved:
      May 03, 2019
      10:00 AM PT

      Opened:
      March 12, 2019
      10:00 AM PT
      " diff --git a/windows/release-information/resolved-issues-windows-10-1903.yml b/windows/release-information/resolved-issues-windows-10-1903.yml index 9226fbbd4e..9de5f0a7b9 100644 --- a/windows/release-information/resolved-issues-windows-10-1903.yml +++ b/windows/release-information/resolved-issues-windows-10-1903.yml @@ -32,6 +32,7 @@ sections: - type: markdown text: " + @@ -131,6 +132,7 @@ sections: - type: markdown text: "
      SummaryOriginating updateStatusDate resolved
      Cannot launch Camera app
      Microsoft and Intel have identified an issue affecting Intel RealSense SR300 or Intel RealSense S200 camera apps.

      See details >      		OS Build 18362.116

      May 21, 2019
      KB4505057      		Resolved
      KB4501375      		June 27, 2019
      10:00 AM PT
      Unable to discover or connect to Bluetooth devices using some Qualcomm adapters
      Microsoft has identified compatibility issues with some versions of Qualcomm Bluetooth radio drivers.

      See details >      		OS Build 18362.116

      May 20, 2019
      KB4505057      		Resolved
      KB4517389      		October 08, 2019
      10:00 AM PT
      Safeguard on certain devices with some Intel and Broadcom Wi-Fi adapters
      Some devices with Intel Centrino 6205/6235 and Broadcom 802.11ac Wi-Fi cards may experience compatibility issues.

      See details >      		N/A

      		Resolved
      KB4522355      		October 24, 2019
      10:00 AM PT
      dGPU occasionally disappear from device manager on Surface Book 2
      Some apps or games may close or fail to open on Surface Book 2 devices with Nvidia dGPU.

      See details >      		OS Build 18362.145

      May 29, 2019
      KB4497935      		Resolved
      		October 18, 2019
      04:33 PM PT
      + diff --git a/windows/release-information/status-windows-10-1507.yml b/windows/release-information/status-windows-10-1507.yml index be4512cee7..0e940b2321 100644 --- a/windows/release-information/status-windows-10-1507.yml +++ b/windows/release-information/status-windows-10-1507.yml @@ -60,6 +60,7 @@ sections: - type: markdown text: "
      This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

      DetailsOriginating updateStatusHistory
      Cannot launch Camera app
      Microsoft and Intel have identified an issue affecting Intel RealSense SR300 and Intel RealSense S200 cameras when using the Camera app. After updating to the Windows 10 May 2019 Update and launching the Camera app, you may get an error message stating:
              \"Close other apps, error code: 0XA00F4243.”

      To safeguard your update experience, we have applied a protective hold on machines with Intel RealSense SR300 or Intel RealSense S200 cameras installed from being offered Windows 10, version 1903, until this issue is resolved.

      Affected platforms:
      • Client: Windows 10, version 1903
      Resolution: This issue was resolved in KB4501375 and the safeguard hold has been removed.

      Back to top      		OS Build 18362.116

      May 21, 2019
      KB4505057      		Resolved
      KB4501375      		Resolved:
      June 27, 2019
      10:00 AM PT

      Opened:
      May 21, 2019
      07:20 AM PT
      Windows Sandbox may fail to start with error code “0x80070002”
      Windows Sandbox may fail to start with \"ERROR_FILE_NOT_FOUND (0x80070002)\" on devices in which the operating system language is changed during the update process when installing Windows 10, version 1903.

      Affected platforms:
      • Client: Windows 10, version 1903
      Resolution: This issue was resolved in KB4512941.

      Back to top      		OS Build 18362.116

      May 20, 2019
      KB4505057      		Resolved
      KB4512941      		Resolved:
      August 30, 2019
      10:00 AM PT

      Opened:
      May 24, 2019
      04:20 PM PT
      Display brightness may not respond to adjustments
      Microsoft and Intel have identified a driver compatibility issue on devices configured with certain Intel display drivers. After updating to Windows 10, version 1903, brightness settings may sometime appear as if changes applied took effect, yet the actual display brightness doesn't change.

      To safeguard your update experience, we have applied a compatibility hold on devices with certain Intel drivers from being offered Windows 10, version 1903, until this issue is resolved.

      Affected platforms:
      • Client: Windows 10, version 1903
      Resolution: This issue was resolved in KB4505903 and the safeguard hold has been removed. Please ensure you have applied the resolving update before attempting to update to the Windows 10 May 2019 Update (version 1903). Please note, it can take up to 48 hours for the safeguard to be removed.

      Back to top      		OS Build 18362.116

      May 21, 2019
      KB4505057      		Resolved
      KB4505903      		Resolved:
      July 26, 2019
      02:00 PM PT

      Opened:
      May 21, 2019
      07:56 AM PT
      Loss of functionality in Dynabook Smartphone Link app
      Some users may experience a loss of functionality after updating to Windows 10, version 1903 when using the Dynabook Smartphone Link application on Windows devices. Loss of functionality may affect the display of phone numbers in the Call menu and the ability to answer phone calls on the Windows PC.

      To safeguard your update experience, we have applied a compatibility hold on devices with Dynabook Smartphone Link from being offered Windows 10, version 1903, until this issue is resolved.

      Affected platforms:
      • Client: Windows 10, version 1903
      Resolution: This issue is now resolved and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to Windows 10, version 1903.

      Back to top      		OS Build 18362.116

      May 20, 2019
      KB4505057      		Resolved
      		Resolved:
      July 11, 2019
      01:54 PM PT

      Opened:
      May 24, 2019
      03:10 PM PT
      +
      SummaryOriginating updateStatusLast updated
      TLS connections might fail or timeout
      Transport Layer Security (TLS) connections might fail or timeout when connecting or attempting a resumption.

      See details >      		OS Build 10240.18368

      October 08, 2019
      KB4520011      		Mitigated External
      		November 05, 2019
      03:36 PM PT
      Intermittent issues when printing
      The print spooler service may intermittently have issues completing a print job and results print job failure.

      See details >      		OS Build 10240.18334

      September 23, 2019
      KB4522009      		Resolved
      KB4520011      		October 08, 2019
      10:00 AM PT
      Certain operations performed on a Cluster Shared Volume may fail
      Operations performed on files or folders on a CSV may fail with the error: STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5).

      See details >      		OS Build 10240.18094

      January 08, 2019
      KB4480962      		Mitigated
      		April 25, 2019
      02:00 PM PT
      @@ -72,6 +73,15 @@ sections:
      " +- title: November 2019 +- items: + - type: markdown + text: " + + +
      DetailsOriginating updateStatusHistory
      TLS connections might fail or timeout
      Updates for Windows released October 8, 2019 or later provide protections, tracked by CVE-2019-1318, against an attack that could allow unauthorized access to information or data within TLS connections. This type of attack is known as a man-in-the-middle exploit. Windows might fail to connect to TLS clients and servers that do not support Extended Master Secret for resumption (RFC 7627). Lack of RFC support might cause one or more of the following errors or logged events:
      • \"The request was aborted: Could not create SSL/TLS secure Channel\"
      • SCHANNEL event 36887 is logged in the System event log with the description, \"A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 20.​\"
      Affected platforms:
      • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
      • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2

      Next Steps: Connections between two devices running any supported version of Windows should not have this issue when fully updated. There is no update for Windows needed for this issue. These changes are required to address a security issue and security compliance. For information, see KB4528489.

      Back to top      		OS Build 10240.18368

      October 08, 2019
      KB4520011      		Mitigated External
      		Last updated:
      November 05, 2019
      03:36 PM PT

      Opened:
      November 05, 2019
      03:36 PM PT
      + " + - title: September 2019 - items: - type: markdown diff --git a/windows/release-information/status-windows-10-1607-and-windows-server-2016.yml b/windows/release-information/status-windows-10-1607-and-windows-server-2016.yml index c75ec5b5a9..d3cf6d65f2 100644 --- a/windows/release-information/status-windows-10-1607-and-windows-server-2016.yml +++ b/windows/release-information/status-windows-10-1607-and-windows-server-2016.yml @@ -60,6 +60,7 @@ sections: - type: markdown text: "
      This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

      + @@ -74,6 +75,15 @@ sections:
      " +- title: November 2019 +- items: + - type: markdown + text: " +
      SummaryOriginating updateStatusLast updated
      TLS connections might fail or timeout
      Transport Layer Security (TLS) connections might fail or timeout when connecting or attempting a resumption.

      See details >      		OS Build 14393.3274

      October 08, 2019
      KB4519998      		Mitigated External
      		November 05, 2019
      03:36 PM PT
      Intermittent issues when printing
      The print spooler service may intermittently have issues completing a print job and results print job failure.

      See details >      		OS Build 14393.3206

      September 23, 2019
      KB4522010      		Resolved
      KB4519998      		October 08, 2019
      10:00 AM PT
      Certain operations performed on a Cluster Shared Volume may fail
      Operations performed on files or folders on a CSV may fail with the error: STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5).

      See details >      		OS Build 14393.2724

      January 08, 2019
      KB4480961      		Mitigated
      		April 25, 2019
      02:00 PM PT
      Windows may not start on certain Lenovo and Fujitsu laptops with less than 8GB of RAM
      Windows may fail to start on certain Lenovo and Fujitsu laptops that have less than 8 GB of RAM.

      See details >      		OS Build 14393.2608

      November 13, 2018
      KB4467691      		Mitigated
      		February 19, 2019
      10:00 AM PT
      + +
      DetailsOriginating updateStatusHistory
      TLS connections might fail or timeout
      Updates for Windows released October 8, 2019 or later provide protections, tracked by CVE-2019-1318, against an attack that could allow unauthorized access to information or data within TLS connections. This type of attack is known as a man-in-the-middle exploit. Windows might fail to connect to TLS clients and servers that do not support Extended Master Secret for resumption (RFC 7627). Lack of RFC support might cause one or more of the following errors or logged events:
      • \"The request was aborted: Could not create SSL/TLS secure Channel\"
      • SCHANNEL event 36887 is logged in the System event log with the description, \"A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 20.​\"
      Affected platforms:
      • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
      • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2

      Next Steps: Connections between two devices running any supported version of Windows should not have this issue when fully updated. There is no update for Windows needed for this issue. These changes are required to address a security issue and security compliance. For information, see KB4528489.

      Back to top      		OS Build 14393.3274

      October 08, 2019
      KB4519998      		Mitigated External
      		Last updated:
      November 05, 2019
      03:36 PM PT

      Opened:
      November 05, 2019
      03:36 PM PT
      + " + - title: September 2019 - items: - type: markdown diff --git a/windows/release-information/status-windows-10-1703.yml b/windows/release-information/status-windows-10-1703.yml index 9b774ca109..5ad1df7093 100644 --- a/windows/release-information/status-windows-10-1703.yml +++ b/windows/release-information/status-windows-10-1703.yml @@ -21,7 +21,7 @@ sections: Find information on known issues for Windows 10, version 1703. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s). -
      Windows 10, version 1703 has reached end of service
      Consumer and commercial editions of Windows 10, version 1703 have reached end of service. As devices running these editions are no longer receiving monthly security and quality updates containing protections from the latest security threats, we recommend that you update these devices to the latest version of Windows 10 immediately. For more information on end of service dates currently supported versions of Windows 10, see the Windows lifecycle fact sheet.
      +
      Windows 10, version 1703 has reached end of service
      Consumer and commercial editions of Windows 10, version 1703 have reached end of service. Devices running these editions are no longer receiving monthly security and quality updates containing protections from the latest security threats. We recommend that you update these devices to the latest version of Windows 10 immediately. For more information on end of service dates currently supported versions of Windows 10, see the Windows lifecycle fact sheet.

      Note This page will be retired on Tuesday, November 12, 2019.
      " diff --git a/windows/release-information/status-windows-10-1709.yml b/windows/release-information/status-windows-10-1709.yml index 217b281dbc..01a0e958ec 100644 --- a/windows/release-information/status-windows-10-1709.yml +++ b/windows/release-information/status-windows-10-1709.yml @@ -60,6 +60,8 @@ sections: - type: markdown text: "
      This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

      + +
      SummaryOriginating updateStatusLast updated
      TLS connections might fail or timeout
      Transport Layer Security (TLS) connections might fail or timeout when connecting or attempting a resumption.

      See details >      		OS Build 16299.1451

      October 08, 2019
      KB4520004      		Mitigated External
      		November 05, 2019
      03:36 PM PT
      Unable to create local users in Chinese, Japanese and Korean during device setup
      You might be unable to create users in Chinese, Japanese and Korean using Input Method Editor (IME) during OOBE.

      See details >      		OS Build 16299.1387

      September 10, 2019
      KB4516066      		Mitigated
      		October 29, 2019
      05:15 PM PT
      Intermittent issues when printing
      The print spooler service may intermittently have issues completing a print job and results print job failure.

      See details >      		OS Build 16299.1392

      September 23, 2019
      KB4522012      		Resolved
      KB4520004      		October 08, 2019
      10:00 AM PT
      Certain operations performed on a Cluster Shared Volume may fail
      Operations performed on files or folders on a CSV may fail with the error: STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5).

      See details >      		OS Build 16299.904

      January 08, 2019
      KB4480978      		Mitigated
      		April 25, 2019
      02:00 PM PT
      @@ -72,6 +74,24 @@ sections:
      " +- title: November 2019 +- items: + - type: markdown + text: " + + +
      DetailsOriginating updateStatusHistory
      TLS connections might fail or timeout
      Updates for Windows released October 8, 2019 or later provide protections, tracked by CVE-2019-1318, against an attack that could allow unauthorized access to information or data within TLS connections. This type of attack is known as a man-in-the-middle exploit. Windows might fail to connect to TLS clients and servers that do not support Extended Master Secret for resumption (RFC 7627). Lack of RFC support might cause one or more of the following errors or logged events:
      • \"The request was aborted: Could not create SSL/TLS secure Channel\"
      • SCHANNEL event 36887 is logged in the System event log with the description, \"A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 20.​\"
      Affected platforms:
      • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
      • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2

      Next Steps: Connections between two devices running any supported version of Windows should not have this issue when fully updated. There is no update for Windows needed for this issue. These changes are required to address a security issue and security compliance. For information, see KB4528489.

      Back to top      		OS Build 16299.1451

      October 08, 2019
      KB4520004      		Mitigated External
      		Last updated:
      November 05, 2019
      03:36 PM PT

      Opened:
      November 05, 2019
      03:36 PM PT
      + " + +- title: October 2019 +- items: + - type: markdown + text: " + + +
      DetailsOriginating updateStatusHistory
      Unable to create local users in Chinese, Japanese and Korean during device setup
      When setting up a new Windows device using the Out of Box Experience (OOBE), you might be unable to create a local user when using Input Method Editor (IME). This issue might affect you if you are using the IME for Chinese, Japanese, or Korean languages.

      Note This issue does not affect using a Microsoft Account during OOBE.

      Affected platforms:
      • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709
      • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709
      Workaround: To mitigate this issue, set the keyboard language to English during user creation or use a Microsoft Account to complete OOBE. You can set the keyboard language back to your preferred language after user creation. Once the OOBE is done and you are at the desktop, you can rename the current user using these instructions. If you prefer to create a new local user, see KB4026923.

      Next steps: We are working on a resolution and estimate a solution will be available in late November.

      Back to top      		OS Build 16299.1387

      September 10, 2019
      KB4516066      		Mitigated
      		Last updated:
      October 29, 2019
      05:15 PM PT

      Opened:
      October 29, 2019
      05:15 PM PT
      + " + - title: September 2019 - items: - type: markdown diff --git a/windows/release-information/status-windows-10-1803.yml b/windows/release-information/status-windows-10-1803.yml index 9480e53e4d..4fa63b7381 100644 --- a/windows/release-information/status-windows-10-1803.yml +++ b/windows/release-information/status-windows-10-1803.yml @@ -64,6 +64,8 @@ sections: - type: markdown text: "
      This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

      + + @@ -78,6 +80,24 @@ sections:
      " +- title: November 2019 +- items: + - type: markdown + text: " +
      SummaryOriginating updateStatusLast updated
      TLS connections might fail or timeout
      Transport Layer Security (TLS) connections might fail or timeout when connecting or attempting a resumption.

      See details >      		OS Build 17134.1069

      October 08, 2019
      KB4520008      		Mitigated External
      		November 05, 2019
      03:36 PM PT
      Unable to create local users in Chinese, Japanese and Korean during device setup
      You might be unable to create users in Chinese, Japanese and Korean using Input Method Editor (IME) during OOBE.

      See details >      		OS Build 17134.1006

      September 10, 2019
      KB4516058      		Mitigated
      		October 29, 2019
      05:15 PM PT
      Windows Mixed Reality Portal users may intermittently receive a 15-5 error code
      You may receive a 15-5 error code in Windows Mixed Reality Portal and your headset may not wake up from sleep.

      See details >      		OS Build 17134.950

      August 13, 2019
      KB4512501      		Resolved
      KB4519978      		October 15, 2019
      10:00 AM PT
      Startup to a black screen after installing updates
      Your device may startup to a black screen during the first logon after installing updates.

      See details >      		OS Build 17134.829

      June 11, 2019
      KB4503286      		Resolved
      KB4519978      		October 15, 2019
      10:00 AM PT
      Intermittent issues when printing
      The print spooler service may intermittently have issues completing a print job and results print job failure.

      See details >      		OS Build 17134.1009

      September 23, 2019
      KB4522014      		Resolved
      KB4520008      		October 08, 2019
      10:00 AM PT
      + +
      DetailsOriginating updateStatusHistory
      TLS connections might fail or timeout
      Updates for Windows released October 8, 2019 or later provide protections, tracked by CVE-2019-1318, against an attack that could allow unauthorized access to information or data within TLS connections. This type of attack is known as a man-in-the-middle exploit. Windows might fail to connect to TLS clients and servers that do not support Extended Master Secret for resumption (RFC 7627). Lack of RFC support might cause one or more of the following errors or logged events:
      • \"The request was aborted: Could not create SSL/TLS secure Channel\"
      • SCHANNEL event 36887 is logged in the System event log with the description, \"A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 20.​\"
      Affected platforms:
      • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
      • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2

      Next Steps: Connections between two devices running any supported version of Windows should not have this issue when fully updated. There is no update for Windows needed for this issue. These changes are required to address a security issue and security compliance. For information, see KB4528489.

      Back to top      		OS Build 17134.1069

      October 08, 2019
      KB4520008      		Mitigated External
      		Last updated:
      November 05, 2019
      03:36 PM PT

      Opened:
      November 05, 2019
      03:36 PM PT
      + " + +- title: October 2019 +- items: + - type: markdown + text: " + + +
      DetailsOriginating updateStatusHistory
      Unable to create local users in Chinese, Japanese and Korean during device setup
      When setting up a new Windows device using the Out of Box Experience (OOBE), you might be unable to create a local user when using Input Method Editor (IME). This issue might affect you if you are using the IME for Chinese, Japanese, or Korean languages.

      Note This issue does not affect using a Microsoft Account during OOBE.

      Affected platforms:
      • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709
      • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709
      Workaround: To mitigate this issue, set the keyboard language to English during user creation or use a Microsoft Account to complete OOBE. You can set the keyboard language back to your preferred language after user creation. Once the OOBE is done and you are at the desktop, you can rename the current user using these instructions. If you prefer to create a new local user, see KB4026923.

      Next steps: We are working on a resolution and estimate a solution will be available in late November.

      Back to top      		OS Build 17134.1006

      September 10, 2019
      KB4516058      		Mitigated
      		Last updated:
      October 29, 2019
      05:15 PM PT

      Opened:
      October 29, 2019
      05:15 PM PT
      + " + - title: September 2019 - items: - type: markdown diff --git a/windows/release-information/status-windows-10-1809-and-windows-server-2019.yml b/windows/release-information/status-windows-10-1809-and-windows-server-2019.yml index 101cc52d36..fcc5aa3645 100644 --- a/windows/release-information/status-windows-10-1809-and-windows-server-2019.yml +++ b/windows/release-information/status-windows-10-1809-and-windows-server-2019.yml @@ -64,6 +64,8 @@ sections: - type: markdown text: "
      This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

      + + @@ -80,11 +82,21 @@ sections:
      " +- title: November 2019 +- items: + - type: markdown + text: " +
      SummaryOriginating updateStatusLast updated
      TLS connections might fail or timeout
      Transport Layer Security (TLS) connections might fail or timeout when connecting or attempting a resumption.

      See details >      		OS Build 17763.805

      October 08, 2019
      KB4519338      		Mitigated External
      		November 05, 2019
      03:36 PM PT
      Unable to create local users in Chinese, Japanese and Korean during device setup
      You might be unable to create users in Chinese, Japanese and Korean using Input Method Editor (IME) during OOBE.

      See details >      		OS Build 17763.737

      September 10, 2019
      KB4512578      		Mitigated
      		October 29, 2019
      05:15 PM PT
      Microsoft Defender Advanced Threat Protection might stop running
      The Microsoft Defender ATP service might stop running and might fail to send reporting data.

      See details >      		OS Build 17763.832

      October 15, 2019
      KB4520062      		Investigating
      		October 18, 2019
      04:23 PM PT
      Windows Mixed Reality Portal users may intermittently receive a 15-5 error code
      You may receive a 15-5 error code in Windows Mixed Reality Portal and your headset may not wake up from sleep.

      See details >      		OS Build 17763.678

      August 13, 2019
      KB4511553      		Resolved
      KB4520062      		October 15, 2019
      10:00 AM PT
      Startup to a black screen after installing updates
      Your device may startup to a black screen during the first logon after installing updates.

      See details >      		OS Build 17763.557

      June 11, 2019
      KB4503327      		Resolved
      KB4520062      		October 15, 2019
      10:00 AM PT
      + +
      DetailsOriginating updateStatusHistory
      TLS connections might fail or timeout
      Updates for Windows released October 8, 2019 or later provide protections, tracked by CVE-2019-1318, against an attack that could allow unauthorized access to information or data within TLS connections. This type of attack is known as a man-in-the-middle exploit. Windows might fail to connect to TLS clients and servers that do not support Extended Master Secret for resumption (RFC 7627). Lack of RFC support might cause one or more of the following errors or logged events:
      • \"The request was aborted: Could not create SSL/TLS secure Channel\"
      • SCHANNEL event 36887 is logged in the System event log with the description, \"A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 20.​\"
      Affected platforms:
      • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
      • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2

      Next Steps: Connections between two devices running any supported version of Windows should not have this issue when fully updated. There is no update for Windows needed for this issue. These changes are required to address a security issue and security compliance. For information, see KB4528489.

      Back to top      		OS Build 17763.805

      October 08, 2019
      KB4519338      		Mitigated External
      		Last updated:
      November 05, 2019
      03:36 PM PT

      Opened:
      November 05, 2019
      03:36 PM PT
      + " + - title: October 2019 - items: - type: markdown text: " +
      DetailsOriginating updateStatusHistory
      Unable to create local users in Chinese, Japanese and Korean during device setup
      When setting up a new Windows device using the Out of Box Experience (OOBE), you might be unable to create a local user when using Input Method Editor (IME). This issue might affect you if you are using the IME for Chinese, Japanese, or Korean languages.

      Note This issue does not affect using a Microsoft Account during OOBE.

      Affected platforms:
      • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709
      • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709
      Workaround: To mitigate this issue, set the keyboard language to English during user creation or use a Microsoft Account to complete OOBE. You can set the keyboard language back to your preferred language after user creation. Once the OOBE is done and you are at the desktop, you can rename the current user using these instructions. If you prefer to create a new local user, see KB4026923.

      Next steps: We are working on a resolution and estimate a solution will be available in late November.

      Back to top      		OS Build 17763.737

      September 10, 2019
      KB4512578      		Mitigated
      		Last updated:
      October 29, 2019
      05:15 PM PT

      Opened:
      October 29, 2019
      05:15 PM PT
      Microsoft Defender Advanced Threat Protection might stop running
      After installing the optional non-security update (KB4520062), the Microsoft Defender Advanced Threat Protection (ATP) service might stop running and might fail to send reporting data. You might also receive a 0xc0000409 error in Event Viewer on MsSense.exe.

      Note Microsoft Windows Defender Antivirus is not affected by this issue.

      Affected platforms:
      • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019
      • Server: Windows Server, version 1809; Windows Server 2019
      Next steps: At this time, we suggest that devices in an affected environment do not install the optional non-security update, KB4520062. We are working on a resolution and estimate a solution will be available in mid-November.

      Back to top      		OS Build 17763.832

      October 15, 2019
      KB4520062      		Investigating
      		Last updated:
      October 18, 2019
      04:23 PM PT

      Opened:
      October 17, 2019
      05:14 PM PT
      " diff --git a/windows/release-information/status-windows-10-1903.yml b/windows/release-information/status-windows-10-1903.yml index f60396039a..d0dd443d7e 100644 --- a/windows/release-information/status-windows-10-1903.yml +++ b/windows/release-information/status-windows-10-1903.yml @@ -64,17 +64,18 @@ sections: - type: markdown text: "
      This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

      + + + - - + -
      SummaryOriginating updateStatusLast updated
      TLS connections might fail or timeout
      Transport Layer Security (TLS) connections might fail or timeout when connecting or attempting a resumption.

      See details >      		OS Build 18362.418

      October 08, 2019
      KB4517389      		Mitigated External
      		November 05, 2019
      03:36 PM PT
      Unable to create local users in Chinese, Japanese and Korean during device setup
      You might be unable to create users in Chinese, Japanese and Korean using Input Method Editor (IME) during OOBE.

      See details >      		OS Build 18362.356

      September 10, 2019
      KB4515384      		Mitigated
      		October 29, 2019
      05:15 PM PT
      Cannot launch Camera app
      Microsoft and Intel have identified an issue affecting Intel RealSense SR300 or Intel RealSense S200 camera apps.

      See details >      		OS Build 18362.116

      May 21, 2019
      KB4505057      		Resolved
      KB4501375      		June 27, 2019
      10:00 AM PT
      Unable to discover or connect to Bluetooth devices using some Qualcomm adapters
      Microsoft has identified compatibility issues with some versions of Qualcomm Bluetooth radio drivers.

      See details >      		OS Build 18362.116

      May 20, 2019
      KB4505057      		Resolved
      KB4517389      		October 08, 2019
      10:00 AM PT
      Unable to discover or connect to Bluetooth devices using some Realtek adapters
      Microsoft has identified compatibility issues with some versions of Realtek Bluetooth radio drivers.

      See details >      		OS Build 18362.116

      May 21, 2019
      KB4505057      		Mitigated
      		October 25, 2019
      04:21 PM PT
      Safeguard on certain devices with some Intel and Broadcom Wi-Fi adapters
      Some devices with Intel Centrino 6205/6235 and Broadcom 802.11ac Wi-Fi cards may experience compatibility issues.

      See details >      		N/A

      		Resolved
      KB4522355      		October 24, 2019
      10:00 AM PT
      dGPU occasionally disappear from device manager on Surface Book 2
      Some apps or games may close or fail to open on Surface Book 2 devices with Nvidia dGPU.

      See details >      		OS Build 18362.145

      May 29, 2019
      KB4497935      		Resolved
      		October 18, 2019
      04:33 PM PT
      Intermittent issues when printing
      The print spooler service may intermittently have issues completing a print job and results print job failure.

      See details >      		OS Build 18362.357

      September 23, 2019
      KB4522016      		Resolved
      KB4517389      		October 08, 2019
      10:00 AM PT
      Audio in games is quiet or different than expected
      Microsoft has received reports that audio in certain games is quieter or different than expected.

      See details >      		OS Build 18362.356

      September 10, 2019
      KB4515384      		Resolved
      KB4517211      		September 26, 2019
      02:00 PM PT
      Updates may fail to install and you may receive Error 0x80073701
      Installation of updates may fail and you may receive error code 0x80073701.

      See details >      		OS Build 18362.145

      May 29, 2019
      KB4497935      		Investigating
      		August 16, 2019
      04:28 PM PT
      Intermittent loss of Wi-Fi connectivity
      Some older devices may experience loss of Wi-Fi connectivity due to an outdated Qualcomm driver.

      See details >      		OS Build 18362.116

      May 21, 2019
      KB4505057      		Mitigated External
      		August 01, 2019
      08:44 PM PT
      Gamma ramps, color profiles, and night light settings do not apply in some cases
      Microsoft has identified some scenarios where gamma ramps, color profiles and night light settings may stop working.

      See details >      		OS Build 18362.116

      May 21, 2019
      KB4505057      		Mitigated
      		August 01, 2019
      06:27 PM PT
      Gamma ramps, color profiles, and night light settings do not apply in some cases
      Microsoft has identified some scenarios where gamma ramps, color profiles and night light settings may stop working.

      See details >      		OS Build 18362.116

      May 21, 2019
      KB4505057      		Mitigated
      KB4505903      		August 01, 2019
      06:27 PM PT
      Intel Audio displays an intcdaud.sys notification
      Devices with a range of Intel Display Audio device drivers may experience battery drain.

      See details >      		OS Build 18362.116

      May 21, 2019
      KB4505057      		Mitigated
      		May 21, 2019
      04:47 PM PT
      Cannot launch Camera app
      Microsoft and Intel have identified an issue affecting Intel RealSense SR300 or Intel RealSense S200 camera apps.

      See details >      		OS Build 18362.116

      May 21, 2019
      KB4505057      		Mitigated
      		May 21, 2019
      04:47 PM PT
      " @@ -85,11 +86,21 @@ sections:
      " +- title: November 2019 +- items: + - type: markdown + text: " + + +
      DetailsOriginating updateStatusHistory
      TLS connections might fail or timeout
      Updates for Windows released October 8, 2019 or later provide protections, tracked by CVE-2019-1318, against an attack that could allow unauthorized access to information or data within TLS connections. This type of attack is known as a man-in-the-middle exploit. Windows might fail to connect to TLS clients and servers that do not support Extended Master Secret for resumption (RFC 7627). Lack of RFC support might cause one or more of the following errors or logged events:
      • \"The request was aborted: Could not create SSL/TLS secure Channel\"
      • SCHANNEL event 36887 is logged in the System event log with the description, \"A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 20.​\"
      Affected platforms:
      • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
      • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2

      Next Steps: Connections between two devices running any supported version of Windows should not have this issue when fully updated. There is no update for Windows needed for this issue. These changes are required to address a security issue and security compliance. For information, see KB4528489.

      Back to top      		OS Build 18362.418

      October 08, 2019
      KB4517389      		Mitigated External
      		Last updated:
      November 05, 2019
      03:36 PM PT

      Opened:
      November 05, 2019
      03:36 PM PT
      + " + - title: October 2019 - items: - type: markdown text: " +
      DetailsOriginating updateStatusHistory
      Unable to create local users in Chinese, Japanese and Korean during device setup
      When setting up a new Windows device using the Out of Box Experience (OOBE), you might be unable to create a local user when using Input Method Editor (IME). This issue might affect you if you are using the IME for Chinese, Japanese, or Korean languages.

      Note This issue does not affect using a Microsoft Account during OOBE.

      Affected platforms:
      • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709
      • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709
      Workaround: To mitigate this issue, set the keyboard language to English during user creation or use a Microsoft Account to complete OOBE. You can set the keyboard language back to your preferred language after user creation. Once the OOBE is done and you are at the desktop, you can rename the current user using these instructions. If you prefer to create a new local user, see KB4026923.

      Next steps: We are working on a resolution and estimate a solution will be available in late November.

      Back to top      		OS Build 18362.356

      September 10, 2019
      KB4515384      		Mitigated
      		Last updated:
      October 29, 2019
      05:15 PM PT

      Opened:
      October 29, 2019
      05:15 PM PT
      Unable to discover or connect to Bluetooth devices using some Qualcomm adapters
      Microsoft has identified compatibility issues with some driver versions for Bluetooth radios made by Qualcomm. To safeguard your update experience, we have applied a compatibility hold on devices with affected driver versions for Qualcomm Bluetooth radios from being offered Windows 10, version 1903 or Windows Server, version 1903 until the driver has been updated.

      Affected platforms:
      • Client: Windows 10, version 1903
      • Server: Windows Server, version 1903
      Resolution: This issue was resolved in KB4517389 and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1903 or Windows Server, version 1903.

      Back to top      		OS Build 18362.116

      May 20, 2019
      KB4505057      		Resolved
      KB4517389      		Resolved:
      October 08, 2019
      10:00 AM PT

      Opened:
      October 25, 2019
      04:21 PM PT
      " @@ -101,7 +112,6 @@ sections: -
      DetailsOriginating updateStatusHistory
      Safeguard on certain devices with some Intel and Broadcom Wi-Fi adapters
      Microsoft and NEC have found incompatibility issues with Intel Centrino 6205/6235 and Broadcom 802.11ac Wi-Fi cards when running Windows 10, version 1903 on specific models of NEC devices. If these devices are updated to Windows 10, version 1903, they will no longer be able to use any Wi-Fi connections. The Wi-Fi driver may have a yellow exclamation point in device manager. The task tray icon for networking may show the icon for no internet and Network & Internet settings may not show any Wi-Fi networks.

      To safeguard your update experience, we have applied a compatibility hold on the affected devices from being offered Windows 10, version 1903.

      Affected platforms:
      • Client: Windows 10, version 1903
      Resolution: This issue was resolved in KB4522355. The safeguard hold is estimated to be removed in mid-November.

      Back to top      		N/A

      		Resolved
      KB4522355      		Resolved:
      October 24, 2019
      10:00 AM PT

      Opened:
      September 13, 2019
      05:25 PM PT
      Intermittent issues when printing
      Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
      • Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver.
      • The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
      Affected platforms:
      • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
      • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
      Resolution: This issue was resolved in KB4517389.

      Back to top      		OS Build 18362.357

      September 23, 2019
      KB4522016      		Resolved
      KB4517389      		Resolved:
      October 08, 2019
      10:00 AM PT

      Opened:
      September 30, 2019
      06:26 PM PT
      Audio in games is quiet or different than expected
      Microsoft has received reports that audio in certain games is quieter or different than expected. At the request of some of our audio partners, we implemented a compatibility change that enabled certain games to query support and render multi-channel audio. Due to customer feedback, we are reverting this change as some games and some devices are not rendering multi-channel audio as expected. This may result in games sounding different than customers are used to and may have missing channels.

      Affected platforms:
      • Client: Windows 10, version 1903
      Resolution: This issue was resolved in KB4517211.

      Back to top      		OS Build 18362.356

      September 10, 2019
      KB4515384      		Resolved
      KB4517211      		Resolved:
      September 26, 2019
      02:00 PM PT

      Opened:
      September 13, 2019
      05:25 PM PT
      " @@ -128,10 +138,10 @@ sections: - type: markdown text: " + - + -
      DetailsOriginating updateStatusHistory
      Cannot launch Camera app
      Microsoft and Intel have identified an issue affecting Intel RealSense SR300 and Intel RealSense S200 cameras when using the Camera app. After updating to the Windows 10 May 2019 Update and launching the Camera app, you may get an error message stating:
              \"Close other apps, error code: 0XA00F4243.”

      To safeguard your update experience, we have applied a protective hold on machines with Intel RealSense SR300 or Intel RealSense S200 cameras installed from being offered Windows 10, version 1903, until this issue is resolved.

      Affected platforms:
      • Client: Windows 10, version 1903
      Resolution: This issue was resolved in KB4501375 and the safeguard hold has been removed.

      Back to top      		OS Build 18362.116

      May 21, 2019
      KB4505057      		Resolved
      KB4501375      		Resolved:
      June 27, 2019
      10:00 AM PT

      Opened:
      May 21, 2019
      07:20 AM PT
      Unable to discover or connect to Bluetooth devices using some Realtek adapters
      Microsoft has identified compatibility issues with some driver versions for Bluetooth radios made by Realtek. To safeguard your update experience, we have applied a compatibility hold on devices with affected driver versions for Realtek Bluetooth radios from being offered Windows 10, version 1903 or Windows Server, version 1903 until the driver has been updated.

      Affected platforms:
      • Client: Windows 10, version 1903
      • Server: Windows Server, version 1903
      Workaround: Check with your device manufacturer (OEM) to see if an updated driver is available and install it. You will need to install a Realtek driver version greater than 1.5.1011.0.

      Note Until an updated driver has been installed, we recommend you do not attempt to manually update using the Update now button or the Media Creation Tool. 

      Next steps: Microsoft is working with Realtek to release new drivers for all affected system via Windows Update.

      October 25, 2019 note This issue was previously grouped with the Qualcomm radio issue, which is now resolved. There is no change to this issue except to remove reference to Qualcomm.

      Back to top      		OS Build 18362.116

      May 21, 2019
      KB4505057      		Mitigated
      		Last updated:
      October 25, 2019
      04:21 PM PT

      Opened:
      May 21, 2019
      07:29 AM PT
      Intermittent loss of Wi-Fi connectivity
      Some older computers may experience loss of Wi-Fi connectivity due to an outdated Qualcomm driver. An updated Wi-Fi driver should be available from your device manufacturer (OEM).

      To safeguard your upgrade experience, we have applied a hold on devices with this Qualcomm driver from being offered Windows 10, version 1903, until the updated driver is installed.

      Affected platforms:
      • Client: Windows 10, version 1903
      Workaround: Before updating to Windows 10, version 1903, you will need to download and install an updated Wi-Fi driver from your device manufacturer (OEM).
       
      Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until a new driver has been installed and the Windows 10, version 1903 feature update has been automatically offered to you.

      Back to top      		OS Build 18362.116

      May 21, 2019
      KB4505057      		Mitigated External
      		Last updated:
      August 01, 2019
      08:44 PM PT

      Opened:
      May 21, 2019
      07:13 AM PT
      Gamma ramps, color profiles, and night light settings do not apply in some cases
      Microsoft has identified some scenarios where gamma ramps, color profiles and night light settings may stop working.

      Microsoft has identified some scenarios in which these features may have issues or stop working, for example:
      • Connecting to (or disconnecting from) an external monitor, dock, or projector
      • Rotating the screen
      • Updating display drivers or making other display mode changes
      • Closing full screen applications
      • Applying custom color profiles
      • Running applications that rely on custom gamma ramps
      Affected platforms:
      • Client: Windows 10, version 1903
      Workaround: If you find that your night light has stopped working, try turning the night light off and on, or restarting your computer. For other color setting issues, restart your computer to correct the issue.

      Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.

      Next steps: We are working on a resolution and will provide an update in an upcoming release.

      Back to top      		OS Build 18362.116

      May 21, 2019
      KB4505057      		Mitigated
      		Last updated:
      August 01, 2019
      06:27 PM PT

      Opened:
      May 21, 2019
      07:28 AM PT
      Gamma ramps, color profiles, and night light settings do not apply in some cases
      Microsoft has identified some scenarios where gamma ramps, color profiles and night light settings may stop working.

      Microsoft has identified some scenarios in which these features may have issues or stop working, for example:
      • Connecting to (or disconnecting from) an external monitor, dock, or projector
      • Rotating the screen
      • Updating display drivers or making other display mode changes
      • Closing full screen applications
      • Applying custom color profiles
      • Running applications that rely on custom gamma ramps
      Affected platforms:
      • Client: Windows 10, version 1903
      Workaround: If you find that your night light has stopped working, try turning the night light off and on, or restarting your computer. For other color setting issues, restart your computer to correct the issue.

      Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.

      Next steps: We are working on a resolution and will provide an update in an upcoming release.

      Back to top      		OS Build 18362.116

      May 21, 2019
      KB4505057      		Mitigated
      KB4505903      		Last updated:
      August 01, 2019
      06:27 PM PT

      Opened:
      May 21, 2019
      07:28 AM PT
      Intel Audio displays an intcdaud.sys notification
      Microsoft and Intel have identified an issue with a range of Intel Display Audio device drivers that may result in higher than normal battery drain. If you see an intcdaud.sys notification or “What needs your attention” notification when trying to update to Windows 10, version 1903, you have an affected Intel Audio Display device driver installed on your machine (intcdaud.sys, versions 10.25.0.3 through 10.25.0.8).
        
      To safeguard your update experience, we have applied a compatibility hold on devices with drivers from being offered Windows 10, version 1903 until updated device drivers have been installed.

      Affected platforms:
      • Client: Windows 10, version 1903; Windows 10, version 1809
      Workaround:
      On the “What needs your attention\" notification, click the Back button to remain on your current version of Windows 10. (Do not click Confirm as this will proceed with the update and you may experience compatibility issues.) Affected devices will automatically revert to the previous working configuration.

      For more information, see Intel's customer support guidance and the Microsoft knowledge base article KB4465877.

      Note We recommend you do not attempt to update your devices until newer device drivers are installed.

      Next steps: You can opt to wait for newer drivers to be installed automatically through Windows Update or check with the computer manufacturer for the latest device driver software availability and installation procedures.

      Back to top      		OS Build 18362.116

      May 21, 2019
      KB4505057      		Mitigated
      		Last updated:
      May 21, 2019
      04:47 PM PT

      Opened:
      May 21, 2019
      07:22 AM PT
      Cannot launch Camera app
      Microsoft and Intel have identified an issue affecting Intel RealSense SR300 and Intel RealSense S200 cameras when using the Camera app. After updating to the Windows 10 May 2019 Update and launching the Camera app, you may get an error message stating:

      \"Close other apps, error code: 0XA00F4243.”


      To safeguard your update experience, we have applied a protective hold on machines with Intel RealSense SR300 or Intel RealSense S200 cameras installed from being offered Windows 10, version 1903, until this issue is resolved.

      Affected platforms:
      • Client: Windows 10, version 1903
      Workaround: To temporarily resolve this issue, perform one of the following:

      • Unplug your camera and plug it back in.

      or

      • Disable and re-enable the driver in Device Manager. In the Search box, type \"Device Manager\" and press Enter. In the Device Manager dialog box, expand Cameras, then right-click on any RealSense driver listed and select Disable device. Right click on the driver again and select Enable device.

      or

      • Restart the RealSense service. In the Search box, type \"Task Manager\" and hit Enter. In the Task Manager dialog box, click on the Services tab, right-click on RealSense, and select Restart. 
      Note This workaround will only resolve the issue until your next system restart.

      Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.

      Next steps: We are working on a resolution and will provide an update in an upcoming release.

      Back to top      		OS Build 18362.116

      May 21, 2019
      KB4505057      		Mitigated
      		Last updated:
      May 21, 2019
      04:47 PM PT

      Opened:
      May 21, 2019
      07:20 AM PT
      " diff --git a/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml b/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml index e1dbec18dc..1f8aaa76bb 100644 --- a/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml +++ b/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml @@ -60,6 +60,7 @@ sections: - type: markdown text: "
      This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

      +
      SummaryOriginating updateStatusLast updated
      TLS connections might fail or timeout
      Transport Layer Security (TLS) connections might fail or timeout when connecting or attempting a resumption.

      See details >      		October 08, 2019
      KB4519976      		Mitigated External
      		November 05, 2019
      03:36 PM PT
      Intermittent issues when printing
      The print spooler service may intermittently have issues completing a print job and results print job failure.

      See details >      		September 24, 2019
      KB4516048      		Resolved
      KB4519976      		October 08, 2019
      10:00 AM PT
      IA64 and x64 devices may fail to start after installing updates
      After installing updates released on or after August 13, 2019, IA64 and x64 devices using EFI Boot may fail to start.

      See details >      		August 13, 2019
      KB4512506      		Mitigated
      		August 17, 2019
      12:59 PM PT
      @@ -72,6 +73,15 @@ sections:
      " +- title: November 2019 +- items: + - type: markdown + text: " + + +
      DetailsOriginating updateStatusHistory
      TLS connections might fail or timeout
      Updates for Windows released October 8, 2019 or later provide protections, tracked by CVE-2019-1318, against an attack that could allow unauthorized access to information or data within TLS connections. This type of attack is known as a man-in-the-middle exploit. Windows might fail to connect to TLS clients and servers that do not support Extended Master Secret for resumption (RFC 7627). Lack of RFC support might cause one or more of the following errors or logged events:
      • \"The request was aborted: Could not create SSL/TLS secure Channel\"
      • SCHANNEL event 36887 is logged in the System event log with the description, \"A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 20.​\"
      Affected platforms:
      • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
      • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2

      Next Steps: Connections between two devices running any supported version of Windows should not have this issue when fully updated. There is no update for Windows needed for this issue. These changes are required to address a security issue and security compliance. For information, see KB4528489.

      Back to top      		October 08, 2019
      KB4519976      		Mitigated External
      		Last updated:
      November 05, 2019
      03:36 PM PT

      Opened:
      November 05, 2019
      03:36 PM PT
      + " + - title: September 2019 - items: - type: markdown diff --git a/windows/release-information/status-windows-8.1-and-windows-server-2012-r2.yml b/windows/release-information/status-windows-8.1-and-windows-server-2012-r2.yml index 6b30adb9b0..e0f869f26a 100644 --- a/windows/release-information/status-windows-8.1-and-windows-server-2012-r2.yml +++ b/windows/release-information/status-windows-8.1-and-windows-server-2012-r2.yml @@ -60,6 +60,7 @@ sections: - type: markdown text: "
      This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

      + @@ -73,6 +74,15 @@ sections:
      " +- title: November 2019 +- items: + - type: markdown + text: " +
      SummaryOriginating updateStatusLast updated
      TLS connections might fail or timeout
      Transport Layer Security (TLS) connections might fail or timeout when connecting or attempting a resumption.

      See details >      		October 08, 2019
      KB4520005      		Mitigated External
      		November 05, 2019
      03:36 PM PT
      Intermittent issues when printing
      The print spooler service may intermittently have issues completing a print job and results print job failure.

      See details >      		September 24, 2019
      KB4516041      		Resolved
      KB4520005      		October 08, 2019
      10:00 AM PT
      Japanese IME doesn't show the new Japanese Era name as a text input option
      With previous dictionary updates installed, the Japanese IME doesn't show the new Japanese Era name as an input option.

      See details >      		April 25, 2019
      KB4493443      		Mitigated
      		May 15, 2019
      05:53 PM PT
      Certain operations performed on a Cluster Shared Volume may fail
      Operations performed on files or folders on a CSV may fail with the error: STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5).

      See details >      		January 08, 2019
      KB4480963      		Mitigated
      		April 25, 2019
      02:00 PM PT
      + +
      DetailsOriginating updateStatusHistory
      TLS connections might fail or timeout
      Updates for Windows released October 8, 2019 or later provide protections, tracked by CVE-2019-1318, against an attack that could allow unauthorized access to information or data within TLS connections. This type of attack is known as a man-in-the-middle exploit. Windows might fail to connect to TLS clients and servers that do not support Extended Master Secret for resumption (RFC 7627). Lack of RFC support might cause one or more of the following errors or logged events:
      • \"The request was aborted: Could not create SSL/TLS secure Channel\"
      • SCHANNEL event 36887 is logged in the System event log with the description, \"A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 20.​\"
      Affected platforms:
      • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
      • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2

      Next Steps: Connections between two devices running any supported version of Windows should not have this issue when fully updated. There is no update for Windows needed for this issue. These changes are required to address a security issue and security compliance. For information, see KB4528489.

      Back to top      		October 08, 2019
      KB4520005      		Mitigated External
      		Last updated:
      November 05, 2019
      03:36 PM PT

      Opened:
      November 05, 2019
      03:36 PM PT
      + " + - title: September 2019 - items: - type: markdown diff --git a/windows/release-information/status-windows-server-2008-sp2.yml b/windows/release-information/status-windows-server-2008-sp2.yml index 0df1e85294..9e2992e255 100644 --- a/windows/release-information/status-windows-server-2008-sp2.yml +++ b/windows/release-information/status-windows-server-2008-sp2.yml @@ -60,6 +60,7 @@ sections: - type: markdown text: "
      This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

      +
      SummaryOriginating updateStatusLast updated
      TLS connections might fail or timeout
      Transport Layer Security (TLS) connections might fail or timeout when connecting or attempting a resumption.

      See details >      		October 08, 2019
      KB4520002      		Mitigated External
      		November 05, 2019
      03:36 PM PT
      Issues manually installing updates by double-clicking the .msu file
      You may encounter issues manually installing updates by double-clicking the .msu file and may receive an error.

      See details >      		September 10, 2019
      KB4474419      		Resolved
      KB4474419      		September 23, 2019
      10:00 AM PT
      Intermittent issues when printing
      The print spooler service may intermittently have issues completing a print job and results print job failure.

      See details >      		September 24, 2019
      KB4516030      		Resolved
      KB4520002      		October 08, 2019
      10:00 AM PT
      @@ -72,6 +73,15 @@ sections:
      " +- title: November 2019 +- items: + - type: markdown + text: " + + +
      DetailsOriginating updateStatusHistory
      TLS connections might fail or timeout
      Updates for Windows released October 8, 2019 or later provide protections, tracked by CVE-2019-1318, against an attack that could allow unauthorized access to information or data within TLS connections. This type of attack is known as a man-in-the-middle exploit. Windows might fail to connect to TLS clients and servers that do not support Extended Master Secret for resumption (RFC 7627). Lack of RFC support might cause one or more of the following errors or logged events:
      • \"The request was aborted: Could not create SSL/TLS secure Channel\"
      • SCHANNEL event 36887 is logged in the System event log with the description, \"A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 20.​\"
      Affected platforms:
      • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
      • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2

      Next Steps: Connections between two devices running any supported version of Windows should not have this issue when fully updated. There is no update for Windows needed for this issue. These changes are required to address a security issue and security compliance. For information, see KB4528489.

      Back to top      		October 08, 2019
      KB4520002      		Mitigated External
      		Last updated:
      November 05, 2019
      03:36 PM PT

      Opened:
      November 05, 2019
      03:36 PM PT
      + " + - title: September 2019 - items: - type: markdown diff --git a/windows/release-information/status-windows-server-2012.yml b/windows/release-information/status-windows-server-2012.yml index e05f9d92b9..560b75a79f 100644 --- a/windows/release-information/status-windows-server-2012.yml +++ b/windows/release-information/status-windows-server-2012.yml @@ -60,6 +60,7 @@ sections: - type: markdown text: "
      This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

      + @@ -73,6 +74,15 @@ sections:
      " +- title: November 2019 +- items: + - type: markdown + text: " +
      SummaryOriginating updateStatusLast updated
      TLS connections might fail or timeout
      Transport Layer Security (TLS) connections might fail or timeout when connecting or attempting a resumption.

      See details >      		October 08, 2019
      KB4520007      		Mitigated External
      		November 05, 2019
      03:36 PM PT
      Intermittent issues when printing
      The print spooler service may intermittently have issues completing a print job and results print job failure.

      See details >      		September 24, 2019
      KB4516069      		Resolved
      KB4520007      		October 08, 2019
      10:00 AM PT
      Japanese IME doesn't show the new Japanese Era name as a text input option
      With previous dictionary updates installed, the Japanese IME doesn't show the new Japanese Era name as an input option.

      See details >      		April 25, 2019
      KB4493462      		Mitigated
      		May 15, 2019
      05:53 PM PT
      Certain operations performed on a Cluster Shared Volume may fail
      Operations performed on files or folders on a CSV may fail with the error: STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5).

      See details >      		January 08, 2019
      KB4480975      		Mitigated
      		April 25, 2019
      02:00 PM PT
      + +
      DetailsOriginating updateStatusHistory
      TLS connections might fail or timeout
      Updates for Windows released October 8, 2019 or later provide protections, tracked by CVE-2019-1318, against an attack that could allow unauthorized access to information or data within TLS connections. This type of attack is known as a man-in-the-middle exploit. Windows might fail to connect to TLS clients and servers that do not support Extended Master Secret for resumption (RFC 7627). Lack of RFC support might cause one or more of the following errors or logged events:
      • \"The request was aborted: Could not create SSL/TLS secure Channel\"
      • SCHANNEL event 36887 is logged in the System event log with the description, \"A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 20.​\"
      Affected platforms:
      • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
      • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2

      Next Steps: Connections between two devices running any supported version of Windows should not have this issue when fully updated. There is no update for Windows needed for this issue. These changes are required to address a security issue and security compliance. For information, see KB4528489.

      Back to top      		October 08, 2019
      KB4520007      		Mitigated External
      		Last updated:
      November 05, 2019
      03:36 PM PT

      Opened:
      November 05, 2019
      03:36 PM PT
      + " + - title: September 2019 - items: - type: markdown diff --git a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md index 4b3c9b8488..7bbc4f1ce7 100644 --- a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md +++ b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md @@ -23,16 +23,17 @@ In Windows 10, Windows Hello for Business replaces passwords with strong two-fa Windows Hello for Business lets user authenticate to an Active Directory or Azure Active Directory account. Windows Hello addresses the following problems with passwords: -- Strong passwords can be difficult to remember, and users often reuse passwords on multiple sites. -- Server breaches can expose symmetric network credentials (passwords). -- Passwords are subject to [replay attacks](https://go.microsoft.com/fwlink/p/?LinkId=615673). -- Users can inadvertently expose their passwords due to [phishing attacks](https://docs.microsoft.com/windows/security/threat-protection/intelligence/phishing). + +- Strong passwords can be difficult to remember, and users often reuse passwords on multiple sites. +- Server breaches can expose symmetric network credentials (passwords). +- Passwords are subject to [replay attacks](https://go.microsoft.com/fwlink/p/?LinkId=615673). +- Users can inadvertently expose their passwords due to [phishing attacks](https://docs.microsoft.com/windows/security/threat-protection/intelligence/phishing). > | | | | > | :---: | :---: | :---: | > | [![Overview Icon](images/hello_filter.png)](hello-overview.md)
      [Overview](hello-overview.md) | [![Why a PIN is better than a password Icon](images/hello_lock.png)](hello-why-pin-is-better-than-password.md)
      [Why PIN is better than a password](hello-why-pin-is-better-than-password.md) | [![Manage Hello Icon](images/hello_gear.png)](hello-manage-in-organization.md)
      [Manage Windows Hello in your Organization](hello-manage-in-organization.md) | -## Prerequisites +## Prerequisites > [!Important] > 1. Hybrid deployments support non-destructive PIN reset that only works with the certificate trust model.
      . @@ -47,6 +48,7 @@ Windows Hello addresses the following problems with passwords: > Reset above lock screen (_I forgot my PIN_ link) - Windows 10, version 1903 ### Cloud Only Deployment + * Windows 10, version 1511 or later * Microsoft Azure Account * Azure Active Directory @@ -55,6 +57,7 @@ Windows Hello addresses the following problems with passwords: * Azure AD Premium subscription - *optional*, needed for automatic MDM enrollment when the device joins Azure Active Directory ### Hybrid Deployments + The table shows the minimum requirements for each deployment. For key trust in a multi-domain/multi-forest deployment, the following requirements are applicable for each domain/forest that hosts Windows Hello for business components or is involved in the Kerberos referral process. | Key trust
      Group Policy managed | Certificate trust
      Mixed managed | Key trust
      Modern managed | Certificate trust
      Modern managed | @@ -65,25 +68,26 @@ The table shows the minimum requirements for each deployment. For key trust in a | Windows Server 2016 or later Domain Controllers | Windows Server 2008 R2 or later Domain Controllers | Windows Server 2016 or later Domain Controllers | Windows Server 2008 R2 or later Domain Controllers | | Windows Server 2012 or later Certificate Authority | Windows Server 2012 or later Certificate Authority | Windows Server 2012 or later Certificate Authority | Windows Server 2012 or later Certificate Authority | | N/A | Windows Server 2016 AD FS with [KB4088889 update](https://support.microsoft.com/help/4088889) (hybrid Azure AD joined clients),
      and
      Windows Server 2012 or later Network Device Enrollment Service (Azure AD joined) | N/A | Windows Server 2012 or later Network Device Enrollment Service | -| Azure MFA tenant, or
      AD FS w/Azure MFA adapter, or
      AD FS w/Azure MFA Server adapter, or
      AD FS w/3rd Party MFA Adapter| Azure MFA tenant, or
      AD FS w/Azure MFA adapter, or
      AD FS w/Azure MFA Server adapter, or
      AD FS w/3rd Party MFA Adapter | Azure MFA tenant, or
      AD FS w/Azure MFA adapter, or
      AD FS w/Azure MFA Server adapter, or
      AD FS w/3rd Party MFA Adapter | Azure MFA tenant, or
      AD FS w/Azure MFA adapter, or
      AD FS w/Azure MFA Server adapter, or
      AD FS w/3rd Party MFA Adapter | +| Azure MFA tenant, or
      AD FS w/Azure MFA adapter, or
      AD FS w/3rd Party MFA Adapter| Azure MFA tenant, or
      AD FS w/Azure MFA adapter, or
      AD FS w/3rd Party MFA Adapter | Azure MFA tenant, or
      AD FS w/Azure MFA adapter, or
      AD FS w/3rd Party MFA Adapter | Azure MFA tenant, or
      AD FS w/Azure MFA adapter, or
      AD FS w/3rd Party MFA Adapter | | Azure Account | Azure Account | Azure Account | Azure Account | | Azure Active Directory | Azure Active Directory | Azure Active Directory | Azure Active Directory | | Azure AD Connect | Azure AD Connect | Azure AD Connect | Azure AD Connect | | Azure AD Premium, optional | Azure AD Premium, needed for device write-back | Azure AD Premium, optional for automatic MDM enrollment | Azure AD Premium, optional for automatic MDM enrollment | -### On-premises Deployments +### On-premises Deployments + The table shows the minimum requirements for each deployment. | Key trust
      Group Policy managed | Certificate trust
      Group Policy managed| -| --- | --- | +| --- | --- | | Windows 10, version 1703 or later | Windows 10, version 1703 or later | | Windows Server 2016 Schema | Windows Server 2016 Schema| | Windows Server 2008 R2 Domain/Forest functional level | Windows Server 2008 R2 Domain/Forest functional level | | Windows Server 2016 or later Domain Controllers | Windows Server 2008 R2 or later Domain Controllers | | Windows Server 2012 or later Certificate Authority | Windows Server 2012 or later Certificate Authority | | Windows Server 2016 AD FS with [KB4088889 update](https://support.microsoft.com/help/4088889) | Windows Server 2016 AD FS with [KB4088889 update](https://support.microsoft.com/help/4088889) | -| AD FS with Azure MFA Server, or
      AD FS with 3rd Party MFA Adapter | AD FS with Azure MFA Server, or
      AD FS with 3rd Party MFA Adapter | +| AD FS with 3rd Party MFA Adapter | AD FS with 3rd Party MFA Adapter | | Azure Account, optional for Azure MFA billing | Azure Account, optional for Azure MFA billing | > [!IMPORTANT] -> For Windows Hello for Business deployment, if you have several domains, at least one Windows Server Domain Controller 2016 is required for each domain. For more information, see the [planning guide](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers). +> For Windows Hello for Business key trust deployments, if you have several domains, at least one Windows Server Domain Controller 2016 or newer is required for each domain. For more information, see the [planning guide](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers). diff --git a/windows/security/identity-protection/smart-cards/smart-card-events.md b/windows/security/identity-protection/smart-cards/smart-card-events.md index 830bfcfcfc..702f62e6d4 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-events.md +++ b/windows/security/identity-protection/smart-cards/smart-card-events.md @@ -97,14 +97,14 @@ The smart card reader device name is constructed in the form <*VendorName*> | 607 | Reader object failed to start monitor thread:  %1 | This is an internal, unrecoverable error that indicates a failure in the smart card service. The most common cause is limited computer resources. Restarting the computer may resolve the issue.
      %1 = Windows error code | | 608 | Reader monitor failed to create power down timer: %1 | This is an internal, unrecoverable error that indicates a failure in the smart card service. The most common cause is limited computer resources. Restarting the computer may resolve the issue.
      %1 = Windows error code | | 609 | Reader monitor failed to create overlapped event:  %1 | This is an internal, unrecoverable error that indicates a failure in the smart card service. The most common cause is limited computer resources. Restarting the computer may resolve the issue.
      %1 = Windows error code | -| 610 | Smart Card Reader '%2' rejected IOCTL %3: %1  If this error persists, your smart card or reader may not be functioning correctly.%n%nCommand Header: %4 | The reader cannot successfully transmit the indicated IOCTL to the smart card. This can indicate hardware failure, but this error can also occur if a smart card or smart card reader is removed from the system while an operation is in progress.
      %1 = Windows error code
      %2 = Name of the smart card reader
      %3 = IOCTL that was sent
      %4 = First 4 bytes of the command sent to the smart card | +| 610 | Smart Card Reader '%2' rejected IOCTL %3: %1 If this error persists, your smart card or reader may not be functioning correctly.%n%nCommand Header: %4 | The reader cannot successfully transmit the indicated IOCTL to the smart card. This is a benign error that does not affect end use of a smart card and can be ignored.
      %1 = Windows error code
      %2 = Name of the smart card reader
      %3 = IOCTL that was sent
      %4 = First 4 bytes of the command sent to the smart card | | 611 | Smart Card Reader initialization failed | This is an internal, unrecoverable error that indicates a failure in the smart card service. The most common cause is limited computer resources. Restarting the computer may resolve this issue. | | 612 | Reader insertion monitor error retry threshold reached:  %1 | This occurs when a smart card reader fails several times to respond properly to the IOCTL, which indicates whether a smart card is present in the reader. The smart card reader is marked as defective, and it is not recognized by the service until it is removed from the computer and reinserted or until the computer is restarted.
      %1 = Windows error code | | 615 | Reader removal monitor error retry threshold reached:  %1 | This occurs when a smart card reader fails several times to respond properly to the IOCTL, which indicates whether a smart card is present in the reader. The smart card reader is marked as defective, and it is not recognized by the service until it is removed from the computer and reinserted or until the computer is restarted.
      %1 = Windows error code | | 616 | Reader monitor '%2' received uncaught error code:  %1 | This occurs when a smart card reader fails several times to respond properly to the IOCTL, which indicates whether a smart card is present in the reader. The smart card reader is marked as defective, and it is not recognized by the service until it is removed from the computer and reinserted or until the computer is restarted.
      %1 = Windows error code
      %2 = Reader name | | 617 | Reader monitor '%1' exception -- exiting thread | An unknown error occurred while monitoring a smart card reader for smart card insertions and removals. The smart card reader is marked as defective, and it is not recognized by the service until it is removed from the computer and reinserted or until the computer is restarted.
      %1 = Smart card reader name | | 618 | Smart Card Resource Manager encountered an unrecoverable internal error. | This is an internal, unrecoverable error that indicates a failure in the smart card service. The most common cause is limited computer resources. Restarting the computer may resolve the issue. | -| 621 | Server Control failed to access start event: %1 | This is an internal, unrecoverable error that indicates a failure in the smart card service. The most common cause is limited computer resources. Restarting the computer may resolve the issue.
      %1 = Windows error code | +| 621 | Server Control failed to access start event: %1 | This is an internal, unrecoverable error that indicates a failure in the smart card service. The most common cause is limited computer resources. Restarting the computer may resolve the issue. This error may also occur if the event is queried before the smart card service is ready. In this case the error is benign and can be ignored.
      %1 = Windows error code | | 622 | Server Control failed to access stop event: %1 | This is an internal, unrecoverable error that indicates a failure in the smart card service. The most common cause is limited computer resources. Restarting the computer may resolve the issue.
      %1 = Windows error code | ## Smart card Plug and Play events diff --git a/windows/security/information-protection/index.md b/windows/security/information-protection/index.md index e17bd5c51b..c2050be90b 100644 --- a/windows/security/information-protection/index.md +++ b/windows/security/information-protection/index.md @@ -5,7 +5,8 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -author: justinha +author: dansimp +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md b/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md index f6d1a67328..bf7360d125 100644 --- a/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md +++ b/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md @@ -49,6 +49,9 @@ The recovery process included in this topic only works for desktop devices. WIP 4. Add your EFS DRA certificate to your WIP policy using a deployment tool, such as [Microsoft Intune](create-wip-policy-using-intune-azure.md) or [System Center Configuration Manager](create-wip-policy-using-sccm.md). +> [!NOTE] +> This certificate can be used in Intune for policies both _with_ device enrollment (MDM) and _without_ device enrollment (MAM). + ## Verify your data recovery certificate is correctly set up on a WIP client computer 1. Find or create a file that's encrypted using Windows Information Protection. For example, you could open an app on your allowed app list, and then create and save a file so it’s encrypted by WIP. diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index f8776c4535..65f80dda38 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -9,7 +9,7 @@ #### [Exposure score](microsoft-defender-atp/tvm-exposure-score.md) #### [Configuration score](microsoft-defender-atp/configuration-score.md) #### [Security recommendation](microsoft-defender-atp/tvm-security-recommendation.md) -#### [Remediation](microsoft-defender-atp/tvm-remediation.md) +#### [Remediation and exception](microsoft-defender-atp/tvm-remediation.md) #### [Software inventory](microsoft-defender-atp/tvm-software-inventory.md) #### [Weaknesses](microsoft-defender-atp/tvm-weaknesses.md) #### [Scenarios](microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md) @@ -122,10 +122,13 @@ ##### [NetworkCommunicationEvents](microsoft-defender-atp/advanced-hunting-networkcommunicationevents-table.md) ##### [ProcessCreationEvents](microsoft-defender-atp/advanced-hunting-processcreationevents-table.md) ##### [RegistryEvents](microsoft-defender-atp/advanced-hunting-registryevents-table.md) +##### [DeviceTvmSoftwareInventoryVulnerabilities](microsoft-defender-atp/advanced-hunting-tvm-softwareinventory-table.md) +##### [DeviceTvmSoftwareVulnerabilitiesKB](microsoft-defender-atp/advanced-hunting-tvm-softwarevulnerability-table.md) +##### [DeviceTvmSecureConfigurationAssessment](microsoft-defender-atp/advanced-hunting-tvm-configassessment-table.md) +##### [DeviceTvmSecureConfigurationAssessmentKB](microsoft-defender-atp/advanced-hunting-tvm-secureconfigkb-table.md) #### [Apply query best practices](microsoft-defender-atp/advanced-hunting-best-practices.md) #### [Stream Advanced hunting events to Azure Event Hubs](microsoft-defender-atp/raw-data-export-event-hub.md) - #### [Custom detections]() ##### [Understand custom detection rules](microsoft-defender-atp/overview-custom-detections.md) ##### [Create and manage custom detections rules](microsoft-defender-atp/custom-detection-rules.md) @@ -308,21 +311,23 @@ ##### [Use the mpcmdrun.exe command line tool to manage next generation protection](windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md) -### [Microsoft Defender Advanced Threat Protection for Mac](windows-defender-antivirus/microsoft-defender-atp-mac.md) -#### [What's New in Microsoft Defender ATP for Mac](windows-defender-antivirus/microsoft-defender-atp-mac-whatsnew.md) -#### [Deploy Microsoft Defender Advanced Threat Protection for Mac]() -##### [Microsoft Intune-based deployment](windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md) -##### [JAMF-based deployment](windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md) -##### [Deployment with a different Mobile Device Management (MDM) system](windows-defender-antivirus/microsoft-defender-atp-mac-install-with-other-mdm.md) -##### [Manual deployment](windows-defender-antivirus/microsoft-defender-atp-mac-install-manually.md) -#### [Update Microsoft Defender ATP for Mac](windows-defender-antivirus/microsoft-defender-atp-mac-updates.md) -#### [Configure Microsoft Defender ATP for Mac]() -##### [Set preferences for Microsoft Defender ATP for Mac](windows-defender-antivirus/microsoft-defender-atp-mac-preferences.md) -##### [Detect and block Potentially Unwanted Applications](windows-defender-antivirus/microsoft-defender-atp-mac-pua.md) -#### [Privacy for Microsoft Defender ATP for Mac](windows-defender-antivirus/microsoft-defender-atp-mac-privacy.md) -#### [Resources for Microsoft Defender ATP for Mac](windows-defender-antivirus/microsoft-defender-atp-mac-resources.md) - - +### [Microsoft Defender Advanced Threat Protection for Mac](microsoft-defender-atp/microsoft-defender-atp-mac.md) +#### [What's New](microsoft-defender-atp/mac-whatsnew.md) +#### [Deploy]() +##### [Microsoft Intune-based deployment](microsoft-defender-atp/mac-install-with-intune.md) +##### [JAMF-based deployment](microsoft-defender-atp/mac-install-with-jamf.md) +##### [Deployment with a different Mobile Device Management (MDM) system](microsoft-defender-atp/mac-install-with-other-mdm.md) +##### [Manual deployment](microsoft-defender-atp/mac-install-manually.md) +#### [Update](microsoft-defender-atp/mac-updates.md) +#### [Configure]() +##### [Configure and validate exclusions](microsoft-defender-atp/mac-exclusions.md) +##### [Set preferences](microsoft-defender-atp/mac-preferences.md) +##### [Detect and block Potentially Unwanted Applications](microsoft-defender-atp/mac-pua.md) +#### [Troubleshoot]() +##### [Troubleshoot performance issues](microsoft-defender-atp/mac-support-perf.md) +##### [Troubleshoot kernel extension issues](microsoft-defender-atp/mac-support-kext.md) +#### [Privacy](microsoft-defender-atp/mac-privacy.md) +#### [Resources](microsoft-defender-atp/mac-resources.md) ### [Configure Secure score dashboard security controls](microsoft-defender-atp/secure-score-dashboard.md) diff --git a/windows/security/threat-protection/device-control/control-usb-devices-using-intune.md b/windows/security/threat-protection/device-control/control-usb-devices-using-intune.md index 2fa857956a..74a43afb5e 100644 --- a/windows/security/threat-protection/device-control/control-usb-devices-using-intune.md +++ b/windows/security/threat-protection/device-control/control-usb-devices-using-intune.md @@ -50,8 +50,10 @@ The following table describes the ways Microsoft Defender ATP can allow or block |----------|-------------| | [Restrict USB drives and other peripherals](#restrict-usb-drives-and-other-peripherals) | You can allow/prevent users to install only the USB drives and other peripherals included on a list of authorized/unauthorized devices or device types. | | [Block installation and usage of removable storage](#block-installation-and-usage-of-removable-storage) | You can't install or use removable storage. | -| [Only allow installation and usage of specifically approved peripherals](#only-allow-installation-and-usage-of-specifically-approved-peripherals) | You can only install and use approved peripherals that report specific properties in their firmware. | +| [Allow installation and usage of specifically approved peripherals](#allow-installation-and-usage-of-specifically-approved-peripherals) | You can only install and use approved peripherals that report specific properties in their firmware. | | [Prevent installation of specifically prohibited peripherals](#prevent-installation-of-specifically-prohibited-peripherals) | You can't install or use prohibited peripherals that report specific properties in their firmware. | +| [Allow installation and usage of specifically approved peripherals with matching device instance IDs](#allow-installation-and-usage-of-specifically-approved-peripherals-with-matching-device-instance-ids) | You can only install and use approved peripherals that match any of these device instance IDs. | +| [Prevent installation and usage of specifically prohibited peripherals with matching device instance IDs](#prevent-installation-and-usage-of-specifically-prohibited-peripherals-with-matching-device-instance-ids) | You can't install or use prohibited peripherals that match any of these device instance IDs. | | [Limit services that use Bluetooth](#limit-services-that-use-bluetooth) | You can limit the services that can use Bluetooth. | | [Use Microsoft Defender ATP baseline settings](#use-microsoft-defender-atp-baseline-settings) | You can set the recommended configuration for ATP by using the Microsoft Defender ATP security baseline. | @@ -169,7 +171,7 @@ Select-Object -Property * 7. Click **Create** to save the profile. -### Only allow installation and usage of specifically approved peripherals +### Allow installation and usage of specifically approved peripherals Peripherals that are allowed to be installed can be specified by their [hardware identity](https://docs.microsoft.com/windows-hardware/drivers/install/device-identification-strings). For a list of common identifier structures, see [Device Identifier Formats](https://docs.microsoft.com/windows-hardware/drivers/install/device-identifier-formats). Test the configuration prior to rolling it out to ensure it blocks and allows the devices expected. Ideally test various instances of the hardware. For example, test multiple USB keys rather than only one. @@ -183,6 +185,18 @@ Microsoft Defender ATP blocks installation and usage of prohibited peripherals b - [Administrative Templates](https://docs.microsoft.com/intune/administrative-templates-windows) can block any device with a matching hardware ID or setup class. - [Device Installation CSP settings](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deviceinstallation) with a custom profile in Intune. You can [prevent installation of specific device IDs](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deviceinstallation#deviceinstallation-preventinstallationofmatchingdeviceids) or [prevent specific device classes](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deviceinstallation#deviceinstallation-preventinstallationofmatchingdevicesetupclasses). +### Allow installation and usage of specifically approved peripherals with matching device instance IDs + +Peripherals that are allowed to be installed can be specified by their [device instance IDs](https://docs.microsoft.com/windows-hardware/drivers/install/device-instance-ids). Test the configuration prior to rolling it out to ensure it allows the devices expected. Ideally test various instances of the hardware. For example, test multiple USB keys rather than only one. + +You can allow installation and usage of approved peripherals with matching device instance IDs by configuring [DeviceInstallation/AllowInstallationOfMatchingDeviceInstanceIDs](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deviceinstallation#deviceinstallation-allowinstallationofmatchingdeviceinstanceids) policy setting. + +### Prevent installation and usage of specifically prohibited peripherals with matching device instance IDs + +Peripherals that are prohibited to be installed can be specified by their [device instance IDs](https://docs.microsoft.com/windows-hardware/drivers/install/device-instance-ids). Test the configuration prior to rolling it out to ensure it allows the devices expected. Ideally test various instances of the hardware. For example, test multiple USB keys rather than only one. + +You can prevent installation of the prohibited peripherals with matching device instance IDs by configuring [DeviceInstallation/PreventInstallationOfMatchingDeviceInstanceIDs](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deviceinstallation#deviceinstallation-preventinstallationofmatchingdeviceinstanceids) policy setting. + ### Limit services that use Bluetooth Using Intune, you can limit the services that can use Bluetooth through the ["Bluetooth allowed services"](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-bluetooth#servicesallowedlist-usage-guide). The default state of "Bluetooth allowed services" settings means everything is allowed. As soon as a service is added, that becomes the allowed list. If the customer adds the Keyboards and Mice values, and doesn’t add the file transfer GUIDs, file transfer should be blocked. diff --git a/windows/security/threat-protection/fips-140-validation.md b/windows/security/threat-protection/fips-140-validation.md index 5f47de9db6..32bbf69dc2 100644 --- a/windows/security/threat-protection/fips-140-validation.md +++ b/windows/security/threat-protection/fips-140-validation.md @@ -1,7091 +1,7194 @@ ---- -title: FIPS 140 Validation -description: This topic provides information on how Microsoft products and cryptographic modules comply with the U.S. Federal government standard FIPS 140. -ms.prod: w10 -audience: ITPro -author: dulcemontemayor -ms.author: dansimp -manager: dansimp -ms.collection: M365-identity-device-management -ms.topic: article -ms.localizationpriority: medium -ms.date: 04/03/2018 -ms.reviewer: ---- - - -# FIPS 140 Validation - -On this page - -- [Introduction](https://technet.microsoft.com/library/cc750357.aspx#id0eo) -- [FIPS 140 Overview](https://technet.microsoft.com/library/cc750357.aspx#id0ebd) -- [Microsoft Product Validation (Information for Procurement Officers and Auditors)](https://technet.microsoft.com/library/cc750357.aspx#id0ezd) -- [Information for System Integrators](https://technet.microsoft.com/library/cc750357.aspx#id0eve) -- [Information for Software Developers](https://technet.microsoft.com/library/cc750357.aspx#id0eibac) -- [FIPS 140 FAQ](https://technet.microsoft.com/library/cc750357.aspx#id0eqcac) -- [Microsoft FIPS 140 Validated Cryptographic Modules](https://technet.microsoft.com/library/cc750357.aspx#id0ewfac) -- [Cryptographic Algorithms](https://technet.microsoft.com/library/cc750357.aspx#id0erobg) - -Updated: March 2018 - - - -## Introduction - -This document provides information on how Microsoft products and cryptographic modules comply with the U.S. Federal government standard, *Federal Information Processing Standard (FIPS) 140 – Security Requirements for Cryptographic Modules* \[FIPS 140\]. - -### Audience - -This document is primarily focused on providing information for three parties: - -[Procurement Officer](https://technet.microsoft.com/library/cc750357.aspx#_microsoft_product_validation) – Responsible for verifying that Microsoft products (or even third-party applications) are either FIPS 140 validated or utilize a Microsoft FIPS 140 validated cryptographic module. - -[System Integrator](https://technet.microsoft.com/library/cc750357.aspx#_information_for_system) – Responsible for ensuring that Microsoft Products are configured properly to use only FIPS 140 validated cryptographic modules. - -[Software Developer](https://technet.microsoft.com/library/cc750357.aspx#_information_for_software) – Responsible for building software products that utilize Microsoft FIPS 140 validated cryptographic modules. - -### Document Map - -This document is broken into seven major sections: - -[FIPS 140 Overview](https://technet.microsoft.com/library/cc750357.aspx#_fips_140_overview) – Provides an overview of the FIPS 140 standard as well as provides some historical information about the standard. - -[Microsoft Product Validation (Information for Procurement Officers and Auditors)](https://technet.microsoft.com/library/cc750357.aspx#_microsoft_product_validation) – Provides information on how Microsoft products are FIPS 140 validated. - -[Information for System Integrators](https://technet.microsoft.com/library/cc750357.aspx#_information_for_system) – Describes how to configure and verify that Microsoft Products are being used in a manner consistent with the product’s FIPS 140 Security Policy. - -[Information for Software Developers](https://technet.microsoft.com/library/cc750357.aspx#_information_for_software) – Identifies how developers can leverage the Microsoft FIPS 140 validated cryptographic modules. - -[FAQ](https://technet.microsoft.com/library/cc750357.aspx#_fips_140_faq) – Frequently Asked Questions. - -[Microsoft FIPS 140 Validated Cryptographic Modules](https://technet.microsoft.com/library/cc750357.aspx#_microsoft_fips_140) – Explains Microsoft cryptographic architecture and identifies specific modules that are FIPS 140 validated. - -[Cryptographic Algorithms](https://technet.microsoft.com/library/cc750357.aspx#_cryptographic_algorithms) – Lists the cryptographic algorithm, modes, states, key sizes, Windows versions, and corresponding cryptographic algorithm validation certificates. - -## FIPS 140 Overview - -### FIPS 140 Standard - -FIPS 140 is a US government and Canadian government standard that defines a minimum set of the security requirements for products that implement cryptography. This standard is designed for cryptographic modules that are used to secure sensitive but unclassified information. Testing against the FIPS 140 standard is maintained by the Cryptographic Module Validation Program (CMVP), a joint effort between the US National Institute of Standards and Technology (NIST) and the Communications Security Establishment of Canada (CSEC). - -The current standard defines four-levels of increasing security, 1 through 4. Most software products (including all Microsoft products) are tested against the Level 1 security requirements. - -### Applicability of the FIPS standard - -Within the US Federal government, the FIPS 140 standard applies to any security system (whether hardware, firmware, software, or a combination thereof) to be used by agencies for protecting sensitive but unclassified information. Some agencies have expanded its use by requiring that the modules to be procured for secret systems also meet the FIPS 140 requirements. - -The FIPS 140 standard has also been used by different standards bodies, specification groups, nations, and private institutions as a requirement or guideline for those products (e.g. – Digital Cinema Systems Specification). - -### History of 140-1 - -FIPS 140-1 is the original working version of the standard made official on January 11, 1994. The standard remained in effect until FIPS 140-2 became mandatory for new products on May 25, 2002. - -### FIPS 140-2 - -FIPS 140-2 is currently the active version of the standard. - -### Microsoft FIPS Support Policy - -Microsoft actively maintains FIPS 140 validation for its cryptographic modules. - -### FIPS Mode of Operation - -The common term “FIPS mode” is used in this document and Security Policy documents. When a cryptographic module contains both FIPS-approved and non-FIPS approved security methods, it must have a "FIPS mode of operation" to ensure only FIPS-approved security methods may be used. When a module is in "FIPS mode", a non-FIPS approved method cannot be used instead of a FIPS-approved method. - -## Microsoft Product Validation (Information for Procurement Officers and Auditors) - -This section provides information for Procurement Officers and Auditors who are responsible for ensuring that Microsoft products with FIPS 140 validated cryptographic modules are used in their organization. The goal of this section is to provide an overview of the Microsoft developed products and modules and explain how the validated cryptographic modules are used. - -### Microsoft Product Relationship with CNG and CAPI libraries - -Rather than validate individual components and products, Microsoft chooses to validate only the underlying cryptographic modules. Subsequently, many Windows components and Microsoft products are built to rely on the Cryptographic API: Next Generation (CNG) and legacy Cryptographic API (CAPI) FIPS 140 validated cryptographic modules. Windows components and Microsoft products use the documented application programming interfaces (APIs) for each of the modules to access various cryptographic services. - -The following list contains some of the Windows components and Microsoft products that rely on FIPS 140 validated cryptographic modules: - -- Schannel Security Package -- Remote Desktop Protocol (RDP) Client -- Encrypting File System (EFS) -- Some Microsoft .NET Framework Applications (.NET also provides cryptographic algorithm implementations that have not been FIPS 140 validated.) -- BitLocker® Drive Full-volume Encryption -- IPsec Settings of Windows Firewall -- Server Message Block (SMB) 3.x - -## Information for System Integrators - -This section provides information for System Integrators and Auditors who are responsible for deploying Microsoft products in a manner consistent with the product’s FIPS 140 Security Policy. - -There are two steps to ensure that Microsoft products operate in FIPS mode: - -1. Selecting/Installing FIPS 140 validated cryptographic modules -2. Setting FIPS local/group security policy flag. - -### Step 1 – Selecting/Installing FIPS 140 Validated Cryptographic Modules - -Systems Integrators must ensure that all cryptographic modules installed are, in fact, FIPS 140 validated. This can be accomplished by cross-checking the version number of the installed module with the list of validated binaries. The list of validated CAPI binaries is identified in the [CAPI Validated Cryptographic Modules](https://technet.microsoft.com/library/cc750357.aspx#_capi_validated_cryptographic) section below and the list of validated CNG binaries is identified in the [CNG Validated Cryptographic Modules](https://technet.microsoft.com/library/cc750357.aspx#_cng_validated_cryptographic) section below. There are similar sections for all other validated cryptographic modules. - -The version number of the installed binary is found by right-clicking the module file and clicking on the Version or Details tab. Cryptographic modules are stored in the "windows\\system32" or "windows\\system32\\drivers" directory. - -### Step 2 – Setting FIPS Local/Group Security Policy Flag - -The Windows operating system provides a group (or local) security policy setting, “System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing”, which is used by many Microsoft products to determine whether to operate in a FIPS-approved mode. When this policy is set, the validated cryptographic modules in Windows will also operate in a FIPS-approved mode. - -**Note** – There is no enforcement of the FIPS policy by the operating system or the validated cryptographic modules. Instead, each individual application must check this flag and enforce the Security Policy of the validated cryptographic modules. - -#### Instructions on Setting the FIPS Local/Group Security Policy Flag - -While there are alternative methods for setting the FIPS local/group security policy flag, the following method is included as a guide to users with Administrative privileges. This description is for the Local Security Policy, but the Group Security Policy may be set in a similar manner. - -1. Open the 'Run' menu by pressing the combination 'Windows Key + R'. -2. Type 'secpol.msc' and press 'Enter' or click the 'Ok' button. -3. In the Local Security Policy management console window that opens, use the left tab to navigate to the Local Policies -\> Security Options. -4. Scroll down the right pane and double-click 'System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing'. -5. In the properties window, select the 'Enabled' option and click the 'Apply' button. - -#### Microsoft Components and Products That Utilize FIPS Local/Group Security Policy - -The following list details some of the Microsoft components that use the cryptographic functionality implemented by either CNG or legacy CAPI. When the FIPS Local/Group Security Policy is set, the following components will enforce the validated module Security Policy. - -- Schannel Security Package -- Remote Desktop Protocol (RDP) Client -- Encrypting File System (EFS) -- Some Microsoft .NET Framework Applications (.NET also provides cryptographic algorithm implementations that have not been FIPS 140 validated.) -- BitLocker® Drive Full-volume Encryption -- IPsec Settings of Windows Firewall - -#### Effects of Setting FIPS Local/Group Security Policy Flag - -When setting the FIPS local/group security policy flag, the behavior of several Microsoft components and products are affected. The most noticeable difference will be that the components enforcing this setting will only use those algorithms approved or allowed in FIPS mode. The specific changes to the products listed above are: - -- Schannel Security Package forced to negotiate sessions using TLS. The following supported Cipher Suites are disabled: - -- - TLS\_RSA\_WITH\_RC4\_128\_SHA - - TLS\_RSA\_WITH\_RC4\_128\_MD5 - - SSL\_CK\_RC4\_128\_WITH\_MD5 - - SSL\_CK\_DES\_192\_EDE3\_CBC\_WITH\_MD5 - - TLS\_RSA\_WITH\_NULL\_MD5 - - TLS\_RSA\_WITH\_NULL\_SHA - -- The set of cryptographic algorithms that a Remote Desktop Protocol (RDP) server will use is scoped to: - -- - CALG\_RSA\_KEYX - RSA public key exchange algorithm - - CALG\_3DES - Triple DES encryption algorithm - - CALG\_AES\_128 - 128 bit AES - - CALG\_AES\_256 - 256 bit AES - - CALG\_SHA1 - SHA hashing algorithm - - CALG\_SHA\_256 - 256 bit SHA hashing algorithm - - CALG\_SHA\_384 - 384 bit SHA hashing algorithm - - CALG\_SHA\_512 - 512 bit SHA hashing algorithm - -- Any Microsoft .NET Framework applications, such as Microsoft ASP.NET or Windows Communication Foundation (WCF), only allow algorithm implementations that are validated to FIPS 140, meaning only classes that end in "CryptoServiceProvider" or "Cng" can be used. Any attempt to create an instance of other cryptographic algorithm classes or create instances that use non-allowed algorithms will cause an InvalidOperationException exception. - -- Verification of ClickOnce applications fails unless the client computer has .NET Framework 2.0 SP1 or later service pack installed or .NET Framework 3.5 or later installed. - -- On Windows Vista and Windows Server 2008 and later, BitLocker Drive Encryption switches from AES-128 using the elephant diffuser to using the approved AES-256 encryption. Recovery passwords are not created or backed up. Instead, backup a recovery key on a local drive or on a network share. To use the recovery key, put the key on a USB device and plug the device into the computer. - -Please be aware that selection of FIPS mode can limit product functionality (See ). - -## Information for Software Developers - -This section is targeted at developers who wish to build their own applications using the FIPS 140 validated cryptographic modules. - -Each of the validated cryptographic modules defines a series of rules that must be followed. The security rules for each validated cryptographic module are specified in the Security Policy document. Links to each of the Security Policy documents is provided in the [Microsoft FIPS 140 Validated Cryptographic Modules](https://technet.microsoft.com/library/cc750357.aspx#_microsoft_fips_140) section below. Generally, the restriction in Microsoft validated cryptographic modules is limiting the use of cryptography to only FIPS Approved cryptographic algorithms, modes, and key sizes. - -### Using Microsoft Cryptographic Modules in a FIPS mode of operation - -No matter whether developing with native languages or using .NET, it is important to first check whether the CNG modules for the target system are FIPS validated. The list of validated CNG binaries is identified in the [CNG Validated Cryptographic Modules](https://technet.microsoft.com/library/cc750357.aspx#_cng_validated_cryptographic) section. - -When developing using CNG directly, it is the responsibility of the developer to follow the security rules outlined in the FIPS 140 Security Policy for each module. The security policy for each module is provided on the CMVP website. Links to each of the Security Policy documents is provided in the tables below. It is important to remember that setting the FIPS local/group security policy Flag (discussed above) does not affect the behavior of the modules when used for developing custom applications. - -If you are developing your application using .NET instead of using the native libraries, then setting the FIPS local policy flag will generate an exception when an improper .NET class is used for cryptography (i.e. the cryptographic classes whose names end in "Managed"). The names of these allowed classes end with "Cng", which use the CNG binaries or "CryptoServiceProvider", which use the legacy CAPI binaries. - -### Key Strengths and Validity Periods - -NIST Special Publication 800-131A Revision 1, Transitions: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths, dated November 2015, \[[SP 800-131A](http://dx.doi.org/10.6028/nist.sp.800-131ar1)\], offers guidance for moving to stronger cryptographic keys and algorithms. This does not replace NIST SP 800-57, Recommendation for Key Management Part 1: General, \[[SP 800-57](http://csrc.nist.gov/publications/pubssps.html#800-57-part1)\], but gives more specific guidance. One of the most important topics discussed in these publications deals with the key strengths of FIPS Approved algorithms and their validity periods. When developing applications that use FIPS Approved algorithms, it is also extremely important to select appropriate key sizes based on the security lifetimes recommended by NIST. - -## FIPS 140 FAQ - -The following are answers to commonly asked questions for the FIPS 140-2 validation of Microsoft products. - -1. How does FIPS 140 relate to the Common Criteria? - **Answer:** These are two separate security standards with different, but complementary, purposes. FIPS 140 is a standard designed specifically for validating product modules that implement cryptography. On the other hand, Common Criteria is designed to help evaluate security functions in IT products. - In many cases, Common Criteria evaluations will rely on FIPS 140 validations to provide assurance that cryptographic functionality is implemented properly. -2. How does FIPS 140 relate to Suite B? - **Answer:** Suite B is simply a set of cryptographic algorithms defined by the U.S. National Security Agency (NSA) as part of its Cryptographic Modernization Program. The set of Suite B cryptographic algorithms are to be used for both unclassified information and most classified information. - The Suite B cryptographic algorithms are a subset of the FIPS Approved cryptographic algorithms as allowed by the FIPS 140 standard. -3. There are so many modules listed on the NIST website for each release, how are they related and how do I tell which one applies to me? - **Answer:** Microsoft strives to validate all releases of its cryptographic modules. Each module provides a different set of cryptographic algorithms. If you are required to use only FIPS validated cryptographic modules, you simply need to verify that the version being used appears on the validation list. - Please see the [Microsoft FIPS 140 Validated Cryptographic Modules](https://technet.microsoft.com/library/cc750357.aspx#_microsoft_fips_140)section for a complete list of Microsoft validated modules. -4. My application links against crypt32.dll, cryptsp.dll, advapi32.dll, bcrypt.dll, bcryptprimitives.dll, or ncrypt.dll. What do I need to do to assure I’m using FIPS 140 validated cryptographic modules? - **Answer:** crypt32.dll, cryptsp.dll, advapi32.dll, and ncrypt.dll are intermediary libraries that will offload all cryptographic operations to the FIPS validated cryptographic modules. Bcrypt.dll itself is a validated cryptographic module for Windows Vista and Windows Server 2008. For Windows 7 and Windows Server 2008 R2 and later, bcryptprimitives.dll is the validated module, but bcrypt.dll remains as one of the libraries to link against. - You must first verify that the underlying CNG cryptographic module is validated. Once verified, you'll need to confirm that you're using the module correctly in FIPS mode (See [Information for Software Developers](https://technet.microsoft.com/library/cc750357.aspx#_information_for_software) section for details). -5. What does "When operated in FIPS mode" mean on certificates? - **Answer:** This caveat identifies that a required configuration and security rules must be followed in order to use the cryptographic module in a manner consistent with its FIPS 140 Security Policy. The security rules are defined in the Security Policy for the module and usually revolve around using only FIPS Approved cryptographic algorithms and key sizes. Please see the Security Policy for the specific security rules for each cryptographic module (See [Microsoft FIPS 140 Validated Cryptographic Modules](https://technet.microsoft.com/library/cc750357.aspx#_microsoft_fips_140) section for links to each policy). -6. Which FIPS validated module is called when Windows 7 or Windows 8 is configured to use the FIPS setting in the wireless configuration? - **Answer:** CNG is used. This setting tells the wireless driver to call FIPS 140-2 validated cryptographic modules instead of using the driver’s own cryptography, if any. -7. Is BitLocker to Go FIPS 140-2 validated? - **Answer:** There are two separate parts for BitLocker to Go. One part is simply a native feature of BitLocker and as such, it uses FIPS 140-2 validated cryptographic modules. The other part is the BitLocker to Go Reader application for down-level support of older operating systems such as Windows XP and Windows Vista. The Reader application does not use FIPS 140-2 validated cryptographic modules. -8. Are applications FIPS 140-2 validated? - **Answer:** Microsoft only has low-level cryptographic modules in Windows FIPS 140-2 validated, not high-level applications. A better question is whether a certain application calls a FIPS 140-2 validated cryptographic module in the underlying Windows OS. That question needs to be directed to the company/product group that created the application of interest. -9. How can Systems Center Operations Manager 2012 be configured to use FIPS 140-2 validated cryptographic modules? - **Answer:** See [https://technet.microsoft.com/library/hh914094.aspx](https://technet.microsoft.com/library/hh914094.aspx) - -## Microsoft FIPS 140 Validated Cryptographic Modules - -### Modules By Operating System - -The following tables identify the Cryptographic Modules for an operating system. - -#### Windows - -##### Windows 10 Creators Update (Version 1703) - -Validated Editions: Home, Pro, Enterprise, Education, S, Surface Hub, Mobile - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll)10.0.15063#3095

      FIPS Approved algorithms: AES (Cert. #4624); CKG (vendor affirmed); CVL (Certs. #1278 and #1281); DRBG (Cert. #1555); DSA (Cert. #1223); ECDSA (Cert. #1133); HMAC (Cert. #3061); KAS (Cert. #127); KBKDF (Cert. #140); KTS (AES Cert. #4626; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2521 and #2522); SHS (Cert. #3790); Triple-DES (Cert. #2459)
      -
      -Other algorithms: HMAC-MD5; MD5; DES; Legacy CAPI KDF; MD2; MD4; RC2; RC4; RSA (encrypt/decrypt)

      -

      Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #1133); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #2521); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #1281); SP800-135 - Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS (Cert. #1278)

      Kernel Mode Cryptographic Primitives Library (cng.sys)10.0.15063#3094

      #3094

      -

      FIPS Approved algorithms: AES (Certs. #4624 and #4626); CKG (vendor affirmed); CVL (Certs. #1278 and #1281); DRBG (Cert. #1555); DSA (Cert. #1223); ECDSA (Cert. #1133); HMAC (Cert. #3061); KAS (Cert. #127); KBKDF (Cert. #140); KTS (AES Cert. #4626; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2521 and #2523); SHS (Cert. #3790); Triple-DES (Cert. #2459)
      -
      -Other algorithms: HMAC-MD5; MD5; NDRNG; DES; Legacy CAPI KDF; MD2; MD4; RC2; RC4; RSA (encrypt/decrypt)

      -

      Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert.#1133); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert.#2521); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert.#1281)

      Boot Manager10.0.15063#3089

      FIPS Approved algorithms: AES (Certs. #4624 and #4625); CKG (vendor affirmed); HMAC (Cert. #3061); PBKDF (vendor affirmed); RSA (Cert. #2523); SHS (Cert. #3790)

      -

      Other algorithms: PBKDF (vendor affirmed); VMK KDF (vendor affirmed)

      Windows OS Loader10.0.15063#3090

      FIPS Approved algorithms: AES (Certs. #4624 and #4625); RSA (Cert. #2523); SHS (Cert. #3790)

      -

      Other algorithms: NDRNG

      Windows Resume[1]10.0.15063#3091FIPS Approved algorithms: AES (Certs. #4624 and #4625); RSA (Cert. #2523); SHS (Cert. #3790)
      BitLocker® Dump Filter[2]10.0.15063#3092FIPS Approved algorithms: AES (Certs. #4624 and #4625); RSA (Cert. #2522); SHS (Cert. #3790)
      Code Integrity (ci.dll)10.0.15063#3093

      FIPS Approved algorithms: AES (Cert. #4624); RSA (Certs. #2522 and #2523); SHS (Cert. #3790)

      -

      Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v1.5 - RSASP1 Signature Primitive (Cert. #1282)

      Secure Kernel Code Integrity (skci.dll)[3]10.0.15063#3096

      FIPS Approved algorithms: AES (Cert. #4624); RSA (Certs. #2522 and #2523); SHS (Cert. #3790)

      -

      Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v1.5 - RSASP1 Signature Primitive (Cert. #1282)

      - - -\[1\] Applies only to Home, Pro, Enterprise, Education and S - -\[2\] Applies only to Pro, Enterprise, Education, S, Mobile and Surface Hub - -\[3\] Applies only to Pro, Enterprise Education and S - -##### Windows 10 Anniversary Update (Version 1607) - -Validated Editions: Home, Pro, Enterprise, Enterprise LTSB, Mobile - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll)10.0.14393#2937

      FIPS Approved algorithms: AES (Cert. #4064); DRBG (Cert. #1217); DSA (Cert. #1098); ECDSA (Cert. #911); HMAC (Cert. #2651); KAS (Cert. #92); KBKDF (Cert. #101); KTS (AES Cert. #4062; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2192, #2193 and #2195); SHS (Cert. #3347); Triple-DES (Cert. #2227)
      -
      -Other algorithms: HMAC-MD5; MD5; DES; Legacy CAPI KDF; MD2; MD4; RC2; RC4; RSA (encrypt/decrypt)

      -

      Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #922); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #888); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #887); SP800-135 - Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS (Cert. #886)

      Kernel Mode Cryptographic Primitives Library (cng.sys)10.0.14393#2936

      FIPS Approved algorithms: AES (Cert. #4064); DRBG (Cert. #1217); DSA (Cert. #1098); ECDSA (Cert. #911); HMAC (Cert. #2651); KAS (Cert. #92); KBKDF (Cert. #101); KTS (AES Cert. #4062; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2192, #2193 and #2195); SHS (Cert. #3347); Triple-DES (Cert. #2227)
      -
      -Other algorithms: HMAC-MD5; MD5; NDRNG; DES; Legacy CAPI KDF; MD2; MD4; RC2; RC4; RSA (encrypt/decrypt)

      -

      Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #922); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #888); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #887)

      Boot Manager10.0.14393#2931

      FIPS Approved algorithms: AES (Certs. #4061 and #4064); HMAC (Cert. #2651); PBKDF (vendor affirmed); RSA (Cert. #2193); SHS (Cert. #3347)

      -

      Other algorithms: MD5; PBKDF (non-compliant); VMK KDF

      BitLocker® Windows OS Loader (winload)10.0.14393#2932FIPS Approved algorithms: AES (Certs. #4061 and #4064); RSA (Cert. #2193); SHS (Cert. #3347)
      -
      -Other algorithms: NDRNG; MD5
      BitLocker® Windows Resume (winresume)[1]10.0.14393#2933FIPS Approved algorithms: AES (Certs. #4061 and #4064); RSA (Cert. #2193); SHS (Cert. #3347)
      -
      -Other algorithms: MD5
      BitLocker® Dump Filter (dumpfve.sys)[2]10.0.14393#2934FIPS Approved algorithms: AES (Certs. #4061 and #4064)
      Code Integrity (ci.dll)10.0.14393#2935

      FIPS Approved algorithms: RSA (Cert. #2193); SHS (Cert. #3347)
      -
      -Other algorithms: AES (non-compliant); MD5

      -

      Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #888)

      Secure Kernel Code Integrity (skci.dll)[3]10.0.14393#2938

      FIPS Approved algorithms: RSA (Certs. #2193); SHS (Certs. #3347)
      -
      -Other algorithms: MD5

      -

      Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #888)

      - - -\[1\] Applies only to Home, Pro, Enterprise and Enterprise LTSB - -\[2\] Applies only to Pro, Enterprise, Enterprise LTSB and Mobile - -\[3\] Applies only to Pro, Enterprise and Enterprise LTSB - -##### Windows 10 November 2015 Update (Version 1511) - -Validated Editions: Home, Pro, Enterprise, Enterprise LTSB, Mobile, Surface Hub - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll)10.0.10586#2606

      FIPS Approved algorithms: AES (Certs. #3629); DRBG (Certs. #955); DSA (Certs. #1024); ECDSA (Certs. #760); HMAC (Certs. #2381); KAS (Certs. #72; key agreement; key establishment methodology provides between 112 and 256 bits of encryption strength); KBKDF (Certs. #72); KTS (AES Certs. #3653; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #1887, #1888 and #1889); SHS (Certs. #3047); Triple-DES (Certs. #2024)
      -
      -Other algorithms: DES; HMAC-MD5; Legacy CAPI KDF; MD2; MD4; MD5; RC2; RC4; RSA (encrypt/decrypt)

      -

      Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #666); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #665); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #663); SP800-135 - Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS (Cert. #664)

      Kernel Mode Cryptographic Primitives Library (cng.sys)10.0.10586#2605

      FIPS Approved algorithms: AES (Certs. #3629); DRBG (Certs. #955); DSA (Certs.  #1024); ECDSA (Certs. #760); HMAC (Certs. #2381); KAS (Certs. #72; key agreement; key establishment methodology provides between 112 and 256 bits of encryption strength); KBKDF (Certs. #72); KTS (AES Certs. #3653; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #1887, #1888 and #1889); SHS (Certs. #3047); Triple-DES (Certs. #2024)
      -
      -Other algorithms: DES; HMAC-MD5; Legacy CAPI KDF; MD2; MD4; MD5; RC2; RC4; RSA (encrypt/decrypt)

      -

      Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #666); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #665); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #663)

      Boot Manager[4]10.0.10586#2700FIPS Approved algorithms: AES (Certs. #3653); HMAC (Cert. #2381); PBKDF (vendor affirmed); RSA (Cert. #1871); SHS (Certs. #3047 and #3048)
      -
      -Other algorithms: MD5; KDF (non-compliant); PBKDF (non-compliant)
      BitLocker® Windows OS Loader (winload)[5]10.0.10586#2701FIPS Approved algorithms: AES (Certs. #3629 and #3653); RSA (Cert. #1871); SHS (Cert. #3048)
      -
      -Other algorithms: MD5; NDRNG
      BitLocker® Windows Resume (winresume)[6]10.0.10586#2702FIPS Approved algorithms: AES (Certs. #3653); RSA (Cert. #1871); SHS (Cert. #3048)
      -
      -Other algorithms: MD5
      BitLocker® Dump Filter (dumpfve.sys)[7]10.0.10586#2703FIPS Approved algorithms: AES (Certs. #3653)
      Code Integrity (ci.dll)10.0.10586#2604

      FIPS Approved algorithms: RSA (Certs. #1871); SHS (Certs. #3048)
      -
      -Other algorithms: AES (non-compliant); MD5

      -

      Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #665)

      Secure Kernel Code Integrity (skci.dll)[8]10.0.10586#2607

      FIPS Approved algorithms: RSA (Certs. #1871); SHS (Certs. #3048)
      -
      -Other algorithms: MD5

      -

      Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #665)

      - - -\[4\] Applies only to Home, Pro, Enterprise, Mobile and Surface Hub - -\[5\] Applies only to Home, Pro, Enterprise, Mobile and Surface Hub - -\[6\] Applies only to Home, Pro and Enterprise - -\[7\] Applies only to Pro, Enterprise, Mobile and Surface Hub - -\[8\] Applies only to Enterprise and Enterprise LTSB - -##### Windows 10 (Version 1507) - -Validated Editions: Home, Pro, Enterprise, Enterprise LTSB, Mobile, and Surface Hub - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll)10.0.10240#2606

      FIPS Approved algorithms: AES (Certs. #3497); DRBG (Certs. #868); DSA (Certs. #983); ECDSA (Certs. #706); HMAC (Certs. #2233); KAS (Certs. #64; key agreement; key establishment methodology provides between 112 and 256 bits of encryption strength); KBKDF (Certs. #66); KTS (AES Certs. #3507; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #1783, #1798, and #1802); SHS (Certs. #2886); Triple-DES (Certs. #1969)
      -
      -Other algorithms: DES; HMAC-MD5; Legacy CAPI KDF; MD2; MD4; MD5; RC2; RC4; RSA (encrypt/decrypt)

      -

      Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #572); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #576); SP800-135 - Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS (Cert. #575)

      Kernel Mode Cryptographic Primitives Library (cng.sys)10.0.10240#2605

      FIPS Approved algorithms: AES (Certs. #3497); DRBG (Certs. #868); DSA (Certs. #983); ECDSA (Certs. #706); HMAC (Certs. #2233); KAS (Certs. #64; key agreement; key establishment methodology provides between 112 and 256 bits of encryption strength); KBKDF (Certs. #66); KTS (AES Certs. #3507; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #1783, #1798, and #1802); SHS (Certs. #2886); Triple-DES (Certs. #1969)
      -
      -Other algorithms: DES; HMAC-MD5; Legacy CAPI KDF; MD2; MD4; MD5; RC2; RC4; RSA (encrypt/decrypt)

      -

      Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #572); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #576)

      Boot Manager[9]10.0.10240#2600FIPS Approved algorithms: AES (Cert. #3497); HMAC (Cert. #2233); KTS (AES Cert. #3498); PBKDF (vendor affirmed); RSA (Cert. #1784); SHS (Certs. #2871 and #2886)
      -
      -Other algorithms: MD5; KDF (non-compliant); PBKDF (non-compliant)
      BitLocker® Windows OS Loader (winload)[10]10.0.10240#2601FIPS Approved algorithms: AES (Certs. #3497 and #3498); RSA (Cert. #1784); SHS (Cert. #2871)
      -
      -Other algorithms: MD5; NDRNG
      BitLocker® Windows Resume (winresume)[11]10.0.10240#2602FIPS Approved algorithms: AES (Certs. #3497 and #3498); RSA (Cert. #1784); SHS (Cert. #2871)
      -
      -Other algorithms: MD5
      BitLocker® Dump Filter (dumpfve.sys)[12]10.0.10240#2603FIPS Approved algorithms: AES (Certs. #3497 and #3498)
      Code Integrity (ci.dll)10.0.10240#2604

      FIPS Approved algorithms: RSA (Certs. #1784); SHS (Certs. #2871)
      -
      -Other algorithms: AES (non-compliant); MD5

      -

      Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #572)

      Secure Kernel Code Integrity (skci.dll)[13]10.0.10240#2607

      FIPS Approved algorithms: RSA (Certs. #1784); SHS (Certs. #2871)
      -
      -Other algorithms: MD5

      -

      Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #572)

      - - -\[9\] Applies only to Home, Pro, Enterprise and Enterprise LTSB - -\[10\] Applies only to Home, Pro, Enterprise and Enterprise LTSB - -\[11\] Applies only to Home, Pro, Enterprise and Enterprise LTSB - -\[12\] Applies only to Pro, Enterprise and Enterprise LTSB - -\[13\] Applies only to Enterprise and Enterprise LTSB - -##### Windows 8.1 - -Validated Editions: RT, Pro, Enterprise, Phone, Embedded - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll)6.3.9600 6.3.9600.17031#2357

      FIPS Approved algorithms: AES (Cert. #2832); DRBG (Certs. #489); DSA (Cert. #855); ECDSA (Cert. #505); HMAC (Cert. #1773); KAS (Cert. #47); KBKDF (Cert. #30); PBKDF (vendor affirmed); RSA (Certs. #1487, #1493 and #1519); SHS (Cert. #2373); Triple-DES (Cert. #1692)
      -
      -Other algorithms: AES (Cert. #2832, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); AES-GCM encryption (non-compliant); DES; HMAC MD5; Legacy CAPI KDF; MD2; MD4; MD5; NDRNG; RC2; RC4; RSA (encrypt/decrypt)#2832, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); AES-GCM encryption (non-compliant); DES; HMAC MD5; Legacy CAPI KDF; MD2; MD4; MD5; NDRNG; RC2; RC4; RSA (encrypt/decrypt)

      -

      Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #288); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #289); SP800-135 - Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS (Cert. #323)

      Kernel Mode Cryptographic Primitives Library (cng.sys)6.3.9600 6.3.9600.17042#2356

      FIPS Approved algorithms: AES (Cert. #2832); DRBG (Certs. #489); ECDSA (Cert. #505); HMAC (Cert. #1773); KAS (Cert. #47); KBKDF (Cert. #30); PBKDF (vendor affirmed); RSA (Certs. #1487, #1493 and #1519); SHS (Cert. # 2373); Triple-DES (Cert. #1692)
      -
      -Other algorithms: AES (Cert. #2832, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); AES-GCM encryption (non-compliant); DES; HMAC MD5; Legacy CAPI KDF; MD2; MD4; MD5; NDRNG; RC2; RC4; RSA (encrypt/decrypt)

      -

      Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #288); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #289)

      Boot Manager6.3.9600 6.3.9600.17031#2351FIPS Approved algorithms: AES (Cert. #2832); HMAC (Cert. #1773); PBKDF (vendor affirmed); RSA (Cert. #1494); SHS (Certs. # 2373 and #2396)
      -
      -Other algorithms: MD5; KDF (non-compliant); PBKDF (non-compliant)
      BitLocker® Windows OS Loader (winload)6.3.9600 6.3.9600.17031#2352FIPS Approved algorithms: AES (Cert. #2832); RSA (Cert. #1494); SHS (Cert. #2396)
      -
      -Other algorithms: MD5; NDRNG
      BitLocker® Windows Resume (winresume)[14]6.3.9600 6.3.9600.17031#2353FIPS Approved algorithms: AES (Cert. #2832); RSA (Cert. #1494); SHS (Certs. # 2373 and #2396)
      -
      -Other algorithms: MD5
      BitLocker® Dump Filter (dumpfve.sys)6.3.9600 6.3.9600.17031#2354FIPS Approved algorithms: AES (Cert. #2832)
      -
      -Other algorithms: N/A
      Code Integrity (ci.dll)6.3.9600 6.3.9600.17031#2355#2355

      FIPS Approved algorithms: RSA (Cert. #1494); SHS (Cert. # 2373)
      -
      -Other algorithms: MD5

      -

      Validated Component Implementations: PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #289)

      - - -\[14\] Applies only to Pro, Enterprise, and Embedded 8. - -##### Windows 8 - -Validated Editions: RT, Home, Pro, Enterprise, Phone - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Cryptographic Primitives Library (BCRYPTPRIMITIVES.DLL)6.2.9200#1892FIPS Approved algorithms: AES (Certs. #2197 and #2216); DRBG (Certs. #258); DSA (Cert. #687); ECDSA (Cert. #341); HMAC (Cert. #1345); KAS (Cert. #36); KBKDF (Cert. #3); PBKDF (vendor affirmed); RSA (Certs. #1133 and #1134); SHS (Cert. #1903); Triple-DES (Cert. #1387)
      -
      -Other algorithms: AES (Cert. #2197, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)#258); DSA (Cert. ); ECDSA (Cert. ); HMAC (Cert. ); KAS (Cert. ); KBKDF (Cert. ); PBKDF (vendor affirmed); RSA (Certs.  and ); SHS (Cert. ); Triple-DES (Cert. )
      -
      -
      Kernel Mode Cryptographic Primitives Library (cng.sys)6.2.9200#1891FIPS Approved algorithms: AES (Certs. #2197 and #2216); DRBG (Certs. #258 and #259); ECDSA (Cert. #341); HMAC (Cert. #1345); KAS (Cert. #36); KBKDF (Cert. #3); PBKDF (vendor affirmed); RNG (Cert. #1110); RSA (Certs. #1133 and #1134); SHS (Cert. #1903); Triple-DES (Cert. #1387)
      -
      -Other algorithms: AES (Cert. #2197, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)#258 and ); ECDSA (Cert. ); HMAC (Cert. ); KAS (Cert. ); KBKDF (Cert. ); PBKDF (vendor affirmed); RNG (Cert. ); RSA (Certs.  and ); SHS (Cert. ); Triple-DES (Cert. )
      -
      -Other algorithms: AES (Cert. , key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)
      Boot Manager6.2.9200#1895FIPS Approved algorithms: AES (Certs. #2196 and #2198); HMAC (Cert. #1347); RSA (Cert. #1132); SHS (Cert. #1903)
      -
      -Other algorithms: MD5
      BitLocker® Windows OS Loader (WINLOAD)6.2.9200#1896FIPS Approved algorithms: AES (Certs. #2196 and #2198); RSA (Cert. #1132); SHS (Cert. #1903)
      -
      -Other algorithms: AES (Cert. #2197; non-compliant); MD5; Non-Approved RNG
      BitLocker® Windows Resume (WINRESUME)[15]6.2.9200#1898FIPS Approved algorithms: AES (Certs. #2196 and #2198); RSA (Cert. #1132); SHS (Cert. #1903)
      -
      -Other algorithms: MD5
      BitLocker® Dump Filter (DUMPFVE.SYS)6.2.9200#1899FIPS Approved algorithms: AES (Certs. #2196 and #2198)
      -
      -Other algorithms: N/A
      Code Integrity (CI.DLL)6.2.9200#1897FIPS Approved algorithms: RSA (Cert. #1132); SHS (Cert. #1903)
      -
      -Other algorithms: MD5
      Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH.DLL)6.2.9200#1893FIPS Approved algorithms: DSA (Cert. #686); SHS (Cert. #1902); Triple-DES (Cert. #1386); Triple-DES MAC (Triple-DES Cert. #1386, vendor affirmed)
      -
      -Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman; MD5; RC2; RC2 MAC; RC4; Triple-DES (Cert. #1386, key wrapping; key establishment methodology provides 112 bits of encryption strength; non-compliant less than 112 bits of encryption strength)#1902); Triple-DES (Cert. ); Triple-DES MAC (Triple-DES Cert. , vendor affirmed)
      -
      -Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman; MD5; RC2; RC2 MAC; RC4; Triple-DES (Cert. , key wrapping; key establishment methodology provides 112 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
      Enhanced Cryptographic Provider (RSAENH.DLL)6.2.9200#1894FIPS Approved algorithms: AES (Cert. #2196); HMAC (Cert. #1346); RSA (Cert. #1132); SHS (Cert. #1902); Triple-DES (Cert. #1386)
      -
      -Other algorithms: AES (Cert. #2196, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); Triple-DES (Cert. #1386, key wrapping; key establishment methodology provides 112 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
      - - -\[15\] Applies only to Home and Pro - -**Windows 7** - -Validated Editions: Windows 7, Windows 7 SP1 - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Cryptographic Primitives Library (BCRYPTPRIMITIVES.DLL)

      6.1.7600.16385

      -

      6.1.7601.17514

      		1329FIPS Approved algorithms: AES (Certs. #1168 and #1178); AES GCM (Cert. #1168, vendor-affirmed); AES GMAC (Cert. #1168, vendor-affirmed); DRBG (Certs. #23 and #24); DSA (Cert. #386); ECDSA (Cert. #141); HMAC (Cert. #677); KAS (SP 800-56A, vendor affirmed, key agreement; key establishment methodology provides 80 to 256 bits of encryption strength); RNG (Cert. #649); RSA (Certs. #559 and #560); SHS (Cert. #1081); Triple-DES (Cert. #846)
      -
      -Other algorithms: AES (Cert. #1168, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4#559 and ); SHS (Cert. ); Triple-DES (Cert. )
      -
      -Other algorithms: AES (Cert. , key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4
      Kernel Mode Cryptographic Primitives Library (cng.sys)

      6.1.7600.16385

      -

      6.1.7600.16915

      -

      6.1.7600.21092

      -

      6.1.7601.17514

      -

      6.1.7601.17725

      -

      6.1.7601.17919

      -

      6.1.7601.21861

      -

      6.1.7601.22076

      		1328FIPS Approved algorithms: AES (Certs. #1168 and #1178); AES GCM (Cert. #1168, vendor-affirmed); AES GMAC (Cert. #1168, vendor-affirmed); DRBG (Certs. #23 and #24); ECDSA (Cert. #141); HMAC (Cert. #677); KAS (SP 800-56A, vendor affirmed, key agreement; key establishment methodology provides 80 to 256 bits of encryption strength); RNG (Cert. #649); RSA (Certs. #559 and #560); SHS (Cert. #1081); Triple-DES (Cert. #846)
      -
      -Other algorithms: AES (Cert. #1168, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4
      Boot Manager

      6.1.7600.16385

      -

      6.1.7601.17514

      		1319FIPS Approved algorithms: AES (Certs. #1168 and #1177); HMAC (Cert. #675); RSA (Cert. #557); SHS (Cert. #1081)
      -
      -Other algorithms: MD5#1168 and ); HMAC (Cert. ); RSA (Cert. ); SHS (Cert. )
      -
      -Other algorithms: MD5
      Winload OS Loader (winload.exe)

      6.1.7600.16385

      -

      6.1.7600.16757

      -

      6.1.7600.20897

      -

      6.1.7600.20916

      -

      6.1.7601.17514

      -

      6.1.7601.17556

      -

      6.1.7601.21655

      -

      6.1.7601.21675

      		1326FIPS Approved algorithms: AES (Certs. #1168 and #1177); RSA (Cert. #557); SHS (Cert. #1081)
      -
      -Other algorithms: MD5
      BitLocker™ Drive Encryption

      6.1.7600.16385

      -

      6.1.7600.16429

      -

      6.1.7600.16757

      -

      6.1.7600.20536

      -

      6.1.7600.20873

      -

      6.1.7600.20897

      -

      6.1.7600.20916

      -

      6.1.7601.17514

      -

      6.1.7601.17556

      -

      6.1.7601.21634

      -

      6.1.7601.21655

      -

      6.1.7601.21675

      		1332FIPS Approved algorithms: AES (Certs. #1168 and #1177); HMAC (Cert. #675); SHS (Cert. #1081)
      -
      -Other algorithms: Elephant Diffuser
      Code Integrity (CI.DLL)

      6.1.7600.16385

      -

      6.1.7600.17122

      -

      6.1.7600.21320

      -

      6.1.7601.17514

      -

      6.1.7601.17950

      -

      6.1.7601.22108

      		1327FIPS Approved algorithms: RSA (Cert. #557); SHS (Cert. #1081)
      -
      -Other algorithms: MD5
      Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH.DLL)6.1.7600.16385
      -(no change in SP1)      		1331FIPS Approved algorithms: DSA (Cert. #385); RNG (Cert. #649); SHS (Cert. #1081); Triple-DES (Cert. #846); Triple-DES MAC (Triple-DES Cert. #846, vendor affirmed)
      -
      -Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman; MD5; RC2; RC2 MAC; RC4
      Enhanced Cryptographic Provider (RSAENH.DLL)6.1.7600.16385
      -(no change in SP1)      		1330FIPS Approved algorithms: AES (Cert. #1168); DRBG (Cert. #23); HMAC (Cert. #673); SHS (Cert. #1081); RSA (Certs. #557 and #559); Triple-DES (Cert. #846)
      -
      -Other algorithms: DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 256-bits of encryption strength; non-compliant less than 112 bits of encryption strength)
      - - -##### Windows Vista SP1 - -Validated Editions: Ultimate Edition - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Boot Manager (bootmgr)6.0.6001.18000 and 6.0.6002.18005978FIPS Approved algorithms: AES (Certs. #739 and #760); HMAC (Cert. #415); RSA (Cert. #354); SHS (Cert. #753)
      Winload OS Loader (winload.exe)6.0.6001.18000, 6.0.6001.18027, 6.0.6001.18606, 6.0.6001.22125, 6.0.6001.22861, 6.0.6002.18005, 6.0.6002.18411 and 6.0.6002.22596979FIPS Approved algorithms: AES (Certs. #739 and #760); RSA (Cert. #354); SHS (Cert. #753)
      -
      -Other algorithms: MD5
      Code Integrity (ci.dll)6.0.6001.18000, 6.0.6001.18023, 6.0.6001.22120, and 6.0.6002.18005980FIPS Approved algorithms: RSA (Cert. #354); SHS (Cert. #753)
      -
      -Other algorithms: MD5
      Kernel Mode Security Support Provider Interface (ksecdd.sys)6.0.6001.18709, 6.0.6001.18272, 6.0.6001.18796, 6.0.6001.22202, 6.0.6001.22450, 6.0.6001.22987, 6.0.6001.23069, 6.0.6002.18005, 6.0.6002.18051, 6.0.6002.18541, 6.0.6002.18643, 6.0.6002.22152, 6.0.6002.22742, and 6.0.6002.228696.0.6001.18709, 6.0.6001.18272, 6.0.6001.18796, 6.0.6001.22202, 6.0.6001.22450, 6.0.6001.22987, 6.0.6001.23069, 6.0.6002.18005, 6.0.6002.18051, 6.0.6002.18541, 6.0.6002.18643, 6.0.6002.22152, 6.0.6002.22742, and 6.0.6002.228691000

      FIPS Approved algorithms: AES (Certs. #739 and #756); ECDSA (Cert. #82); HMAC (Cert. #412); RNG (Cert. #435 and SP 800-90 AES-CTR, vendor-affirmed); RSA (Certs. #353 and #357); SHS (Cert. #753); Triple-DES (Cert. #656)#739 and ); ECDSA (Cert. ); HMAC (Cert. ); RNG (Cert.  and SP 800-90 AES-CTR, vendor-affirmed); RSA (Certs.  and ); SHS (Cert. ); Triple-DES (Cert. )

      -

      Other algorithms: AES (GCM and GMAC; non-compliant); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides between 128 and 256 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4; RNG (SP 800-90 Dual-EC; non-compliant); RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength)

      Cryptographic Primitives Library (bcrypt.dll)6.0.6001.22202, 6.0.6002.18005, and 6.0.6002.228726.0.6001.22202, 6.0.6002.18005, and 6.0.6002.228721001

      FIPS Approved algorithms: AES (Certs. #739 and #756); DSA (Cert. #283); ECDSA (Cert. #82); HMAC (Cert. #412); RNG (Cert. #435 and SP 800-90, vendor affirmed); RSA (Certs. #353 and #357); SHS (Cert. #753); Triple-DES (Cert. #656)

      -

      Other algorithms: AES (GCM and GMAC; non-compliant); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides between 128 and 256 bits of encryption strength); MD2; MD4; MD5; RC2; RC4; RNG (SP 800-90 Dual-EC; non-compliant); RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant provides less than 112 bits of encryption strength)

      Enhanced Cryptographic Provider (RSAENH)6.0.6001.22202 and 6.0.6002.180056.0.6001.22202 and 6.0.6002.180051002

      FIPS Approved algorithms: AES (Cert. #739); HMAC (Cert. #407); RNG (SP 800-90, vendor affirmed); RSA (Certs. #353 and #354); SHS (Cert. #753); Triple-DES (Cert. #656)

      -

      Other algorithms: DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength)

      Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)6.0.6001.18000 and 6.0.6002.180056.0.6001.18000 and 6.0.6002.180051003

      FIPS Approved algorithms: DSA (Cert. #281); RNG (Cert. #435); SHS (Cert. #753); Triple-DES (Cert. #656); Triple-DES MAC (Triple-DES Cert. #656, vendor affirmed)

      -

      Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD5; RC2; RC2 MAC; RC4

      - - -##### Windows Vista - -Validated Editions: Ultimate Edition - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Enhanced Cryptographic Provider (RSAENH)6.0.6000.16386893FIPS Approved algorithms: AES (Cert. #553); HMAC (Cert. #297); RNG (Cert. #321); RSA (Certs. #255 and #258); SHS (Cert. #618); Triple-DES (Cert. #549)
      -
      -Other algorithms: DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
      Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)6.0.6000.16386894FIPS Approved algorithms: DSA (Cert. #226); RNG (Cert. #321); SHS (Cert. #618); Triple-DES (Cert. #549); Triple-DES MAC (Triple-DES Cert. #549, vendor affirmed)
      -
      -Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD5; RC2; RC2 MAC; RC4
      BitLocker™ Drive Encryption6.0.6000.16386947FIPS Approved algorithms: AES (Cert. #715); HMAC (Cert. #386); SHS (Cert. #737)
      -
      -Other algorithms: Elephant Diffuser
      Kernel Mode Security Support Provider Interface (ksecdd.sys)6.0.6000.16386, 6.0.6000.16870 and 6.0.6000.21067891FIPS Approved algorithms: AES (Cert. #553); ECDSA (Cert. #60); HMAC (Cert. #298); RNG (Cert. #321); RSA (Certs. #257 and #258); SHS (Cert. #618); Triple-DES (Cert. #549)
      -
      -Other algorithms: DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides 128 to 256 bits of encryption strength); MD2; MD4; MD5; RC2; RC4; HMAC MD5
      - - -##### Windows XP SP3 - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Kernel Mode Cryptographic Module (FIPS.SYS)5.1.2600.5512997

      FIPS Approved algorithms: HMAC (Cert. #429); RNG (Cert. #449); SHS (Cert. #785); Triple-DES (Cert. #677); Triple-DES MAC (Triple-DES Cert. #677, vendor affirmed)

      -

      Other algorithms: DES; MD5; HMAC MD5

      Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)5.1.2600.5507990

      FIPS Approved algorithms: DSA (Cert. #292); RNG (Cert. #448); SHS (Cert. #784); Triple-DES (Cert. #676); Triple-DES MAC (Triple-DES Cert. #676, vendor affirmed)

      -

      Other algorithms: DES; DES40; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits); MD5; RC2; RC4

      Enhanced Cryptographic Provider (RSAENH)5.1.2600.5507989

      FIPS Approved algorithms: AES (Cert. #781); HMAC (Cert. #428); RNG (Cert. #447); RSA (Cert. #371); SHS (Cert. #783); Triple-DES (Cert. #675); Triple-DES MAC (Triple-DES Cert. #675, vendor affirmed)

      -

      Other algorithms: DES; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits)

      - - -##### Windows XP SP2 - - ------ - - - - - - - - - - - - - - - - - - - - -
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      DSS/Diffie-Hellman Enhanced Cryptographic Provider5.1.2600.2133240

      FIPS Approved algorithms: Triple-DES (Cert. #16); DSA/SHA-1 (Cert. #29)

      -

      Other algorithms: DES (Cert. #66); RC2; RC4; MD5; DES40; Diffie-Hellman (key agreement)

      Microsoft Enhanced Cryptographic Provider5.1.2600.2161238

      FIPS Approved algorithms: Triple-DES (Cert. #81); AES (Cert. #33); SHA-1 (Cert. #83); RSA (PKCS#1, vendor affirmed); HMAC-SHA-1 (Cert. #83, vendor affirmed)

      -

      Other algorithms: DES (Cert. #156); RC2; RC4; MD5

      - - -##### Windows XP SP1 - - ------ - - - - - - - - - - - - - - -
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Microsoft Enhanced Cryptographic Provider5.1.2600.1029238

      FIPS Approved algorithms: Triple-DES (Cert. #81); AES (Cert. #33); SHA-1 (Cert. #83); RSA (PKCS#1, vendor affirmed); HMAC-SHA-1 (Cert. #83, vendor affirmed)

      -

      Other algorithms: DES (Cert. #156); RC2; RC4; MD5

      - - -##### Windows XP - - ------ - - - - - - - - - - - - - - -
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Kernel Mode Cryptographic Module5.1.2600.0241

      FIPS Approved algorithms: Triple-DES (Cert. #16); DSA/SHA-1 (Cert. #35); HMAC-SHA-1 (Cert. #35, vendor affirmed)

      -

      Other algorithms: DES (Cert. #89)

      - - -##### Windows 2000 SP3 - - ------ - - - - - - - - - - - - - - - - - - - - -
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Kernel Mode Cryptographic Module (FIPS.SYS)5.0.2195.1569106

      FIPS Approved algorithms: Triple-DES (Cert. #16); SHA-1 (Certs. #35)

      -

      Other algorithms: DES (Certs. #89)

      Base DSS Cryptographic Provider, Base Cryptographic Provider, DSS/Diffie-Hellman Enhanced Cryptographic Provider, and Enhanced Cryptographic Provider

      (Base DSS: 5.0.2195.3665 [SP3])

      -

      (Base: 5.0.2195.3839 [SP3])

      -

      (DSS/DH Enh: 5.0.2195.3665 [SP3])

      -

      (Enh: 5.0.2195.3839 [SP3]

      		103

      FIPS Approved algorithms: Triple-DES (Cert. #16); DSA/SHA-1 (Certs. #28 and #29); RSA (vendor affirmed)

      -

      Other algorithms: DES (Certs. #65, 66, 67 and 68); Diffie-Hellman (key agreement); RC2; RC4; MD2; MD4; MD5

      - - -##### Windows 2000 SP2 - - ------ - - - - - - - - - - - - - - - - - - - - -
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Kernel Mode Cryptographic Module (FIPS.SYS)5.0.2195.1569106

      FIPS Approved algorithms: Triple-DES (Cert. #16); SHA-1 (Certs. #35)

      -

      Other algorithms: DES (Certs. #89)

      Base DSS Cryptographic Provider, Base Cryptographic Provider, DSS/Diffie-Hellman Enhanced Cryptographic Provider, and Enhanced Cryptographic Provider

      (Base DSS:

      -

      5.0.2195.2228 [SP2])

      -

      (Base:

      -

      5.0.2195.2228 [SP2])

      -

      (DSS/DH Enh:

      -

      5.0.2195.2228 [SP2])

      -

      (Enh:

      -

      5.0.2195.2228 [SP2])

      		103

      FIPS Approved algorithms: Triple-DES (Cert. #16); DSA/SHA-1 (Certs. #28 and #29); RSA (vendor affirmed)

      -

      Other algorithms: DES (Certs. #65, 66, 67 and 68); Diffie-Hellman (key agreement); RC2; RC4; MD2; MD4; MD5

      - - -##### Windows 2000 SP1 - - ------ - - - - - - - - - - - - - - -
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Base DSS Cryptographic Provider, Base Cryptographic Provider, DSS/Diffie-Hellman Enhanced Cryptographic Provider, and Enhanced Cryptographic Provider

      (Base DSS: 5.0.2150.1391 [SP1])

      -

      (Base: 5.0.2150.1391 [SP1])

      -

      (DSS/DH Enh: 5.0.2150.1391 [SP1])

      -

      (Enh: 5.0.2150.1391 [SP1])

      		103

      FIPS Approved algorithms: Triple-DES (Cert. #16); DSA/SHA-1 (Certs. #28 and #29); RSA (vendor affirmed)

      -

      Other algorithms: DES (Certs. #65, 66, 67 and 68); Diffie-Hellman (key agreement); RC2; RC4; MD2; MD4; MD5

      - - -##### Windows 2000 - - ------ - - - - - - - - - - - - - - -
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Base DSS Cryptographic Provider, Base Cryptographic Provider, DSS/Diffie-Hellman Enhanced Cryptographic Provider, and Enhanced Cryptographic Provider5.0.2150.176

      FIPS Approved algorithms: Triple-DES (vendor affirmed); DSA/SHA-1 (Certs. #28 and 29); RSA (vendor affirmed)

      -

      Other algorithms: DES (Certs. #65, 66, 67 and 68); RC2; RC4; MD2; MD4; MD5; Diffie-Hellman (key agreement)

      - - -##### Windows 95 and Windows 98 - - ------ - - - - - - - - - - - - - - -
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Base DSS Cryptographic Provider, Base Cryptographic Provider, DSS/Diffie-Hellman Enhanced Cryptographic Provider, and Enhanced Cryptographic Provider5.0.1877.6 and 5.0.1877.775

      FIPS Approved algorithms: Triple-DES (vendor affirmed); SHA-1 (Certs. #20 and 21); DSA/SHA-1 (Certs. #25 and 26); RSA (vendor- affirmed)

      -

      Other algorithms: DES (Certs. #61, 62, 63 and 64); RC2; RC4; MD2; MD4; MD5; Diffie-Hellman (key agreement)

      - - -##### Windows NT 4.0 - - - - - - - - - - - - - - - - -
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Base Cryptographic Provider5.0.1877.6 and 5.0.1877.768FIPS Approved algorithms: SHA-1 (Certs. #20 and 21); DSA/SHA- 1 (Certs. #25 and 26); RSA (vendor affirmed)
      -
      -Other algorithms: DES (Certs. #61, 62, 63 and 64); Triple-DES (allowed for US and Canadian Government use); RC2; RC4; MD2; MD4; MD5; Diffie-Hellman (key agreement)
      - - -#### Windows Server - -##### Windows Server 2016 - -Validated Editions: Standard, Datacenter, Storage Server - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll)10.0.143932937FIPS Approved algorithms: AES (Cert. #4064); DRBG (Cert. #1217); DSA (Cert. #1098); ECDSA (Cert. #911); HMAC (Cert. #2651); KAS (Cert. #92); KBKDF (Cert. #101); KTS (AES Cert. #4062; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2192, #2193 and #2195); SHS (Cert. #3347); Triple-DES (Cert. #2227)
      -
      -Other algorithms: HMAC-MD5; MD5; DES; Legacy CAPI KDF; MD2; MD4; RC2; RC4; RSA (encrypt/decrypt)
      Kernel Mode Cryptographic Primitives Library (cng.sys)10.0.143932936FIPS Approved algorithms: AES (Cert. #4064); DRBG (Cert. #1217); DSA (Cert. #1098); ECDSA (Cert. #911); HMAC (Cert. #2651); KAS (Cert. #92); KBKDF (Cert. #101); KTS (AES Cert. #4062; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2192, #2193 and #2195); SHS (Cert. #3347); Triple-DES (Cert. #2227)
      -
      -Other algorithms: HMAC-MD5; MD5; NDRNG; DES; Legacy CAPI KDF; MD2; MD4; RC2; RC4; RSA (encrypt/decrypt)
      Boot Manager10.0.143932931

      FIPS Approved algorithms: AES (Certs. #4061 and #4064); HMAC (Cert. #2651); PBKDF (vendor affirmed); RSA (Cert. #2193); SHS (Cert. #3347)

      -

      Other algorithms: MD5; PBKDF (non-compliant); VMK KDF

      BitLocker® Windows OS Loader (winload)10.0.143932932FIPS Approved algorithms: AES (Certs. #4061 and #4064); RSA (Cert. #2193); SHS (Cert. #3347)
      -
      -Other algorithms: NDRNG; MD5
      BitLocker® Windows Resume (winresume)10.0.143932933FIPS Approved algorithms: AES (Certs. #4061 and #4064); RSA (Cert. #2193); SHS (Cert. #3347)
      -
      -Other algorithms: MD5
      BitLocker® Dump Filter (dumpfve.sys)10.0.143932934FIPS Approved algorithms: AES (Certs. #4061 and #4064)
      Code Integrity (ci.dll)10.0.143932935FIPS Approved algorithms: RSA (Cert. #2193); SHS (Cert. #3347)
      -
      -Other algorithms: AES (non-compliant); MD5
      Secure Kernel Code Integrity (skci.dll)10.0.143932938FIPS Approved algorithms: RSA (Certs. #2193); SHS (Certs. #3347)
      -
      -Other algorithms: MD5
      - - -##### Windows Server 2012 R2 - -Validated Editions: Server, Storage Server, - -**StorSimple 8000 Series, Azure StorSimple Virtual Array Windows Server 2012 R2** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll)6.3.9600 6.3.9600.170312357FIPS Approved algorithms: AES (Cert. #2832); DRBG (Certs. #489); DSA (Cert. #855); ECDSA (Cert. #505); HMAC (Cert. #1773); KAS (Cert. #47); KBKDF (Cert. #30); PBKDF (vendor affirmed); RSA (Certs. #1487, #1493 and #1519); SHS (Cert. #2373); Triple-DES (Cert. #1692)
      -
      -Other algorithms: AES (Cert. #2832, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); AES-GCM encryption (non-compliant); DES; HMAC MD5; Legacy CAPI KDF; MD2; MD4; MD5; NDRNG; RC2; RC4; RSA (encrypt/decrypt)
      Kernel Mode Cryptographic Primitives Library (cng.sys)6.3.9600 6.3.9600.170422356FIPS Approved algorithms: AES (Cert. #2832); DRBG (Certs. #489); ECDSA (Cert. #505); HMAC (Cert. #1773); KAS (Cert. #47); KBKDF (Cert. #30); PBKDF (vendor affirmed); RSA (Certs. #1487, #1493 and #1519); SHS (Cert. # 2373); Triple-DES (Cert. #1692)
      -
      -Other algorithms: AES (Cert. #2832, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); AES-GCM encryption (non-compliant); DES; HMAC MD5; Legacy CAPI KDF; MD2; MD4; MD5; NDRNG; RC2; RC4; RSA (encrypt/decrypt)
      Boot Manager6.3.9600 6.3.9600.170312351FIPS Approved algorithms: AES (Cert. #2832); HMAC (Cert. #1773); PBKDF (vendor affirmed); RSA (Cert. #1494); SHS (Certs. # 2373 and #2396)
      -
      -Other algorithms: MD5; KDF (non-compliant); PBKDF (non-compliant)
      BitLocker® Windows OS Loader (winload)6.3.9600 6.3.9600.170312352FIPS Approved algorithms: AES (Cert. #2832); RSA (Cert. #1494); SHS (Cert. #2396)
      -
      -Other algorithms: MD5; NDRNG
      BitLocker® Windows Resume (winresume)[16]6.3.9600 6.3.9600.170312353FIPS Approved algorithms: AES (Cert. #2832); RSA (Cert. #1494); SHS (Certs. # 2373 and #2396)
      -
      -Other algorithms: MD5
      BitLocker® Dump Filter (dumpfve.sys)[17]6.3.9600 6.3.9600.170312354FIPS Approved algorithms: AES (Cert. #2832)
      -
      -Other algorithms: N/A
      Code Integrity (ci.dll)6.3.9600 6.3.9600.170312355FIPS Approved algorithms: RSA (Cert. #1494); SHS (Cert. # 2373)
      -
      -Other algorithms: MD5
      - - -\[16\] Does not apply to **Azure StorSimple Virtual Array Windows Server 2012 R2** - -\[17\] Does not apply to **Azure StorSimple Virtual Array Windows Server 2012 R2** - -**Windows Server 2012** - -Validated Editions: Server, Storage Server - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Cryptographic Primitives Library (BCRYPTPRIMITIVES.DLL)6.2.92001892FIPS Approved algorithms: AES (Certs. #2197 and #2216); DRBG (Certs. #258); DSA (Cert. #687); ECDSA (Cert. #341); HMAC (Cert. #1345); KAS (Cert. #36); KBKDF (Cert. #3); PBKDF (vendor affirmed); RSA (Certs. #1133 and #1134); SHS (Cert. #1903); Triple-DES (Cert. #1387)
      -
      -Other algorithms: AES (Cert. #2197, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)#687); ECDSA (Cert. ); HMAC (Cert. #); KAS (Cert. ); KBKDF (Cert. ); PBKDF (vendor affirmed); RSA (Certs.  and ); SHS (Cert. ); Triple-DES (Cert. )
      -
      -Other algorithms: AES (Cert. , key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)
      Kernel Mode Cryptographic Primitives Library (cng.sys)6.2.92001891FIPS Approved algorithms: AES (Certs. #2197 and #2216); DRBG (Certs. #258 and #259); ECDSA (Cert. #341); HMAC (Cert. #1345); KAS (Cert. #36); KBKDF (Cert. #3); PBKDF (vendor affirmed); RNG (Cert. #1110); RSA (Certs. #1133 and #1134); SHS (Cert. #1903); Triple-DES (Cert. #1387)
      -
      -Other algorithms: AES (Cert. #2197, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)#1110); RSA (Certs.  and ); SHS (Cert. ); Triple-DES (Cert. )
      -
      -Other algorithms: AES (Cert. , key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)
      Boot Manager6.2.92001895FIPS Approved algorithms: AES (Certs. #2196 and #2198); HMAC (Cert. #1347); RSA (Cert. #1132); SHS (Cert. #1903)
      -
      -Other algorithms: MD5
      BitLocker® Windows OS Loader (WINLOAD)6.2.92001896FIPS Approved algorithms: AES (Certs. #2196 and #2198); RSA (Cert. #1132); SHS (Cert. #1903)
      -
      -Other algorithms: AES (Cert. #2197; non-compliant); MD5; Non-Approved RNG
      BitLocker® Windows Resume (WINRESUME)6.2.92001898FIPS Approved algorithms: AES (Certs. #2196 and #2198); RSA (Cert. #1132); SHS (Cert. #1903)
      -
      -Other algorithms: MD5
      BitLocker® Dump Filter (DUMPFVE.SYS)6.2.92001899FIPS Approved algorithms: AES (Certs. #2196 and #2198)
      -
      -Other algorithms: N/A
      Code Integrity (CI.DLL)6.2.92001897FIPS Approved algorithms: RSA (Cert. #1132); SHS (Cert. #1903)
      -
      -Other algorithms: MD5
      Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH.DLL)6.2.92001893FIPS Approved algorithms: DSA (Cert. #686); SHS (Cert. #1902); Triple-DES (Cert. #1386); Triple-DES MAC (Triple-DES Cert. #1386, vendor affirmed)
      -
      -Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman; MD5; RC2; RC2 MAC; RC4; Triple-DES (Cert. #1386, key wrapping; key establishment methodology provides 112 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
      Enhanced Cryptographic Provider (RSAENH.DLL)6.2.92001894FIPS Approved algorithms: AES (Cert. #2196); HMAC (Cert. #1346); RSA (Cert. #1132); SHS (Cert. #1902); Triple-DES (Cert. #1386)
      -
      -Other algorithms: AES (Cert. #2196, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); Triple-DES (Cert. #1386, key wrapping; key establishment methodology provides 112 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
      - - -##### Windows Server 2008 R2 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Boot Manager (bootmgr)6.1.7600.16385 or 6.1.7601.175146.1.7600.16385 or 6.1.7601.175141321FIPS Approved algorithms: AES (Certs. #1168 and #1177); HMAC (Cert. #675); RSA (Cert. #568); SHS (Cert. #1081)
      -
      -Other algorithms: MD5
      Winload OS Loader (winload.exe)6.1.7600.16385, 6.1.7600.16757, 6.1.7600.20897, 6.1.7600.20916, 6.1.7601.17514, 6.1.7601.17556, 6.1.7601.21655 and 6.1.7601.216756.1.7600.16385, 6.1.7600.16757, 6.1.7600.20897, 6.1.7600.20916, 6.1.7601.17514, 6.1.7601.17556, 6.1.7601.21655 and 6.1.7601.216751333FIPS Approved algorithms: AES (Certs. #1168 and #1177); RSA (Cert. #568); SHS (Cert. #1081)
      -
      -Other algorithms: MD5
      Code Integrity (ci.dll)6.1.7600.16385, 6.1.7600.17122, 6.1.7600.21320, 6.1.7601.17514, 6.1.7601.17950 and 6.1.7601.221086.1.7600.16385, 6.1.7600.17122, 6.1.7600.21320, 6.1.7601.17514, 6.1.7601.17950 and 6.1.7601.221081334FIPS Approved algorithms: RSA (Cert. #568); SHS (Cert. #1081)
      -
      -Other algorithms: MD5
      Kernel Mode Cryptographic Primitives Library (cng.sys)6.1.7600.16385, 6.1.7600.16915, 6.1.7600.21092, 6.1.7601.17514, 6.1.7601.17919, 6.1.7601.17725, 6.1.7601.21861 and 6.1.7601.220766.1.7600.16385, 6.1.7600.16915, 6.1.7600.21092, 6.1.7601.17514, 6.1.7601.17919, 6.1.7601.17725, 6.1.7601.21861 and 6.1.7601.220761335FIPS Approved algorithms: AES (Certs. #1168 and #1177); AES GCM (Cert. #1168, vendor-affirmed); AES GMAC (Cert. #1168, vendor-affirmed); DRBG (Certs. #23 and #27); ECDSA (Cert. #142); HMAC (Cert. #686); KAS (SP 800-56A, vendor affirmed, key agreement; key establishment methodology provides between 80 and 256 bits of encryption strength); RNG (Cert. #649); RSA (Certs. #559 and #567); SHS (Cert. #1081); Triple-DES (Cert. #846)
      -
      --Other algorithms: AES (Cert. #1168, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4
      Cryptographic Primitives Library (bcryptprimitives.dll)66.1.7600.16385 or 6.1.7601.1751466.1.7600.16385 or 6.1.7601.175141336FIPS Approved algorithms: AES (Certs. #1168 and #1177); AES GCM (Cert. #1168, vendor-affirmed); AES GMAC (Cert. #1168, vendor-affirmed); DRBG (Certs. #23 and #27); DSA (Cert. #391); ECDSA (Cert. #142); HMAC (Cert. #686); KAS (SP 800-56A, vendor affirmed, key agreement; key establishment methodology provides between 80 and 256 bits of encryption strength); RNG (Cert. #649); RSA (Certs. #559 and #567); SHS (Cert. #1081); Triple-DES (Cert. #846)
      -
      -Other algorithms: AES (Cert. #1168, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; HMAC MD5; MD2; MD4; MD5; RC2; RC4
      Enhanced Cryptographic Provider (RSAENH)6.1.7600.163851337FIPS Approved algorithms: AES (Cert. #1168); DRBG (Cert. #23); HMAC (Cert. #687); SHS (Cert. #1081); RSA (Certs. #559 and #568); Triple-DES (Cert. #846)
      -
      -Other algorithms: DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 256 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
      Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)6.1.7600.163851338FIPS Approved algorithms: DSA (Cert. #390); RNG (Cert. #649); SHS (Cert. #1081); Triple-DES (Cert. #846); Triple-DES MAC (Triple-DES Cert. #846, vendor affirmed)
      -
      -Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman; MD5; RC2; RC2 MAC; RC4
      BitLocker™ Drive Encryption6.1.7600.16385, 6.1.7600.16429, 6.1.7600.16757, 6.1.7600.20536, 6.1.7600.20873, 6.1.7600.20897, 6.1.7600.20916, 6.1.7601.17514, 6.1.7601.17556, 6.1.7601.21634, 6.1.7601.21655 or 6.1.7601.216756.1.7600.16385, 6.1.7600.16429, 6.1.7600.16757, 6.1.7600.20536, 6.1.7600.20873, 6.1.7600.20897, 6.1.7600.20916, 6.1.7601.17514, 6.1.7601.17556, 6.1.7601.21634, 6.1.7601.21655 or 6.1.7601.216751339FIPS Approved algorithms: AES (Certs. #1168 and #1177); HMAC (Cert. #675); SHS (Cert. #1081)
      -
      -Other algorithms: Elephant Diffuser
      - - -##### Windows Server 2008 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Boot Manager (bootmgr)6.0.6001.18000, 6.0.6002.18005 and 6.0.6002.224976.0.6001.18000, 6.0.6002.18005 and 6.0.6002.224971004FIPS Approved algorithms: AES (Certs. #739 and #760); HMAC (Cert. #415); RSA (Cert. #355); SHS (Cert. #753)
      -
      -Other algorithms: N/A
      Winload OS Loader (winload.exe)6.0.6001.18000, 6.0.6001.18606, 6.0.6001.22861, 6.0.6002.18005, 6.0.6002.18411, 6.0.6002.22497 and 6.0.6002.225966.0.6001.18000, 6.0.6001.18606, 6.0.6001.22861, 6.0.6002.18005, 6.0.6002.18411, 6.0.6002.22497 and 6.0.6002.225961005FIPS Approved algorithms: AES (Certs. #739 and #760); RSA (Cert. #355); SHS (Cert. #753)
      -
      -Other algorithms: MD5
      Code Integrity (ci.dll)6.0.6001.18000 and 6.0.6002.180056.0.6001.18000 and 6.0.6002.180051006FIPS Approved algorithms: RSA (Cert. #355); SHS (Cert. #753)
      -
      -Other algorithms: MD5
      Kernel Mode Security Support Provider Interface (ksecdd.sys)6.0.6001.18709, 6.0.6001.18272, 6.0.6001.18796, 6.0.6001.22202, 6.0.6001.22450, 6.0.6001.22987, 6.0.6001.23069, 6.0.6002.18005, 6.0.6002.18051, 6.0.6002.18541, 6.0.6002.18643, 6.0.6002.22152, 6.0.6002.22742 and 6.0.6002.228696.0.6001.18709, 6.0.6001.18272, 6.0.6001.18796, 6.0.6001.22202, 6.0.6001.22450, 6.0.6001.22987, 6.0.6001.23069, 6.0.6002.18005, 6.0.6002.18051, 6.0.6002.18541, 6.0.6002.18643, 6.0.6002.22152, 6.0.6002.22742 and 6.0.6002.228691007FIPS Approved algorithms: AES (Certs. #739 and #757); ECDSA (Cert. #83); HMAC (Cert. #413); RNG (Cert. #435 and SP800-90 AES-CTR, vendor affirmed); RSA (Certs. #353 and #358); SHS (Cert. #753); Triple-DES (Cert. #656)
      -
      -Other algorithms: AES (GCM and GMAC; non-compliant); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides between 128 and 256 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4; RNG (SP 800-90 Dual-EC; non-compliant); RSA (key wrapping: key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength)#83); HMAC (Cert. ); RNG (Cert.  and SP800-90 AES-CTR, vendor affirmed); RSA (Certs.  and ); SHS (Cert. ); Triple-DES (Cert. )
      -
      -Other algorithms: AES (GCM and GMAC; non-compliant); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides between 128 and 256 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4; RNG (SP 800-90 Dual-EC; non-compliant); RSA (key wrapping: key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
      Cryptographic Primitives Library (bcrypt.dll)6.0.6001.22202, 6.0.6002.18005 and 6.0.6002.228726.0.6001.22202, 6.0.6002.18005 and 6.0.6002.228721008FIPS Approved algorithms: AES (Certs. #739 and #757); DSA (Cert. #284); ECDSA (Cert. #83); HMAC (Cert. #413); RNG (Cert. #435 and SP800-90, vendor affirmed); RSA (Certs. #353 and #358); SHS (Cert. #753); Triple-DES (Cert. #656)
      -
      -Other algorithms: AES (GCM and GMAC; non-compliant); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides between 128 and 256 bits of encryption strength); MD2; MD4; MD5; RC2; RC4; RNG (SP 800-90 Dual-EC; non-compliant); RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant provides less than 112 bits of encryption strength)
      Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)6.0.6001.18000 and 6.0.6002.180056.0.6001.18000 and 6.0.6002.180051009FIPS Approved algorithms: DSA (Cert. #282); RNG (Cert. #435); SHS (Cert. #753); Triple-DES (Cert. #656); Triple-DES MAC (Triple-DES Cert. #656, vendor affirmed)
      -
      --Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD5; RC2; RC2 MAC; RC4
      Enhanced Cryptographic Provider (RSAENH)6.0.6001.22202 and 6.0.6002.180056.0.6001.22202 and 6.0.6002.180051010FIPS Approved algorithms: AES (Cert. #739); HMAC (Cert. #408); RNG (SP 800-90, vendor affirmed); RSA (Certs. #353 and #355); SHS (Cert. #753); Triple-DES (Cert. #656)
      -
      -Other algorithms: DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
      - - -##### Windows Server 2003 SP2 - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)5.2.3790.3959875

      FIPS Approved algorithms: DSA (Cert. #221); RNG (Cert. #314); RSA (Cert. #245); SHS (Cert. #611); Triple-DES (Cert. #543)

      -

      Other algorithms: DES; DES40; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD5; RC2; RC4

      Kernel Mode Cryptographic Module (FIPS.SYS)5.2.3790.3959869

      FIPS Approved algorithms: HMAC (Cert. #287); RNG (Cert. #313); SHS (Cert. #610); Triple-DES (Cert. #542)

      -

      Other algorithms: DES; HMAC-MD5

      Enhanced Cryptographic Provider (RSAENH)5.2.3790.3959868

      FIPS Approved algorithms: AES (Cert. #548); HMAC (Cert. #289); RNG (Cert. #316); RSA (Cert. #245); SHS (Cert. #613); Triple-DES (Cert. #544)

      -

      Other algorithms: DES; RC2; RC4; MD2; MD4; MD5; RSA (key wrapping; key establishment methodology provides between 112 and 256 bits of encryption strength; non-compliant less than 112 bits of encryption strength)

      - - -##### Windows Server 2003 SP1 - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Kernel Mode Cryptographic Module (FIPS.SYS)5.2.3790.1830 [SP1]405

      FIPS Approved algorithms: Triple-DES (Certs. #201[1] and #370[1]); SHS (Certs. #177[1] and #371[2])

      -

      Other algorithms: DES (Cert. #230[1]); HMAC-MD5; HMAC-SHA-1 (non-compliant)

      -

      [1] x86
      -[2] SP1 x86, x64, IA64

      Enhanced Cryptographic Provider (RSAENH)5.2.3790.1830 [Service Pack 1])382

      FIPS Approved algorithms: Triple-DES (Cert. #192[1] and #365[2]); AES (Certs. #80[1] and #290[2]); SHS (Cert. #176[1] and #364[2]); HMAC (Cert. #176, vendor affirmed[1] and #99[2]); RSA (PKCS#1, vendor affirmed[1] and #81[2])

      -

      Other algorithms: DES (Cert. #226[1]); SHA-256[1]; SHA-384[1]; SHA-512[1]; RC2; RC4; MD2; MD4; MD5

      -

      [1] x86
      -[2] SP1 x86, x64, IA64

      Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)5.2.3790.1830 [Service Pack 1]381

      FIPS Approved algorithms: Triple-DES (Certs. #199[1] and #381[2]); SHA-1 (Certs. #181[1] and #385[2]); DSA (Certs. #95[1] and #146[2]); RSA (Cert. #81)

      -

      Other algorithms: DES (Cert. #229[1]); Diffie-Hellman (key agreement); RC2; RC4; MD5; DES 40

      -

      [1] x86
      -[2] SP1 x86, x64, IA64

      - - -##### Windows Server 2003 - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Kernel Mode Cryptographic Module (FIPS.SYS)5.2.3790.0405

      FIPS Approved algorithms: Triple-DES (Certs. #201[1] and #370[1]); SHS (Certs. #177[1] and #371[2])

      -

      Other algorithms: DES (Cert. #230[1]); HMAC-MD5; HMAC-SHA-1 (non-compliant)

      -

      [1] x86
      -[2] SP1 x86, x64, IA64

      Enhanced Cryptographic Provider (RSAENH)5.2.3790.0382

      FIPS Approved algorithms: Triple-DES (Cert. #192[1] and #365[2]); AES (Certs. #80[1] and #290[2]); SHS (Cert. #176[1] and #364[2]); HMAC (Cert. #176, vendor affirmed[1] and #99[2]); RSA (PKCS#1, vendor affirmed[1] and #81[2])

      -

      Other algorithms: DES (Cert. #226[1]); SHA-256[1]; SHA-384[1]; SHA-512[1]; RC2; RC4; MD2; MD4; MD5

      -

      [1] x86
      -[2] SP1 x86, x64, IA64

      Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)5.2.3790.0381

      FIPS Approved algorithms: Triple-DES (Certs. #199[1] and #381[2]); SHA-1 (Certs. #181[1] and #385[2]); DSA (Certs. #95[1] and #146[2]); RSA (Cert. #81)

      -

      Other algorithms: DES (Cert. #229[1]); Diffie-Hellman (key agreement); RC2; RC4; MD5; DES 40

      -

      [1] x86
      -[2] SP1 x86, x64, IA64

      - - -#### Other Products - -##### Windows Embedded Compact 7 and Windows Embedded Compact 8 - - ------ - - - - - - - - - - - - - - - - - - - - -
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Enhanced Cryptographic Provider7.00.2872 [1] and 8.00.6246 [2]2957

      FIPS Approved algorithms: AES (Certs.#4433and#4434); CKG (vendor affirmed); DRBG (Certs.#1432and#1433); HMAC (Certs.#2946and#2945); RSA (Certs.#2414and#2415); SHS (Certs.#3651and#3652); Triple-DES (Certs.#2383and#2384)

      -

      Allowed algorithms: HMAC-MD5; MD5; NDRNG

      Cryptographic Primitives Library (bcrypt.dll)7.00.2872 [1] and 8.00.6246 [2]2956

      FIPS Approved algorithms: AES (Certs.#4430and#4431); CKG (vendor affirmed); CVL (Certs.#1139and#1140); DRBG (Certs.#1429and#1430); DSA (Certs.#1187and#1188); ECDSA (Certs.#1072and#1073); HMAC (Certs.#2942and#2943); KAS (Certs.#114and#115); RSA (Certs.#2411and#2412); SHS (Certs.#3648and#3649); Triple-DES (Certs.#2381and#2382)

      -

      Allowed algorithms: MD5; NDRNG; RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength

      - - - -##### Windows CE 6.0 and Windows Embedded Compact 7 - - ------ - - - - - - - - - - - - - - -
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Enhanced Cryptographic Provider6.00.1937 [1] and 7.00.1687 [2]825

      FIPS Approved algorithms: AES (Certs. #516 [1] and #2024 [2]); HMAC (Certs. #267 [1] and #1227 [2]); RNG (Certs. #292 [1] and #1060 [2]); RSA (Cert. #230 [1] and #1052 [2]); SHS (Certs. #589 [1] and #1774 [2]); Triple-DES (Certs. #526 [1] and #1308 [2])

      -

      Other algorithms: MD5; HMAC-MD5; RC2; RC4; DES

      - - -##### Outlook Cryptographic Provider - - ------ - - - - - - - - - - - - - - -
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Outlook Cryptographic Provider (EXCHCSP)SR-1A (3821)SR-1A (3821)110

      FIPS Approved algorithms: Triple-DES (Cert. #18); SHA-1 (Certs. #32); RSA (vendor affirmed)

      -

      Other algorithms: DES (Certs. #91); DES MAC; RC2; MD2; MD5

      - - - -### Cryptographic Algorithms - -The following tables are organized by cryptographic algorithms with their modes, states, and key sizes. For each algorithm implementation (operating system / platform), there is a link to the Cryptographic Algorithm Validation Program (CAVP) issued certificate. - -### Advanced Encryption Standard (AES) - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Modes / States / Key SizesAlgorithm Implementation and Certificate #
        -
      • AES-CBC:
        • -
        • -
        • Modes: Decrypt, Encrypt
          • -
        • Key Lengths: 128, 192, 256 (bits)
          • -
        • -
      • AES-CFB128:
        • -
        • -
        • Modes: Decrypt, Encrypt
          • -
        • Key Lengths: 128, 192, 256 (bits)
          • -
        • -
      • AES-CTR:
        • -
        • -
        • Counter Source: Internal
          • -
        • Key Lengths: 128, 192, 256 (bits)
          • -
        • -
      • AES-OFB:
        • -
        • -
        • Modes: Decrypt, Encrypt
          • -
        • Key Lengths: 128, 192, 256 (bits)
          • -
        • -

      Microsoft Surface Hub Virtual TPM Implementations #4904

      -

      Version 10.0.15063.674

        -
      • AES-CBC:
        • -
        • -
        • Modes: Decrypt, Encrypt
          • -
        • Key Lengths: 128, 192, 256 (bits)
          • -
        • -
      • AES-CFB128:
        • -
        • -
        • Modes: Decrypt, Encrypt
          • -
        • Key Lengths: 128, 192, 256 (bits)
          • -
        • -
      • AES-CTR:
        • -
        • -
        • Counter Source: Internal
          • -
        • Key Lengths: 128, 192, 256 (bits)
          • -
        • -
      • AES-OFB:
        • -
        • -
        • Modes: Decrypt, Encrypt
          • -
        • Key Lengths: 128, 192, 256 (bits)
          • -
        • -

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #4903

      -

      Version 10.0.16299

        -
      • AES-CBC:
        • -
        • -
        • Modes: Decrypt, Encrypt
          • -
        • Key Lengths: 128, 192, 256 (bits)
          • -
        • -
      • AES-CCM:
        • -
        • -
        • Key Lengths: 128, 192, 256 (bits)
          • -
        • Tag Lengths: 32, 48, 64, 80, 96, 112, 128 (bits)
          • -
        • IV Lengths: 56, 64, 72, 80, 88, 96, 104 (bits)
          • -
        • Plain Text Length: 0-32
          • -
        • AAD Length: 0-65536
          • -
        • -
      • AES-CFB128:
        • -
        • -
        • Modes: Decrypt, Encrypt
          • -
        • Key Lengths: 128, 192, 256 (bits)
          • -
        • -
      • AES-CFB8:
        • -
        • -
        • Modes: Decrypt, Encrypt
          • -
        • Key Lengths: 128, 192, 256 (bits)
          • -
        • -
      • AES-CMAC:
        • -
        • -
        • Generation:
          • -
          • -
          • AES-128:
            • -
            • -
            • Block Sizes: Full, Partial
              • -
            • Message Length: 0-65536
              • -
            • Tag Length: 16-16
              • -
            • -
          • AES-192:
            • -
            • -
            • Block Sizes: Full, Partial
              • -
            • Message Length: 0-65536
              • -
            • Tag Length: 16-16
              • -
            • -
          • AES-256:
            • -
            • -
            • Block Sizes: Full, Partial
              • -
            • Message Length: 0-65536
              • -
            • Tag Length: 16-16
              • -
            • -
          • -
        • Verification:
          • -
          • -
          • AES-128:
            • -
            • -
            • Block Sizes: Full, Partial
              • -
            • Message Length: 0-65536
              • -
            • Tag Length: 16-16
              • -
            • -
          • AES-192:
            • -
            • -
            • Block Sizes: Full, Partial
              • -
            • Message Length: 0-65536
              • -
            • Tag Length: 16-16
              • -
            • -
          • AES-256:
            • -
            • -
            • Block Sizes: Full, Partial
              • -
            • Message Length: 0-65536
              • -
            • Tag Length: 16-16
              • -
            • -
          • -
        • -
      • AES-CTR:
        • -
        • -
        • Counter Source: Internal
          • -
        • Key Lengths: 128, 192, 256 (bits)
          • -
        • -
      • AES-ECB:
        • -
        • -
        • Modes: Decrypt, Encrypt
          • -
        • Key Lengths: 128, 192, 256 (bits)
          • -
        • -
      • AES-GCM:
        • -
        • -
        • Modes: Decrypt, Encrypt
          • -
        • Key Lengths: 128, 192, 256 (bits)
          • -
        • Tag Lengths: 96, 104, 112, 120, 128 (bits)
          • -
        • Plain Text Lengths: 0, 8, 1016, 1024 (bits)
          • -
        • AAD Lengths: 0, 8, 1016, 1024 (bits)
          • -
        • 96 bit IV supported
          • -
        • -
      • AES-XTS:
        • -
        • -
        • Key Size: 128:
          • -
          • -
          • Modes: Decrypt, Encrypt
            • -
          • Block Sizes: Full
            • -
          • -
        • Key Size: 256:
          • -
          • -
          • Modes: Decrypt, Encrypt
            • -
          • Block Sizes: Full
            • -
          • -
        • -

      Microsoft Surface Hub SymCrypt Cryptographic Implementations #4902

      -

      Version 10.0.15063.674

        -
      • AES-CBC:
        • -
        • -
        • Modes: Decrypt, Encrypt
          • -
        • Key Lengths: 128, 192, 256 (bits)
          • -
        • -
      • AES-CCM:
        • -
        • -
        • Key Lengths: 128, 192, 256 (bits)
          • -
        • Tag Lengths: 32, 48, 64, 80, 96, 112, 128 (bits)
          • -
        • IV Lengths: 56, 64, 72, 80, 88, 96, 104 (bits)
          • -
        • Plain Text Length: 0-32
          • -
        • AAD Length: 0-65536
          • -
        • -
      • AES-CFB128:
        • -
        • -
        • Modes: Decrypt, Encrypt
          • -
        • Key Lengths: 128, 192, 256 (bits)
          • -
        • -
      • AES-CFB8:
        • -
        • -
        • Modes: Decrypt, Encrypt
          • -
        • Key Lengths: 128, 192, 256 (bits)
          • -
        • -
      • AES-CMAC:
        • -
        • -
        • Generation:
          • -
          • -
          • AES-128:
            • -
            • -
            • Block Sizes: Full, Partial
              • -
            • Message Length: 0-65536
              • -
            • Tag Length: 16-16
              • -
            • -
          • AES-192:
            • -
            • -
            • Block Sizes: Full, Partial
              • -
            • Message Length: 0-65536
              • -
            • Tag Length: 16-16
              • -
            • -
          • AES-256:
            • -
            • -
            • Block Sizes: Full, Partial
              • -
            • Message Length: 0-65536
              • -
            • Tag Length: 16-16
              • -
            • -
          • -
        • Verification:
          • -
          • -
          • AES-128:
            • -
            • -
            • Block Sizes: Full, Partial
              • -
            • Message Length: 0-65536
              • -
            • Tag Length: 16-16
              • -
            • -
          • AES-192:
            • -
            • -
            • Block Sizes: Full, Partial
              • -
            • Message Length: 0-65536
              • -
            • Tag Length: 16-16
              • -
            • -
          • AES-256:
            • -
            • -
            • Block Sizes: Full, Partial
              • -
            • Message Length: 0-65536
              • -
            • Tag Length: 16-16
              • -
            • -
          • -
        • -
      • AES-CTR:
        • -
        • -
        • Counter Source: Internal
          • -
        • Key Lengths: 128, 192, 256 (bits)
          • -
        • -
      • AES-ECB:
        • -
        • -
        • Modes: Decrypt, Encrypt
          • -
        • Key Lengths: 128, 192, 256 (bits)
          • -
        • -
      • AES-GCM:
        • -
        • -
        • Modes: Decrypt, Encrypt
          • -
        • Key Lengths: 128, 192, 256 (bits)
          • -
        • Tag Lengths: 96, 104, 112, 120, 128 (bits)
          • -
        • Plain Text Lengths: 0, 8, 1016, 1024 (bits)
          • -
        • AAD Lengths: 0, 8, 1016, 1024 (bits)
          • -
        • 96 bit IV supported
          • -
        • -
      • AES-XTS:
        • -
        • -
        • Key Size: 128:
          • -
          • -
          • Modes: Decrypt, Encrypt
            • -
          • Block Sizes: Full
            • -
          • -
        • Key Size: 256:
          • -
          • -
          • Modes: Decrypt, Encrypt
            • -
          • Block Sizes: Full
            • -
          • -
        • -

      Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #4901

      -

      Version 10.0.15254

        -
      • AES-CBC:
        • -
        • -
        • Modes: Decrypt, Encrypt
          • -
        • Key Lengths: 128, 192, 256 (bits)
          • -
        • -
      • AES-CCM:
        • -
        • -
        • Key Lengths: 128, 192, 256 (bits)
          • -
        • Tag Lengths: 32, 48, 64, 80, 96, 112, 128 (bits)
          • -
        • IV Lengths: 56, 64, 72, 80, 88, 96, 104 (bits)
          • -
        • Plain Text Length: 0-32
          • -
        • AAD Length: 0-65536
          • -
        • -
      • AES-CFB128:
        • -
        • -
        • Modes: Decrypt, Encrypt
          • -
        • Key Lengths: 128, 192, 256 (bits)
          • -
        • -
      • AES-CFB8:
        • -
        • -
        • Modes: Decrypt, Encrypt
          • -
        • Key Lengths: 128, 192, 256 (bits)
          • -
        • -
      • AES-CMAC:
        • -
        • -
        • Generation:
          • -
          • -
          • AES-128:
            • -
            • -
            • Block Sizes: Full, Partial
              • -
            • Message Length: 0-65536
              • -
            • Tag Length: 16-16
              • -
            • -
          • AES-192:
            • -
            • -
            • Block Sizes: Full, Partial
              • -
            • Message Length: 0-65536
              • -
            • Tag Length: 16-16
              • -
            • -
          • AES-256:
            • -
            • -
            • Block Sizes: Full, Partial
              • -
            • Message Length: 0-65536
              • -
            • Tag Length: 16-16
              • -
            • -
          • -
        • Verification:
          • -
          • -
          • AES-128:
            • -
            • -
            • Block Sizes: Full, Partial
              • -
            • Message Length: 0-65536
              • -
            • Tag Length: 16-16
              • -
            • -
          • AES-192:
            • -
            • -
            • Block Sizes: Full, Partial
              • -
            • Message Length: 0-65536
              • -
            • Tag Length: 16-16
              • -
            • -
          • AES-256:
            • -
            • -
            • Block Sizes: Full, Partial
              • -
            • Message Length: 0-65536
              • -
            • Tag Length: 16-16
              • -
            • -
          • -
        • -
      • AES-CTR:
        • -
        • -
        • Counter Source: Internal
          • -
        • Key Lengths: 128, 192, 256 (bits)
          • -
        • -
      • AES-ECB:
        • -
        • -
        • Modes: Decrypt, Encrypt
          • -
        • Key Lengths: 128, 192, 256 (bits)
          • -
        • -
      • AES-GCM:
        • -
        • -
        • Modes: Decrypt, Encrypt
          • -
        • IV Generation: External
          • -
        • Key Lengths: 128, 192, 256 (bits)
          • -
        • Tag Lengths: 96, 104, 112, 120, 128 (bits)
          • -
        • Plain Text Lengths: 0, 8, 1016, 1024 (bits)
          • -
        • AAD Lengths: 0, 8, 1016, 1024 (bits)
          • -
        • 96 bit IV supported
          • -
        • -
      • AES-XTS:
        • -
        • -
        • Key Size: 128:
          • -
          • -
          • Modes: Decrypt, Encrypt
            • -
          • Block Sizes: Full
            • -
          • -
        • Key Size: 256:
          • -
          • -
          • Modes: Decrypt, Encrypt
            • -
          • Block Sizes: Full
            • -
          • -
        • -

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #4897

      -

      Version 10.0.16299

      AES-KW:

      -
        -
      • Modes: Decrypt, Encrypt
        • -
      • CIPHK transformation direction: Forward
        • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • Plain Text Lengths: 128, 192, 256, 320, 2048 (bits)
        • -
      -

      AES Val#4902

      Microsoft Surface Hub Cryptography Next Generation (CNG) Implementations #4900

      -

      Version 10.0.15063.674

      AES-KW:

      -
        -
      • Modes: Decrypt, Encrypt
        • -
      • CIPHK transformation direction: Forward
        • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • Plain Text Lengths: 128, 192, 256, 320, 2048 (bits)
        • -
      -

      AES Val#4901

      Windows 10 Mobile (version 1709) Cryptography Next Generation (CNG) Implementations #4899

      -

      Version 10.0.15254

      AES-KW:

      -
        -
      • Modes: Decrypt, Encrypt
        • -
      • CIPHK transformation direction: Forward
        • -
      • Key Lengths: 128, 192, 256 (bits)
        • -
      • Plain Text Lengths: 128, 192, 256, 320, 2048 (bits)
        • -
      -

      AES Val#4897

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Cryptography Next Generation (CNG) Implementations #4898

      -

      Version 10.0.16299

      AES-CCM:

      -
        -
      • Key Lengths: 256 (bits)
        • -
      • Tag Lengths: 128 (bits)
        • -
      • IV Lengths: 96 (bits)
        • -
      • Plain Text Length: 0-32
        • -
      • AAD Length: 0-65536
        • -
      -

      AES Val#4902

      Microsoft Surface Hub BitLocker(R) Cryptographic Implementations #4896

      -

      Version 10.0.15063.674

      AES-CCM:

      -
        -
      • Key Lengths: 256 (bits)
        • -
      • Tag Lengths: 128 (bits)
        • -
      • IV Lengths: 96 (bits)
        • -
      • Plain Text Length: 0-32
        • -
      • AAD Length: 0-65536
        • -
      -

      AES Val#4901

      Windows 10 Mobile (version 1709) BitLocker(R) Cryptographic Implementations #4895

      -

      Version 10.0.15254

      AES-CCM:

      -
        -
      • Key Lengths: 256 (bits)
        • -
      • Tag Lengths: 128 (bits)
        • -
      • IV Lengths: 96 (bits)
        • -
      • Plain Text Length: 0-32
        • -
      • AAD Length: 0-65536
        • -
      -

      AES Val#4897

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); BitLocker(R) Cryptographic Implementations #4894

      -

      Version 10.0.16299

      CBC ( e/d; 128 , 192 , 256 );

      -

      CFB128 ( e/d; 128 , 192 , 256 );

      -

      OFB ( e/d; 128 , 192 , 256 );

      -

      CTR ( int only; 128 , 192 , 256 )

      Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #4627

      -

      Version 10.0.15063

      KW ( AE , AD , AES-128 , AES-192 , AES-256 , FWD , 128 , 256 , 192 , 320 , 2048 )

      -

      AES Val#4624

      Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile Cryptography Next Generation (CNG) Implementations #4626

      -

      Version 10.0.15063

      CCM (KS: 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 12 (Tag Length(s): 16 )

      -

      AES Val#4624

      -

       

      Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile BitLocker(R) Cryptographic Implementations #4625

      -

      Version 10.0.15063

      ECB ( e/d; 128 , 192 , 256 );

      -

      CBC ( e/d; 128 , 192 , 256 );

      -

      CFB8 ( e/d; 128 , 192 , 256 );

      -

      CFB128 ( e/d; 128 , 192 , 256 );

      -

      CTR ( int only; 128 , 192 , 256 )

      -

      CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )

      -

      CMAC (Generation/Verification ) (KS: 128; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 16 Max: 16 ) (KS: 192; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 16 Max: 16 ) (KS: 256; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 16 Max: 16 )

      -

      GCM (KS: AES_128( e/d ) Tag Length(s): 128 120 112 104 96 ) (KS: AES_192( e/d ) Tag Length(s): 128 120 112 104 96 )

      -

      (KS: AES_256( e/d ) Tag Length(s): 128 120 112 104 96 )

      -

      IV Generated: ( External ) ; PT Lengths Tested: ( 0 , 1024 , 8 , 1016 ) ; AAD Lengths tested: ( 0 , 1024 , 8 , 1016 ) ; 96BitIV_Supported

      -

      GMAC_Supported

      -

      XTS( (KS: XTS_128( (e/d) (f) ) KS: XTS_256( (e/d) (f) )

      Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #4624

      -

      Version 10.0.15063

      ECB ( e/d; 128 , 192 , 256 );

      -

      CBC ( e/d; 128 , 192 , 256 );

      Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #4434

      -

      Version 7.00.2872

      ECB ( e/d; 128 , 192 , 256 );

      -

      CBC ( e/d; 128 , 192 , 256 );

      Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #4433

      -

      Version 8.00.6246

      ECB ( e/d; 128 , 192 , 256 );

      -

      CBC ( e/d; 128 , 192 , 256 );

      -

      CTR ( int only; 128 , 192 , 256 )

      Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #4431

      -

      Version 7.00.2872

      ECB ( e/d; 128 , 192 , 256 );

      -

      CBC ( e/d; 128 , 192 , 256 );

      -

      CTR ( int only; 128 , 192 , 256 )

      Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #4430

      -

      Version 8.00.6246

      CBC ( e/d; 128 , 192 , 256 );

      -

      CFB128 ( e/d; 128 , 192 , 256 );

      -

      OFB ( e/d; 128 , 192 , 256 );

      -

      CTR ( int only; 128 , 192 , 256 )

      Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #4074

      -

      Version 10.0.14393

      ECB ( e/d; 128 , 192 , 256 ); CBC ( e/d; 128 , 192 , 256 ); CFB8 ( e/d; 128 , 192 , 256 ); CFB128 ( e/d; 128 , 192 , 256 ); CTR ( int only; 128 , 192 , 256 )

      -

      CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )

      -

      CMAC (Generation/Verification ) (KS: 128; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 192; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 256; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 )

      -

      GCM (KS: AES_128( e/d ) Tag Length(s): 128 120 112 104 96 ) (KS: AES_192( e/d ) Tag Length(s): 128 120 112 104 96 )
      -(KS: AES_256( e/d ) Tag Length(s): 128 120 112 104 96 )
      -IV Generated:  ( Externally ) ; PT Lengths Tested:  ( 0 , 1024 , 8 , 1016 ) ; AAD Lengths tested:  ( 0 , 1024 , 8 , 1016 ) ; IV Lengths Tested:  ( 0 , 0 ) ; 96BitIV_Supported
      -GMAC_Supported

      -

      XTS( (KS: XTS_128( (e/d) (f) ) KS: XTS_256( (e/d) (f) )

      Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update SymCrypt Cryptographic Implementations #4064

      -

      Version 10.0.14393

      ECB ( e/d; 128 , 192 , 256 );

      -

      CBC ( e/d; 128 , 192 , 256 );

      -

      CFB8 ( e/d; 128 , 192 , 256 );

      -

       

      		Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update RSA32 Algorithm Implementations #4063
      -Version 10.0.14393

      KW  ( AE , AD , AES-128 , AES-192 , AES-256 , FWD , 128 , 192 , 256 , 320 , 2048 )

      -

      AES Val#4064

      Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #4062

      -

      Version 10.0.14393

      CCM (KS: 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 12 (Tag Length(s): 16 )

      -

      AES Val#4064

      Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update BitLocker® Cryptographic Implementations #4061

      -

      Version 10.0.14393

      KW  ( AE , AD , AES-128 , AES-192 , AES-256 , FWD , 128 , 256 , 192 , 320 , 2048 )

      -

      AES Val#3629

      Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” Cryptography Next Generation (CNG) Implementations #3652

      -

      Version 10.0.10586

      CCM (KS: 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 12 (Tag Length(s): 16 )

      -

      AES Val#3629

      Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” BitLocker® Cryptographic Implementations #3653

      -

      Version 10.0.10586

      ECB ( e/d; 128 , 192 , 256 );

      -

      CBC ( e/d; 128 , 192 , 256 );

      -

      CFB8 ( e/d; 128 , 192 , 256 );

      -

       

      		Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” RSA32 Algorithm Implementations #3630
      -Version 10.0.10586

      ECB ( e/d; 128 , 192 , 256 ); CBC ( e/d; 128 , 192 , 256 ); CFB8 ( e/d; 128 , 192 , 256 ); CFB128 ( e/d; 128 , 192 , 256 ); CTR ( int only; 128 , 192 , 256 )

      -

      CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )

      -

      CMAC (Generation/Verification ) (KS: 128; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 192; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 256; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 )

      -

      GCM (KS: AES_128( e/d ) Tag Length(s): 128 120 112 104 96 ) (KS: AES_192( e/d ) Tag Length(s): 128 120 112 104 96 )
      -(KS: AES_256( e/d ) Tag Length(s): 128 120 112 104 96 )
      -IV Generated:  ( Externally ) ; PT Lengths Tested:  ( 0 , 1024 , 8 , 1016 ) ; AAD Lengths tested:  ( 0 , 1024 , 8 , 1016 ) ; IV Lengths Tested:  ( 0 , 0 ) ; 96BitIV_Supported
      -GMAC_Supported

      -

      XTS( (KS: XTS_128( (e/d) (f) ) KS: XTS_256( (e/d) (f) )

      Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” SymCrypt Cryptographic Implementations #3629
      -
      -

      -

      Version 10.0.10586

      KW  ( AE , AD , AES-128 , AES-192 , AES-256 , FWD , 128 , 256 , 192 , 320 , 2048 )

      -

      AES Val#3497

      Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #3507

      -

      Version 10.0.10240

      CCM (KS: 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 12 (Tag Length(s): 16 )

      -

      AES Val#3497

      Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 BitLocker® Cryptographic Implementations #3498

      -

      Version 10.0.10240

      ECB ( e/d; 128 , 192 , 256 ); CBC ( e/d; 128 , 192 , 256 ); CFB8 ( e/d; 128 , 192 , 256 ); CFB128 ( e/d; 128 , 192 , 256 ); CTR ( int only; 128 , 192 , 256 )

      -

      CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )

      -

      CMAC(Generation/Verification ) (KS: 128; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 192; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 256; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 )

      -

      GCM (KS: AES_128( e/d ) Tag Length(s): 128 120 112 104 96 ) (KS: AES_192( e/d ) Tag Length(s): 128 120 112 104 96 )
      -(KS: AES_256( e/d ) Tag Length(s): 128 120 112 104 96 )
      -IV Generated:  ( Externally ) ; PT Lengths Tested:  ( 0 , 1024 , 8 , 1016 ) ; AAD Lengths tested:  ( 0 , 1024 , 8 , 1016 ) ; IV Lengths Tested:  ( 0 , 0 ) ; 96BitIV_Supported
      -GMAC_Supported

      -

      XTS( (KS: XTS_128( (e/d) (f) ) KS: XTS_256( (e/d) (f) )

      		Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 SymCrypt Cryptographic Implementations #3497
      -Version 10.0.10240

      ECB ( e/d; 128 , 192 , 256 );

      -

      CBC ( e/d; 128 , 192 , 256 );

      -

      CFB8 ( e/d; 128 , 192 , 256 );

      -

       

      		Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 RSA32 Algorithm Implementations #3476
      -Version 10.0.10240

      ECB ( e/d; 128 , 192 , 256 );

      -

      CBC ( e/d; 128 , 192 , 256 );

      -

      CFB8 ( e/d; 128 , 192 , 256 );

      -

       

      Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry RSA32 Algorithm Implementations #2853

      -

      Version 6.3.9600

      CCM (KS: 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 12 (Tag Length(s): 16 )

      -

      AES Val#2832

      Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 BitLocker� Cryptographic Implementations #2848

      -

      Version 6.3.9600

      CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 0 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )

      -

      CMAC (Generation/Verification ) (KS: 128; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 192; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 256; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 )

      -

      GCM (KS: AES_128( e/d ) Tag Length(s): 128 120 112 104 96 ) (KS: AES_192( e/d ) Tag Length(s): 128 120 112 104 96 )

      -

      (KS: AES_256( e/d ) Tag Length(s): 128 120 112 104 96 )

      -

      IV Generated:  ( Externally ) ; PT Lengths Tested:  ( 0 , 128 , 1024 , 8 , 1016 ) ; AAD Lengths tested:  ( 0 , 128 , 1024 , 8 , 1016 ) ; IV Lengths Tested:  ( 8 , 1024 ) ; 96BitIV_Supported ;
      -OtherIVLen_Supported
      -GMAC_Supported

      Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 SymCrypt Cryptographic Implementations #2832

      -

      Version 6.3.9600

      CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )
      -AES Val#2197

      -

      CMAC (Generation/Verification ) (KS: 128; Block Size(s): ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 16 Max: 16 ) (KS: 192; Block Size(s): ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 16 Max: 16 ) (KS: 256; Block Size(s): ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 16 Max: 16 )
      -AES Val#2197

      -

      GCM(KS: AES_128( e/d ) Tag Length(s): 128 120 112 104 96 ) (KS: AES_192( e/d ) Tag Length(s): 128 120 112 104 96 )
      -(KS: AES_256( e/d ) Tag Length(s): 128 120 112 104 96 )
      -IV Generated: ( Externally ) ; PT Lengths Tested: ( 0 , 128 , 1024 , 8 , 1016 ) ; AAD Lengths tested: ( 0 , 128 , 1024 , 8 , 1016 ) ; IV Lengths Tested: ( 8 , 1024 ) ; 96BitIV_Supported
      -GMAC_Supported

      		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #2216

      CCM (KS: 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 12 (Tag Length(s): 16 )

      -

      AES Val#2196

      		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 BitLocker® Cryptographic Implementations #2198

      ECB ( e/d; 128 , 192 , 256 );

      -

      CBC ( e/d; 128 , 192 , 256 );

      -

      CFB8 ( e/d; 128 , 192 , 256 );

      -

      CFB128 ( e/d; 128 , 192 , 256 );

      -

      CTR ( int only; 128 , 192 , 256 )

      		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Next Generation Symmetric Cryptographic Algorithms Implementations (SYMCRYPT) #2197

      ECB ( e/d; 128 , 192 , 256 );

      -

      CBC ( e/d; 128 , 192 , 256 );

      -

      CFB8 ( e/d; 128 , 192 , 256 );

      -

       

      		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Symmetric Algorithm Implementations (RSA32) #2196
      CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 – 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )
      -AES Val#1168

      Windows Server 2008 R2 and SP1 CNG algorithms #1187

      -

      Windows 7 Ultimate and SP1 CNG algorithms #1178

      CCM (KS: 128 , 256 ) (Assoc. Data Len Range: 0 - 8 ) (Payload Length Range: 4 - 32 ( Nonce Length(s): 7 8 12 13 (Tag Length(s): 4 6 8 14 16 )
      -AES Val#1168      		Windows 7 Ultimate and SP1 and Windows Server 2008 R2 and SP1 BitLocker Algorithm Implementations #1177

      ECB ( e/d; 128 , 192 , 256 );

      -

      CBC ( e/d; 128 , 192 , 256 );

      -

      CFB8 ( e/d; 128 , 192 , 256 );

      -

       

      		Windows 7 and SP1 and Windows Server 2008 R2 and SP1 Symmetric Algorithm Implementation #1168

      GCM

      -

      GMAC

      		Windows 7 and SP1 and Windows Server 2008 R2 and SP1 Symmetric Algorithm Implementation #1168 , vendor-affirmed
      CCM (KS: 128 , 256 ) (Assoc. Data Len Range: 0 - 8 ) (Payload Length Range: 4 - 32 ( Nonce Length(s): 7 8 12 13 (Tag Length(s): 4 6 8 14 16 )Windows Vista Ultimate SP1 and Windows Server 2008 BitLocker Algorithm Implementations #760
      CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 1 - 32 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )

      Windows Server 2008 CNG algorithms #757

      -

      Windows Vista Ultimate SP1 CNG algorithms #756

      CBC ( e/d; 128 , 256 );

      -

      CCM (KS: 128 , 256 ) (Assoc. Data Len Range: 0 - 8 ) (Payload Length Range: 4 - 32 ( Nonce Length(s): 7 8 12 13 (Tag Length(s): 4 6 8 14 16 )

      Windows Vista Ultimate BitLocker Drive Encryption #715

      -

      Windows Vista Ultimate BitLocker Drive Encryption #424

      ECB ( e/d; 128 , 192 , 256 );

      -

      CBC ( e/d; 128 , 192 , 256 );

      -

      CFB8 ( e/d; 128 , 192 , 256 );

      Windows Vista Ultimate SP1 and Windows Server 2008 Symmetric Algorithm Implementation #739

      -

      Windows Vista Symmetric Algorithm Implementation #553

      ECB ( e/d; 128 , 192 , 256 );

      -

      CBC ( e/d; 128 , 192 , 256 );

      -

      CTR ( int only; 128 , 192 , 256 )

      		Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #2023

      ECB ( e/d; 128 , 192 , 256 );

      -

      CBC ( e/d; 128 , 192 , 256 );

      Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #2024

      -

      Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #818

      -

      Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #781

      -

      Windows 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #548

      -

      Windows CE 6.0 and Windows CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #516

      -

      Windows CE and Windows Mobile 6, 6.1, and 6.5 Enhanced Cryptographic Provider (RSAENH) #507

      -

      Windows Server 2003 SP1 Enhanced Cryptographic Provider (RSAENH) #290

      -

      Windows CE 5.0 and 5.1 Enhanced Cryptographic Provider (RSAENH) #224

      -

      Windows Server 2003 Enhanced Cryptographic Provider (RSAENH) #80

      -

      Windows XP, SP1, and SP2 Enhanced Cryptographic Provider (RSAENH) #33

      - - -Deterministic Random Bit Generator (DRBG) - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Modes / States / Key SizesAlgorithm Implementation and Certificate #
        -
      • Counter:
        • -
        • -
        • Modes: AES-256
          • -
        • Derivation Function States: Derivation Function not used
          • -
        • Prediction Resistance Modes: Not Enabled
          • -
        • -
      -

      Prerequisite: AES #4904

      Microsoft Surface Hub Virtual TPM Implementations #1734

      -

      Version 10.0.15063.674

        -
      • Counter:
        • -
        • -
        • Modes: AES-256
          • -
        • Derivation Function States: Derivation Function not used
          • -
        • Prediction Resistance Modes: Not Enabled
          • -
        • -
      -

      Prerequisite: AES #4903

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #1733

      -

      Version 10.0.16299

        -
      • Counter:
        • -
        • -
        • Modes: AES-256
          • -
        • Derivation Function States: Derivation Function used
          • -
        • Prediction Resistance Modes: Not Enabled
          • -
        • -
      -

      Prerequisite: AES #4902

      Microsoft Surface Hub SymCrypt Cryptographic Implementations #1732

      -

      Version 10.0.15063.674

        -
      • Counter:
        • -
        • -
        • Modes: AES-256
          • -
        • Derivation Function States: Derivation Function used
          • -
        • Prediction Resistance Modes: Not Enabled
          • -
        • -
      -

      Prerequisite: AES #4901

      Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1731

      -

      Version 10.0.15254

        -
      • Counter:
        • -
        • -
        • Modes: AES-256
          • -
        • Derivation Function States: Derivation Function used
          • -
        • Prediction Resistance Modes: Not Enabled
          • -
        • -
      -

      Prerequisite: AES #4897

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1730

      -

      Version 10.0.16299

      CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#4627 ) ]

      Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #1556

      -

      Version 10.0.15063

      CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: ( AES-256 ) ( AES Val#4624 ) ]

      Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1555

      -

      Version 10.0.15063

      CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#4434 ) ]

      Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #1433

      -

      Version 7.00.2872

      CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#4433 ) ]

      Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #1432

      -

      Version 8.00.6246

      CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#4431 ) ]

      Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1430

      -

      Version 7.00.2872

      CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#4430 ) ]

      Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1429

      -

      Version 8.00.6246

      CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#4074 ) ]

      Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #1222

      -

      Version 10.0.14393

      CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: ( AES-256 ) ( AES Val#4064 ) ]

      Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update SymCrypt Cryptographic Implementations #1217

      -

      Version 10.0.14393

      CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: ( AES-256 ) ( AES Val#3629 ) ]

      Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub SymCrypt Cryptographic Implementations #955

      -

      Version 10.0.10586

      CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: ( AES-256 ) ( AES Val#3497 ) ]

      Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 SymCrypt Cryptographic Implementations #868

      -

      Version 10.0.10240

      CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: ( AES-256 ) ( AES Val#2832 ) ]

      Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 SymCrypt Cryptographic Implementations #489

      -

      Version 6.3.9600

      CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: ( AES-256 ) ( AES Val#2197 ) ]Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Next Generation Symmetric Cryptographic Algorithms Implementations (SYMCRYPT) #258
      CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#2023 ) ]Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #193
      CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#1168 ) ]Windows 7 Ultimate and SP1 and Windows Server 2008 R2 and SP1 RNG Library #23
      DRBG (SP 800–90)Windows Vista Ultimate SP1, vendor-affirmed
      - - -#### Digital Signature Algorithm (DSA) - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Modes / States / Key SizesAlgorithm Implementation and Certificate #
        -
      • DSA:
        • -
        • -
        • 186-4:
          • -
          • -
          • PQGGen:
            • -
            • -
            • L = 2048, N = 256 SHA: SHA-256
              • -
            • L = 3072, N = 256 SHA: SHA-256
              • -
            • -
          • PQGVer:
            • -
            • -
            • L = 2048, N = 256 SHA: SHA-256
              • -
            • L = 3072, N = 256 SHA: SHA-256
              • -
            • -
          • SigGen:
            • -
            • -
            • L = 2048, N = 256 SHA: SHA-256
              • -
            • L = 3072, N = 256 SHA: SHA-256
              • -
            • -
          • SigVer:
            • -
            • -
            • L = 2048, N = 256 SHA: SHA-256
              • -
            • L = 3072, N = 256 SHA: SHA-256
              • -
            • -
          • KeyPair:
            • -
            • -
            • L = 2048, N = 256
              • -
            • L = 3072, N = 256
              • -
            • -
          • -
        • -
      -

      Prerequisite: SHS #4011, DRBG #1732

      Microsoft Surface Hub SymCrypt Cryptographic Implementations #1303

      -

      Version 10.0.15063.674

        -
      • DSA:
        • -
        • -
        • 186-4:
          • -
          • -
          • PQGGen:
            • -
            • -
            • L = 2048, N = 256 SHA: SHA-256
              • -
            • L = 3072, N = 256 SHA: SHA-256
              • -
            • -
          • PQGVer:
            • -
            • -
            • L = 2048, N = 256 SHA: SHA-256
              • -
            • L = 3072, N = 256 SHA: SHA-256
              • -
            • -
          • SigGen:
            • -
            • -
            • L = 2048, N = 256 SHA: SHA-256
              • -
            • L = 3072, N = 256 SHA: SHA-256
              • -
            • -
          • SigVer:
            • -
            • -
            • L = 2048, N = 256 SHA: SHA-256
              • -
            • L = 3072, N = 256 SHA: SHA-256
              • -
            • -
          • KeyPair:
            • -
            • -
            •  
              • -
            •  
              • -
            • L = 2048, N = 256
              • -
            • L = 3072, N = 256
              • -
            • -
          • -
        • -
      -

      Prerequisite: SHS #4010, DRBG #1731

      Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1302

      -

      Version 10.0.15254

        -
      • DSA:
        • -
        • -
        • 186-4:
          • -
          • -
          • PQGGen:
            • -
            • -
            • L = 2048, N = 256 SHA: SHA-256
              • -
            • L = 3072, N = 256 SHA: SHA-256
              • -
            • -
          • PQGVer:
            • -
            • -
            • L = 2048, N = 256 SHA: SHA-256
              • -
            • L = 3072, N = 256 SHA: SHA-256
              • -
            • -
          • SigGen:
            • -
            • -
            • L = 2048, N = 256 SHA: SHA-256
              • -
            • L = 3072, N = 256 SHA: SHA-256
              • -
            • -
          • SigVer:
            • -
            • -
            • L = 2048, N = 256 SHA: SHA-256
              • -
            • L = 3072, N = 256 SHA: SHA-256
              • -
            • -
          • KeyPair:
            • -
            • -
            • L = 2048, N = 256
              • -
            • L = 3072, N = 256
              • -
            • -
          • -
        • -
      -

      Prerequisite: SHS #4009, DRBG #1730

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1301

      -

      Version 10.0.16299

      FIPS186-4:

      -

      PQG(gen)PARMS TESTED:   [ (2048,256)SHA( 256 ); (3072,256) SHA( 256 ) ]

      -

      PQG(ver)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]

      -

      KeyPairGen:   [ (2048,256) ; (3072,256) ]

      -

      SIG(gen)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ); ]

      -

      SIG(ver)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]

      -

      SHS: Val#3790

      -

      DRBG: Val# 1555

      Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1223

      -

      Version 10.0.15063

      FIPS186-4:
      -PQG(ver)PARMS TESTED:         [ (1024,160) SHA( 1 ); ]
      -SIG(ver)PARMS TESTED:   [ (1024,160) SHA( 1 ); ]
      -SHS: Val# 3649

      Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1188

      -

      Version 7.00.2872

      FIPS186-4:
      -PQG(ver)PARMS TESTED:         [ (1024,160) SHA( 1 ); ]
      -SIG(ver)PARMS TESTED:   [ (1024,160) SHA( 1 ); ]
      -SHS: Val#3648

      Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1187

      -

      Version 8.00.6246

      FIPS186-4:
      -PQG(gen)      PARMS TESTED: [
      -(2048,256)SHA( 256 ); (3072,256) SHA( 256 ) ]
      -PQG(ver)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]
      -KeyPairGen:    [ (2048,256) ; (3072,256) ]
      -SIG(gen)PARMS TESTED:   [ (2048,256)
      -SHA( 256 ); (3072,256) SHA( 256 ); ]
      -SIG(ver)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]

      -

      SHS: Val# 3347
      -DRBG: Val# 1217

      Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update MsBignum Cryptographic Implementations #1098

      -

      Version 10.0.14393

      FIPS186-4:
      -PQG(gen)      PARMS TESTED:   [ (2048,256)SHA( 256 ); (3072,256) SHA( 256 ) ] PQG(ver)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 )]
      -KeyPairGen:    [ (2048,256) ; (3072,256) ] SIG(gen)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ); ]
      -SIG(ver)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]

      -

      SHS: Val# 3047
      -DRBG: Val# 955

      Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” MsBignum Cryptographic Implementations #1024

      -

      Version 10.0.10586

      FIPS186-4:
      -PQG(gen)      PARMS TESTED:   [ (2048,256)SHA( 256 ); (3072,256) SHA( 256 ) ]
      -PQG(ver)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]
      -KeyPairGen:    [ (2048,256) ; (3072,256) ]
      -SIG(gen)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ); ] SIG(ver)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]

      -

      SHS: Val# 2886
      -DRBG: Val# 868

      Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 MsBignum Cryptographic Implementations #983

      -

      Version 10.0.10240

      FIPS186-4:
      -PQG(gen)      PARMS TESTED:   [
      -(2048,256)SHA( 256 ); (3072,256) SHA( 256 ) ]
      -PQG(ver)PARMS TESTED:   [ (2048,256)
      -SHA( 256 ); (3072,256) SHA( 256 ) ]
      -KeyPairGen:    [ (2048,256) ; (3072,256) ]
      -SIG(gen)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ); ]
      -SIG(ver)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]

      -

      SHS: Val# 2373
      -DRBG: Val# 489

      Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #855

      -

      Version 6.3.9600

      FIPS186-2:
      -PQG(ver) MOD(1024);
      -SIG(ver) MOD(1024);
      -SHS: #1903
      -DRBG: #258

      -

      FIPS186-4:
      -PQG(gen)PARMS TESTED      : [ (2048,256)SHA( 256 ); (3072,256) SHA( 256 ) ]
      -PQG(ver)PARMS TESTED: [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]
      -SIG(gen)PARMS TESTED: [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ); ]
      -SIG(ver)PARMS TESTED: [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]
      -SHS: #1903
      -DRBG: #258
      -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#687.

      		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #687
      FIPS186-2:
      -PQG(ver)       MOD(1024);
      -SIG(ver) MOD(1024);
      -SHS: #1902
      -DRBG: #258
      -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#686.      		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 DSS and Diffie-Hellman Enhanced Cryptographic Provider (DSSENH) #686
      FIPS186-2:
      -SIG(ver)       MOD(1024);
      -SHS: Val# 1773
      -DRBG: Val# 193
      -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#645.      		Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #645
      FIPS186-2:
      -SIG(ver)       MOD(1024);
      -SHS: Val# 1081
      -DRBG: Val# 23
      -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#391. See Historical DSA List Val#386.

      Windows Server 2008 R2 and SP1 CNG algorithms #391

      -

      Windows 7 Ultimate and SP1 CNG algorithms #386

      FIPS186-2:
      -SIG(ver)       MOD(1024);
      -SHS: Val# 1081
      -RNG: Val# 649
      -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#390. See Historical DSA List Val#385.

      Windows Server 2008 R2 and SP1 Enhanced DSS (DSSENH) #390

      -

      Windows 7 Ultimate and SP1 Enhanced DSS (DSSENH) #385

      FIPS186-2:
      -SIG(ver)       MOD(1024);
      -SHS: Val# 753
      -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#284. See Historical DSA List Val#283.

      Windows Server 2008 CNG algorithms #284

      -

      Windows Vista Ultimate SP1 CNG algorithms #283

      FIPS186-2:
      -SIG(ver)       MOD(1024);
      -SHS: Val# 753
      -RNG: Val# 435
      -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#282. See Historical DSA List Val#281.

      Windows Server 2008 Enhanced DSS (DSSENH) #282

      -

      Windows Vista Ultimate SP1 Enhanced DSS (DSSENH) #281

      FIPS186-2:
      -SIG(ver)       MOD(1024);
      -SHS: Val# 618
      -RNG: Val# 321
      -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#227. See Historical DSA List Val#226.

      Windows Vista CNG algorithms #227

      -

      Windows Vista Enhanced DSS (DSSENH) #226

      FIPS186-2:
      -SIG(ver)       MOD(1024);
      -SHS: Val# 784
      -RNG: Val# 448
      -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#292.      		Windows XP Professional SP3 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #292
      FIPS186-2:
      -SIG(ver)       MOD(1024);
      -SHS: Val# 783
      -RNG: Val# 447
      -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#291.      		Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #291
      FIPS186-2:
      -PQG(gen)       MOD(1024);
      -PQG(ver) MOD(1024);
      -KEYGEN(Y) MOD(1024);
      -SIG(gen) MOD(1024);
      -SIG(ver) MOD(1024);
      -SHS: Val# 611
      -RNG: Val# 314      		Windows 2003 SP2 Enhanced DSS and Diffie-Hellman Cryptographic Provider #221
      FIPS186-2:
      -PQG(gen)       MOD(1024);
      -PQG(ver) MOD(1024);
      -KEYGEN(Y) MOD(1024);
      -SIG(gen) MOD(1024);
      -SIG(ver) MOD(1024);
      -SHS: Val# 385      		Windows Server 2003 SP1 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #146
      FIPS186-2:
      -PQG(ver)       MOD(1024);
      -KEYGEN(Y) MOD(1024);
      -SIG(gen) MOD(1024);
      -SIG(ver) MOD(1024);
      -SHS: Val# 181
      -
      -      		Windows Server 2003 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #95
      FIPS186-2:
      -PQG(gen)       MOD(1024);
      -PQG(ver) MOD(1024);
      -KEYGEN(Y) MOD(1024);
      -SIG(gen) MOD(1024);
      -SHS: SHA-1 (BYTE)
      -SIG(ver) MOD(1024);
      -SHS: SHA-1 (BYTE)

      Windows 2000 DSSENH.DLL #29

      -

      Windows 2000 DSSBASE.DLL #28

      -

      Windows NT 4 SP6 DSSENH.DLL #26

      -

      Windows NT 4 SP6 DSSBASE.DLL #25

      FIPS186-2: PRIME;
      -FIPS186-2:

      -

      KEYGEN(Y):
      -SHS: SHA-1 (BYTE)

      -

      SIG(gen):
      -SIG(ver)       MOD(1024);
      -SHS: SHA-1 (BYTE)

      		Windows NT 4.0 SP4 Microsoft Enhanced DSS and Diffie-Hellman Cryptographic Provider #17
      - - -#### Elliptic Curve Digital Signature Algorithm (ECDSA) - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Modes / States / Key SizesAlgorithm Implementation and Certificate #
        -
      • ECDSA:
        • -
        • -
        • 186-4:
          • -
          • -
          • Key Pair Generation:
            • -
            • -
            • Curves: P-256, P-384, P-521
              • -
            • Generation Methods: Extra Random Bits
              • -
            • -
          • Public Key Validation:
            • -
            • -
            • Curves: P-256, P-384, P-521
              • -
            • -
          • Signature Generation:
            • -
            • -
            • P-256 SHA: SHA-256
              • -
            • P-384 SHA: SHA-384
              • -
            • P-521 SHA: SHA-512
              • -
            • -
          • Signature Verification:
            • -
            • -
            • P-256 SHA: SHA-256
              • -
            • P-384 SHA: SHA-384
              • -
            • P-521 SHA: SHA-512
              • -
            • -
          • -
        • -
      -

      Prerequisite: SHS #2373, DRBG #489

      Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #1263

      -

      Version 6.3.9600

        -
      • ECDSA:
        • -
        • -
        • 186-4:
          • -
          • -
          • Key Pair Generation:
            • -
            • -
            • Curves: P-256, P-384
              • -
            • Generation Methods: Testing Candidates
              • -
            • -
          • -
        • -
      -

      Prerequisite: SHS #4011, DRBG #1734

      Microsoft Surface Hub Virtual TPM Implementations #1253

      -

      Version 10.0.15063.674

        -
      • ECDSA:
        • -
        • -
        • 186-4:
          • -
          • -
          • Key Pair Generation:
            • -
            • -
            • Curves: P-256, P-384
              • -
            • Generation Methods: Testing Candidates
              • -
            • -
          • -
        • -
      -

      Prerequisite: SHS #4009, DRBG #1733

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #1252

      -

      Version 10.0.16299

        -
      • ECDSA:
        • -
        • -
        • 186-4:
          • -
          • -
          • Key Pair Generation:
            • -
            • -
            • Curves: P-256, P-384, P-521
              • -
            • Generation Methods: Extra Random Bits
              • -
            • -
          • Public Key Validation:
            • -
            • -
            • Curves: P-256, P-384, P-521
              • -
            • -
          • Signature Generation:
            • -
            • -
            • P-256 SHA: SHA-256
              • -
            • P-384 SHA: SHA-384
              • -
            • P-521 SHA: SHA-512
              • -
            • -
          • Signature Verification:
            • -
            • -
            • P-256 SHA: SHA-256
              • -
            • P-384 SHA: SHA-384
              • -
            • P-521 SHA: SHA-512
              • -
            • -
          • -
        • -
      -

      Prerequisite: SHS #4011, DRBG #1732

      Microsoft Surface Hub MsBignum Cryptographic Implementations #1251

      -

      Version 10.0.15063.674

        -
      • ECDSA:
        • -
        • -
        • 186-4:
          • -
          • -
          • Key Pair Generation:
            • -
            • -
            • Curves: P-256, P-384, P-521
              • -
            • Generation Methods: Extra Random Bits
              • -
            • -
          • Public Key Validation:
            • -
            • -
            • Curves: P-256, P-384, P-521
              • -
            • -
          • Signature Generation:
            • -
            • -
            • P-256 SHA: SHA-256
              • -
            • P-384 SHA: SHA-384
              • -
            • P-521 SHA: SHA-512
              • -
            • -
          • Signature Verification:
            • -
            • -
            • P-256 SHA: SHA-256
              • -
            • P-384 SHA: SHA-384
              • -
            • P-521 SHA: SHA-512
              • -
            • -
          • -
        • -
      -

      Prerequisite: SHS #4011, DRBG #1732

      Microsoft Surface Hub SymCrypt Cryptographic Implementations #1250

      -

      Version 10.0.15063.674

        -
      • ECDSA:
        • -
        • -
        • 186-4:
          • -
          • -
          • Key Pair Generation:
            • -
            • -
            • Curves: P-256, P-384, P-521
              • -
            • Generation Methods: Extra Random Bits
              • -
            • -
          • Public Key Validation:
            • -
            • -
            • Curves: P-256, P-384, P-521
              • -
            • -
          • Signature Generation:
            • -
            • -
            • P-256 SHA: SHA-256
              • -
            • P-384 SHA: SHA-384
              • -
            • P-521 SHA: SHA-512
              • -
            • -
          • Signature Verification:
            • -
            • -
            • P-256 SHA: SHA-256
              • -
            • P-384 SHA: SHA-384
              • -
            • P-521 SHA: SHA-512
              • -
            • -
          • -
        • -
      -

      Prerequisite: SHS #4010, DRBG #1731

      Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1249

      -

      Version 10.0.15254

        -
      • ECDSA:
        • -
        • -
        • 186-4:
          • -
          • -
          • Key Pair Generation:
            • -
            • -
            • Curves: P-256, P-384, P-521
              • -
            • Generation Methods: Extra Random Bits
              • -
            • -
          • Public Key Validation:
            • -
            • -
            • Curves: P-256, P-384, P-521
              • -
            • -
          • Signature Generation:
            • -
            • -
            • P-256 SHA: SHA-256
              • -
            • P-384 SHA: SHA-384
              • -
            • P-521 SHA: SHA-512
              • -
            • -
          • Signature Verification:
            • -
            • -
            • P-256 SHA: SHA-256
              • -
            • P-384 SHA: SHA-384
              • -
            • P-521 SHA: SHA-512
              • -
            • -
          • -
        • -
      -

      Prerequisite: SHS #4010, DRBG #1731

      Windows 10 Mobile (version 1709) MsBignum Cryptographic Implementations #1248

      -

      Version 10.0.15254

        -
      • ECDSA:
        • -
        • -
        • 186-4:
          • -
          • -
          • Key Pair Generation:
            • -
            • -
            • Curves: P-256, P-384, P-521
              • -
            • Generation Methods: Extra Random Bits
              • -
            • -
          • Public Key Validation:
            • -
            • -
            • Curves: P-256, P-384, P-521
              • -
            • -
          • Signature Generation:
            • -
            • -
            • P-256 SHA: SHA-256
              • -
            • P-384 SHA: SHA-384
              • -
            • P-521 SHA: SHA-512
              • -
            • -
          • Signature Verification:
            • -
            • -
            • P-256 SHA: SHA-256
              • -
            • P-384 SHA: SHA-384
              • -
            • P-521 SHA: SHA-512
              • -
            • -
          • -
        • -
      -

      Prerequisite: SHS #4009, DRBG #1730

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); MsBignum Cryptographic Implementations #1247

      -

      Version 10.0.16299

        -
      • ECDSA:
        • -
        • -
        • 186-4:
          • -
          • -
          • Key Pair Generation:
            • -
            • -
            • Curves: P-256, P-384, P-521
              • -
            • Generation Methods: Extra Random Bits
              • -
            • -
          • Public Key Validation:
            • -
            • -
            • Curves: P-256, P-384, P-521
              • -
            • -
          • Signature Generation:
            • -
            • -
            • P-256 SHA: SHA-256
              • -
            • P-384 SHA: SHA-384
              • -
            • P-521 SHA: SHA-512
              • -
            • -
          • Signature Verification:
            • -
            • -
            • P-256 SHA: SHA-256
              • -
            • P-384 SHA: SHA-384
              • -
            • P-521 SHA: SHA-512
              • -
            • -
          • -
        • -
      -

      Prerequisite: SHS #4009, DRBG #1730

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1246

      -

      Version 10.0.16299

      FIPS186-4:
      -PKG: CURVES      ( P-256 P-384 TestingCandidates )
      -SHS: Val#3790
      -DRBG: Val# 1555

      Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #1136

      -

      Version 10.0.15063

      FIPS186-4:
      -PKG: CURVES      ( P-256 P-384 P-521 ExtraRandomBits )
      -PKV: CURVES( P-256 P-384 P-521 )
      -SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
      -SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )
      -SHS: Val#3790
      -DRBG: Val# 1555

      Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile MsBignum Cryptographic Implementations #1135

      -

      Version 10.0.15063

      FIPS186-4:
      -PKG: CURVES      ( P-256 P-384 P-521 ExtraRandomBits )
      -PKV: CURVES( P-256 P-384 P-521 )
      -SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
      -SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )
      -SHS: Val#3790
      -DRBG: Val# 1555

      Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1133

      -

      Version 10.0.15063

      FIPS186-4:
      -PKG: CURVES      ( P-256 P-384 P-521 ExtraRandomBits )
      -PKV: CURVES( P-256 P-384 P-521 )
      -SigGen: CURVES( P-256: (SHA-1, 256) P-384: (SHA-1, 384) P-521: (SHA-1, 512) SIG(gen) with SHA-1 affirmed for use with protocols only.
      -SigVer: CURVES( P-256: (SHA-1, 256) P-384: (SHA-1, 384) P-521: (SHA-1, 512) )
      -SHS:Val# 3649
      -DRBG:Val# 1430

      Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1073

      -

      Version 7.00.2872

      FIPS186-4:
      -PKG: CURVES      ( P-256 P-384 P-521 ExtraRandomBits )
      -PKV: CURVES( P-256 P-384 P-521 )
      -SigGen: CURVES( P-256: (SHA-1, 256) P-384: (SHA-1, 384) P-521: (SHA-1, 512) SIG(gen) with SHA-1 affirmed for use with protocols only.
      -SigVer: CURVES( P-256: (SHA-1, 256) P-384: (SHA-1, 384) P-521: (SHA-1, 512) )
      -SHS:Val#3648
      -DRBG:Val# 1429

      Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1072

      -

      Version 8.00.6246

      FIPS186-4:
      -PKG: CURVES      ( P-256 P-384 TestingCandidates )
      -PKV: CURVES( P-256 P-384 )
      -SigGen: CURVES( P-256: (SHA-1, 256) P-384: (SHA-1, 256, 384) SIG(gen) with SHA-1 affirmed for use with protocols only.
      -SigVer: CURVES( P-256: (SHA-1, 256) P-384: (SHA-1, 256, 384) )

      -

      SHS: Val# 3347
      -DRBG: Val# 1222

      Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #920

      -

      Version 10.0.14393

      FIPS186-4:
      -PKG: CURVES      ( P-256 P-384 P-521 ExtraRandomBits )
      -PKV: CURVES( P-256 P-384 P-521 )
      -SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
      -SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )

      -

      SHS: Val# 3347
      -DRBG: Val# 1217

      Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update MsBignum Cryptographic Implementations #911

      -

      Version 10.0.14393

      FIPS186-4:
      -PKG: CURVES      ( P-256 P-384 P-521 ExtraRandomBits )
      -SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
      -SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )

      -

      SHS: Val# 3047
      -DRBG: Val# 955

      Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” MsBignum Cryptographic Implementations #760

      -

      Version 10.0.10586

      FIPS186-4:
      -PKG: CURVES      ( P-256 P-384 P-521 ExtraRandomBits )
      -SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
      -SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )

      -

      SHS: Val# 2886
      -DRBG: Val# 868

      Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 MsBignum Cryptographic Implementations #706

      -

      Version 10.0.10240

      FIPS186-4:
      -PKG: CURVES      ( P-256 P-384 P-521 ExtraRandomBits )
      -SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
      -SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )

      -

      SHS: Val#2373
      -DRBG: Val# 489

      Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #505

      -

      Version 6.3.9600

      FIPS186-2:
      -PKG: CURVES      ( P-256 P-384 P-521 )
      -SHS: #1903
      -DRBG: #258
      -SIG(ver):CURVES( P-256 P-384 P-521 )
      -SHS: #1903
      -DRBG: #258

      -

      FIPS186-4:
      -PKG: CURVES      ( P-256 P-384 P-521 ExtraRandomBits )
      -SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
      -SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )
      -SHS: #1903
      -DRBG: #258
      -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical ECDSA List Val#341.

      		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #341

      FIPS186-2:
      -PKG: CURVES      ( P-256 P-384 P-521 )
      -SHS: Val#1773
      -DRBG: Val# 193
      -SIG(ver): CURVES( P-256 P-384 P-521 )
      -SHS: Val#1773
      -DRBG: Val# 193

      -

      FIPS186-4:
      -PKG: CURVES      ( P-256 P-384 P-521 ExtraRandomBits )
      -SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
      -SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )
      -SHS: Val#1773
      -DRBG: Val# 193
      -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical ECDSA List Val#295.

      		Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #295
      FIPS186-2:
      -PKG: CURVES      ( P-256 P-384 P-521 )
      -SHS: Val#1081
      -DRBG: Val# 23
      -SIG(ver): CURVES( P-256 P-384 P-521 )
      -SHS: Val#1081
      -DRBG: Val# 23
      -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical ECDSA List Val#142. See Historical ECDSA List Val#141.

      Windows Server 2008 R2 and SP1 CNG algorithms #142

      -

      Windows 7 Ultimate and SP1 CNG algorithms #141

      FIPS186-2:
      -PKG: CURVES      ( P-256 P-384 P-521 )
      -SHS: Val#753
      -SIG(ver): CURVES( P-256 P-384 P-521 )
      -SHS: Val#753
      -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical ECDSA List Val#83. See Historical ECDSA List Val#82.

      Windows Server 2008 CNG algorithms #83

      -

      Windows Vista Ultimate SP1 CNG algorithms #82

      FIPS186-2:
      -PKG: CURVES      ( P-256 P-384 P-521 )
      -SHS: Val#618
      -RNG: Val# 321
      -SIG(ver): CURVES( P-256 P-384 P-521 )
      -SHS: Val#618
      -RNG: Val# 321
      -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical ECDSA List Val#60.      		Windows Vista CNG algorithms #60
      - - -#### Keyed-Hash Message Authentication Code (HMAC) - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Modes / States / Key SizesAlgorithm Implementation and Certificate #
        -
      • HMAC-SHA-1:
        • -
        • -
        • Key Sizes &lt; Block Size
          • -
        • Key Sizes &gt; Block Size
          • -
        • Key Sizes = Block Size
          • -
        • -
      • HMAC-SHA2-256:
        • -
        • -
        • Key Sizes &lt; Block Size
          • -
        • Key Sizes &gt; Block Size
          • -
        • Key Sizes = Block Size
          • -
        • -
      • HMAC-SHA2-384:
        • -
        • -
        • Key Sizes &lt; Block Size
          • -
        • Key Sizes &gt; Block Size
          • -
        • Key Sizes = Block Size
          • -
        • -
      -

      Prerequisite: SHS #4011

      Microsoft Surface Hub Virtual TPM Implementations #3271

      -

      Version 10.0.15063.674

        -
      • HMAC-SHA-1:
        • -
        • -
        • Key Sizes &lt; Block Size
          • -
        • Key Sizes &gt; Block Size
          • -
        • Key Sizes = Block Size
          • -
        • -
      • HMAC-SHA2-256:
        • -
        • -
        • Key Sizes &lt; Block Size
          • -
        • Key Sizes &gt; Block Size
          • -
        • Key Sizes = Block Size
          • -
        • -
      • HMAC-SHA2-384:
        • -
        • -
        • Key Sizes &lt; Block Size
          • -
        • Key Sizes &gt; Block Size
          • -
        • Key Sizes = Block Size
          • -
        • -
      -

      Prerequisite: SHS #4009

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #3270

      -

      Version 10.0.16299

        -
      • HMAC-SHA-1:
        • -
        • -
        • Key Sizes &lt; Block Size
          • -
        • Key Sizes &gt; Block Size
          • -
        • Key Sizes = Block Size
          • -
        • -
      • HMAC-SHA2-256:
        • -
        • -
        • Key Sizes &lt; Block Size
          • -
        • Key Sizes &gt; Block Size
          • -
        • Key Sizes = Block Size
          • -
        • -
      • HMAC-SHA2-384:
        • -
        • -
        • Key Sizes &lt; Block Size
          • -
        • Key Sizes &gt; Block Size
          • -
        • Key Sizes = Block Size
          • -
        • -
      • HMAC-SHA2-512:
        • -
        • -
        • Key Sizes &lt; Block Size
          • -
        • Key Sizes &gt; Block Size
          • -
        • Key Sizes = Block Size
          • -
        • -
      -

      Prerequisite: SHS #4011

      Microsoft Surface Hub SymCrypt Cryptographic Implementations #3269

      -

      Version 10.0.15063.674

        -
      • HMAC-SHA-1:
        • -
        • -
        • Key Sizes &lt; Block Size
          • -
        • Key Sizes &gt; Block Size
          • -
        • Key Sizes = Block Size
          • -
        • -
      • HMAC-SHA2-256:
        • -
        • -
        • Key Sizes &lt; Block Size
          • -
        • Key Sizes &gt; Block Size
          • -
        • Key Sizes = Block Size
          • -
        • -
      • HMAC-SHA2-384:
        • -
        • -
        • Key Sizes &lt; Block Size
          • -
        • Key Sizes &gt; Block Size
          • -
        • Key Sizes = Block Size
          • -
        • -
      • HMAC-SHA2-512:
        • -
        • -
        • Key Sizes &lt; Block Size
          • -
        • Key Sizes &gt; Block Size
          • -
        • Key Sizes = Block Size
          • -
        • -
      -

      Prerequisite: SHS #4010

      Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #3268

      -

      Version 10.0.15254

        -
      • HMAC-SHA-1:
        • -
        • -
        • Key Sizes &lt; Block Size
          • -
        • Key Sizes &gt; Block Size
          • -
        • Key Sizes = Block Size
          • -
        • -
      • HMAC-SHA2-256:
        • -
        • -
        • Key Sizes &lt; Block Size
          • -
        • Key Sizes &gt; Block Size
          • -
        • Key Sizes = Block Size
          • -
        • -
      • HMAC-SHA2-384:
        • -
        • -
        • Key Sizes &lt; Block Size
          • -
        • Key Sizes &gt; Block Size
          • -
        • Key Sizes = Block Size
          • -
        • -
      • HMAC-SHA2-512:
        • -
        • -
        • Key Sizes &lt; Block Size
          • -
        • Key Sizes &gt; Block Size
          • -
        • Key Sizes = Block Size
          • -
        • -
      -

      Prerequisite: SHS #4009

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #3267

      -

      Version 10.0.16299

      HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS Val#3790

      -

      HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val#3790

      -

      HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val#3790

      Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #3062

      -

      Version 10.0.15063

      HMAC-SHA1(Key Sizes Ranges Tested: KSBS ) SHS Val#3790

      -

      HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val#3790

      -

      HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val#3790

      -

      HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHS Val#3790

      Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #3061

      -

      Version 10.0.15063

      HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS Val#3652

      -

      HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val#3652

      -

      HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val#3652

      -

      HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#3652

      Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2946

      -

      Version 7.00.2872

      HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS Val#3651

      -

      HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val#3651

      -

      HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val#3651

      -

      HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#3651

      Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2945

      -

      Version 8.00.6246

      HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS Val# 3649

      -

      HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val# 3649

      -

      HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val# 3649

      -

      HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal# 3649

      Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2943

      -

      Version 7.00.2872

      HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS Val#3648

      -

      HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val#3648

      -

      HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val#3648

      -

      HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#3648

      Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2942

      -

      Version 8.00.6246

      HMAC-SHA1 (Key Sizes Ranges Tested:  KSBS )
      -SHS Val# 3347

      -

      HMAC-SHA256 ( Key Size Ranges Tested:  KSBS )
      -SHS Val# 3347

      -

      HMAC-SHA384 ( Key Size Ranges Tested:  KSBS )
      -SHS Val# 3347

      Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #2661

      -

      Version 10.0.14393

      HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS Val# 3347

      -

      HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val# 3347

      -

      HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val# 3347

      -

      HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHS Val# 3347

      Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update SymCrypt Cryptographic Implementations #2651

      -

      Version 10.0.14393

      HMAC-SHA1 (Key Sizes Ranges Tested:  KSBS )
      -SHS Val# 3047

      -

      HMAC-SHA256 ( Key Size Ranges Tested:  KSBS )
      -SHS Val# 3047

      -

      HMAC-SHA384 ( Key Size Ranges Tested:  KSBS )
      -SHS Val# 3047

      -

      HMAC-SHA512 ( Key Size Ranges Tested:  KSBS )
      -SHS Val# 3047

      Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” SymCrypt Cryptographic Implementations #2381

      -

      Version 10.0.10586

      HMAC-SHA1 (Key Sizes Ranges Tested:  KSBS )
      -SHSVal# 2886

      -

      HMAC-SHA256 ( Key Size Ranges Tested:  KSBS )
      -SHSVal# 2886

      -

      HMAC-SHA384 ( Key Size Ranges Tested:  KSBS )
      - SHSVal# 2886

      -

      HMAC-SHA512 ( Key Size Ranges Tested:  KSBS )
      -SHSVal# 2886

      Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 SymCrypt Cryptographic Implementations #2233

      -

      Version 10.0.10240

      HMAC-SHA1 (Key Sizes Ranges Tested:  KSBS )
      -SHS Val#2373

      -

      HMAC-SHA256 ( Key Size Ranges Tested:  KSBS )
      -SHS Val#2373

      -

      HMAC-SHA384 ( Key Size Ranges Tested:  KSBS )
      -SHS Val#2373

      -

      HMAC-SHA512 ( Key Size Ranges Tested:  KSBS )
      -SHS Val#2373

      Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 SymCrypt Cryptographic Implementations #1773

      -

      Version 6.3.9600

      HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS Val#2764

      -

      HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val#2764

      -

      HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val#2764

      -

      HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHS Val#2764

      Windows CE and Windows Mobile, and Windows Embedded Handheld Enhanced Cryptographic Provider (RSAENH) #2122

      -

      Version 5.2.29344

      HMAC-SHA1 (Key Sizes Ranges Tested: KS#1902

      -

      HMAC-SHA256 ( Key Size Ranges Tested: KS#1902

      		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 BitLocker® Cryptographic Implementations #1347

      HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS#1902

      -

      HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS#1902

      -

      HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS#1902

      -

      HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHS#1902

      		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Enhanced Cryptographic Provider (RSAENH) #1346

      HMAC-SHA1 (Key Sizes Ranges Tested: KSBS )

      -

      SHS#1903

      -

      HMAC-SHA256 ( Key Size Ranges Tested: KSBS )

      -

      SHS#1903

      -

      HMAC-SHA384 ( Key Size Ranges Tested: KSBS )

      -

      SHS#1903

      -

      HMAC-SHA512 ( Key Size Ranges Tested: KSBS )

      -

      SHS#1903

      		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Next Generation Symmetric Cryptographic Algorithms Implementations (SYMCRYPT) #1345

      HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#1773

      -

      HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#1773

      -

      Tinker HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#1773

      -

      HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#1773

      		Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #1364

      HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#1774

      -

      HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#1774

      -

      HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#1774

      -

      HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#1774

      		Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #1227

      HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#1081

      -

      HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#1081

      -

      HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#1081

      -

      HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#1081

      Windows Server 2008 R2 and SP1 CNG algorithms #686

      -

      Windows 7 and SP1 CNG algorithms #677

      -

      Windows Server 2008 R2 Enhanced Cryptographic Provider (RSAENH) #687

      -

      Windows 7 Enhanced Cryptographic Provider (RSAENH) #673

      HMAC-SHA1(Key Sizes Ranges Tested: KSVal#1081

      -

      HMAC-SHA256 ( Key Size Ranges Tested: KSVal#1081

      		Windows 7 and SP1 and Windows Server 2008 R2 and SP1 BitLocker Algorithm Implementations #675

      HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#816

      -

      HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#816

      -

      HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#816

      -

      HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#816

      		Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #452

      HMAC-SHA1 (Key Sizes Ranges Tested: KSVal#753

      -

      HMAC-SHA256 ( Key Size Ranges Tested: KSVal#753

      		Windows Vista Ultimate SP1 and Windows Server 2008 BitLocker Algorithm Implementations #415

      HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#753

      -

      HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#753

      -

      HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#753

      -

      HMAC-SHA512 ( Key Size Ranges Tested: KSBS )SHS Val#753

      Windows Server 2008 Enhanced Cryptographic Provider (RSAENH) #408

      -

      Windows Vista Enhanced Cryptographic Provider (RSAENH) #407

      HMAC-SHA1 (Key Sizes Ranges Tested: KSBS )SHSVal#618

      -

      HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#618

      -

      HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#618

      -

      HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#618

      		Windows Vista Enhanced Cryptographic Provider (RSAENH) #297
      HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#785

      Windows XP Professional SP3 Kernel Mode Cryptographic Module (fips.sys) #429

      -

      Windows XP, vendor-affirmed

      HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#783

      -

      HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#783

      -

      HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#783

      -

      HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#783

      		Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #428

      HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#613

      -

      HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#613

      -

      HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#613

      -

      HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#613

      		Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #289
      HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#610Windows Server 2003 SP2 Kernel Mode Cryptographic Module (fips.sys) #287

      HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#753

      -

      HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#753

      -

      HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#753

      -

      HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#753

      Windows Server 2008 CNG algorithms #413

      -

      Windows Vista Ultimate SP1 CNG algorithms #412

      HMAC-SHA1 (Key Sizes Ranges Tested: KSVal#737

      -

      HMAC-SHA256 ( Key Size Ranges Tested: KSVal#737

      		Windows Vista Ultimate BitLocker Drive Encryption #386

      HMAC-SHA1 ( Key Sizes Ranges Tested: KSBS ) SHSVal#618

      -

      HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#618

      -

      HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#618

      -

      HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#618

      		Windows Vista CNG algorithms #298

      HMAC-SHA1 ( Key Sizes Ranges Tested: KSBS ) SHSVal#589

      -

      HMAC-SHA256 ( Key Size Ranges Tested: KSBS )SHSVal#589

      -

      HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#589

      -

      HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#589

      		Windows CE 6.0 and Windows CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #267

      HMAC-SHA1 ( Key Sizes Ranges Tested: KSBS ) SHSVal#578

      -

      HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#578

      -

      HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#578

      -

      HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#578

      		Windows CE and Windows Mobile 6.0 and Windows Mobil 6.5 Enhanced Cryptographic Provider (RSAENH) #260

      HMAC-SHA1 (Key Sizes Ranges Tested: KSVal#495

      -

      HMAC-SHA256 ( Key Size Ranges Tested: KSVal#495

      		Windows Vista BitLocker Drive Encryption #199
      HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#364

      Windows Server 2003 SP1 Enhanced Cryptographic Provider (RSAENH) #99

      -

      Windows XP, vendor-affirmed

      HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#305

      -

      HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#305

      -

      HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#305

      -

      HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#305

      		Windows CE 5.00 and Windows CE 5.01 Enhanced Cryptographic Provider (RSAENH) #31
      - - -#### Key Agreement Scheme (KAS) - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Modes / States / Key SizesAlgorithm Implementation and Certificate #
        -
      • KAS ECC:
        • -
        • -
        • Functions: Domain Parameter Generation, Domain Parameter Validation, Full Public Key Validation, Key Pair Generation, Public Key Regeneration
          • -
        • Schemes:
          • -
          • -
          • Full Unified:
            • -
            • -
            • Key Agreement Roles: Initiator, Responder
              • -
            • KDFs: Concatenation
              • -
            • Parameter Sets:
              • -
              • -
              • EC:
                • -
                • -
                • Curve: P-256
                  • -
                • SHA: SHA-256
                  • -
                • MAC: HMAC
                  • -
                • -
              • ED:
                • -
                • -
                • Curve: P-384
                  • -
                • SHA: SHA-384
                  • -
                • MAC: HMAC
                  • -
                • -
              • -
            • -
          • -
        • -
      -

      Prerequisite: SHS #4011, ECDSA #1253, DRBG #1734

      Microsoft Surface Hub Virtual TPM Implementations #150

      -

      Version 10.0.15063.674

        -
      • KAS ECC:
        • -
        • -
        • Functions: Domain Parameter Generation, Domain Parameter Validation, Full Public Key Validation, Key Pair Generation, Public Key Regeneration
          • -
        • Schemes:
          • -
          • -
          • Full Unified:
            • -
            • -
            • Key Agreement Roles: Initiator, Responder
              • -
            • KDFs: Concatenation
              • -
            • Parameter Sets:
              • -
              • -
              • EC:
                • -
                • -
                • Curve: P-256
                  • -
                • SHA: SHA-256
                  • -
                • MAC: HMAC
                  • -
                • -
              • ED:
                • -
                • -
                • Curve: P-384
                  • -
                • SHA: SHA-384
                  • -
                • MAC: HMAC
                  • -
                • -
              • -
            • -
          • -
        • -
      -

      Prerequisite: SHS #4009, ECDSA #1252, DRBG #1733

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #149

      -

      Version 10.0.16299

        -
      • KAS ECC:
        • -
        • -
        • Functions: Domain Parameter Generation, Domain Parameter Validation, Key Pair Generation, Partial Public Key Validation, Public Key Regeneration
          • -
        • Schemes:
          • -
          • -
          • Ephemeral Unified:
            • -
            • -
            • Key Agreement Roles: Initiator, Responder
              • -
            • KDFs: Concatenation
              • -
            • Parameter Sets:
              • -
              • -
              • EC:
                • -
                • -
                • Curve: P-256
                  • -
                • SHA: SHA-256
                  • -
                • MAC: HMAC
                  • -
                • -
              • ED:
                • -
                • -
                • Curve: P-384
                  • -
                • SHA: SHA-384
                  • -
                • MAC: HMAC
                  • -
                • -
              • EE:
                • -
                • -
                • Curve: P-521
                  • -
                • SHA: SHA-512
                  • -
                • MAC: HMAC
                  • -
                • -
              • -
            • -
          • One Pass DH:
            • -
            • -
            • Key Agreement Roles: Initiator, Responder
              • -
            • Parameter Sets:
              • -
              • -
              • EC:
                • -
                • -
                • Curve: P-256
                  • -
                • SHA: SHA-256
                  • -
                • MAC: HMAC
                  • -
                • -
              • ED:
                • -
                • -
                • Curve: P-384
                  • -
                • SHA: SHA-384
                  • -
                • MAC: HMAC
                  • -
                • -
              • EE:
                • -
                • -
                • Curve: P-521
                  • -
                • SHA: SHA-512
                  • -
                • MAC: HMAC
                  • -
                • -
              • -
            • -
          • Static Unified:
            • -
            • -
            • Key Agreement Roles: Initiator, Responder
              • -
            • Parameter Sets:
              • -
              • -
              • EC:
                • -
                • -
                • Curve: P-256
                  • -
                • SHA: SHA-256
                  • -
                • MAC: HMAC
                  • -
                • -
              • ED:
                • -
                • -
                • Curve: P-384
                  • -
                • SHA: SHA-384
                  • -
                • MAC: HMAC
                  • -
                • -
              • EE:
                • -
                • -
                • Curve: P-521
                  • -
                • SHA: SHA-512
                  • -
                • MAC: HMAC
                  • -
                • -
              • -
            • -
          • -
        • -
      -

      Prerequisite: SHS #4011, ECDSA #1250, DRBG #1732

      -
        -
      • KAS FFC:
        • -
        • -
        • Functions: Domain Parameter Generation, Domain Parameter Validation, Key Pair Generation, Partial Public Key Validation
          • -
        • Schemes:
          • -
          • -
          • dhEphem:
            • -
            • -
            • Key Agreement Roles: Initiator, Responder
              • -
            • Parameter Sets:
              • -
              • -
              • FB:
                • -
                • -
                • SHA: SHA-256
                  • -
                • MAC: HMAC
                  • -
                • -
              • FC:
                • -
                • -
                • SHA: SHA-256
                  • -
                • MAC: HMAC
                  • -
                • -
              • -
            • -
          • dhOneFlow:
            • -
            • -
            • Key Agreement Roles: Initiator, Responder
              • -
            • Parameter Sets:
              • -
              • -
              • FB:
                • -
                • -
                • SHA: SHA-256
                  • -
                • MAC: HMAC
                  • -
                • -
              • FC:
                • -
                • -
                • SHA: SHA-256
                  • -
                • MAC: HMAC
                  • -
                • -
              • -
            • -
          • dhStatic:
            • -
            • -
            • Key Agreement Roles: Initiator, Responder
              • -
            • Parameter Sets:
              • -
              • -
              • FB:
                • -
                • -
                • SHA: SHA-256
                  • -
                • MAC: HMAC
                  • -
                • -
              • FC:
                • -
                • -
                • SHA: SHA-256
                  • -
                • MAC: HMAC
                  • -
                • -
              • -
            • -
          • -
        • -
      -

      Prerequisite: SHS #4011, DSA #1303, DRBG #1732

      Microsoft Surface Hub SymCrypt Cryptographic Implementations #148

      -

      Version 10.0.15063.674

        -
      • KAS ECC:
        • -
        • -
        • Functions: Domain Parameter Generation, Domain Parameter Validation, Key Pair Generation, Partial Public Key Validation, Public Key Regeneration
          • -
        • Schemes:
          • -
          • -
          • Ephemeral Unified:
            • -
            • -
            • Key Agreement Roles: Initiator, Responder
              • -
            • KDFs: Concatenation
              • -
            • Parameter Sets:
              • -
              • -
              • EC:
                • -
                • -
                • Curve: P-256
                  • -
                • SHA: SHA-256
                  • -
                • MAC: HMAC
                  • -
                • -
              • ED:
                • -
                • -
                • Curve: P-384
                  • -
                • SHA: SHA-384
                  • -
                • MAC: HMAC
                  • -
                • -
              • EE:
                • -
                • -
                • Curve: P-521
                  • -
                • SHA: SHA-512
                  • -
                • MAC: HMAC
                  • -
                • -
              • -
            • -
          • One Pass DH:
            • -
            • -
            • Key Agreement Roles: Initiator, Responder
              • -
            • Parameter Sets:
              • -
              • -
              • EC:
                • -
                • -
                • Curve: P-256
                  • -
                • SHA: SHA-256
                  • -
                • MAC: HMAC
                  • -
                • -
              • ED:
                • -
                • -
                • Curve: P-384
                  • -
                • SHA: SHA-384
                  • -
                • MAC: HMAC
                  • -
                • -
              • EE:
                • -
                • -
                • Curve: P-521
                  • -
                • SHA: SHA-512
                  • -
                • MAC: HMAC
                  • -
                • -
              • -
            • -
          • Static Unified:
            • -
            • -
            • Key Agreement Roles: Initiator, Responder
              • -
            • Parameter Sets:
              • -
              • -
              • EC:
                • -
                • -
                • Curve: P-256
                  • -
                • SHA: SHA-256
                  • -
                • MAC: HMAC
                  • -
                • -
              • ED:
                • -
                • -
                • Curve: P-384
                  • -
                • SHA: SHA-384
                  • -
                • MAC: HMAC
                  • -
                • -
              • EE:
                • -
                • -
                • Curve: P-521
                  • -
                • SHA: SHA-512
                  • -
                • MAC: HMAC
                  • -
                • -
              • -
            • -
          • -
        • -
      -

      Prerequisite: SHS #4010, ECDSA #1249, DRBG #1731

      -
        -
      • KAS FFC:
        • -
        • -
        • Functions: Domain Parameter Generation, Domain Parameter Validation, Key Pair Generation, Partial Public Key Validation
          • -
        • Schemes:
          • -
          • -
          • dhEphem:
            • -
            • -
            • Key Agreement Roles: Initiator, Responder
              • -
            • Parameter Sets:
              • -
              • -
              • FB:
                • -
                • -
                • SHA: SHA-256
                  • -
                • MAC: HMAC
                  • -
                • -
              • FC:
                • -
                • -
                • SHA: SHA-256
                  • -
                • MAC: HMAC
                  • -
                • -
              • -
            • -
          • dhOneFlow:
            • -
            • -
            • Key Agreement Roles: Initiator, Responder
              • -
            • Parameter Sets:
              • -
              • -
              • FB:
                • -
                • -
                • SHA: SHA-256
                  • -
                • MAC: HMAC
                  • -
                • -
              • FC:
                • -
                • -
                • SHA: SHA-256
                  • -
                • MAC: HMAC
                  • -
                • -
              • -
            • -
          • dhStatic:
            • -
            • -
            • Key Agreement Roles: Initiator, Responder
              • -
            • Parameter Sets:
              • -
              • -
              • FB:
                • -
                • -
                • SHA: SHA-256
                  • -
                • MAC: HMAC
                  • -
                • -
              • FC:
                • -
                • -
                • SHA: SHA-256
                  • -
                • MAC: HMAC
                  • -
                • -
              • -
            • -
          • -
        • -
      -

      Prerequisite: SHS #4010, DSA #1302, DRBG #1731

      Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #147

      -

      Version 10.0.15254

        -
      • KAS ECC:
        • -
        • -
        • Functions: Domain Parameter Generation, Domain Parameter Validation, Key Pair Generation, Partial Public Key Validation, Public Key Regeneration
          • -
        • Schemes:
          • -
          • -
          • Ephemeral Unified:
            • -
            • -
            • Key Agreement Roles: Initiator, Responder
              • -
            • KDFs: Concatenation
              • -
            • Parameter Sets:
              • -
              • -
              • EC:
                • -
                • -
                • Curve: P-256
                  • -
                • SHA: SHA-256
                  • -
                • MAC: HMAC
                  • -
                • -
              • ED:
                • -
                • -
                • Curve: P-384
                  • -
                • SHA: SHA-384
                  • -
                • MAC: HMAC
                  • -
                • -
              • EE:
                • -
                • -
                • Curve: P-521
                  • -
                • SHA: SHA-512
                  • -
                • MAC: HMAC
                  • -
                • -
              • -
            • -
          • One Pass DH:
            • -
            • -
            • Key Agreement Roles: Initiator, Responder
              • -
            • Parameter Sets:
              • -
              • -
              • EC:
                • -
                • -
                • Curve: P-256
                  • -
                • SHA: SHA-256
                  • -
                • MAC: HMAC
                  • -
                • -
              • ED:
                • -
                • -
                • Curve: P-384
                  • -
                • SHA: SHA-384
                  • -
                • MAC: HMAC
                  • -
                • -
              • EE:
                • -
                • -
                • Curve: P-521
                  • -
                • SHA: SHA-512
                  • -
                • MAC: HMAC
                  • -
                • -
              • -
            • -
          • Static Unified:
            • -
            • -
            • Key Agreement Roles: Initiator, Responder
              • -
            • Parameter Sets:
              • -
              • -
              • EC:
                • -
                • -
                • Curve: P-256
                  • -
                • SHA: SHA-256
                  • -
                • MAC: HMAC
                  • -
                • -
              • ED:
                • -
                • -
                • Curve: P-384
                  • -
                • SHA: SHA-384
                  • -
                • MAC: HMAC
                  • -
                • -
              • EE:
                • -
                • -
                • Curve: P-521
                  • -
                • SHA: SHA-512
                  • -
                • MAC: HMAC
                  • -
                • -
              • -
            • -
          • -
        • -
      -

      Prerequisite: SHS #4009, ECDSA #1246, DRBG #1730

      -
        -
      • KAS FFC:
        • -
        • -
        • Functions: Domain Parameter Generation, Domain Parameter Validation, Key Pair Generation, Partial Public Key Validation
          • -
        • Schemes:
          • -
          • -
          • dhEphem:
            • -
            • -
            • Key Agreement Roles: Initiator, Responder
              • -
            • Parameter Sets:
              • -
              • -
              • FB:
                • -
                • -
                • SHA: SHA-256
                  • -
                • MAC: HMAC
                  • -
                • -
              • FC:
                • -
                • -
                • SHA: SHA-256
                  • -
                • MAC: HMAC
                  • -
                • -
              • -
            • -
          • dhOneFlow:
            • -
            • -
            • Key Agreement Roles: Initiator, Responder
              • -
            • Parameter Sets:
              • -
              • -
              • FB:
                • -
                • -
                • SHA: SHA-256
                  • -
                • MAC: HMAC
                  • -
                • -
              • FC:
                • -
                • -
                • SHA: SHA-256
                  • -
                • MAC: HMAC
                  • -
                • -
              • -
            • -
          • dhStatic:
            • -
            • -
            • Key Agreement Roles: Initiator, Responder
              • -
            • Parameter Sets:
              • -
              • -
              • FB:
                • -
                • -
                • SHA: SHA-256
                  • -
                • MAC: HMAC
                  • -
                • -
              • FC:
                • -
                • -
                • SHA: SHA-256
                  • -
                • MAC: HMAC
                  • -
                • -
              • -
            • -
          • -
        • -
      -

      Prerequisite: SHS #4009, DSA #1301, DRBG #1730

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #146

      -

      Version 10.0.16299

      ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Full Validation   Key Regeneration ) SCHEMES [ FullUnified ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ]

      -

      SHS Val#3790
      -DSA Val#1135
      -DRBG Val#1556

      Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #128

      -

      Version 10.0.15063

      FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation ) SCHEMES [ dhEphem ( KARole(s): Initiator / Responder )
      -( FB: SHA256 ) ( FC: SHA256 ) ]
      -[ dhOneFlow ( FB: SHA256 ) ( FC: SHA256 ) ] [ dhStatic ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( FB: SHA256 HMAC ) ( FC: SHA256   HMAC ) ]
      -SHS Val#3790
      -DSA Val#1223
      -DRBG Val#1555

      -

      ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation ) SCHEMES [ EphemeralUnified ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
      -[ OnePassDH ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ( EE: P-521   HMAC (SHA512, HMAC_SHA512) ) ]
      -[ StaticUnified ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ( EE: P-521   HMAC (SHA512, HMAC_SHA512) ) ]
      -
      -SHS Val#3790
      -ECDSA Val#1133
      -DRBG Val#1555

      Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #127

      -

      Version 10.0.15063

      FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation ) SCHEMES [ dhEphem ( KARole(s): Initiator / Responder )
      -( FB: SHA256 ) ( FC: SHA256 ) ]
      -[ dhOneFlow ( KARole(s): Initiator / Responder ) ( FB: SHA256 ) ( FC: SHA256 ) ] [ dhStatic ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( FB: SHA256 HMAC ) ( FC: SHA256   HMAC ) ]
      -SHS Val# 3649
      -DSA Val#1188
      -DRBG Val#1430

      -

      ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation   Key Regeneration ) SCHEMES [ EphemeralUnified ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
      -[ OnePassDH ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ( EE: P-521   HMAC (SHA512, HMAC_SHA512) ) ]
      -[ StaticUnified ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ( EE: P-521   HMAC (SHA512, HMAC_SHA512) ) ]

      Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #115

      -

      Version 7.00.2872

      FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation ) SCHEMES [ dhEphem ( KARole(s): Initiator / Responder )
      -( FB: SHA256 ) ( FC: SHA256 ) ]
      -[ dhHybridOneFlow ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( FB:SHA256 HMAC ) ( FC: SHA256   HMAC ) ]
      -[ dhStatic ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( FB:SHA256 HMAC ) ( FC: SHA256   HMAC ) ]
      -SHS Val#3648
      -DSA Val#1187
      -DRBG Val#1429

      -

      ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation   Key Regeneration ) SCHEMES [ EphemeralUnified ( No_KC ) ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
      -[ OnePassDH ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ( EE: P-521   HMAC (SHA512, HMAC_SHA512) ) ]
      -[ StaticUnified ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ( EE: P-521   HMAC (SHA512, HMAC_SHA512) ) ]
      -
      -SHS Val#3648
      -ECDSA Val#1072
      -DRBG Val#1429

      Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #114

      -

      Version 8.00.6246

      ECC:  (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Full Validation   Key Regeneration )
      -SCHEMES  [ FullUnified  ( No_KC  &lt; KARole(s): Initiator / Responder &gt; &lt; KDF: CONCAT &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ]

      -

      SHS Val# 3347 ECDSA Val#920 DRBG Val#1222

      Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #93

      -

      Version 10.0.14393

      FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation )
      -SCHEMES  [ dhEphem  ( KARole(s): Initiator / Responder )
      -( FB: SHA256 ) ( FC: SHA256 ) ]
      -[ dhOneFlow ( KARole(s): Initiator / Responder ) ( FB:  SHA256 ) ( FC:  SHA256 ) ] [ dhStatic (No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( FB:  SHA256 HMAC ) ( FC:  SHA256   HMAC ) ]

      -

      SHS Val# 3347 DSA Val#1098 DRBG Val#1217

      -

      ECC:  (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation   Key Regeneration ) SCHEMES  [ EphemeralUnified ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
      -[ OnePassDH  ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521   HMAC (SHA512, HMAC_SHA512) ) ]
      -[ StaticUnified ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521   HMAC (SHA512, HMAC_SHA512) ) ]

      -

      SHS Val# 3347 DSA Val#1098 ECDSA Val#911 DRBG Val#1217 HMAC Val#2651

      Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #92

      -

      Version 10.0.14393

      FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation ) SCHEMES  [ dhEphem  ( KARole(s): Initiator / Responder )
      -( FB: SHA256 ) ( FC: SHA256 ) ]
      -[ dhOneFlow ( KARole(s): Initiator / Responder ) ( FB:  SHA256 ) ( FC:  SHA256 ) ] [ dhStatic ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( FB:  SHA256 HMAC ) ( FC:  SHA256   HMAC ) ]

      -

      SHS Val# 3047 DSA Val#1024 DRBG Val#955

      -

      ECC:  (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation   Key Regeneration ) SCHEMES  [ EphemeralUnified ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
      -[ OnePassDH  ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521   HMAC (SHA512, HMAC_SHA512) ) ]
      -[ StaticUnified ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521   HMAC (SHA512, HMAC_SHA512) ) ]

      -

      SHS Val# 3047 ECDSA Val#760 DRBG Val#955

      Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub Cryptography Next Generation (CNG) Implementations #72

      -

      Version 10.0.10586

      FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation ) SCHEMES  [ dhEphem  ( KARole(s): Initiator / Responder )
      -( FB: SHA256 ) ( FC: SHA256 ) ]
      -[ dhOneFlow ( KARole(s): Initiator / Responder ) ( FB:  SHA256 ) ( FC:  SHA256 ) ] [ dhStatic ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( FB:  SHA256 HMAC ) ( FC:  SHA256   HMAC ) ]

      -

      SHS Val# 2886 DSA Val#983 DRBG Val#868

      -

      ECC:  (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation   Key Regeneration ) SCHEMES  [ EphemeralUnified ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
      -[ OnePassDH  ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521   HMAC (SHA512, HMAC_SHA512) ) ]
      -[ StaticUnified ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521   HMAC (SHA512, HMAC_SHA512) ) ]

      -

      SHS Val# 2886 ECDSA Val#706 DRBG Val#868

      Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 Cryptography Next Generation (CNG) Implementations #64

      -

      Version 10.0.10240

      FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation ) SCHEMES  [ dhEphem  ( KARole(s): Initiator / Responder )
      -( FB: SHA256 ) ( FC: SHA256 ) ]
      -[ dhOneFlow ( KARole(s): Initiator / Responder ) ( FB:  SHA256 ) ( FC:  SHA256 ) ] [ dhStatic ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( FB:  SHA256 HMAC ) ( FC:  SHA256   HMAC ) ]

      -

      SHS Val#2373 DSA Val#855 DRBG Val#489

      -

      ECC:  (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation   Key Regeneration ) SCHEMES  [ EphemeralUnified ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
      -[ OnePassDH  ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521   HMAC (SHA512, HMAC_SHA512) ) ]
      -[ StaticUnified ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521   HMAC (SHA512, HMAC_SHA512) ) ]

      -

      SHS Val#2373 ECDSA Val#505 DRBG Val#489

      Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 Cryptography Next Generation Cryptographic Implementations #47

      -

      Version 6.3.9600

      FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG DPV KPG Partial Validation ) SCHEMES [ dhEphem ( KARole(s): Initiator / Responder )
      -( FA: SHA256 ) ( FB: SHA256 ) ( FC: SHA256 ) ]
      -[ dhOneFlow ( KARole(s): Initiator / Responder ) ( FA: SHA256 ) ( FB: SHA256 ) ( FC: SHA256 ) ]
      -[ dhStatic ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( FA: SHA256 HMAC ) ( FB: SHA256 HMAC ) ( FC: SHA256 HMAC ) ]
      -SHS #1903 DSA Val#687 DRBG #258

      -

      ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG DPV KPG Partial Validation Key Regeneration ) SCHEMES [ EphemeralUnified ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
      -[ OnePassDH( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256 SHA256 ) ( ED: P-384 SHA384 ) ( EE: P-521 (SHA512, HMAC_SHA512) ) ) ]
      -[ StaticUnified ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ]
      -
      -SHS #1903 ECDSA Val#341 DRBG #258

      		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #36

      KAS (SP 800–56A)

      -

      key agreement

      -

      key establishment methodology provides 80 to 256 bits of encryption strength

      Windows 7 and SP1, vendor-affirmed

      -

      Windows Server 2008 R2 and SP1, vendor-affirmed

      - - -SP 800-108 Key-Based Key Derivation Functions (KBKDF) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Modes / States / Key SizesAlgorithm Implementation and Certificate #
        -
      • Counter:
        • -
        • -
        • MACs: HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384
          • -
        • -
      -

      MAC prerequisite: HMAC #3271

      -
      -
        -
      • Counter Location: Before Fixed Data
        • -
      • R Length: 32 (bits)
        • -
      • SPs used to generate K: SP 800-56A, SP 800-90A
        • -
      -
      -

      K prerequisite: DRBG #1734, KAS #150

      Microsoft Surface Hub Virtual TPM Implementations #161

      -

      Version 10.0.15063.674

        -
      • Counter:
        • -
        • -
        • MACs: HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384
          • -
        • -
      -

      MAC prerequisite: HMAC #3270

      -
      -
        -
      • Counter Location: Before Fixed Data
        • -
      • R Length: 32 (bits)
        • -
      • SPs used to generate K: SP 800-56A, SP 800-90A
        • -
      -
      -

      K prerequisite: DRBG #1733, KAS #149

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #160

      -

      Version 10.0.16299

        -
      • Counter:
        • -
        • -
        • MACs: CMAC-AES-128, CMAC-AES-192, CMAC-AES-256, HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384, HMAC-SHA-512
          • -
        • -
      -

      MAC prerequisite: AES #4902, HMAC #3269

      -
      -
        -
      • Counter Location: Before Fixed Data
        • -
      • R Length: 32 (bits)
        • -
      • SPs used to generate K: SP 800-56A, SP 800-90A
        • -
      • K prerequisite: KAS #148
        • -
      -

      Microsoft Surface Hub Cryptography Next Generation (CNG) Implementations #159

      -

      Version 10.0.15063.674

        -
      • Counter:
        • -
        • -
        • MACs: CMAC-AES-128, CMAC-AES-192, CMAC-AES-256, HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384, HMAC-SHA-512
          • -
        • -
      -

      MAC prerequisite: AES #4901, HMAC #3268

      -
      -
        -
      • Counter Location: Before Fixed Data
        • -
      • R Length: 32 (bits)
        • -
      • SPs used to generate K: SP 800-56A, SP 800-90A
        • -
      -
      -

      K prerequisite: KAS #147

      Windows 10 Mobile (version 1709) Cryptography Next Generation (CNG) Implementations #158

      -

      Version 10.0.15254

        -
      • Counter:
        • -
        • -
        • MACs: CMAC-AES-128, CMAC-AES-192, CMAC-AES-256, HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384, HMAC-SHA-512
          • -
        • -
      -

      MAC prerequisite: AES #4897, HMAC #3267

      -
      -
        -
      • Counter Location: Before Fixed Data
        • -
      • R Length: 32 (bits)
        • -
      • SPs used to generate K: SP 800-56A, SP 800-90A
        • -
      -
      -

      K prerequisite: KAS #146

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Cryptography Next Generation (CNG) Implementations #157

      -

      Version 10.0.16299

      CTR_Mode: ( Llength( Min0 Max0 ) MACSupported( [HMACSHA1] [HMACSHA256] [HMACSHA384] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )
      -
      -KAS Val#128
      -DRBG Val#1556
      -MAC Val#3062

      Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #141

      -

      Version 10.0.15063

      CTR_Mode: ( Llength( Min20 Max64 ) MACSupported( [CMACAES128] [CMACAES192] [CMACAES256] [HMACSHA1] [HMACSHA256] [HMACSHA384] [HMACSHA512] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )
      -
      -KAS Val#127
      -AES Val#4624
      -DRBG Val#1555
      -MAC Val#3061

      Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile Cryptography Next Generation (CNG) Implementations #140

      -

      Version 10.0.15063

      CTR_Mode:  ( Llength( Min20 Max64 ) MACSupported( [HMACSHA1] [HMACSHA256] [HMACSHA384] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )

      -

      KAS Val#93 DRBG Val#1222 MAC Val#2661

      Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #102

      -

      Version 10.0.14393

      CTR_Mode:  ( Llength( Min20 Max64 ) MACSupported( [CMACAES128] [CMACAES192] [CMACAES256] [HMACSHA1] [HMACSHA256] [HMACSHA384] [HMACSHA512] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )

      -

      KAS Val#92 AES Val#4064 DRBG Val#1217 MAC Val#2651

      Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #101

      -

      Version 10.0.14393

      CTR_Mode:  ( Llength( Min20 Max64 ) MACSupported( [CMACAES128] [CMACAES192] [CMACAES256] [HMACSHA1] [HMACSHA256] [HMACSHA384] [HMACSHA512] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )

      -

      KAS Val#72 AES Val#3629 DRBG Val#955 MAC Val#2381

      Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” Cryptography Next Generation (CNG) Implementations #72

      -

      Version 10.0.10586

      CTR_Mode:  ( Llength( Min20 Max64 ) MACSupported( [CMACAES128] [CMACAES192] [CMACAES256] [HMACSHA1] [HMACSHA256] [HMACSHA384] [HMACSHA512] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )

      -

      KAS Val#64 AES Val#3497 RBG Val#868 MAC Val#2233

      Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 Cryptography Next Generation (CNG) Implementations #66

      -

      Version 10.0.10240

      CTR_Mode:  ( Llength( Min0 Max0 ) MACSupported( [HMACSHA1] [HMACSHA256] [HMACSHA512] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )

      -

      DRBG Val#489 MAC Val#1773

      Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 Cryptography Next Generation Cryptographic Implementations #30

      -

      Version 6.3.9600

      CTR_Mode: ( Llength( Min0 Max4 ) MACSupported( [HMACSHA1] [HMACSHA256] [HMACSHA512] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )

      -

      DRBG #258 HMAC Val#1345

      		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #3
      - - -Random Number Generator (RNG) - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Modes / States / Key SizesAlgorithm Implementation and Certificate #

      FIPS 186-2 General Purpose

      -

      [ (x-Original); (SHA-1) ]

      		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #1110
      FIPS 186-2
      -[ (x-Original); (SHA-1) ]

      Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #1060

      -

      Windows CE 6.0 and Windows CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #292

      -

      Windows CE and Windows Mobile 6.0 and Windows Mobile 6.5 Enhanced Cryptographic Provider (RSAENH) #286

      -

      Windows CE 5.00 and Window CE 5.01 Enhanced Cryptographic Provider (RSAENH) #66

      FIPS 186-2
      -[ (x-Change Notice); (SHA-1) ]

      -

      FIPS 186-2 General Purpose
      -[ (x-Change Notice); (SHA-1) ]

      Windows 7 and SP1 and Windows Server 2008 R2 and SP1 RNG Library #649

      -

      Windows Vista Ultimate SP1 and Windows Server 2008 RNG Implementation #435

      -

      Windows Vista RNG implementation #321

      FIPS 186-2 General Purpose
      -[ (x-Change Notice); (SHA-1) ]

      Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #470

      -

      Windows XP Professional SP3 Kernel Mode Cryptographic Module (fips.sys) #449

      -

      Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #447

      -

      Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #316

      -

      Windows Server 2003 SP2 Kernel Mode Cryptographic Module (fips.sys) #313

      FIPS 186-2
      -[ (x-Change Notice); (SHA-1) ]

      Windows XP Professional SP3 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #448

      -

      Windows Server 2003 SP2 Enhanced DSS and Diffie-Hellman Cryptographic Provider #314

      - - -#### RSA - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Modes / States / Key SizesAlgorithm Implementation and Certificate #

      RSA:

      -
        -
      • 186-4:
        • -
        • -
        • Signature Generation PKCS1.5:
          • -
          • -
          • Mod 2048 SHA: SHA-1, SHA-256, SHA-384
            • -
          • -
        • Signature Generation PSS:
          • -
          • -
          • Mod 2048:
            • -
            • -
            • SHA-1: Salt Length: 160 (bits)
              • -
            • SHA-256: Salt Length: 256 (bits)
              • -
            • SHA-384: Salt Length: 384 (bits)
              • -
            • -
          • -
        • Signature Verification PKCS1.5:
          • -
          • -
          • Mod 1024 SHA: SHA-1, SHA-256, SHA-384
            • -
          • Mod 2048 SHA: SHA-1, SHA-256, SHA-384
            • -
          • -
        • Signature Verification PSS:
          • -
          • -
          • Mod 2048:
            • -
            • -
            • SHA-1: Salt Length: 160 (bits)
              • -
            • SHA-256: Salt Length: 256 (bits)
              • -
            • SHA-384: Salt Length: 384 (bits)
              • -
            • -
          • Mod 3072:
            • -
            • -
            • SHA-1: Salt Length: 160 (bits)
              • -
            • SHA-256: Salt Length: 256 (bits)
              • -
            • SHA-384: Salt Length: 384 (bits)
              • -
            • -
          • -
        • -
      -

      Prerequisite: SHS #4011, DRBG #1734

      Microsoft Surface Hub Virtual TPM Implementations #2677

      -

      Version 10.0.15063.674

      RSA:

      -
        -
      • 186-4:
        • -
        • -
        • Signature Generation PKCS1.5:
          • -
          • -
          • Mod 2048 SHA: SHA-1, SHA-256, SHA-384
            • -
          • -
        • Signature Generation PSS:
          • -
          • -
          • Mod 2048:
            • -
            • -
            • SHA-1: Salt Length: 240 (bits)
              • -
            • SHA-256: Salt Length: 256 (bits)
              • -
            • SHA-384: Salt Length: 384 (bits)
              • -
            • -
          • -
        • Signature Verification PKCS1.5:
          • -
          • -
          • Mod 1024 SHA: SHA-1, SHA-256, SHA-384
            • -
          • Mod 2048 SHA: SHA-1, SHA-256, SHA-384
            • -
          • -
        • Signature Verification PSS:
          • -
          • -
          • Mod 1024:
            • -
            • -
            • SHA-1: Salt Length: 160 (bits)
              • -
            • SHA-256: Salt Length: 256 (bits)
              • -
            • SHA-384: Salt Length: 384 (bits)
              • -
            • -
          • Mod 2048:
            • -
            • -
            • SHA-1: Salt Length: 160 (bits)
              • -
            • SHA-256: Salt Length: 256 (bits)
              • -
            • SHA-384: Salt Length: 384 (bits)
              • -
            • -
          • -
        • -
      -

      Prerequisite: SHS #4009, DRBG #1733

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #2676

      -

      Version 10.0.16299

      RSA:

      -
        -
      • 186-4:
        • -
        • -
        • Key Generation:
          • -
        • Signature Verification PKCS1.5:
          • -
          • -
          • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • -
          • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • -
          • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • -
          • -
        • -
      -

      Prerequisite: SHS #4011, DRBG #1732

      Microsoft Surface Hub RSA32 Algorithm Implementations #2675

      -

      Version 10.0.15063.674

      RSA:

      -
        -
      • 186-4:
        • -
        • -
        • Signature Verification PKCS1.5:
          • -
          • -
          • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • -
          • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • -
          • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • -
          • -
        • -
      -

      Prerequisite: SHS #4009, DRBG #1730

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); RSA32 Algorithm Implementations #2674

      -

      Version 10.0.16299

      RSA:

      -
        -
      • 186-4:
        • -
        • -
        • Signature Verification PKCS1.5:
          • -
          • -
          • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • -
          • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • -
          • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • -
          • -
        • -
      -

      Prerequisite: SHS #4010, DRBG #1731

      Windows 10 Mobile (version 1709) RSA32 Algorithm Implementations #2673

      -

      Version 10.0.15254

      RSA:

      -
        -
      • 186-4:
        • -
        • -
        • Key Generation:
          • -
          • -
          • Public Key Exponent: Fixed (10001)
            • -
          • Provable Primes with Conditions:
            • -
            • -
            • Mod lengths: 2048, 3072 (bits)
              • -
            • Primality Tests: C.3
              • -
            • -
          • -
        • Signature Generation PKCS1.5:
          • -
          • -
          • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • -
          • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • -
          • -
        • Signature Generation PSS:
          • -
          • -
          • Mod 2048:
            • -
            • -
            • SHA-1: Salt Length: 160 (bits)
              • -
            • SHA-256: Salt Length: 256 (bits)
              • -
            • SHA-384: Salt Length: 384 (bits)
              • -
            • SHA-512: Salt Length: 512 (bits)
              • -
            • -
          • Mod 3072:
            • -
            • -
            • SHA-1: Salt Length: 160 (bits)
              • -
            • SHA-256: Salt Length: 256 (bits)
              • -
            • SHA-384: Salt Length: 384 (bits)
              • -
            • SHA-512: Salt Length: 512 (bits)
              • -
            • -
          • -
        • Signature Verification PKCS1.5:
          • -
          • -
          • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • -
          • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • -
          • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • -
          • -
        • Signature Verification PSS:
          • -
          • -
          • Mod 1024:
            • -
            • -
            • SHA-1: Salt Length: 160 (bits)
              • -
            • SHA-256: Salt Length: 256 (bits)
              • -
            • SHA-384: Salt Length: 384 (bits)
              • -
            • SHA-512: Salt Length: 496 (bits)
              • -
            • -
          • Mod 2048:
            • -
            • -
            • SHA-1: Salt Length: 160 (bits)
              • -
            • SHA-256: Salt Length: 256 (bits)
              • -
            • SHA-384: Salt Length: 384 (bits)
              • -
            • SHA-512: Salt Length: 512 (bits)
              • -
            • -
          • Mod 3072:
            • -
            • -
            • SHA-1: Salt Length: 160 (bits)
              • -
            • SHA-256: Salt Length: 256 (bits)
              • -
            • SHA-384: Salt Length: 384 (bits)
              • -
            • SHA-512: Salt Length: 512 (bits)
              • -
            • -
          • -
        • -
      -

      Prerequisite: SHS #4011, DRBG #1732

      Microsoft Surface Hub MsBignum Cryptographic Implementations #2672

      -

      Version 10.0.15063.674

      RSA:

      -
        -
      • 186-4:
        • -
        • -
        • Key Generation:
          • -
          • -
          • Probable Random Primes:
            • -
            • -
            • Mod lengths: 2048, 3072 (bits)
              • -
            • Primality Tests: C.2
              • -
            • -
          • -
        • Signature Generation PKCS1.5:
          • -
          • -
          • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • -
          • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • -
          • -
        • Signature Generation PSS:
          • -
          • -
          • Mod 2048:
            • -
            • -
            • SHA-1: Salt Length: 160 (bits)
              • -
            • SHA-256: Salt Length: 256 (bits)
              • -
            • SHA-384: Salt Length: 384 (bits)
              • -
            • SHA-512: Salt Length: 512 (bits)
              • -
            • -
          • Mod 3072:
            • -
            • -
            • SHA-1: Salt Length: 160 (bits)
              • -
            • SHA-256: Salt Length: 256 (bits)
              • -
            • SHA-384: Salt Length: 384 (bits)
              • -
            • SHA-512: Salt Length: 512 (bits)
              • -
            • -
          • -
        • Signature Verification PKCS1.5:
          • -
          • -
          • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • -
          • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • -
          • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • -
          • -
        • Signature Verification PSS:
          • -
          • -
          • Mod 1024:
            • -
            • -
            • SHA-1: Salt Length: 160 (bits)
              • -
            • SHA-256: Salt Length: 256 (bits)
              • -
            • SHA-384: Salt Length: 384 (bits)
              • -
            • SHA-512: Salt Length: 496 (bits)
              • -
            • -
          • Mod 2048:
            • -
            • -
            • SHA-1: Salt Length: 160 (bits)
              • -
            • SHA-256: Salt Length: 256 (bits)
              • -
            • SHA-384: Salt Length: 384 (bits)
              • -
            • SHA-512: Salt Length: 512 (bits)
              • -
            • -
          • Mod 3072:
            • -
            • -
            • SHA-1: Salt Length: 160 (bits)
              • -
            • SHA-256: Salt Length: 256 (bits)
              • -
            • SHA-384: Salt Length: 384 (bits)
              • -
            • SHA-512: Salt Length: 512 (bits)
              • -
            • -
          • -
        • -
      -

      Prerequisite: SHS #4011, DRBG #1732

      Microsoft Surface Hub SymCrypt Cryptographic Implementations #2671

      -

      Version 10.0.15063.674

      RSA:

      -
        -
      • 186-4:
        • -
        • -
        • Key Generation:
          • -
          • -
          • Probable Random Primes:
            • -
            • -
            • Mod lengths: 2048, 3072 (bits)
              • -
            • Primality Tests: C.2
              • -
            • -
          • -
        • Signature Generation PKCS1.5:
          • -
          • -
          • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • -
          • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • -
          • -
        • Signature Generation PSS:
          • -
          • -
          • Mod 2048:
            • -
            • -
            • SHA-1: Salt Length: 160 (bits)
              • -
            • SHA-256: Salt Length: 256 (bits)
              • -
            • SHA-384: Salt Length: 384 (bits)
              • -
            • SHA-512: Salt Length: 512 (bits)
              • -
            • -
          • Mod 3072:
            • -
            • -
            • SHA-1: Salt Length: 160 (bits)
              • -
            • SHA-256: Salt Length: 256 (bits)
              • -
            • SHA-384: Salt Length: 384 (bits)
              • -
            • SHA-512: Salt Length: 512 (bits)
              • -
            • -
          • -
        • Signature Verification PKCS1.5:
          • -
          • -
          • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • -
          • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • -
          • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • -
          • -
        • Signature Verification PSS:
          • -
          • -
          • Mod 1024:
            • -
            • -
            • SHA-1: Salt Length: 160 (bits)
              • -
            • SHA-256: Salt Length: 256 (bits)
              • -
            • SHA-384: Salt Length: 384 (bits)
              • -
            • SHA-512: Salt Length: 496 (bits)
              • -
            • -
          • Mod 2048:
            • -
            • -
            • SHA-1: Salt Length: 160 (bits)
              • -
            • SHA-256: Salt Length: 256 (bits)
              • -
            • SHA-384: Salt Length: 384 (bits)
              • -
            • SHA-512: Salt Length: 512 (bits)
              • -
            • -
          • Mod 3072:
            • -
            • -
            • SHA-1: Salt Length: 160 (bits)
              • -
            • SHA-256: Salt Length: 256 (bits)
              • -
            • SHA-384: Salt Length: 384 (bits)
              • -
            • SHA-512: Salt Length: 512 (bits)
              • -
            • -
          • -
        • -
      -

      Prerequisite: SHS #4010, DRBG #1731

      Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #2670

      -

      Version 10.0.15254

      RSA:

      -
        -
      • 186-4:
        • -
        • -
        • Key Generation:
          • -
          • -
          • Public Key Exponent: Fixed (10001)
            • -
          • Provable Primes with Conditions:
            • -
            • -
            • Mod lengths: 2048, 3072 (bits)
              • -
            • Primality Tests: C.3
              • -
            • -
          • -
        • Signature Generation PKCS1.5:
          • -
          • -
          • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • -
          • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • -
          • -
        • Signature Generation PSS:
          • -
          • -
          • Mod 2048:
            • -
            • -
            • SHA-1: Salt Length: 160 (bits)
              • -
            • SHA-256: Salt Length: 256 (bits)
              • -
            • SHA-384: Salt Length: 384 (bits)
              • -
            • SHA-512: Salt Length: 512 (bits)
              • -
            • -
          • Mod 3072:
            • -
            • -
            • SHA-1: Salt Length: 160 (bits)
              • -
            • SHA-256: Salt Length: 256 (bits)
              • -
            • SHA-384: Salt Length: 384 (bits)
              • -
            • SHA-512: Salt Length: 512 (bits)
              • -
            • -
          • -
        • Signature Verification PKCS1.5:
          • -
          • -
          • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • -
          • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • -
          • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • -
          • -
        • Signature Verification PSS:
          • -
          • -
          • Mod 1024:
            • -
            • -
            • SHA-1: Salt Length: 160 (bits)
              • -
            • SHA-256: Salt Length: 256 (bits)
              • -
            • SHA-384: Salt Length: 384 (bits)
              • -
            • SHA-512: Salt Length: 496 (bits)
              • -
            • -
          • Mod 2048:
            • -
            • -
            • SHA-1: Salt Length: 160 (bits)
              • -
            • SHA-256: Salt Length: 256 (bits)
              • -
            • SHA-384: Salt Length: 384 (bits)
              • -
            • SHA-512: Salt Length: 512 (bits)
              • -
            • -
          • Mod 3072:
            • -
            • -
            • SHA-1: Salt Length: 160 (bits)
              • -
            • SHA-256: Salt Length: 256 (bits)
              • -
            • SHA-384: Salt Length: 384 (bits)
              • -
            • SHA-512: Salt Length: 512 (bits)
              • -
            • -
          • -
        • -
      -

      Prerequisite: SHS #4010, DRBG #1731

      Windows 10 Mobile (version 1709) MsBignum Cryptographic Implementations #2669

      -

      Version 10.0.15254

        -
      • 186-4:
        • -
        • -
        • Key Generation:
          • -
          • -
          • Public Key Exponent: Fixed (10001)
            • -
          • Provable Primes with Conditions:
            • -
            • -
            • Mod lengths: 2048, 3072 (bits)
              • -
            • Primality Tests: C.3
              • -
            • -
          • -
        • Signature Generation PKCS1.5:
          • -
          • -
          • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • -
          • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • -
          • -
        • Signature Generation PSS:
          • -
          • -
          • Mod 2048:
            • -
            • -
            • SHA-1: Salt Length: 160 (bits)
              • -
            • SHA-256: Salt Length: 256 (bits)
              • -
            • SHA-384: Salt Length: 384 (bits)
              • -
            • SHA-512: Salt Length: 512 (bits)
              • -
            • -
          • Mod 3072:
            • -
            • -
            • SHA-1: Salt Length: 160 (bits)
              • -
            • SHA-256: Salt Length: 256 (bits)
              • -
            • SHA-384: Salt Length: 384 (bits)
              • -
            • SHA-512: Salt Length: 512 (bits)
              • -
            • -
          • -
        • Signature Verification PKCS1.5:
          • -
          • -
          • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • -
          • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • -
          • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • -
          • -
        • Signature Verification PSS:
          • -
          • -
          • Mod 1024:
            • -
            • -
            • SHA-1: Salt Length: 160 (bits)
              • -
            • SHA-256: Salt Length: 256 (bits)
              • -
            • SHA-384: Salt Length: 384 (bits)
              • -
            • SHA-512: Salt Length: 496 (bits)
              • -
            • -
          • Mod 2048:
            • -
            • -
            • SHA-1: Salt Length: 160 (bits)
              • -
            • SHA-256: Salt Length: 256 (bits)
              • -
            • SHA-384: Salt Length: 384 (bits)
              • -
            • SHA-512: Salt Length: 512 (bits)
              • -
            • -
          • Mod 3072:
            • -
            • -
            • SHA-1: Salt Length: 160 (bits)
              • -
            • SHA-256: Salt Length: 256 (bits)
              • -
            • SHA-384: Salt Length: 384 (bits)
              • -
            • SHA-512: Salt Length: 512 (bits)
              • -
            • -
          • -
        • -
      -

      Prerequisite: SHS #4009, DRBG #1730

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); MsBignum Cryptographic Implementations #2668

      -

      Version 10.0.16299

        -
      • 186-4:
        • -
        • -
        • Key Generation:
          • -
          • -
          • Probable Random Primes:
            • -
            • -
            • Mod lengths: 2048, 3072 (bits)
              • -
            • Primality Tests: C.2
              • -
            • -
          • -
        • Signature Generation PKCS1.5:
          • -
          • -
          • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • -
          • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • -
          • -
        • Signature Generation PSS:
          • -
          • -
          • Mod 2048:
            • -
            • -
            • SHA-1: Salt Length: 160 (bits)
              • -
            • SHA-256: Salt Length: 256 (bits)
              • -
            • SHA-384: Salt Length: 384 (bits)
              • -
            • SHA-512: Salt Length: 512 (bits)
              • -
            • -
          • Mod 3072:
            • -
            • -
            • SHA-1: Salt Length: 160 (bits)
              • -
            • SHA-256: Salt Length: 256 (bits)
              • -
            • SHA-384: Salt Length: 384 (bits)
              • -
            • SHA-512: Salt Length: 512 (bits)
              • -
            • -
          • -
        • Signature Verification PKCS1.5:
          • -
          • -
          • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • -
          • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • -
          • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • -
          • -
        • Signature Verification PSS:
          • -
          • -
          • Mod 1024:
            • -
            • -
            • SHA-1: Salt Length: 160 (bits)
              • -
            • SHA-256: Salt Length: 256 (bits)
              • -
            • SHA-384: Salt Length: 384 (bits)
              • -
            • SHA-512: Salt Length: 496 (bits)
              • -
            • -
          • Mod 2048:
            • -
            • -
            • SHA-1: Salt Length: 160 (bits)
              • -
            • SHA-256: Salt Length: 256 (bits)
              • -
            • SHA-384: Salt Length: 384 (bits)
              • -
            • SHA-512: Salt Length: 512 (bits)
              • -
            • -
          • Mod 3072:
            • -
            • -
            • SHA-1: Salt Length: 160 (bits)
              • -
            • SHA-256: Salt Length: 256 (bits)
              • -
            • SHA-384: Salt Length: 384 (bits)
              • -
            • SHA-512: Salt Length: 512 (bits)
              • -
            • -
          • -
        • -
      -

      Prerequisite: SHS #4009, DRBG #1730

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #2667

      -

      Version 10.0.16299

      FIPS186-4:
      -ALG[RSASSA-PKCS1_V1_5]       SIG(gen) (2048 SHA( 1 , 256 , 384 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
      -       SIG(Ver) (1024 SHA( 1 , 256 , 384 )) (2048 SHA( 1 , 256 , 384 ))
      -[RSASSA-PSS]: Sig(Gen): (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) )) SIG(gen) with SHA-1 affirmed for use with protocols only.
      -       Sig(Ver): (1024 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) )) (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) ))
      -SHA Val#3790

      Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #2524

      -

      Version 10.0.15063

      FIPS186-4:
      -ALG[RSASSA-PKCS1_V1_5]       SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
      -SHA Val#3790

      Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile RSA32 Algorithm Implementations #2523

      -

      Version 10.0.15063

      FIPS186-4:
      -186-4KEY(gen):       FIPS186-4_Fixed_e ( 10001 ) ;
      -PGM(ProbPrimeCondition): 2048 , 3072 PPTT:( C.3 )
      -ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
      -       SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
      -[RSASSA-PSS]: Sig(Gen): (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) SIG(gen) with SHA-1 affirmed for use with protocols only.
      -       Sig(Ver): (1024 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 62 ) )) (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))
      -SHA Val#3790
      -DRBG: Val# 1555

      Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile MsBignum Cryptographic Implementations #2522

      -

      Version 10.0.15063

      FIPS186-4:
      -186-4KEY(gen):
      -PGM(ProbRandom:       ( 2048 , 3072 ) PPTT:( C.2 )
      -ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
      -       SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
      -[RSASSA-PSS]: Sig(Gen): (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) SIG(gen) with SHA-1 affirmed for use with protocols only.
      -       Sig(Ver): (1024 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 62 ) )) (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))
      -SHA Val#3790

      Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #2521

      -

      Version 10.0.15063

      FIPS186-2:
      -ALG[ANSIX9.31]:
      -SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#3652
      -ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 4096 , SHS: SHA-256Val#3652, SHA-384Val#3652, SHA-512Val#3652
      -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#3652, SHA-256Val#3652, SHA-384Val#3652, SHA-512Val#3652

      -

      FIPS186-4:
      -ALG[ANSIX9.31]       Sig(Gen): (2048 SHA( 1 )) (3072 SHA( 1 ))
      -SIG(gen) with SHA-1 affirmed for use with protocols only.       Sig(Ver): (1024 SHA( 1 )) (2048 SHA( 1 )) (3072 SHA( 1 ))
      -ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
      -       SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
      -SHA Val#3652

      Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2415

      -

      Version 7.00.2872

      FIPS186-2:
      -ALG[ANSIX9.31]:
      -SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#3651
      -ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 4096 , SHS: SHA-256Val#3651, SHA-384Val#3651, SHA-512Val#3651
      -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#3651, SHA-256Val#3651, SHA-384Val#3651, SHA-512Val#3651

      -

      FIPS186-4:
      -ALG[ANSIX9.31]       Sig(Gen): (2048 SHA( 1 )) (3072 SHA( 1 ))
      -SIG(gen) with SHA-1 affirmed for use with protocols only.       Sig(Ver): (1024 SHA( 1 )) (2048 SHA( 1 )) (3072 SHA( 1 ))
      -ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
      -       SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
      -SHA Val#3651

      Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2414

      -

      Version 8.00.6246

      FIPS186-2:
      -ALG[RSASSA-PKCS1_V1_5]:       SIG(gen) 4096 , SHS: SHA-256Val# 3649 , SHA-384Val# 3649 , SHA-512Val# 3649
      -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val# 3649 , SHA-256Val# 3649 , SHA-384Val# 3649 , SHA-512Val# 3649

      -

      FIPS186-4:
      -186-4KEY(gen):       FIPS186-4_Fixed_e (10001) ;
      -PGM(ProbRandom: ( 2048 , 3072 ) PPTT:( C.2 )
      -ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
      -       SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
      -SHA Val# 3649
      -DRBG: Val# 1430

      Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2412

      -

      Version 7.00.2872

      FIPS186-2:
      -ALG[RSASSA-PKCS1_V1_5]:       SIG(gen) 4096 , SHS: SHA-256Val#3648, SHA-384Val#3648, SHA-512Val#3648
      -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#3648, SHA-256Val#3648, SHA-384Val#3648, SHA-512Val#3648

      -

      FIPS186-4:
      -186-4KEY(gen):       FIPS186-4_Fixed_e (10001) ;
      -PGM(ProbRandom: ( 2048 , 3072 ) PPTT:( C.2 )
      -ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
      -       SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
      -SHA Val#3648
      -DRBG: Val# 1429

      Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2411

      -

      Version 8.00.6246

      FIPS186-4:
      -ALG[RSASSA-PKCS1_V1_5]       SIG(gen) (2048 SHA( 1 , 256 , 384 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
      -SIG(Ver) (1024 SHA( 1 , 256 , 384 )) (2048 SHA( 1 , 256 , 384 ))
      -[RSASSA-PSS]: Sig(Gen): (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) )) SIG(gen) with SHA-1 affirmed for use with protocols only.
      -Sig(Ver): (1024 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) )) (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) ))

      -

      SHA Val# 3347

      Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #2206

      -

      Version 10.0.14393

      FIPS186-4:
      -186-4KEY(gen):       FIPS186-4_Fixed_e ( 10001 ) ;
      -PGM(ProbPrimeCondition): 2048 , 3072 PPTT:( C.3 )

      -

      SHA Val# 3347 DRBG: Val# 1217

      Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update RSA Key Generation Implementation #2195

      -

      Version 10.0.14393

      FIPS186-4:
      -ALG[RSASSA-PKCS1_V1_5]       SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))

      -

      SHA Val#3346

      soft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update RSA32 Algorithm Implementations #2194

      -

      Version 10.0.14393

      FIPS186-4:
      -ALG[RSASSA-PKCS1_V1_5]       SIG(gen) (2048 SHA( 256 , 384 , 512 )) (3072 SHA( 256 , 384 , 512 ))
      -SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))

      -

      SHA Val# 3347 DRBG: Val# 1217

      Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update MsBignum Cryptographic Implementations #2193

      -

      Version 10.0.14393

      FIPS186-4:
      -[RSASSA-PSS]: Sig(Gen):       (2048 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))

      -

      Sig(Ver): (1024 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 62 ) )) (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))

      -

      SHA Val# 3347 DRBG: Val# 1217

      Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #2192

      -

      Version 10.0.14393

      FIPS186-4:
      -186-4KEY(gen)      :  FIPS186-4_Fixed_e ( 10001 ) ;
      -PGM(ProbPrimeCondition): 2048 , 3072 PPTT:( C.3 )

      -

      SHA Val# 3047 DRBG: Val# 955

      Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” RSA Key Generation Implementation #1889

      -

      Version 10.0.10586

      FIPS186-4:
      -ALG[RSASSA-PKCS1_V1_5]       SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))

      -

      SHA Val#3048

      Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub RSA32 Algorithm Implementations #1871

      -

      Version 10.0.10586

      FIPS186-4:
      -ALG[RSASSA-PKCS1_V1_5]       SIG(gen) (2048 SHA( 256 , 384 , 512 )) (3072 SHA( 256 , 384 , 512 ))
      -SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))

      -

      SHA Val# 3047

      Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub MsBignum Cryptographic Implementations #1888

      -

      Version 10.0.10586

      FIPS186-4:
      -[RSASSA-PSS]: Sig(Gen)      : (2048 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))
      -Sig(Ver): (1024 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 62 ) )) (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))

      -

      SHA Val# 3047

      Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub Cryptography Next Generation (CNG) Implementations #1887

      -

      Version 10.0.10586

      FIPS186-4:
      -186-4KEY(gen):       FIPS186-4_Fixed_e ( 10001 ) ;
      -PGM(ProbPrimeCondition): 2048 , 3072 PPTT:( C.3 )

      -

      SHA Val# 2886 DRBG: Val# 868

      Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 RSA Key Generation Implementation #1798

      -

      Version 10.0.10240

      FIPS186-4:
      -ALG[RSASSA-PKCS1_V1_5]       SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))

      -

      SHA Val#2871

      Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 RSA32 Algorithm Implementations #1784

      -

      Version 10.0.10240

      FIPS186-4:
      -ALG[RSASSA-PKCS1_V1_5]       SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))

      -

      SHA Val#2871

      Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 MsBignum Cryptographic Implementations #1783

      -

      Version 10.0.10240

      FIPS186-4:
      -[RSASSA-PSS]:       Sig(Gen): (2048 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))
      -Sig(Ver): (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))

      -

      SHA Val# 2886

      Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 Cryptography Next Generation (CNG) Implementations #1802

      -

      Version 10.0.10240

      FIPS186-4:
      -186-4KEY(gen):       FIPS186-4_Fixed_e ;
      -PGM(ProbPrimeCondition): 2048 , 3072 PPTT:( C.3 )

      -

      SHA Val#2373 DRBG: Val# 489

      Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 RSA Key Generation Implementation #1487

      -

      Version 6.3.9600

      FIPS186-4:
      -ALG[RSASSA-PKCS1_V1_5]       SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))

      -

      SHA Val#2373

      Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry RSA32 Algorithm Implementations #1494

      -

      Version 6.3.9600

      FIPS186-4:
      -ALG[RSASSA-PKCS1_V1_5      ] SIG(gen) (2048 SHA( 256 , 384 , 512 )) (3072 SHA( 256 , 384 , 512 ))
      -SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))

      -

      SHA Val#2373

      Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #1493

      -

      Version 6.3.9600

      FIPS186-4:
      -[RSASSA-PSS]:       Sig(Gen): (2048 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))
      - Sig(Ver): (1024 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 62 ) )) (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))

      -

      SHA Val#2373

      Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 Cryptography Next Generation Cryptographic Implementations #1519

      -

      Version 6.3.9600

      FIPS186-4:
      -ALG[RSASSA-PKCS1_V1_5]       SIG(gen) (2048 SHA( 256 , 384 , 512-256 )) (3072 SHA( 256 , 384 , 512-256 ))
      -SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512-256 )) (2048 SHA( 1 , 256 , 384 , 512-256 )) (3072 SHA( 1 , 256 , 384 , 512-256 ))
      -[RSASSA-PSS]: Sig(Gen): (2048 SHA( 256 , 384 , 512 )) (3072 SHA( 256 , 384 , 512 ))
      -Sig(Ver): (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 , 512 ))
      -SHA #1903

      -

      Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#1134.

      		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #1134
      FIPS186-4:
      -186-4KEY(gen):       FIPS186-4_Fixed_e , FIPS186-4_Fixed_e_Value
      -PGM(ProbPrimeCondition): 2048 , 3072 PPTT:( C.3 )
      -SHA #1903 DRBG: #258      		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 RSA Key Generation Implementation #1133
      FIPS186-2:
      -ALG[ANSIX9.31]:       Key(gen)(MOD: 2048 , 3072 , 4096 PubKey Values: 65537 DRBG: #258
      -ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256#1902, SHA-384#1902, SHA-512#1902,
      -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1#1902, SHA-256#1902, SHA-#1902, SHA-512#1902,
      -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#1132.      		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Enhanced Cryptographic Provider (RSAENH) #1132
      FIPS186-2:
      -ALG[ANSIX9.31]:
      -SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#1774
      -ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#1774, SHA-384Val#1774, SHA-512Val#1774,
      -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#1774, SHA-256Val#1774, SHA-384Val#1774, SHA-512Val#1774,
      -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#1052.      		Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #1052
      FIPS186-2:
      -ALG[ANSIX9.31]:       Key(gen)(MOD: 2048 , 3072 , 4096 PubKey Values: 65537 DRBG: Val# 193
      -ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#1773, SHA-384Val#1773, SHA-512Val#1773,
      -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#1773, SHA-256Val#1773, SHA-384Val#1773, SHA-512Val#1773,
      -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#1051.      		Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1051
      FIPS186-2:
      -ALG[RSASSA-PKCS1_V1_5]:       SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081,
      -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#1081, SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081,
      -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#568.      		Windows Server 2008 R2 and SP1 Enhanced Cryptographic Provider (RSAENH) #568
      FIPS186-2:
      -ALG[RSASSA-PKCS1_V1_5]:       SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081,
      -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#1081, SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081,
      -ALG[RSASSA-PSS]: SIG(gen); 2048 , 3072 , 4096 , SHS: SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081
      -SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#1081, SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081
      -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#567. See Historical RSA List Val#560.

      Windows Server 2008 R2 and SP1 CNG algorithms #567

      -

      Windows 7 and SP1 CNG algorithms #560

      FIPS186-2:
      -ALG[ANSIX9.31]:       Key(gen)(MOD: 2048 , 3072 , 4096 PubKey Values: 65537 DRBG: Val# 23
      -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#559.      		Windows 7 and SP1 and Server 2008 R2 and SP1 RSA Key Generation Implementation #559
      FIPS186-2:
      -ALG[RSASSA-PKCS1_V1_5]:       SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081,
      -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#1081, SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081,
      -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#557.      		Windows 7 and SP1 Enhanced Cryptographic Provider (RSAENH) #557
      FIPS186-2:
      -ALG[ANSIX9.31]:
      -ALG[RSASSA-PKCS1_V1_5]:       SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#816, SHA-384Val#816, SHA-512Val#816,
      -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#816, SHA-256Val#816, SHA-384Val#816, SHA-512Val#816,
      -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#395.      		Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #395
      FIPS186-2:
      -ALG[ANSIX9.31]:
      -SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#783
      -ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#783, SHA-384Val#783, SHA-512Val#783,
      -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#371.      		Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #371
      FIPS186-2:
      -ALG[RSASSA-PKCS1_V1_5]:       SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#753, SHA-384Val#753, SHA-512Val#753,
      -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#753, SHA-256Val#753, SHA-384Val#753, SHA-512Val#753,
      -ALG[RSASSA-PSS]: SIG(gen); 2048 , 3072 , 4096 , SHS: SHA-256Val#753, SHA-384Val#753, SHA-512Val#753
      -SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#753, SHA-256Val#753, SHA-384Val#753, SHA-512Val#753
      -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#358. See Historical RSA List Val#357.

      Windows Server 2008 CNG algorithms #358

      -

      Windows Vista SP1 CNG algorithms #357

      FIPS186-2:
      -ALG[ANSIX9.31]:
      -SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#753
      -ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#753, SHA-384Val#753, SHA-512Val#753,
      -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#753, SHA-256Val#753, SHA-384Val#753, SHA-512Val#753,
      -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#355. See Historical RSA List Val#354.

      Windows Server 2008 Enhanced Cryptographic Provider (RSAENH) #355

      -

      Windows Vista SP1 Enhanced Cryptographic Provider (RSAENH) #354

      FIPS186-2:
      -ALG[ANSIX9.31]:       Key(gen)(MOD: 2048 , 3072 , 4096 PubKey Values: 65537
      -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#353.      		Windows Vista SP1 and Windows Server 2008 RSA Key Generation Implementation #353
      FIPS186-2:
      -ALG[ANSIX9.31]:       Key(gen)(MOD: 2048 , 3072 , 4096 PubKey Values: 65537 RNG: Val# 321
      -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#258.      		Windows Vista RSA key generation implementation #258
      FIPS186-2:
      -ALG[RSASSA-PKCS1_V1_5]:       SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#618, SHA-384Val#618, SHA-512Val#618,
      -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#618, SHA-256Val#618, SHA-384Val#618, SHA-512Val#618,
      -ALG[RSASSA-PSS]: SIG(gen); 2048 , 3072 , 4096 , SHS: SHA-256Val#618, SHA-384Val#618, SHA-512Val#618
      -SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#618, SHA-256Val#618, SHA-384Val#618, SHA-512Val#618
      -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#257.      		Windows Vista CNG algorithms #257
      FIPS186-2:
      -ALG[RSASSA-PKCS1_V1_5]:       SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#618, SHA-384Val#618, SHA-512Val#618,
      -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#618, SHA-256Val#618, SHA-384Val#618, SHA-512Val#618,
      -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#255.      		Windows Vista Enhanced Cryptographic Provider (RSAENH) #255
      FIPS186-2:
      -ALG[ANSIX9.31]:
      -SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#613
      -ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#613, SHA-384Val#613, SHA-512Val#613,
      -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#613, SHA-256Val#613, SHA-384Val#613, SHA-512Val#613,
      -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#245.      		Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #245
      FIPS186-2:
      -ALG[ANSIX9.31]:
      -SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#589
      -ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#589, SHA-384Val#589, SHA-512Val#589,
      -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#589, SHA-256Val#589, SHA-384Val#589, SHA-512Val#589,
      -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#230.      		Windows CE 6.0 and Windows CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #230
      FIPS186-2:
      -ALG[ANSIX9.31]:
      -SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#578
      -ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#578, SHA-384Val#578, SHA-512Val#578,
      -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#578, SHA-256Val#578, SHA-384Val#578, SHA-512Val#578,
      -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#222.      		Windows CE and Windows Mobile 6 and Windows Mobile 6.1 Enhanced Cryptographic Provider (RSAENH) #222
      FIPS186-2:
      -ALG[RSASSA-PKCS1_V1_5]:
      -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#364
      -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#81.      		Windows Server 2003 SP1 Enhanced Cryptographic Provider (RSAENH) #81
      FIPS186-2:
      -ALG[ANSIX9.31]:
      -SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#305
      -ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#305, SHA-384Val#305, SHA-512Val#305,
      -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#305, SHA-256Val#305, SHA-384Val#305, SHA-512Val#305,
      -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#52.      		Windows CE 5.00 and Windows CE 5.01 Enhanced Cryptographic Provider (RSAENH) #52

      FIPS186-2:

      -

      – PKCS#1 v1.5, signature generation and verification

      -

      – Mod sizes: 1024, 1536, 2048, 3072, 4096

      -

      – SHS: SHA–1/256/384/512

      Windows XP, vendor-affirmed

      -

      Windows 2000, vendor-affirmed

      - - -#### Secure Hash Standard (SHS) - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Modes / States / Key SizesAlgorithm Implementation and Certificate #
        -
      • SHA-1:
        • -
        • -
        • Supports Empty Message
          • -
        • -
      • SHA-256:
        • -
        • -
        • Supports Empty Message
          • -
        • -
      • SHA-384:
        • -
        • -
        • Supports Empty Message
          • -
        • -
      • SHA-512:
        • -
        • -
        • Supports Empty Message
          • -
        • -

      Microsoft Surface Hub SymCrypt Cryptographic Implementations #4011

      -

      Version 10.0.15063.674

        -
      • SHA-1:
        • -
        • -
        • Supports Empty Message
          • -
        • -
      • SHA-256:
        • -
        • -
        • Supports Empty Message
          • -
        • -
      • SHA-384:
        • -
        • -
        • Supports Empty Message
          • -
        • -
      • SHA-512:
        • -
        • -
        • Supports Empty Message
          • -
        • -

      Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #4010

      -

      Version 10.0.15254

        -
      • SHA-1:
        • -
        • -
        • Supports Empty Message
          • -
        • -
      • SHA-256:
        • -
        • -
        • Supports Empty Message
          • -
        • -
      • SHA-384:
        • -
        • -
        • Supports Empty Message
          • -
        • -
      • SHA-512:
        • -
        • -
        • Supports Empty Message
          • -
        • -

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #4009

      -

      Version 10.0.16299

      SHA-1      (BYTE-only)
      -SHA-256  (BYTE-only)
      -SHA-384  (BYTE-only)
      -SHA-512  (BYTE-only)

      Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #3790

      -

      Version 10.0.15063

      SHA-1      (BYTE-only)
      -SHA-256  (BYTE-only)
      -SHA-384  (BYTE-only)
      -SHA-512  (BYTE-only)

      Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #3652

      -

      Version 7.00.2872

      SHA-1      (BYTE-only)
      -SHA-256  (BYTE-only)
      -SHA-384  (BYTE-only)
      -SHA-512  (BYTE-only)

      Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #3651

      -

      Version 8.00.6246

      SHA-1      (BYTE-only)
      -SHA-256  (BYTE-only)
      -SHA-384  (BYTE-only)
      -SHA-512  (BYTE-only)

      Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #3649

      -

      Version 7.00.2872

      SHA-1      (BYTE-only)
      -SHA-256  (BYTE-only)
      -SHA-384  (BYTE-only)
      -SHA-512  (BYTE-only)

      Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #3648

      -

      Version 8.00.6246

      SHA-1 (BYTE-only)
      -SHA-256 (BYTE-only)
      -SHA-384 (BYTE-only)
      -SHA-512 (BYTE-only)      		Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update SymCrypt Cryptographic Implementations #3347
      -Version 10.0.14393
      SHA-1 (BYTE-only)
      -SHA-256 (BYTE-only)
      -SHA-384 (BYTE-only)
      -SHA-512 (BYTE-only)      		Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update RSA32 Algorithm Implementations #3346
      -Version 10.0.14393
      SHA-1 (BYTE-only)
      -SHA-256 (BYTE-only)
      -SHA-384 (BYTE-only)
      -SHA-512 (BYTE-only)      		Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub RSA32 Algorithm Implementations #3048
      -Version 10.0.10586
      SHA-1 (BYTE-only)
      -SHA-256 (BYTE-only)
      -SHA-384 (BYTE-only)
      -SHA-512 (BYTE-only)      		Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub SymCrypt Cryptographic Implementations #3047
      -Version 10.0.10586
      SHA-1 (BYTE-only)
      -SHA-256 (BYTE-only)
      -SHA-384 (BYTE-only)
      -SHA-512 (BYTE-only)      		Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 SymCrypt Cryptographic Implementations #2886
      -Version 10.0.10240
      SHA-1 (BYTE-only)
      -SHA-256 (BYTE-only)
      -SHA-384 (BYTE-only)
      -SHA-512 (BYTE-only)      		Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 RSA32 Algorithm Implementations #2871
      -Version 10.0.10240
      SHA-1 (BYTE-only)
      -SHA-256 (BYTE-only)
      -SHA-384 (BYTE-only)
      -SHA-512 (BYTE-only)      		Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry RSA32 Algorithm Implementations #2396
      -Version 6.3.9600
      SHA-1 (BYTE-only)
      -SHA-256 (BYTE-only)
      -SHA-384 (BYTE-only)
      -SHA-512 (BYTE-only)      		Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 SymCrypt Cryptographic Implementations #2373
      -Version 6.3.9600

      SHA-1 (BYTE-only)

      -

      SHA-256 (BYTE-only)

      -

      SHA-384 (BYTE-only)

      -

      SHA-512 (BYTE-only)

      -

      Implementation does not support zero-length (null) messages.

      Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Next Generation Symmetric Cryptographic Algorithms Implementations (SYMCRYPT) #1903

      -

      Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Symmetric Algorithm Implementations (RSA32) #1902

      SHA-1 (BYTE-only)
      -SHA-256 (BYTE-only)
      -SHA-384 (BYTE-only)
      -SHA-512 (BYTE-only)

      Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #1774

      -

      Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #1773

      SHA-1 (BYTE-only)
      -SHA-256 (BYTE-only)
      -SHA-384 (BYTE-only)
      -SHA-512 (BYTE-only)

      Windows 7 and SP1 and Windows Server 2008 R2 and SP1 Symmetric Algorithm Implementation #1081

      -

      Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #816

      SHA-1 (BYTE-only)

      Windows XP Professional SP3 Kernel Mode Cryptographic Module (fips.sys) #785

      -

      Windows XP Professional SP3 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #784

      SHA-1 (BYTE-only)
      -SHA-256 (BYTE-only)
      -SHA-384 (BYTE-only)
      -SHA-512 (BYTE-only)      		Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #783
      SHA-1 (BYTE-only)
      -SHA-256 (BYTE-only)
      -SHA-384 (BYTE-only)
      -SHA-512 (BYTE-only)

      Windows Vista SP1 and Windows Server 2008 Symmetric Algorithm Implementation #753

      -

      Windows Vista Symmetric Algorithm Implementation #618

      SHA-1 (BYTE-only)
      -SHA-256 (BYTE-only)

      Windows Vista BitLocker Drive Encryption #737

      -

      Windows Vista Beta 2 BitLocker Drive Encryption #495

      SHA-1 (BYTE-only)
      -SHA-256 (BYTE-only)
      -SHA-384 (BYTE-only)
      -SHA-512 (BYTE-only)

      Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #613

      -

      Windows Server 2003 SP1 Enhanced Cryptographic Provider (RSAENH) #364

      SHA-1 (BYTE-only)

      Windows Server 2003 SP2 Enhanced DSS and Diffie-Hellman Cryptographic Provider #611

      -

      Windows Server 2003 SP2 Kernel Mode Cryptographic Module (fips.sys) #610

      -

      Windows Server 2003 SP1 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #385

      -

      Windows Server 2003 SP1 Kernel Mode Cryptographic Module (fips.sys) #371

      -

      Windows Server 2003 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #181

      -

      Windows Server 2003 Kernel Mode Cryptographic Module (fips.sys) #177

      -

      Windows Server 2003 Enhanced Cryptographic Provider (RSAENH) #176

      SHA-1 (BYTE-only)
      -SHA-256 (BYTE-only)
      -SHA-384 (BYTE-only)
      -SHA-512 (BYTE-only)

      Windows CE 6.0 and Windows CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #589

      -

      Windows CE and Windows Mobile 6 and Windows Mobile 6.5 Enhanced Cryptographic Provider (RSAENH) #578

      -

      Windows CE 5.00 and Windows CE 5.01 Enhanced Cryptographic Provider (RSAENH) #305

      SHA-1 (BYTE-only)

      Windows XP Microsoft Enhanced Cryptographic Provider #83

      -

      Crypto Driver for Windows 2000 (fips.sys) #35

      -

      Windows 2000 Microsoft Outlook Cryptographic Provider (EXCHCSP.DLL) SR-1A (3821) #32

      -

      Windows 2000 RSAENH.DLL #24

      -

      Windows 2000 RSABASE.DLL #23

      -

      Windows NT 4 SP6 RSAENH.DLL #21

      -

      Windows NT 4 SP6 RSABASE.DLL #20

      - - -#### Triple DES - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Modes / States / Key SizesAlgorithm Implementation and Certificate #
        -
      • TDES-CBC:
        • -
        • -
        • Modes: Decrypt, Encrypt
          • -
        • Keying Option: 1
          • -
        • -
      • TDES-CFB64:
        • -
        • -
        • Modes: Decrypt, Encrypt
          • -
        • Keying Option: 1
          • -
        • -
      • TDES-CFB8:
        • -
        • -
        • Modes: Decrypt, Encrypt
          • -
        • Keying Option: 1
          • -
        • -
      • TDES-ECB:
        • -
        • -
        • Modes: Decrypt, Encrypt
          • -
        • Keying Option: 1
          • -
        • -

      Microsoft Surface Hub SymCrypt Cryptographic Implementations #2558

      -

      Version 10.0.15063.674

        -
      • TDES-CBC:
        • -
        • -
        • Modes: Decrypt, Encrypt
          • -
        • Keying Option: 1
          • -
        • -
      • TDES-CFB64:
        • -
        • -
        • Modes: Decrypt, Encrypt
          • -
        • Keying Option: 1
          • -
        • -
      • TDES-CFB8:
        • -
        • -
        • Modes: Decrypt, Encrypt
          • -
        • Keying Option: 1
          • -
        • -
      • TDES-ECB:
        • -
        • -
        • Modes: Decrypt, Encrypt
          • -
        • Keying Option: 1
          • -
        • -

      Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #2557

      -

      Version 10.0.15254

        -
      • TDES-CBC:
        • -
        • -
        • Modes: Decrypt, Encrypt
          • -
        • Keying Option: 1
          • -
        • -
      • TDES-CFB64:
        • -
        • -
        • Modes: Decrypt, Encrypt
          • -
        • Keying Option: 1
          • -
        • -
      • TDES-CFB8:
        • -
        • -
        • Modes: Decrypt, Encrypt
          • -
        • Keying Option: 1
          • -
        • -
      • TDES-ECB:
        • -
        • -
        • Modes: Decrypt, Encrypt
          • -
        • Keying Option: 1
          • -
        • -

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #2556

      -

      Version 10.0.16299

      TECB( KO 1 e/d, ) ; TCBC( KO 1 e/d, ) ; TCFB8( KO 1 e/d, ) ; TCFB64( KO 1 e/d, )

      Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #2459

      -

      Version 10.0.15063

      TECB( KO 1 e/d, ) ;

      -

      TCBC( KO 1 e/d, )

      Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2384

      -

      Version 8.00.6246

      TECB( KO 1 e/d, ) ;

      -

      TCBC( KO 1 e/d, )

      Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2383

      -

      Version 8.00.6246

      TECB( KO 1 e/d, ) ;

      -

      TCBC( KO 1 e/d, ) ;

      -

      CTR ( int only )

      Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2382

      -

      Version 7.00.2872

      TECB( KO 1 e/d, ) ;

      -

      TCBC( KO 1 e/d, )

      Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2381

      -

      Version 8.00.6246

      TECB( KO 1 e/d, ) ;

      -

      TCBC( KO 1 e/d, ) ;

      -

      TCFB8( KO 1 e/d, ) ;

      -

      TCFB64( KO 1 e/d, )

      Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update SymCrypt Cryptographic Implementations #2227
      -
      -

      -

      Version 10.0.14393

      TECB( KO 1 e/d, ) ;

      -

      TCBC( KO 1 e/d, ) ;

      -

      TCFB8( KO 1 e/d, ) ;

      -

      TCFB64( KO 1 e/d, )

      Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub SymCrypt Cryptographic Implementations #2024
      -
      -

      -

      Version 10.0.10586

      TECB( KO 1 e/d, ) ;

      -

      TCBC( KO 1 e/d, ) ;

      -

      TCFB8( KO 1 e/d, ) ;

      -

      TCFB64( KO 1 e/d, )

      Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 SymCrypt Cryptographic Implementations #1969
      -
      -

      -

      Version 10.0.10240

      TECB( KO 1 e/d, ) ;

      -

      TCBC( KO 1 e/d, ) ;

      -

      TCFB8( KO 1 e/d, ) ;

      -

      TCFB64( KO 1 e/d, )

      Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 SymCrypt Cryptographic Implementations #1692

      -

      Version 6.3.9600

      TECB( e/d; KO 1,2 ) ;

      -

      TCBC( e/d; KO 1,2 ) ;

      -

      TCFB8( e/d; KO 1,2 ) ;

      -

      TCFB64( e/d; KO 1,2 )

      		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Next Generation Symmetric Cryptographic Algorithms Implementations (SYMCRYPT) #1387

      TECB( e/d; KO 1,2 ) ;

      -

      TCBC( e/d; KO 1,2 ) ;

      -

      TCFB8( e/d; KO 1,2 )

      		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Symmetric Algorithm Implementations (RSA32) #1386

      TECB( e/d; KO 1,2 ) ;

      -

      TCBC( e/d; KO 1,2 ) ;

      -

      TCFB8( e/d; KO 1,2 )

      		Windows 7 and SP1 and Windows Server 2008 R2 and SP1 Symmetric Algorithm Implementation #846

      TECB( e/d; KO 1,2 ) ;

      -

      TCBC( e/d; KO 1,2 ) ;

      -

      TCFB8( e/d; KO 1,2 )

      		Windows Vista SP1 and Windows Server 2008 Symmetric Algorithm Implementation #656

      TECB( e/d; KO 1,2 ) ;

      -

      TCBC( e/d; KO 1,2 ) ;

      -

      TCFB8( e/d; KO 1,2 )

      		Windows Vista Symmetric Algorithm Implementation #549
      Triple DES MAC

      Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 #1386, vendor-affirmed

      -

      Windows 7 and SP1 and Windows Server 2008 R2 and SP1 #846, vendor-affirmed

      TECB( e/d; KO 1,2 ) ;

      -

      TCBC( e/d; KO 1,2 )

      Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #1308

      -

      Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #1307

      -

      Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #691

      -

      Windows XP Professional SP3 Kernel Mode Cryptographic Module (fips.sys) #677

      -

      Windows XP Professional SP3 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #676

      -

      Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #675

      -

      Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #544

      -

      Windows Server 2003 SP2 Enhanced DSS and Diffie-Hellman Cryptographic Provider #543

      -

      Windows Server 2003 SP2 Kernel Mode Cryptographic Module (fips.sys) #542

      -

      Windows CE 6.0 and Window CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #526

      -

      Windows CE and Windows Mobile 6 and Windows Mobile 6.1 and Windows Mobile 6.5 Enhanced Cryptographic Provider (RSAENH) #517

      -

      Windows Server 2003 SP1 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #381

      -

      Windows Server 2003 SP1 Kernel Mode Cryptographic Module (fips.sys) #370

      -

      Windows Server 2003 SP1 Enhanced Cryptographic Provider (RSAENH) #365

      -

      Windows CE 5.00 and Windows CE 5.01 Enhanced Cryptographic Provider (RSAENH) #315

      -

      Windows Server 2003 Kernel Mode Cryptographic Module (fips.sys) #201

      -

      Windows Server 2003 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #199

      -

      Windows Server 2003 Enhanced Cryptographic Provider (RSAENH) #192

      -

      Windows XP Microsoft Enhanced Cryptographic Provider #81

      -

      Windows 2000 Microsoft Outlook Cryptographic Provider (EXCHCSP.DLL) SR-1A (3821) #18

      -

      Crypto Driver for Windows 2000 (fips.sys) #16

      - - -#### SP 800-132 Password Based Key Derivation Function (PBKDF) - - - - - - - - - - - - - - -
      - Modes / States / Key Sizes - - Algorithm Implementation and Certificate # -
      - PBKDF (vendor affirmed) -

       Kernel Mode Cryptographic Primitives Library (cng.sys) Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll) in Microsoft Windows 10, Windows 10 Pro, Windows 10 Enterprise, Windows 10 Enterprise LTSB, Windows 10 Mobile, Windows Server 2016 Standard, Windows Server 2016 Datacenter, Windows Storage Server 2016 #2937
      (Software Version: 10.0.14393)

      -

      Microsoft Windows 10, Windows 10 Pro, Windows 10 Enterprise, Windows 10 Enterprise LTSB, Windows 10 Mobile, Windows Server 2016 Standard, Windows Server 2016 Datacenter, Windows Storage Server 2016 #2936
      (Software Version: 10.0.14393)

      -

      Code Integrity (ci.dll) in Microsoft Windows 10, Windows 10 Pro, Windows 10 Enterprise, Windows 10 Enterprise LTSB, Windows 10 Mobile, Windows Server 2016 Standard, Windows Server 2016 Datacenter, Windows Storage Server 2016 #2935
      (Software Version: 10.0.14393)

      -

      Boot Manager in Microsoft Windows 10, Windows 10 Pro, Windows 10 Enterprise, Windows 10 Enterprise LTSB, Windows 10 Mobile, Windows Server 2016 Standard, Windows Server 2016 Datacenter, Windows Storage Server 2016 #2931
      (Software Version: 10.0.14393)

      -
      - PBKDF (vendor affirmed) -

      Kernel Mode Cryptographic Primitives Library (cng.sys) in Microsoft Windows 10, Windows 10 Pro, Windows 10 Enterprise, Windows 10 Enterprise LTSB, Windows 10 Mobile, Windows Server 2016 Standard, Windows Server 2016 Datacenter, Windows Storage Server 2016 #2936
      (Software Version: 10.0.14393)

      -

      Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG), vendor-affirmed

      -
      - - -#### Component Validation List - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Publication / Component Validated / DescriptionImplementation and Certificate #
        -
      • ECDSA SigGen:
        • -
        • -
        • P-256 SHA: SHA-256
          • -
        • P-384 SHA: SHA-384
          • -
        • P-521 SHA: SHA-512
          • -
        • -
      -

      Prerequisite: DRBG #489

      Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #1540

      -

      Version 6.3.9600

        -
      • RSASP1:
        • -
        • -
        • Modulus Size: 2048 (bits)
          • -
        • Padding Algorithms: PKCS 1.5
          • -
        • -

      Microsoft Surface Hub Virtual TPM Implementations #1519

      -

      Version 10.0.15063.674

        -
      • RSASP1:
        • -
        • -
        • Modulus Size: 2048 (bits)
          • -
        • Padding Algorithms: PKCS 1.5
          • -
        • -

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #1518

      -

      Version 10.0.16299

        -
      • RSADP:
        • -
        • -
        • Modulus Size: 2048 (bits)
          • -
        • -

      Microsoft Surface Hub MsBignum Cryptographic Implementations #1517

      -

      Version 10.0.15063.674

        -
      • RSASP1:
        • -
        • -
        • Modulus Size: 2048 (bits)
          • -
        • Padding Algorithms: PKCS 1.5
          • -
        • -

      Microsoft Surface Hub MsBignum Cryptographic Implementations #1516

      -

      Version 10.0.15063.674

        -
      • ECDSA SigGen:
        • -
        • -
        • P-256 SHA: SHA-256
          • -
        • P-384 SHA: SHA-384
          • -
        • P-521 SHA: SHA-512
          • -
        • -
      -

       Prerequisite: DRBG #1732

      Microsoft Surface Hub MsBignum Cryptographic Implementations #1515

      -

      Version 10.0.15063.674

        -
      • ECDSA SigGen:
        • -
        • -
        • P-256 SHA: SHA-256
          • -
        • P-384 SHA: SHA-384
          • -
        • P-521 SHA: SHA-512
          • -
        • -
      -

      Prerequisite: DRBG #1732

      Microsoft Surface Hub SymCrypt Cryptographic Implementations #1514

      -

      Version 10.0.15063.674

        -
      • RSADP:
        • -
        • -
        • Modulus Size: 2048 (bits)
          • -
        • -

      Microsoft Surface Hub SymCrypt Cryptographic Implementations #1513

      -

      Version 10.0.15063.674

        -
      • RSASP1:
        • -
        • -
        • Modulus Size: 2048 (bits)
          • -
        • Padding Algorithms: PKCS 1.5
          • -
        • -

      Microsoft Surface Hub SymCrypt Cryptographic Implementations #1512

      -

      Version 10.0.15063.674

        -
      • IKEv1:
        • -
        • -
        • Methods: Digital Signature, Pre-shared Key, Public Key Encryption
          • -
        • Pre-shared Key Length: 64-2048
          • -
        • Diffie-Hellman shared secrets:
          • -
          • -
          • Diffie-Hellman shared secret:
            • -
            • -
            • Length: 2048 (bits)
              • -
            • SHA Functions: SHA-256
              • -
            • -
          • Diffie-Hellman shared secret:
            • -
            • -
            • Length: 256 (bits)
              • -
            • SHA Functions: SHA-256
              • -
            • -
          • Diffie-Hellman shared secret:
            • -
            • -
            • Length: 384 (bits)
              • -
            • SHA Functions: SHA-384
              • -
            • -
          • -
        • -
      -

      Prerequisite: SHS #4011, HMAC #3269

      -
        -
      • IKEv2:
        • -
        • -
        • Derived Keying Material length: 192-1792
          • -
        • Diffie-Hellman shared secrets:
          • -
          • -
          • Diffie-Hellman shared secret:
            • -
            • -
            • Length: 2048 (bits)
              • -
            • SHA Functions: SHA-256
              • -
            • -
          • Diffie-Hellman shared secret:
            • -
            • -
            • Length: 256 (bits)
              • -
            • SHA Functions: SHA-256
              • -
            • -
          • Diffie-Hellman shared secret:
            • -
            • -
            • Length: 384 (bits)
              • -
            • SHA Functions: SHA-384
              • -
            • -
          • -
        • -
      -

      Prerequisite: SHS #4011, HMAC #3269

      -
        -
      • TLS:
        • -
        • -
        • Supports TLS 1.0/1.1
          • -
        • Supports TLS 1.2:
          • -
          • -
          • SHA Functions: SHA-256, SHA-384
            • -
          • -
        • -
      -

      Prerequisite: SHS #4011, HMAC #3269

      Microsoft Surface Hub SymCrypt Cryptographic Implementations #1511

      -

      Version 10.0.15063.674

        -
      • ECDSA SigGen:
        • -
        • -
        • P-256 SHA: SHA-256
          • -
        • P-384 SHA: SHA-384
          • -
        • P-521 SHA: SHA-512
          • -
        • -
      -

      Prerequisite: DRBG #1731

      Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1510

      -

      Version 10.0.15254

        -
      • RSADP:
        • -
        • -
        • Modulus Size: 2048 (bits)
          • -
        • -

      Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1509

      -

      Version 10.0.15254

        -
      • RSASP1:
        • -
        • -
        • Modulus Size: 2048 (bits)
          • -
        • Padding Algorithms: PKCS 1.5
          • -
        • -

      Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1508

      -

      Version 10.0.15254

        -
      • IKEv1:
        • -
        • -
        • Methods: Digital Signature, Pre-shared Key, Public Key Encryption
          • -
        • Pre-shared Key Length: 64-2048
          • -
        • Diffie-Hellman shared secrets:
          • -
          • -
          • Diffie-Hellman shared secret:
            • -
            • -
            • Length: 2048 (bits)
              • -
            • SHA Functions: SHA-256
              • -
            • -
          • Diffie-Hellman shared secret:
            • -
            • -
            • Length: 256 (bits)
              • -
            • SHA Functions: SHA-256
              • -
            • -
          • Diffie-Hellman shared secret:
            • -
            • -
            • Length: 384 (bits)
              • -
            • SHA Functions: SHA-384
              • -
            • -
          • -
        • -
      -

      Prerequisite: SHS #4010, HMAC #3268

      -
        -
      • IKEv2:
        • -
        • -
        • Derived Keying Material length: 192-1792
          • -
        • Diffie-Hellman shared secrets:
          • -
          • -
          • Diffie-Hellman shared secret:
            • -
            • -
            • Length: 2048 (bits)
              • -
            • SHA Functions: SHA-256
              • -
            • -
          • Diffie-Hellman shared secret:
            • -
            • -
            • Length: 256 (bits)
              • -
            • SHA Functions: SHA-256
              • -
            • -
          • Diffie-Hellman shared secret:
            • -
            • -
            • Length: 384 (bits)
              • -
            • SHA Functions: SHA-384
              • -
            • -
          • -
        • -
      -

      Prerequisite: SHS #4010, HMAC #3268

      -
        -
      • TLS:
        • -
        • -
        • Supports TLS 1.0/1.1
          • -
        • Supports TLS 1.2:
          • -
          • -
          • SHA Functions: SHA-256, SHA-384
            • -
          • -
        • -
      -

      Prerequisite: SHS #4010, HMAC #3268

      Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1507

      -

      Version 10.0.15254

        -
      • ECDSA SigGen:
        • -
        • -
        • P-256 SHA: SHA-256
          • -
        • P-384 SHA: SHA-384
          • -
        • P-521 SHA: SHA-512
          • -
        • -
      -

      Prerequisite: DRBG #1731

      Windows 10 Mobile (version 1709) MsBignum Cryptographic Implementations #1506

      -

      Version 10.0.15254

        -
      • RSADP:
        • -
        • -
        • Modulus Size: 2048 (bits)
          • -
        • -

      Windows 10 Mobile (version 1709) MsBignum Cryptographic Implementations #1505

      -

      Version 10.0.15254

        -
      • RSASP1:
        • -
        • -
        • Modulus Size: 2048 (bits)
          • -
        • Padding Algorithms: PKCS 1.5
          • -
        • -

      Windows 10 Mobile (version 1709) MsBignum Cryptographic Implementations #1504

      -

      Version 10.0.15254

        -
      • ECDSA SigGen:
        • -
        • -
        • P-256 SHA: SHA-256
          • -
        • P-384 SHA: SHA-384
          • -
        • P-521 SHA: SHA-512
          • -
        • -
      -

      Prerequisite: DRBG #1730

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); MsBignum Cryptographic Implementations #1503

      -

      Version 10.0.16299

        -
      • RSADP:
        • -
        • -
        • Modulus Size: 2048 (bits)
          • -
        • -

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); MsBignum Cryptographic Implementations #1502

      -

      Version 10.0.16299

        -
      • RSASP1:
        • -
        • -
        • Modulus Size: 2048 (bits)
          • -
        • Padding Algorithms: PKCS 1.5
          • -
        • -

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); MsBignum Cryptographic Implementations #1501

      -

      Version 10.0.16299

        -
      • ECDSA SigGen:
        • -
        • -
        • P-256 SHA: SHA-256
          • -
        • P-384 SHA: SHA-384
          • -
        • P-521 SHA: SHA-512
          • -
        • -
      -

      Prerequisite: DRBG #1730

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1499

      -

      Version 10.0.16299

        -
      • RSADP:
        • -
        • -
        • Modulus Size: 2048 (bits)
          • -
        • -

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1498

      -

      Version 10.0.16299

      -

       

        -
      • RSASP1:
        • -
        • -
        • Modulus Size: 2048 (bits)
          • -
        • Padding Algorithms: PKCS 1.5
          • -
        • -

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations  #1497

      -

      Version 10.0.16299

        -
      • IKEv1:
        • -
        • -
        • Methods: Digital Signature, Pre-shared Key, Public Key Encryption
          • -
        • Pre-shared Key Length: 64-2048
          • -
        • Diffie-Hellman shared secrets:
          • -
          • -
          • Diffie-Hellman shared secret:
            • -
            • -
            • Length: 2048 (bits)
              • -
            • SHA Functions: SHA-256
              • -
            • -
          • Diffie-Hellman shared secret:
            • -
            • -
            • Length: 256 (bits)
              • -
            • SHA Functions: SHA-256
              • -
            • -
          • Diffie-Hellman shared secret:
            • -
            • -
            • Length: 384 (bits)
              • -
            • SHA Functions: SHA-384
              • -
            • -
          • -
        • -
      -

      Prerequisite: SHS #4009, HMAC #3267

      -
        -
      • IKEv2:
        • -
        • -
        • Derived Keying Material length: 192-1792
          • -
        • Diffie-Hellman shared secrets:
          • -
          • -
          • Diffie-Hellman shared secret:
            • -
            • -
            • Length: 2048 (bits)
              • -
            • SHA Functions: SHA-256
              • -
            • -
          • Diffie-Hellman shared secret:
            • -
            • -
            • Length: 256 (bits)
              • -
            • SHA Functions: SHA-256
              • -
            • -
          • Diffie-Hellman shared secret:
            • -
            • -
            • Length: 384 (bits)
              • -
            • SHA Functions: SHA-384
              • -
            • -
          • -
        • -
      -

      Prerequisite: SHS #4009, HMAC #3267

      -
        -
      • TLS:
        • -
        • -
        • Supports TLS 1.0/1.1
          • -
        • Supports TLS 1.2:
          • -
          • -
          • SHA Functions: SHA-256, SHA-384
            • -
          • -
        • -
      -

      Prerequisite: SHS #4009, HMAC #3267

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations  #1496

      -

      Version 10.0.16299

      FIPS186-4 ECDSA

      -

      Signature Generation of hash sized messages

      -

      ECDSA SigGen Component: CURVES( P-256 P-384 P-521 )

      Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile MsBignum Cryptographic Implementations #1284
      -Version 10.0. 15063

      -

      Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1279
      -Version 10.0. 15063

      -

      Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update MsBignum Cryptographic Implementations #922
      -Version 10.0.14393

      -

      Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #894
      -Version 10.0.14393icrosoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” MsBignum Cryptographic Implementations #666
      -Version 10.0.10586

      -

      Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #288
      -Version 6.3.9600

      FIPS186-4 RSA; PKCS#1 v2.1

      -

      RSASP1 Signature Primitive

      -

      RSASP1: (Mod2048: PKCS1.5 PKCSPSS)

      Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #1285
      -Version 10.0.15063

      -

      Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile MsBignum Cryptographic Implementations #1282
      -Version 10.0.15063

      -

      Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1280
      -Version 10.0.15063

      -

      Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #893
      -Version 10.0.14393

      -

      Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update MsBignum Cryptographic Implementations #888
      -Version 10.0.14393

      -

      Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” MsBignum Cryptographic Implementations #665
      -Version 10.0.10586

      -

      Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 MsBignum Cryptographic Implementations #572
      -Version  10.0.10240

      -

      Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry MsBignum Cryptographic Implementations #289
      -Version 6.3.9600

      FIPS186-4 RSA; RSADP

      -

      RSADP Primitive

      -

      RSADP: (Mod2048)

      Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile MsBignum Cryptographic Implementations #1283
      -Version 10.0.15063

      -

      Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1281
      -Version 10.0.15063

      -

      Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #895
      -Version 10.0.14393

      -

      Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #887
      -Version 10.0.14393

      -

      Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” Cryptography Next Generation (CNG) Implementations #663
      -Version 10.0.10586

      -

      Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 Cryptography Next Generation (CNG) Implementations #576
      -Version  10.0.10240

      SP800-135

      -

      Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations  #1496

      -

      Version 10.0.16299

      -

      Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1278
      -Version 10.0.15063

      -

      Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1140
      -Version 7.00.2872

      -

      Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1139
      -Version 8.00.6246

      -

      Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update BcryptPrimitives and NCryptSSLp #886
      -Version 10.0.14393

      -

      Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” BCryptPrimitives and NCryptSSLp #664
      -Version 10.0.10586

      -

      Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 BCryptPrimitives and NCryptSSLp #575
      -Version  10.0.10240

      -

      Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 BCryptPrimitives and NCryptSSLp #323
      -Version 6.3.9600

      - - -## References - -\[[FIPS 140](http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf)\] - FIPS 140-2, Security Requirements for Cryptographic Modules - -\[[FIPS FAQ](http://csrc.nist.gov/groups/stm/cmvp/documents/cmvpfaq.pdf)\] - Cryptographic Module Validation Program (CMVP) FAQ - -\[[SP 800-57](http://csrc.nist.gov/publications/pubssps.html#800-57-part1)\] - Recommendation for Key Management – Part 1: General (Revised) - -\[[SP 800-131A](http://csrc.nist.gov/publications/nistpubs/800-131a/sp800-131a.pdf)\] - Transitions: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths - -## Additional Microsoft References - -Enabling FIPS mode - - -Cipher Suites in Schannel - [https://msdn.microsoft.com/library/aa374757(VS.85).aspx](https://msdn.microsoft.com/library/aa374757\(vs.85\).aspx) - +--- +title: FIPS 140 Validation +description: This topic provides information on how Microsoft products and cryptographic modules comply with the U.S. Federal government standard FIPS 140. +ms.prod: w10 +audience: ITPro +author: dulcemontemayor +ms.author: dansimp +manager: dansimp +ms.collection: M365-identity-device-management +ms.topic: article +ms.localizationpriority: medium +ms.date: 11/05/2019 +ms.reviewer: +--- + +# FIPS 140-2 Validation + +## FIPS 140-2 standard overview + +The Federal Information Processing Standard (FIPS) Publication 140-2 is a U.S. government standard that defines minimum security requirements for cryptographic modules in information technology products, as defined in Section 5131 of the Information Technology Management Reform Act of 1996. + +The [Cryptographic Module Validation Program (CMVP)](https://csrc.nist.gov/Projects/cryptographic-module-validation-program), a joint effort of the U.S. National Institute of Standards and Technology (NIST) and the Canadian Centre for Cyber Security (CCCS), validates cryptographic modules against the Security Requirements for Cryptographic Modules (part of FIPS 140-2) and related FIPS cryptography standards. The FIPS 140-2 security requirements cover eleven areas related to the design and implementation of a cryptographic module. The NIST Information Technology Laboratory operates a related program that validates the FIPS approved cryptographic algorithms in the module. + +## Microsoft’s approach to FIPS 140-2 validation + +Microsoft maintains an active commitment to meeting the requirements of the FIPS 140-2 standard, having validated cryptographic modules against it since the inception of the standard in 2001. Microsoft validates its cryptographic modules under the NIST CMVP, as described above. Multiple Microsoft products, including Windows 10, Windows Server, and many cloud services, use these cryptographic modules. + +## Using Windows in a FIPS 140-2 approved mode of operation + +Windows 10 and Windows server may be configured to run in a FIPS 140-2 approved mode of operation. This is commonly referred to as “FIPS mode.” Achieving this mode of operation requires administrators to complete all four steps outlined below. + +### Step 1: Ensure FIPS 140-2 validated cryptographic modules are installed + +Administrators must ensure that all cryptographic modules installed are FIPS 140-2 validated. This is accomplished by cross-checking the version number of the cryptographic module with the table of validated modules at the end of this topic, organized by operating system release. + +### Step 2: Ensure all security policies for all cryptographic modules are followed + +Each of the cryptographic modules has a defined security policy that must be met for the module to operate in its FIPS 140-2 approved mode. The security policy may be found in each module’s published Security Policy Document (SPD). The SPDs for each module may be found by following the links in the table of validated modules at the end of this topic. Click on the module version number to view the published SPD for the module. + +### Step 3: Enable the FIPS security policy + +Windows provides the security policy setting, “System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing,” which is used by some Microsoft products to determine whether to operate in a FIPS 140-2 approved mode. When this policy is enabled, the validated cryptographic modules in Windows will also operate in FIPS approved mode. The policy may be set using Local Security Policy, as part of Group Policy, or through a Modern Device Management (MDM) solution. For more information on the policy, see [System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing](https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing). + +### Step 4: Ensure only FIPS validated cryptographic algorithms are used + +Neither the operating system nor the cryptographic modules can enforce a FIPS approved mode of operation, regardless of the FIPS security policy setting. To run in a FIPS approved mode, an application or service must check for the policy flag and enforce the security policies of the validated modules. If an application or service uses a non-approved cryptographic algorithm or does not follow the security policies of the validated modules, it is not operating in a FIPS approved mode. + +## Frequently asked questions + +### How long does it take to certify cryptographic modules? + +Microsoft begins certification of cryptographic modules after each major feature release of Windows 10 and Windows Server. The duration of each evaluation varies, depending on many factors. + +### When does Microsoft undertake a FIPS 140 validation? + +The cadence for starting module validation aligns with the feature updates of Windows 10 and Windows Server. As the software industry evolves, operating systems release more frequently. Microsoft completes validation work on major releases but, in between releases, seeks to minimize the changes to the cryptographic modules. + +### What is the difference between “FIPS 140 validated” and “FIPS 140 compliant”? + +“FIPS 140 validated” means that the cryptographic module, or a product that embeds the module, has been validated (“certified”) by the CMVP as meeting as meeting the FIPS 140-2 requirements. “FIPS 140 compliant” is an industry term for IT products that rely on FIPS 140 validated products for cryptographic functionality. + +### I need to know if a Windows service or application is FIPS 140-2 validated. + +The cryptographic modules leveraged in Windows are validated through the CMVP, not individual services, applications, hardware peripherals, or other solutions. For a solution to be considered compliant, it must call a FIPS 140-2 validated cryptographic module in the underlying OS and the OS must be configured to run in FIPS mode. Contact the vendor of the service, application, or product for information on whether it calls a validated cryptographic module. + +### What does "When operated in FIPS mode" mean on a certificate? + +This caveat identifies required configuration and security rules that must be followed to use the cryptographic module in a way that is consistent with its FIPS 140-2 security policy. Each module has its own security policy—a precise specification of the security rules under which it will operate—and employs approved cryptographic algorithms, cryptographic key management, and authentication techniques. The security rules are defined in the Security Policy Document (SPD) for each module. + +### What is the relationship between FIPS 140-2 and Common Criteria? + +These are two separate security standards with different, but complementary, purposes. FIPS 140-2 is designed specifically for validating software and hardware cryptographic modules, while Common Criteria is designed to evaluate security functions in IT software and hardware products. Common Criteria evaluations often rely on FIPS 140-2 validations to provide assurance that basic cryptographic functionality is implemented properly. + +### How does FIPS 140 relate to Suite B? + +Suite B is a set of cryptographic algorithms defined by the U.S. National Security Agency (NSA) as part of its Cryptographic Modernization Program. The set of Suite B cryptographic algorithms are to be used for both unclassified information and most classified information. The Suite B cryptographic algorithms are a subset of the FIPS Approved cryptographic algorithms as allowed by the FIPS 140-2 standard. + +## Microsoft FIPS 140-2 validated cryptographic modules + +The following tables identify the cryptographic modules used in an operating system, organized by release. + +## Modules used by Windows + +##### Windows 10 Spring 2018 Update (Version 1803) + +Validated Editions: Home, Pro, Enterprise, Education + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Cryptographic Primitives Library10.0.17134#3197See Security Policy and Certificate page for algorithm information
      Kernel Mode Cryptographic Primitives Library10.0.17134#3196See Security Policy and Certificate page for algorithm information
      Code Integrity10.0.17134#3195See Security Policy and Certificate page for algorithm information
      Windows OS Loader10.0.17134#3480See Security Policy and Certificate page for algorithm information
      Secure Kernel Code Integrity10.0.17134#3096See Security Policy and Certificate page for algorithm information
      BitLocker Dump Filter10.0.17134#3092See Security Policy and Certificate page for algorithm information
      Boot Manager10.0.17134#3089See Security Policy and Certificate page for algorithm information
      + +##### Windows 10 Fall Creators Update (Version 1709) + +Validated Editions: Home, Pro, Enterprise, Education, S, Surface Hub, Mobile + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Cryptographic Primitives Library10.0.16299#3197See Security Policy and Certificate page for algorithm information
      Kernel Mode Cryptographic Primitives Library10.0.16299#3196See Security Policy and Certificate page for algorithm information
      Code Integrity10.0.16299#3195See Security Policy and Certificate page for algorithm information
      Windows OS Loader10.0.16299#3194See Security Policy and Certificate page for algorithm information
      Secure Kernel Code Integrity10.0.16299#3096See Security Policy and Certificate page for algorithm information
      BitLocker Dump Filter10.0.16299#3092See Security Policy and Certificate page for algorithm information
      Windows Resume10.0.16299#3091See Security Policy and Certificate page for algorithm information
      Boot Manager10.0.16299#3089See Security Policy and Certificate page for algorithm information
      + +##### Windows 10 Creators Update (Version 1703) + +Validated Editions: Home, Pro, Enterprise, Education, S, Surface Hub, Mobile + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll)10.0.15063#3095

      FIPS Approved algorithms: AES (Cert. #4624); CKG (vendor affirmed); CVL (Certs. #1278 and #1281); DRBG (Cert. #1555); DSA (Cert. #1223); ECDSA (Cert. #1133); HMAC (Cert. #3061); KAS (Cert. #127); KBKDF (Cert. #140); KTS (AES Cert. #4626; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2521 and #2522); SHS (Cert. #3790); Triple-DES (Cert. #2459)
      +
      +Other algorithms: HMAC-MD5; MD5; DES; Legacy CAPI KDF; MD2; MD4; RC2; RC4; RSA (encrypt/decrypt)

      +

      Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #1133); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #2521); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #1281); SP800-135 - Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS (Cert. #1278)

      Kernel Mode Cryptographic Primitives Library (cng.sys)10.0.15063#3094

      #3094

      +

      FIPS Approved algorithms: AES (Certs. #4624 and #4626); CKG (vendor affirmed); CVL (Certs. #1278 and #1281); DRBG (Cert. #1555); DSA (Cert. #1223); ECDSA (Cert. #1133); HMAC (Cert. #3061); KAS (Cert. #127); KBKDF (Cert. #140); KTS (AES Cert. #4626; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2521 and #2523); SHS (Cert. #3790); Triple-DES (Cert. #2459)
      +
      +Other algorithms: HMAC-MD5; MD5; NDRNG; DES; Legacy CAPI KDF; MD2; MD4; RC2; RC4; RSA (encrypt/decrypt)

      +

      Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert.#1133); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert.#2521); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert.#1281)

      Boot Manager10.0.15063#3089

      FIPS Approved algorithms: AES (Certs. #4624 and #4625); CKG (vendor affirmed); HMAC (Cert. #3061); PBKDF (vendor affirmed); RSA (Cert. #2523); SHS (Cert. #3790)

      +

      Other algorithms: PBKDF (vendor affirmed); VMK KDF (vendor affirmed)

      Windows OS Loader10.0.15063#3090

      FIPS Approved algorithms: AES (Certs. #4624 and #4625); RSA (Cert. #2523); SHS (Cert. #3790)

      +

      Other algorithms: NDRNG

      Windows Resume[1]10.0.15063#3091FIPS Approved algorithms: AES (Certs. #4624 and #4625); RSA (Cert. #2523); SHS (Cert. #3790)
      BitLocker® Dump Filter[2]10.0.15063#3092FIPS Approved algorithms: AES (Certs. #4624 and #4625); RSA (Cert. #2522); SHS (Cert. #3790)
      Code Integrity (ci.dll)10.0.15063#3093

      FIPS Approved algorithms: AES (Cert. #4624); RSA (Certs. #2522 and #2523); SHS (Cert. #3790)

      +

      Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v1.5 - RSASP1 Signature Primitive (Cert. #1282)

      Secure Kernel Code Integrity (skci.dll)[3]10.0.15063#3096

      FIPS Approved algorithms: AES (Cert. #4624); RSA (Certs. #2522 and #2523); SHS (Cert. #3790)

      +

      Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v1.5 - RSASP1 Signature Primitive (Cert. #1282)

      + + +\[1\] Applies only to Home, Pro, Enterprise, Education and S + +\[2\] Applies only to Pro, Enterprise, Education, S, Mobile and Surface Hub + +\[3\] Applies only to Pro, Enterprise Education and S + +##### Windows 10 Anniversary Update (Version 1607) + +Validated Editions: Home, Pro, Enterprise, Enterprise LTSB, Mobile + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll)10.0.14393#2937

      FIPS Approved algorithms: AES (Cert. #4064); DRBG (Cert. #1217); DSA (Cert. #1098); ECDSA (Cert. #911); HMAC (Cert. #2651); KAS (Cert. #92); KBKDF (Cert. #101); KTS (AES Cert. #4062; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2192, #2193 and #2195); SHS (Cert. #3347); Triple-DES (Cert. #2227)
      +
      +Other algorithms: HMAC-MD5; MD5; DES; Legacy CAPI KDF; MD2; MD4; RC2; RC4; RSA (encrypt/decrypt)

      +

      Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #922); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #888); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #887); SP800-135 - Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS (Cert. #886)

      Kernel Mode Cryptographic Primitives Library (cng.sys)10.0.14393#2936

      FIPS Approved algorithms: AES (Cert. #4064); DRBG (Cert. #1217); DSA (Cert. #1098); ECDSA (Cert. #911); HMAC (Cert. #2651); KAS (Cert. #92); KBKDF (Cert. #101); KTS (AES Cert. #4062; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2192, #2193 and #2195); SHS (Cert. #3347); Triple-DES (Cert. #2227)
      +
      +Other algorithms: HMAC-MD5; MD5; NDRNG; DES; Legacy CAPI KDF; MD2; MD4; RC2; RC4; RSA (encrypt/decrypt)

      +

      Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #922); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #888); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #887)

      Boot Manager10.0.14393#2931

      FIPS Approved algorithms: AES (Certs. #4061 and #4064); HMAC (Cert. #2651); PBKDF (vendor affirmed); RSA (Cert. #2193); SHS (Cert. #3347)

      +

      Other algorithms: MD5; PBKDF (non-compliant); VMK KDF

      BitLocker® Windows OS Loader (winload)10.0.14393#2932FIPS Approved algorithms: AES (Certs. #4061 and #4064); RSA (Cert. #2193); SHS (Cert. #3347)
      +
      +Other algorithms: NDRNG; MD5
      BitLocker® Windows Resume (winresume)[1]10.0.14393#2933FIPS Approved algorithms: AES (Certs. #4061 and #4064); RSA (Cert. #2193); SHS (Cert. #3347)
      +
      +Other algorithms: MD5
      BitLocker® Dump Filter (dumpfve.sys)[2]10.0.14393#2934FIPS Approved algorithms: AES (Certs. #4061 and #4064)
      Code Integrity (ci.dll)10.0.14393#2935

      FIPS Approved algorithms: RSA (Cert. #2193); SHS (Cert. #3347)
      +
      +Other algorithms: AES (non-compliant); MD5

      +

      Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #888)

      Secure Kernel Code Integrity (skci.dll)[3]10.0.14393#2938

      FIPS Approved algorithms: RSA (Certs. #2193); SHS (Certs. #3347)
      +
      +Other algorithms: MD5

      +

      Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #888)

      + + +\[1\] Applies only to Home, Pro, Enterprise and Enterprise LTSB + +\[2\] Applies only to Pro, Enterprise, Enterprise LTSB and Mobile + +\[3\] Applies only to Pro, Enterprise and Enterprise LTSB + +##### Windows 10 November 2015 Update (Version 1511) + +Validated Editions: Home, Pro, Enterprise, Enterprise LTSB, Mobile, Surface Hub + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll)10.0.10586#2606

      FIPS Approved algorithms: AES (Certs. #3629); DRBG (Certs. #955); DSA (Certs. #1024); ECDSA (Certs. #760); HMAC (Certs. #2381); KAS (Certs. #72; key agreement; key establishment methodology provides between 112 and 256 bits of encryption strength); KBKDF (Certs. #72); KTS (AES Certs. #3653; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #1887, #1888 and #1889); SHS (Certs. #3047); Triple-DES (Certs. #2024)
      +
      +Other algorithms: DES; HMAC-MD5; Legacy CAPI KDF; MD2; MD4; MD5; RC2; RC4; RSA (encrypt/decrypt)

      +

      Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #666); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #665); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #663); SP800-135 - Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS (Cert. #664)

      Kernel Mode Cryptographic Primitives Library (cng.sys)10.0.10586#2605

      FIPS Approved algorithms: AES (Certs. #3629); DRBG (Certs. #955); DSA (Certs.  #1024); ECDSA (Certs. #760); HMAC (Certs. #2381); KAS (Certs. #72; key agreement; key establishment methodology provides between 112 and 256 bits of encryption strength); KBKDF (Certs. #72); KTS (AES Certs. #3653; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #1887, #1888 and #1889); SHS (Certs. #3047); Triple-DES (Certs. #2024)
      +
      +Other algorithms: DES; HMAC-MD5; Legacy CAPI KDF; MD2; MD4; MD5; RC2; RC4; RSA (encrypt/decrypt)

      +

      Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #666); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #665); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #663)

      Boot Manager[4]10.0.10586#2700FIPS Approved algorithms: AES (Certs. #3653); HMAC (Cert. #2381); PBKDF (vendor affirmed); RSA (Cert. #1871); SHS (Certs. #3047 and #3048)
      +
      +Other algorithms: MD5; KDF (non-compliant); PBKDF (non-compliant)
      BitLocker® Windows OS Loader (winload)[5]10.0.10586#2701FIPS Approved algorithms: AES (Certs. #3629 and #3653); RSA (Cert. #1871); SHS (Cert. #3048)
      +
      +Other algorithms: MD5; NDRNG
      BitLocker® Windows Resume (winresume)[6]10.0.10586#2702FIPS Approved algorithms: AES (Certs. #3653); RSA (Cert. #1871); SHS (Cert. #3048)
      +
      +Other algorithms: MD5
      BitLocker® Dump Filter (dumpfve.sys)[7]10.0.10586#2703FIPS Approved algorithms: AES (Certs. #3653)
      Code Integrity (ci.dll)10.0.10586#2604

      FIPS Approved algorithms: RSA (Certs. #1871); SHS (Certs. #3048)
      +
      +Other algorithms: AES (non-compliant); MD5

      +

      Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #665)

      Secure Kernel Code Integrity (skci.dll)[8]10.0.10586#2607

      FIPS Approved algorithms: RSA (Certs. #1871); SHS (Certs. #3048)
      +
      +Other algorithms: MD5

      +

      Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #665)

      + + +\[4\] Applies only to Home, Pro, Enterprise, Mobile and Surface Hub + +\[5\] Applies only to Home, Pro, Enterprise, Mobile and Surface Hub + +\[6\] Applies only to Home, Pro and Enterprise + +\[7\] Applies only to Pro, Enterprise, Mobile and Surface Hub + +\[8\] Applies only to Enterprise and Enterprise LTSB + +##### Windows 10 (Version 1507) + +Validated Editions: Home, Pro, Enterprise, Enterprise LTSB, Mobile, and Surface Hub + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll)10.0.10240#2606

      FIPS Approved algorithms: AES (Certs. #3497); DRBG (Certs. #868); DSA (Certs. #983); ECDSA (Certs. #706); HMAC (Certs. #2233); KAS (Certs. #64; key agreement; key establishment methodology provides between 112 and 256 bits of encryption strength); KBKDF (Certs. #66); KTS (AES Certs. #3507; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #1783, #1798, and #1802); SHS (Certs. #2886); Triple-DES (Certs. #1969)
      +
      +Other algorithms: DES; HMAC-MD5; Legacy CAPI KDF; MD2; MD4; MD5; RC2; RC4; RSA (encrypt/decrypt)

      +

      Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #572); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #576); SP800-135 - Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS (Cert. #575)

      Kernel Mode Cryptographic Primitives Library (cng.sys)10.0.10240#2605

      FIPS Approved algorithms: AES (Certs. #3497); DRBG (Certs. #868); DSA (Certs. #983); ECDSA (Certs. #706); HMAC (Certs. #2233); KAS (Certs. #64; key agreement; key establishment methodology provides between 112 and 256 bits of encryption strength); KBKDF (Certs. #66); KTS (AES Certs. #3507; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #1783, #1798, and #1802); SHS (Certs. #2886); Triple-DES (Certs. #1969)
      +
      +Other algorithms: DES; HMAC-MD5; Legacy CAPI KDF; MD2; MD4; MD5; RC2; RC4; RSA (encrypt/decrypt)

      +

      Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #572); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #576)

      Boot Manager[9]10.0.10240#2600FIPS Approved algorithms: AES (Cert. #3497); HMAC (Cert. #2233); KTS (AES Cert. #3498); PBKDF (vendor affirmed); RSA (Cert. #1784); SHS (Certs. #2871 and #2886)
      +
      +Other algorithms: MD5; KDF (non-compliant); PBKDF (non-compliant)
      BitLocker® Windows OS Loader (winload)[10]10.0.10240#2601FIPS Approved algorithms: AES (Certs. #3497 and #3498); RSA (Cert. #1784); SHS (Cert. #2871)
      +
      +Other algorithms: MD5; NDRNG
      BitLocker® Windows Resume (winresume)[11]10.0.10240#2602FIPS Approved algorithms: AES (Certs. #3497 and #3498); RSA (Cert. #1784); SHS (Cert. #2871)
      +
      +Other algorithms: MD5
      BitLocker® Dump Filter (dumpfve.sys)[12]10.0.10240#2603FIPS Approved algorithms: AES (Certs. #3497 and #3498)
      Code Integrity (ci.dll)10.0.10240#2604

      FIPS Approved algorithms: RSA (Certs. #1784); SHS (Certs. #2871)
      +
      +Other algorithms: AES (non-compliant); MD5

      +

      Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #572)

      Secure Kernel Code Integrity (skci.dll)[13]10.0.10240#2607

      FIPS Approved algorithms: RSA (Certs. #1784); SHS (Certs. #2871)
      +
      +Other algorithms: MD5

      +

      Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #572)

      + + +\[9\] Applies only to Home, Pro, Enterprise and Enterprise LTSB + +\[10\] Applies only to Home, Pro, Enterprise and Enterprise LTSB + +\[11\] Applies only to Home, Pro, Enterprise and Enterprise LTSB + +\[12\] Applies only to Pro, Enterprise and Enterprise LTSB + +\[13\] Applies only to Enterprise and Enterprise LTSB + +##### Windows 8.1 + +Validated Editions: RT, Pro, Enterprise, Phone, Embedded + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll)6.3.9600 6.3.9600.17031#2357

      FIPS Approved algorithms: AES (Cert. #2832); DRBG (Certs. #489); DSA (Cert. #855); ECDSA (Cert. #505); HMAC (Cert. #1773); KAS (Cert. #47); KBKDF (Cert. #30); PBKDF (vendor affirmed); RSA (Certs. #1487, #1493 and #1519); SHS (Cert. #2373); Triple-DES (Cert. #1692)
      +
      +Other algorithms: AES (Cert. #2832, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); AES-GCM encryption (non-compliant); DES; HMAC MD5; Legacy CAPI KDF; MD2; MD4; MD5; NDRNG; RC2; RC4; RSA (encrypt/decrypt)#2832, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); AES-GCM encryption (non-compliant); DES; HMAC MD5; Legacy CAPI KDF; MD2; MD4; MD5; NDRNG; RC2; RC4; RSA (encrypt/decrypt)

      +

      Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #288); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #289); SP800-135 - Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS (Cert. #323)

      Kernel Mode Cryptographic Primitives Library (cng.sys)6.3.9600 6.3.9600.17042#2356

      FIPS Approved algorithms: AES (Cert. #2832); DRBG (Certs. #489); ECDSA (Cert. #505); HMAC (Cert. #1773); KAS (Cert. #47); KBKDF (Cert. #30); PBKDF (vendor affirmed); RSA (Certs. #1487, #1493 and #1519); SHS (Cert. # 2373); Triple-DES (Cert. #1692)
      +
      +Other algorithms: AES (Cert. #2832, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); AES-GCM encryption (non-compliant); DES; HMAC MD5; Legacy CAPI KDF; MD2; MD4; MD5; NDRNG; RC2; RC4; RSA (encrypt/decrypt)

      +

      Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #288); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #289)

      Boot Manager6.3.9600 6.3.9600.17031#2351FIPS Approved algorithms: AES (Cert. #2832); HMAC (Cert. #1773); PBKDF (vendor affirmed); RSA (Cert. #1494); SHS (Certs. # 2373 and #2396)
      +
      +Other algorithms: MD5; KDF (non-compliant); PBKDF (non-compliant)
      BitLocker® Windows OS Loader (winload)6.3.9600 6.3.9600.17031#2352FIPS Approved algorithms: AES (Cert. #2832); RSA (Cert. #1494); SHS (Cert. #2396)
      +
      +Other algorithms: MD5; NDRNG
      BitLocker® Windows Resume (winresume)[14]6.3.9600 6.3.9600.17031#2353FIPS Approved algorithms: AES (Cert. #2832); RSA (Cert. #1494); SHS (Certs. # 2373 and #2396)
      +
      +Other algorithms: MD5
      BitLocker® Dump Filter (dumpfve.sys)6.3.9600 6.3.9600.17031#2354FIPS Approved algorithms: AES (Cert. #2832)
      +
      +Other algorithms: N/A
      Code Integrity (ci.dll)6.3.9600 6.3.9600.17031#2355#2355

      FIPS Approved algorithms: RSA (Cert. #1494); SHS (Cert. # 2373)
      +
      +Other algorithms: MD5

      +

      Validated Component Implementations: PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #289)

      + + +\[14\] Applies only to Pro, Enterprise, and Embedded 8. + +##### Windows 8 + +Validated Editions: RT, Home, Pro, Enterprise, Phone + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Cryptographic Primitives Library (BCRYPTPRIMITIVES.DLL)6.2.9200#1892FIPS Approved algorithms: AES (Certs. #2197 and #2216); DRBG (Certs. #258); DSA (Cert. #687); ECDSA (Cert. #341); HMAC (Cert. #1345); KAS (Cert. #36); KBKDF (Cert. #3); PBKDF (vendor affirmed); RSA (Certs. #1133 and #1134); SHS (Cert. #1903); Triple-DES (Cert. #1387)
      +
      +Other algorithms: AES (Cert. #2197, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)#258); DSA (Cert. ); ECDSA (Cert. ); HMAC (Cert. ); KAS (Cert. ); KBKDF (Cert. ); PBKDF (vendor affirmed); RSA (Certs.  and ); SHS (Cert. ); Triple-DES (Cert. )
      +
      +
      Kernel Mode Cryptographic Primitives Library (cng.sys)6.2.9200#1891FIPS Approved algorithms: AES (Certs. #2197 and #2216); DRBG (Certs. #258 and #259); ECDSA (Cert. #341); HMAC (Cert. #1345); KAS (Cert. #36); KBKDF (Cert. #3); PBKDF (vendor affirmed); RNG (Cert. #1110); RSA (Certs. #1133 and #1134); SHS (Cert. #1903); Triple-DES (Cert. #1387)
      +
      +Other algorithms: AES (Cert. #2197, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)#258 and ); ECDSA (Cert. ); HMAC (Cert. ); KAS (Cert. ); KBKDF (Cert. ); PBKDF (vendor affirmed); RNG (Cert. ); RSA (Certs.  and ); SHS (Cert. ); Triple-DES (Cert. )
      +
      +Other algorithms: AES (Cert. , key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)
      Boot Manager6.2.9200#1895FIPS Approved algorithms: AES (Certs. #2196 and #2198); HMAC (Cert. #1347); RSA (Cert. #1132); SHS (Cert. #1903)
      +
      +Other algorithms: MD5
      BitLocker® Windows OS Loader (WINLOAD)6.2.9200#1896FIPS Approved algorithms: AES (Certs. #2196 and #2198); RSA (Cert. #1132); SHS (Cert. #1903)
      +
      +Other algorithms: AES (Cert. #2197; non-compliant); MD5; Non-Approved RNG
      BitLocker® Windows Resume (WINRESUME)[15]6.2.9200#1898FIPS Approved algorithms: AES (Certs. #2196 and #2198); RSA (Cert. #1132); SHS (Cert. #1903)
      +
      +Other algorithms: MD5
      BitLocker® Dump Filter (DUMPFVE.SYS)6.2.9200#1899FIPS Approved algorithms: AES (Certs. #2196 and #2198)
      +
      +Other algorithms: N/A
      Code Integrity (CI.DLL)6.2.9200#1897FIPS Approved algorithms: RSA (Cert. #1132); SHS (Cert. #1903)
      +
      +Other algorithms: MD5
      Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH.DLL)6.2.9200#1893FIPS Approved algorithms: DSA (Cert. #686); SHS (Cert. #1902); Triple-DES (Cert. #1386); Triple-DES MAC (Triple-DES Cert. #1386, vendor affirmed)
      +
      +Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman; MD5; RC2; RC2 MAC; RC4; Triple-DES (Cert. #1386, key wrapping; key establishment methodology provides 112 bits of encryption strength; non-compliant less than 112 bits of encryption strength)#1902); Triple-DES (Cert. ); Triple-DES MAC (Triple-DES Cert. , vendor affirmed)
      +
      +Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman; MD5; RC2; RC2 MAC; RC4; Triple-DES (Cert. , key wrapping; key establishment methodology provides 112 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
      Enhanced Cryptographic Provider (RSAENH.DLL)6.2.9200#1894FIPS Approved algorithms: AES (Cert. #2196); HMAC (Cert. #1346); RSA (Cert. #1132); SHS (Cert. #1902); Triple-DES (Cert. #1386)
      +
      +Other algorithms: AES (Cert. #2196, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); Triple-DES (Cert. #1386, key wrapping; key establishment methodology provides 112 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
      + + +\[15\] Applies only to Home and Pro + +**Windows 7** + +Validated Editions: Windows 7, Windows 7 SP1 + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Cryptographic Primitives Library (BCRYPTPRIMITIVES.DLL)

      6.1.7600.16385

      +

      6.1.7601.17514

      		1329FIPS Approved algorithms: AES (Certs. #1168 and #1178); AES GCM (Cert. #1168, vendor-affirmed); AES GMAC (Cert. #1168, vendor-affirmed); DRBG (Certs. #23 and #24); DSA (Cert. #386); ECDSA (Cert. #141); HMAC (Cert. #677); KAS (SP 800-56A, vendor affirmed, key agreement; key establishment methodology provides 80 to 256 bits of encryption strength); RNG (Cert. #649); RSA (Certs. #559 and #560); SHS (Cert. #1081); Triple-DES (Cert. #846)
      +
      +Other algorithms: AES (Cert. #1168, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4#559 and ); SHS (Cert. ); Triple-DES (Cert. )
      +
      +Other algorithms: AES (Cert. , key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4
      Kernel Mode Cryptographic Primitives Library (cng.sys)

      6.1.7600.16385

      +

      6.1.7600.16915

      +

      6.1.7600.21092

      +

      6.1.7601.17514

      +

      6.1.7601.17725

      +

      6.1.7601.17919

      +

      6.1.7601.21861

      +

      6.1.7601.22076

      		1328FIPS Approved algorithms: AES (Certs. #1168 and #1178); AES GCM (Cert. #1168, vendor-affirmed); AES GMAC (Cert. #1168, vendor-affirmed); DRBG (Certs. #23 and #24); ECDSA (Cert. #141); HMAC (Cert. #677); KAS (SP 800-56A, vendor affirmed, key agreement; key establishment methodology provides 80 to 256 bits of encryption strength); RNG (Cert. #649); RSA (Certs. #559 and #560); SHS (Cert. #1081); Triple-DES (Cert. #846)
      +
      +Other algorithms: AES (Cert. #1168, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4
      Boot Manager

      6.1.7600.16385

      +

      6.1.7601.17514

      		1319FIPS Approved algorithms: AES (Certs. #1168 and #1177); HMAC (Cert. #675); RSA (Cert. #557); SHS (Cert. #1081)
      +
      +Other algorithms: MD5#1168 and ); HMAC (Cert. ); RSA (Cert. ); SHS (Cert. )
      +
      +Other algorithms: MD5
      Winload OS Loader (winload.exe)

      6.1.7600.16385

      +

      6.1.7600.16757

      +

      6.1.7600.20897

      +

      6.1.7600.20916

      +

      6.1.7601.17514

      +

      6.1.7601.17556

      +

      6.1.7601.21655

      +

      6.1.7601.21675

      		1326FIPS Approved algorithms: AES (Certs. #1168 and #1177); RSA (Cert. #557); SHS (Cert. #1081)
      +
      +Other algorithms: MD5
      BitLocker™ Drive Encryption

      6.1.7600.16385

      +

      6.1.7600.16429

      +

      6.1.7600.16757

      +

      6.1.7600.20536

      +

      6.1.7600.20873

      +

      6.1.7600.20897

      +

      6.1.7600.20916

      +

      6.1.7601.17514

      +

      6.1.7601.17556

      +

      6.1.7601.21634

      +

      6.1.7601.21655

      +

      6.1.7601.21675

      		1332FIPS Approved algorithms: AES (Certs. #1168 and #1177); HMAC (Cert. #675); SHS (Cert. #1081)
      +
      +Other algorithms: Elephant Diffuser
      Code Integrity (CI.DLL)

      6.1.7600.16385

      +

      6.1.7600.17122

      +

      6.1.7600.21320

      +

      6.1.7601.17514

      +

      6.1.7601.17950

      +

      6.1.7601.22108

      		1327FIPS Approved algorithms: RSA (Cert. #557); SHS (Cert. #1081)
      +
      +Other algorithms: MD5
      Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH.DLL)6.1.7600.16385
      +(no change in SP1)      		1331FIPS Approved algorithms: DSA (Cert. #385); RNG (Cert. #649); SHS (Cert. #1081); Triple-DES (Cert. #846); Triple-DES MAC (Triple-DES Cert. #846, vendor affirmed)
      +
      +Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman; MD5; RC2; RC2 MAC; RC4
      Enhanced Cryptographic Provider (RSAENH.DLL)6.1.7600.16385
      +(no change in SP1)      		1330FIPS Approved algorithms: AES (Cert. #1168); DRBG (Cert. #23); HMAC (Cert. #673); SHS (Cert. #1081); RSA (Certs. #557 and #559); Triple-DES (Cert. #846)
      +
      +Other algorithms: DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 256-bits of encryption strength; non-compliant less than 112 bits of encryption strength)
      + + +##### Windows Vista SP1 + +Validated Editions: Ultimate Edition + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Boot Manager (bootmgr)6.0.6001.18000 and 6.0.6002.18005978FIPS Approved algorithms: AES (Certs. #739 and #760); HMAC (Cert. #415); RSA (Cert. #354); SHS (Cert. #753)
      Winload OS Loader (winload.exe)6.0.6001.18000, 6.0.6001.18027, 6.0.6001.18606, 6.0.6001.22125, 6.0.6001.22861, 6.0.6002.18005, 6.0.6002.18411 and 6.0.6002.22596979FIPS Approved algorithms: AES (Certs. #739 and #760); RSA (Cert. #354); SHS (Cert. #753)
      +
      +Other algorithms: MD5
      Code Integrity (ci.dll)6.0.6001.18000, 6.0.6001.18023, 6.0.6001.22120, and 6.0.6002.18005980FIPS Approved algorithms: RSA (Cert. #354); SHS (Cert. #753)
      +
      +Other algorithms: MD5
      Kernel Mode Security Support Provider Interface (ksecdd.sys)6.0.6001.18709, 6.0.6001.18272, 6.0.6001.18796, 6.0.6001.22202, 6.0.6001.22450, 6.0.6001.22987, 6.0.6001.23069, 6.0.6002.18005, 6.0.6002.18051, 6.0.6002.18541, 6.0.6002.18643, 6.0.6002.22152, 6.0.6002.22742, and 6.0.6002.228696.0.6001.18709, 6.0.6001.18272, 6.0.6001.18796, 6.0.6001.22202, 6.0.6001.22450, 6.0.6001.22987, 6.0.6001.23069, 6.0.6002.18005, 6.0.6002.18051, 6.0.6002.18541, 6.0.6002.18643, 6.0.6002.22152, 6.0.6002.22742, and 6.0.6002.228691000

      FIPS Approved algorithms: AES (Certs. #739 and #756); ECDSA (Cert. #82); HMAC (Cert. #412); RNG (Cert. #435 and SP 800-90 AES-CTR, vendor-affirmed); RSA (Certs. #353 and #357); SHS (Cert. #753); Triple-DES (Cert. #656)#739 and ); ECDSA (Cert. ); HMAC (Cert. ); RNG (Cert.  and SP 800-90 AES-CTR, vendor-affirmed); RSA (Certs.  and ); SHS (Cert. ); Triple-DES (Cert. )

      +

      Other algorithms: AES (GCM and GMAC; non-compliant); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides between 128 and 256 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4; RNG (SP 800-90 Dual-EC; non-compliant); RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength)

      Cryptographic Primitives Library (bcrypt.dll)6.0.6001.22202, 6.0.6002.18005, and 6.0.6002.228726.0.6001.22202, 6.0.6002.18005, and 6.0.6002.228721001

      FIPS Approved algorithms: AES (Certs. #739 and #756); DSA (Cert. #283); ECDSA (Cert. #82); HMAC (Cert. #412); RNG (Cert. #435 and SP 800-90, vendor affirmed); RSA (Certs. #353 and #357); SHS (Cert. #753); Triple-DES (Cert. #656)

      +

      Other algorithms: AES (GCM and GMAC; non-compliant); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides between 128 and 256 bits of encryption strength); MD2; MD4; MD5; RC2; RC4; RNG (SP 800-90 Dual-EC; non-compliant); RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant provides less than 112 bits of encryption strength)

      Enhanced Cryptographic Provider (RSAENH)6.0.6001.22202 and 6.0.6002.180056.0.6001.22202 and 6.0.6002.180051002

      FIPS Approved algorithms: AES (Cert. #739); HMAC (Cert. #407); RNG (SP 800-90, vendor affirmed); RSA (Certs. #353 and #354); SHS (Cert. #753); Triple-DES (Cert. #656)

      +

      Other algorithms: DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength)

      Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)6.0.6001.18000 and 6.0.6002.180056.0.6001.18000 and 6.0.6002.180051003

      FIPS Approved algorithms: DSA (Cert. #281); RNG (Cert. #435); SHS (Cert. #753); Triple-DES (Cert. #656); Triple-DES MAC (Triple-DES Cert. #656, vendor affirmed)

      +

      Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD5; RC2; RC2 MAC; RC4

      + + +##### Windows Vista + +Validated Editions: Ultimate Edition + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Enhanced Cryptographic Provider (RSAENH)6.0.6000.16386893FIPS Approved algorithms: AES (Cert. #553); HMAC (Cert. #297); RNG (Cert. #321); RSA (Certs. #255 and #258); SHS (Cert. #618); Triple-DES (Cert. #549)
      +
      +Other algorithms: DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
      Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)6.0.6000.16386894FIPS Approved algorithms: DSA (Cert. #226); RNG (Cert. #321); SHS (Cert. #618); Triple-DES (Cert. #549); Triple-DES MAC (Triple-DES Cert. #549, vendor affirmed)
      +
      +Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD5; RC2; RC2 MAC; RC4
      BitLocker™ Drive Encryption6.0.6000.16386947FIPS Approved algorithms: AES (Cert. #715); HMAC (Cert. #386); SHS (Cert. #737)
      +
      +Other algorithms: Elephant Diffuser
      Kernel Mode Security Support Provider Interface (ksecdd.sys)6.0.6000.16386, 6.0.6000.16870 and 6.0.6000.21067891FIPS Approved algorithms: AES (Cert. #553); ECDSA (Cert. #60); HMAC (Cert. #298); RNG (Cert. #321); RSA (Certs. #257 and #258); SHS (Cert. #618); Triple-DES (Cert. #549)
      +
      +Other algorithms: DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides 128 to 256 bits of encryption strength); MD2; MD4; MD5; RC2; RC4; HMAC MD5
      + + +##### Windows XP SP3 + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + +
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Kernel Mode Cryptographic Module (FIPS.SYS)5.1.2600.5512997

      FIPS Approved algorithms: HMAC (Cert. #429); RNG (Cert. #449); SHS (Cert. #785); Triple-DES (Cert. #677); Triple-DES MAC (Triple-DES Cert. #677, vendor affirmed)

      +

      Other algorithms: DES; MD5; HMAC MD5

      Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)5.1.2600.5507990

      FIPS Approved algorithms: DSA (Cert. #292); RNG (Cert. #448); SHS (Cert. #784); Triple-DES (Cert. #676); Triple-DES MAC (Triple-DES Cert. #676, vendor affirmed)

      +

      Other algorithms: DES; DES40; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits); MD5; RC2; RC4

      Enhanced Cryptographic Provider (RSAENH)5.1.2600.5507989

      FIPS Approved algorithms: AES (Cert. #781); HMAC (Cert. #428); RNG (Cert. #447); RSA (Cert. #371); SHS (Cert. #783); Triple-DES (Cert. #675); Triple-DES MAC (Triple-DES Cert. #675, vendor affirmed)

      +

      Other algorithms: DES; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits)

      + + +##### Windows XP SP2 + + ++++++ + + + + + + + + + + + + + + + + + + + + +
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      DSS/Diffie-Hellman Enhanced Cryptographic Provider5.1.2600.2133240

      FIPS Approved algorithms: Triple-DES (Cert. #16); DSA/SHA-1 (Cert. #29)

      +

      Other algorithms: DES (Cert. #66); RC2; RC4; MD5; DES40; Diffie-Hellman (key agreement)

      Microsoft Enhanced Cryptographic Provider5.1.2600.2161238

      FIPS Approved algorithms: Triple-DES (Cert. #81); AES (Cert. #33); SHA-1 (Cert. #83); RSA (PKCS#1, vendor affirmed); HMAC-SHA-1 (Cert. #83, vendor affirmed)

      +

      Other algorithms: DES (Cert. #156); RC2; RC4; MD5

      + + +##### Windows XP SP1 + + ++++++ + + + + + + + + + + + + + + +
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Microsoft Enhanced Cryptographic Provider5.1.2600.1029238

      FIPS Approved algorithms: Triple-DES (Cert. #81); AES (Cert. #33); SHA-1 (Cert. #83); RSA (PKCS#1, vendor affirmed); HMAC-SHA-1 (Cert. #83, vendor affirmed)

      +

      Other algorithms: DES (Cert. #156); RC2; RC4; MD5

      + + +##### Windows XP + + ++++++ + + + + + + + + + + + + + + +
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Kernel Mode Cryptographic Module5.1.2600.0241

      FIPS Approved algorithms: Triple-DES (Cert. #16); DSA/SHA-1 (Cert. #35); HMAC-SHA-1 (Cert. #35, vendor affirmed)

      +

      Other algorithms: DES (Cert. #89)

      + + +##### Windows 2000 SP3 + + ++++++ + + + + + + + + + + + + + + + + + + + + +
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Kernel Mode Cryptographic Module (FIPS.SYS)5.0.2195.1569106

      FIPS Approved algorithms: Triple-DES (Cert. #16); SHA-1 (Certs. #35)

      +

      Other algorithms: DES (Certs. #89)

      Base DSS Cryptographic Provider, Base Cryptographic Provider, DSS/Diffie-Hellman Enhanced Cryptographic Provider, and Enhanced Cryptographic Provider

      (Base DSS: 5.0.2195.3665 [SP3])

      +

      (Base: 5.0.2195.3839 [SP3])

      +

      (DSS/DH Enh: 5.0.2195.3665 [SP3])

      +

      (Enh: 5.0.2195.3839 [SP3]

      		103

      FIPS Approved algorithms: Triple-DES (Cert. #16); DSA/SHA-1 (Certs. #28 and #29); RSA (vendor affirmed)

      +

      Other algorithms: DES (Certs. #65, 66, 67 and 68); Diffie-Hellman (key agreement); RC2; RC4; MD2; MD4; MD5

      + + +##### Windows 2000 SP2 + + ++++++ + + + + + + + + + + + + + + + + + + + + +
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Kernel Mode Cryptographic Module (FIPS.SYS)5.0.2195.1569106

      FIPS Approved algorithms: Triple-DES (Cert. #16); SHA-1 (Certs. #35)

      +

      Other algorithms: DES (Certs. #89)

      Base DSS Cryptographic Provider, Base Cryptographic Provider, DSS/Diffie-Hellman Enhanced Cryptographic Provider, and Enhanced Cryptographic Provider

      (Base DSS:

      +

      5.0.2195.2228 [SP2])

      +

      (Base:

      +

      5.0.2195.2228 [SP2])

      +

      (DSS/DH Enh:

      +

      5.0.2195.2228 [SP2])

      +

      (Enh:

      +

      5.0.2195.2228 [SP2])

      		103

      FIPS Approved algorithms: Triple-DES (Cert. #16); DSA/SHA-1 (Certs. #28 and #29); RSA (vendor affirmed)

      +

      Other algorithms: DES (Certs. #65, 66, 67 and 68); Diffie-Hellman (key agreement); RC2; RC4; MD2; MD4; MD5

      + + +##### Windows 2000 SP1 + + ++++++ + + + + + + + + + + + + + + +
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Base DSS Cryptographic Provider, Base Cryptographic Provider, DSS/Diffie-Hellman Enhanced Cryptographic Provider, and Enhanced Cryptographic Provider

      (Base DSS: 5.0.2150.1391 [SP1])

      +

      (Base: 5.0.2150.1391 [SP1])

      +

      (DSS/DH Enh: 5.0.2150.1391 [SP1])

      +

      (Enh: 5.0.2150.1391 [SP1])

      		103

      FIPS Approved algorithms: Triple-DES (Cert. #16); DSA/SHA-1 (Certs. #28 and #29); RSA (vendor affirmed)

      +

      Other algorithms: DES (Certs. #65, 66, 67 and 68); Diffie-Hellman (key agreement); RC2; RC4; MD2; MD4; MD5

      + + +##### Windows 2000 + + ++++++ + + + + + + + + + + + + + + +
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Base DSS Cryptographic Provider, Base Cryptographic Provider, DSS/Diffie-Hellman Enhanced Cryptographic Provider, and Enhanced Cryptographic Provider5.0.2150.176

      FIPS Approved algorithms: Triple-DES (vendor affirmed); DSA/SHA-1 (Certs. #28 and 29); RSA (vendor affirmed)

      +

      Other algorithms: DES (Certs. #65, 66, 67 and 68); RC2; RC4; MD2; MD4; MD5; Diffie-Hellman (key agreement)

      + + +##### Windows 95 and Windows 98 + + ++++++ + + + + + + + + + + + + + + +
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Base DSS Cryptographic Provider, Base Cryptographic Provider, DSS/Diffie-Hellman Enhanced Cryptographic Provider, and Enhanced Cryptographic Provider5.0.1877.6 and 5.0.1877.775

      FIPS Approved algorithms: Triple-DES (vendor affirmed); SHA-1 (Certs. #20 and 21); DSA/SHA-1 (Certs. #25 and 26); RSA (vendor- affirmed)

      +

      Other algorithms: DES (Certs. #61, 62, 63 and 64); RC2; RC4; MD2; MD4; MD5; Diffie-Hellman (key agreement)

      + + +##### Windows NT 4.0 + + + + + + + + + + + + + + + + +
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Base Cryptographic Provider5.0.1877.6 and 5.0.1877.768FIPS Approved algorithms: SHA-1 (Certs. #20 and 21); DSA/SHA- 1 (Certs. #25 and 26); RSA (vendor affirmed)
      +
      +Other algorithms: DES (Certs. #61, 62, 63 and 64); Triple-DES (allowed for US and Canadian Government use); RC2; RC4; MD2; MD4; MD5; Diffie-Hellman (key agreement)
      + +## Modules used by Windows Server + +##### Windows Server (Version 1803) + +Validated Editions: Standard, Datacenter + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Cryptographic Primitives Library10.0.17134#3197See Security Policy and Certificate page for algorithm information
      Kernel Mode Cryptographic Primitives Library10.0.17134#3196See Security Policy and Certificate page for algorithm information
      Code Integrity10.0.17134#3195See Security Policy and Certificate page for algorithm information
      Windows OS Loader10.0.17134#3480See Security Policy and Certificate page for algorithm information
      Secure Kernel Code Integrity10.0.17134#3096See Security Policy and Certificate page for algorithm information
      BitLocker Dump Filter10.0.17134#3092See Security Policy and Certificate page for algorithm information
      Boot Manager10.0.17134#3089See Security Policy and Certificate page for algorithm information
      + +##### Windows Server (Version 1709) + +Validated Editions: Standard, Datacenter + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Cryptographic Primitives Library10.0.16299#3197See Security Policy and Certificate page for algorithm information
      Kernel Mode Cryptographic Primitives Library10.0.16299#3196See Security Policy and Certificate page for algorithm information
      Code Integrity10.0.16299#3195See Security Policy and Certificate page for algorithm information
      Windows OS Loader10.0.16299#3194See Security Policy and Certificate page for algorithm information
      Secure Kernel Code Integrity10.0.16299#3096See Security Policy and Certificate page for algorithm information
      BitLocker Dump Filter10.0.16299#3092See Security Policy and Certificate page for algorithm information
      Windows Resume10.0.16299#3091See Security Policy and Certificate page for algorithm information
      Boot Manager10.0.16299#3089See Security Policy and Certificate page for algorithm information
      + +##### Windows Server 2016 + +Validated Editions: Standard, Datacenter, Storage Server + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll)10.0.143932937FIPS Approved algorithms: AES (Cert. #4064); DRBG (Cert. #1217); DSA (Cert. #1098); ECDSA (Cert. #911); HMAC (Cert. #2651); KAS (Cert. #92); KBKDF (Cert. #101); KTS (AES Cert. #4062; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2192, #2193 and #2195); SHS (Cert. #3347); Triple-DES (Cert. #2227)
      +
      +Other algorithms: HMAC-MD5; MD5; DES; Legacy CAPI KDF; MD2; MD4; RC2; RC4; RSA (encrypt/decrypt)
      Kernel Mode Cryptographic Primitives Library (cng.sys)10.0.143932936FIPS Approved algorithms: AES (Cert. #4064); DRBG (Cert. #1217); DSA (Cert. #1098); ECDSA (Cert. #911); HMAC (Cert. #2651); KAS (Cert. #92); KBKDF (Cert. #101); KTS (AES Cert. #4062; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2192, #2193 and #2195); SHS (Cert. #3347); Triple-DES (Cert. #2227)
      +
      +Other algorithms: HMAC-MD5; MD5; NDRNG; DES; Legacy CAPI KDF; MD2; MD4; RC2; RC4; RSA (encrypt/decrypt)
      Boot Manager10.0.143932931

      FIPS Approved algorithms: AES (Certs. #4061 and #4064); HMAC (Cert. #2651); PBKDF (vendor affirmed); RSA (Cert. #2193); SHS (Cert. #3347)

      +

      Other algorithms: MD5; PBKDF (non-compliant); VMK KDF

      BitLocker® Windows OS Loader (winload)10.0.143932932FIPS Approved algorithms: AES (Certs. #4061 and #4064); RSA (Cert. #2193); SHS (Cert. #3347)
      +
      +Other algorithms: NDRNG; MD5
      BitLocker® Windows Resume (winresume)10.0.143932933FIPS Approved algorithms: AES (Certs. #4061 and #4064); RSA (Cert. #2193); SHS (Cert. #3347)
      +
      +Other algorithms: MD5
      BitLocker® Dump Filter (dumpfve.sys)10.0.143932934FIPS Approved algorithms: AES (Certs. #4061 and #4064)
      Code Integrity (ci.dll)10.0.143932935FIPS Approved algorithms: RSA (Cert. #2193); SHS (Cert. #3347)
      +
      +Other algorithms: AES (non-compliant); MD5
      Secure Kernel Code Integrity (skci.dll)10.0.143932938FIPS Approved algorithms: RSA (Certs. #2193); SHS (Certs. #3347)
      +
      +Other algorithms: MD5
      + + +##### Windows Server 2012 R2 + +Validated Editions: Server, Storage Server, + +**StorSimple 8000 Series, Azure StorSimple Virtual Array Windows Server 2012 R2** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll)6.3.9600 6.3.9600.170312357FIPS Approved algorithms: AES (Cert. #2832); DRBG (Certs. #489); DSA (Cert. #855); ECDSA (Cert. #505); HMAC (Cert. #1773); KAS (Cert. #47); KBKDF (Cert. #30); PBKDF (vendor affirmed); RSA (Certs. #1487, #1493 and #1519); SHS (Cert. #2373); Triple-DES (Cert. #1692)
      +
      +Other algorithms: AES (Cert. #2832, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); AES-GCM encryption (non-compliant); DES; HMAC MD5; Legacy CAPI KDF; MD2; MD4; MD5; NDRNG; RC2; RC4; RSA (encrypt/decrypt)
      Kernel Mode Cryptographic Primitives Library (cng.sys)6.3.9600 6.3.9600.170422356FIPS Approved algorithms: AES (Cert. #2832); DRBG (Certs. #489); ECDSA (Cert. #505); HMAC (Cert. #1773); KAS (Cert. #47); KBKDF (Cert. #30); PBKDF (vendor affirmed); RSA (Certs. #1487, #1493 and #1519); SHS (Cert. # 2373); Triple-DES (Cert. #1692)
      +
      +Other algorithms: AES (Cert. #2832, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); AES-GCM encryption (non-compliant); DES; HMAC MD5; Legacy CAPI KDF; MD2; MD4; MD5; NDRNG; RC2; RC4; RSA (encrypt/decrypt)
      Boot Manager6.3.9600 6.3.9600.170312351FIPS Approved algorithms: AES (Cert. #2832); HMAC (Cert. #1773); PBKDF (vendor affirmed); RSA (Cert. #1494); SHS (Certs. # 2373 and #2396)
      +
      +Other algorithms: MD5; KDF (non-compliant); PBKDF (non-compliant)
      BitLocker® Windows OS Loader (winload)6.3.9600 6.3.9600.170312352FIPS Approved algorithms: AES (Cert. #2832); RSA (Cert. #1494); SHS (Cert. #2396)
      +
      +Other algorithms: MD5; NDRNG
      BitLocker® Windows Resume (winresume)[16]6.3.9600 6.3.9600.170312353FIPS Approved algorithms: AES (Cert. #2832); RSA (Cert. #1494); SHS (Certs. # 2373 and #2396)
      +
      +Other algorithms: MD5
      BitLocker® Dump Filter (dumpfve.sys)[17]6.3.9600 6.3.9600.170312354FIPS Approved algorithms: AES (Cert. #2832)
      +
      +Other algorithms: N/A
      Code Integrity (ci.dll)6.3.9600 6.3.9600.170312355FIPS Approved algorithms: RSA (Cert. #1494); SHS (Cert. # 2373)
      +
      +Other algorithms: MD5
      + + +\[16\] Does not apply to **Azure StorSimple Virtual Array Windows Server 2012 R2** + +\[17\] Does not apply to **Azure StorSimple Virtual Array Windows Server 2012 R2** + +**Windows Server 2012** + +Validated Editions: Server, Storage Server + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Cryptographic Primitives Library (BCRYPTPRIMITIVES.DLL)6.2.92001892FIPS Approved algorithms: AES (Certs. #2197 and #2216); DRBG (Certs. #258); DSA (Cert. #687); ECDSA (Cert. #341); HMAC (Cert. #1345); KAS (Cert. #36); KBKDF (Cert. #3); PBKDF (vendor affirmed); RSA (Certs. #1133 and #1134); SHS (Cert. #1903); Triple-DES (Cert. #1387)
      +
      +Other algorithms: AES (Cert. #2197, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)#687); ECDSA (Cert. ); HMAC (Cert. #); KAS (Cert. ); KBKDF (Cert. ); PBKDF (vendor affirmed); RSA (Certs.  and ); SHS (Cert. ); Triple-DES (Cert. )
      +
      +Other algorithms: AES (Cert. , key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)
      Kernel Mode Cryptographic Primitives Library (cng.sys)6.2.92001891FIPS Approved algorithms: AES (Certs. #2197 and #2216); DRBG (Certs. #258 and #259); ECDSA (Cert. #341); HMAC (Cert. #1345); KAS (Cert. #36); KBKDF (Cert. #3); PBKDF (vendor affirmed); RNG (Cert. #1110); RSA (Certs. #1133 and #1134); SHS (Cert. #1903); Triple-DES (Cert. #1387)
      +
      +Other algorithms: AES (Cert. #2197, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)#1110); RSA (Certs.  and ); SHS (Cert. ); Triple-DES (Cert. )
      +
      +Other algorithms: AES (Cert. , key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)
      Boot Manager6.2.92001895FIPS Approved algorithms: AES (Certs. #2196 and #2198); HMAC (Cert. #1347); RSA (Cert. #1132); SHS (Cert. #1903)
      +
      +Other algorithms: MD5
      BitLocker® Windows OS Loader (WINLOAD)6.2.92001896FIPS Approved algorithms: AES (Certs. #2196 and #2198); RSA (Cert. #1132); SHS (Cert. #1903)
      +
      +Other algorithms: AES (Cert. #2197; non-compliant); MD5; Non-Approved RNG
      BitLocker® Windows Resume (WINRESUME)6.2.92001898FIPS Approved algorithms: AES (Certs. #2196 and #2198); RSA (Cert. #1132); SHS (Cert. #1903)
      +
      +Other algorithms: MD5
      BitLocker® Dump Filter (DUMPFVE.SYS)6.2.92001899FIPS Approved algorithms: AES (Certs. #2196 and #2198)
      +
      +Other algorithms: N/A
      Code Integrity (CI.DLL)6.2.92001897FIPS Approved algorithms: RSA (Cert. #1132); SHS (Cert. #1903)
      +
      +Other algorithms: MD5
      Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH.DLL)6.2.92001893FIPS Approved algorithms: DSA (Cert. #686); SHS (Cert. #1902); Triple-DES (Cert. #1386); Triple-DES MAC (Triple-DES Cert. #1386, vendor affirmed)
      +
      +Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman; MD5; RC2; RC2 MAC; RC4; Triple-DES (Cert. #1386, key wrapping; key establishment methodology provides 112 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
      Enhanced Cryptographic Provider (RSAENH.DLL)6.2.92001894FIPS Approved algorithms: AES (Cert. #2196); HMAC (Cert. #1346); RSA (Cert. #1132); SHS (Cert. #1902); Triple-DES (Cert. #1386)
      +
      +Other algorithms: AES (Cert. #2196, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); Triple-DES (Cert. #1386, key wrapping; key establishment methodology provides 112 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
      + + +##### Windows Server 2008 R2 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Boot Manager (bootmgr)6.1.7600.16385 or 6.1.7601.175146.1.7600.16385 or 6.1.7601.175141321FIPS Approved algorithms: AES (Certs. #1168 and #1177); HMAC (Cert. #675); RSA (Cert. #568); SHS (Cert. #1081)
      +
      +Other algorithms: MD5
      Winload OS Loader (winload.exe)6.1.7600.16385, 6.1.7600.16757, 6.1.7600.20897, 6.1.7600.20916, 6.1.7601.17514, 6.1.7601.17556, 6.1.7601.21655 and 6.1.7601.216756.1.7600.16385, 6.1.7600.16757, 6.1.7600.20897, 6.1.7600.20916, 6.1.7601.17514, 6.1.7601.17556, 6.1.7601.21655 and 6.1.7601.216751333FIPS Approved algorithms: AES (Certs. #1168 and #1177); RSA (Cert. #568); SHS (Cert. #1081)
      +
      +Other algorithms: MD5
      Code Integrity (ci.dll)6.1.7600.16385, 6.1.7600.17122, 6.1.7600.21320, 6.1.7601.17514, 6.1.7601.17950 and 6.1.7601.221086.1.7600.16385, 6.1.7600.17122, 6.1.7600.21320, 6.1.7601.17514, 6.1.7601.17950 and 6.1.7601.221081334FIPS Approved algorithms: RSA (Cert. #568); SHS (Cert. #1081)
      +
      +Other algorithms: MD5
      Kernel Mode Cryptographic Primitives Library (cng.sys)6.1.7600.16385, 6.1.7600.16915, 6.1.7600.21092, 6.1.7601.17514, 6.1.7601.17919, 6.1.7601.17725, 6.1.7601.21861 and 6.1.7601.220766.1.7600.16385, 6.1.7600.16915, 6.1.7600.21092, 6.1.7601.17514, 6.1.7601.17919, 6.1.7601.17725, 6.1.7601.21861 and 6.1.7601.220761335FIPS Approved algorithms: AES (Certs. #1168 and #1177); AES GCM (Cert. #1168, vendor-affirmed); AES GMAC (Cert. #1168, vendor-affirmed); DRBG (Certs. #23 and #27); ECDSA (Cert. #142); HMAC (Cert. #686); KAS (SP 800-56A, vendor affirmed, key agreement; key establishment methodology provides between 80 and 256 bits of encryption strength); RNG (Cert. #649); RSA (Certs. #559 and #567); SHS (Cert. #1081); Triple-DES (Cert. #846)
      +
      +-Other algorithms: AES (Cert. #1168, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4
      Cryptographic Primitives Library (bcryptprimitives.dll)66.1.7600.16385 or 6.1.7601.1751466.1.7600.16385 or 6.1.7601.175141336FIPS Approved algorithms: AES (Certs. #1168 and #1177); AES GCM (Cert. #1168, vendor-affirmed); AES GMAC (Cert. #1168, vendor-affirmed); DRBG (Certs. #23 and #27); DSA (Cert. #391); ECDSA (Cert. #142); HMAC (Cert. #686); KAS (SP 800-56A, vendor affirmed, key agreement; key establishment methodology provides between 80 and 256 bits of encryption strength); RNG (Cert. #649); RSA (Certs. #559 and #567); SHS (Cert. #1081); Triple-DES (Cert. #846)
      +
      +Other algorithms: AES (Cert. #1168, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; HMAC MD5; MD2; MD4; MD5; RC2; RC4
      Enhanced Cryptographic Provider (RSAENH)6.1.7600.163851337FIPS Approved algorithms: AES (Cert. #1168); DRBG (Cert. #23); HMAC (Cert. #687); SHS (Cert. #1081); RSA (Certs. #559 and #568); Triple-DES (Cert. #846)
      +
      +Other algorithms: DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 256 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
      Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)6.1.7600.163851338FIPS Approved algorithms: DSA (Cert. #390); RNG (Cert. #649); SHS (Cert. #1081); Triple-DES (Cert. #846); Triple-DES MAC (Triple-DES Cert. #846, vendor affirmed)
      +
      +Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman; MD5; RC2; RC2 MAC; RC4
      BitLocker™ Drive Encryption6.1.7600.16385, 6.1.7600.16429, 6.1.7600.16757, 6.1.7600.20536, 6.1.7600.20873, 6.1.7600.20897, 6.1.7600.20916, 6.1.7601.17514, 6.1.7601.17556, 6.1.7601.21634, 6.1.7601.21655 or 6.1.7601.216756.1.7600.16385, 6.1.7600.16429, 6.1.7600.16757, 6.1.7600.20536, 6.1.7600.20873, 6.1.7600.20897, 6.1.7600.20916, 6.1.7601.17514, 6.1.7601.17556, 6.1.7601.21634, 6.1.7601.21655 or 6.1.7601.216751339FIPS Approved algorithms: AES (Certs. #1168 and #1177); HMAC (Cert. #675); SHS (Cert. #1081)
      +
      +Other algorithms: Elephant Diffuser
      + + +##### Windows Server 2008 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Boot Manager (bootmgr)6.0.6001.18000, 6.0.6002.18005 and 6.0.6002.224976.0.6001.18000, 6.0.6002.18005 and 6.0.6002.224971004FIPS Approved algorithms: AES (Certs. #739 and #760); HMAC (Cert. #415); RSA (Cert. #355); SHS (Cert. #753)
      +
      +Other algorithms: N/A
      Winload OS Loader (winload.exe)6.0.6001.18000, 6.0.6001.18606, 6.0.6001.22861, 6.0.6002.18005, 6.0.6002.18411, 6.0.6002.22497 and 6.0.6002.225966.0.6001.18000, 6.0.6001.18606, 6.0.6001.22861, 6.0.6002.18005, 6.0.6002.18411, 6.0.6002.22497 and 6.0.6002.225961005FIPS Approved algorithms: AES (Certs. #739 and #760); RSA (Cert. #355); SHS (Cert. #753)
      +
      +Other algorithms: MD5
      Code Integrity (ci.dll)6.0.6001.18000 and 6.0.6002.180056.0.6001.18000 and 6.0.6002.180051006FIPS Approved algorithms: RSA (Cert. #355); SHS (Cert. #753)
      +
      +Other algorithms: MD5
      Kernel Mode Security Support Provider Interface (ksecdd.sys)6.0.6001.18709, 6.0.6001.18272, 6.0.6001.18796, 6.0.6001.22202, 6.0.6001.22450, 6.0.6001.22987, 6.0.6001.23069, 6.0.6002.18005, 6.0.6002.18051, 6.0.6002.18541, 6.0.6002.18643, 6.0.6002.22152, 6.0.6002.22742 and 6.0.6002.228696.0.6001.18709, 6.0.6001.18272, 6.0.6001.18796, 6.0.6001.22202, 6.0.6001.22450, 6.0.6001.22987, 6.0.6001.23069, 6.0.6002.18005, 6.0.6002.18051, 6.0.6002.18541, 6.0.6002.18643, 6.0.6002.22152, 6.0.6002.22742 and 6.0.6002.228691007FIPS Approved algorithms: AES (Certs. #739 and #757); ECDSA (Cert. #83); HMAC (Cert. #413); RNG (Cert. #435 and SP800-90 AES-CTR, vendor affirmed); RSA (Certs. #353 and #358); SHS (Cert. #753); Triple-DES (Cert. #656)
      +
      +Other algorithms: AES (GCM and GMAC; non-compliant); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides between 128 and 256 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4; RNG (SP 800-90 Dual-EC; non-compliant); RSA (key wrapping: key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength)#83); HMAC (Cert. ); RNG (Cert.  and SP800-90 AES-CTR, vendor affirmed); RSA (Certs.  and ); SHS (Cert. ); Triple-DES (Cert. )
      +
      +Other algorithms: AES (GCM and GMAC; non-compliant); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides between 128 and 256 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4; RNG (SP 800-90 Dual-EC; non-compliant); RSA (key wrapping: key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
      Cryptographic Primitives Library (bcrypt.dll)6.0.6001.22202, 6.0.6002.18005 and 6.0.6002.228726.0.6001.22202, 6.0.6002.18005 and 6.0.6002.228721008FIPS Approved algorithms: AES (Certs. #739 and #757); DSA (Cert. #284); ECDSA (Cert. #83); HMAC (Cert. #413); RNG (Cert. #435 and SP800-90, vendor affirmed); RSA (Certs. #353 and #358); SHS (Cert. #753); Triple-DES (Cert. #656)
      +
      +Other algorithms: AES (GCM and GMAC; non-compliant); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides between 128 and 256 bits of encryption strength); MD2; MD4; MD5; RC2; RC4; RNG (SP 800-90 Dual-EC; non-compliant); RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant provides less than 112 bits of encryption strength)
      Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)6.0.6001.18000 and 6.0.6002.180056.0.6001.18000 and 6.0.6002.180051009FIPS Approved algorithms: DSA (Cert. #282); RNG (Cert. #435); SHS (Cert. #753); Triple-DES (Cert. #656); Triple-DES MAC (Triple-DES Cert. #656, vendor affirmed)
      +
      +-Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD5; RC2; RC2 MAC; RC4
      Enhanced Cryptographic Provider (RSAENH)6.0.6001.22202 and 6.0.6002.180056.0.6001.22202 and 6.0.6002.180051010FIPS Approved algorithms: AES (Cert. #739); HMAC (Cert. #408); RNG (SP 800-90, vendor affirmed); RSA (Certs. #353 and #355); SHS (Cert. #753); Triple-DES (Cert. #656)
      +
      +Other algorithms: DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
      + + +##### Windows Server 2003 SP2 + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + +
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)5.2.3790.3959875

      FIPS Approved algorithms: DSA (Cert. #221); RNG (Cert. #314); RSA (Cert. #245); SHS (Cert. #611); Triple-DES (Cert. #543)

      +

      Other algorithms: DES; DES40; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD5; RC2; RC4

      Kernel Mode Cryptographic Module (FIPS.SYS)5.2.3790.3959869

      FIPS Approved algorithms: HMAC (Cert. #287); RNG (Cert. #313); SHS (Cert. #610); Triple-DES (Cert. #542)

      +

      Other algorithms: DES; HMAC-MD5

      Enhanced Cryptographic Provider (RSAENH)5.2.3790.3959868

      FIPS Approved algorithms: AES (Cert. #548); HMAC (Cert. #289); RNG (Cert. #316); RSA (Cert. #245); SHS (Cert. #613); Triple-DES (Cert. #544)

      +

      Other algorithms: DES; RC2; RC4; MD2; MD4; MD5; RSA (key wrapping; key establishment methodology provides between 112 and 256 bits of encryption strength; non-compliant less than 112 bits of encryption strength)

      + + +##### Windows Server 2003 SP1 + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + +
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Kernel Mode Cryptographic Module (FIPS.SYS)5.2.3790.1830 [SP1]405

      FIPS Approved algorithms: Triple-DES (Certs. #201[1] and #370[1]); SHS (Certs. #177[1] and #371[2])

      +

      Other algorithms: DES (Cert. #230[1]); HMAC-MD5; HMAC-SHA-1 (non-compliant)

      +

      [1] x86
      +[2] SP1 x86, x64, IA64

      Enhanced Cryptographic Provider (RSAENH)5.2.3790.1830 [Service Pack 1])382

      FIPS Approved algorithms: Triple-DES (Cert. #192[1] and #365[2]); AES (Certs. #80[1] and #290[2]); SHS (Cert. #176[1] and #364[2]); HMAC (Cert. #176, vendor affirmed[1] and #99[2]); RSA (PKCS#1, vendor affirmed[1] and #81[2])

      +

      Other algorithms: DES (Cert. #226[1]); SHA-256[1]; SHA-384[1]; SHA-512[1]; RC2; RC4; MD2; MD4; MD5

      +

      [1] x86
      +[2] SP1 x86, x64, IA64

      Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)5.2.3790.1830 [Service Pack 1]381

      FIPS Approved algorithms: Triple-DES (Certs. #199[1] and #381[2]); SHA-1 (Certs. #181[1] and #385[2]); DSA (Certs. #95[1] and #146[2]); RSA (Cert. #81)

      +

      Other algorithms: DES (Cert. #229[1]); Diffie-Hellman (key agreement); RC2; RC4; MD5; DES 40

      +

      [1] x86
      +[2] SP1 x86, x64, IA64

      + + +##### Windows Server 2003 + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + +
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Kernel Mode Cryptographic Module (FIPS.SYS)5.2.3790.0405

      FIPS Approved algorithms: Triple-DES (Certs. #201[1] and #370[1]); SHS (Certs. #177[1] and #371[2])

      +

      Other algorithms: DES (Cert. #230[1]); HMAC-MD5; HMAC-SHA-1 (non-compliant)

      +

      [1] x86
      +[2] SP1 x86, x64, IA64

      Enhanced Cryptographic Provider (RSAENH)5.2.3790.0382

      FIPS Approved algorithms: Triple-DES (Cert. #192[1] and #365[2]); AES (Certs. #80[1] and #290[2]); SHS (Cert. #176[1] and #364[2]); HMAC (Cert. #176, vendor affirmed[1] and #99[2]); RSA (PKCS#1, vendor affirmed[1] and #81[2])

      +

      Other algorithms: DES (Cert. #226[1]); SHA-256[1]; SHA-384[1]; SHA-512[1]; RC2; RC4; MD2; MD4; MD5

      +

      [1] x86
      +[2] SP1 x86, x64, IA64

      Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)5.2.3790.0381

      FIPS Approved algorithms: Triple-DES (Certs. #199[1] and #381[2]); SHA-1 (Certs. #181[1] and #385[2]); DSA (Certs. #95[1] and #146[2]); RSA (Cert. #81)

      +

      Other algorithms: DES (Cert. #229[1]); Diffie-Hellman (key agreement); RC2; RC4; MD5; DES 40

      +

      [1] x86
      +[2] SP1 x86, x64, IA64

      + + +#### Other Products + +##### Windows Embedded Compact 7 and Windows Embedded Compact 8 + + ++++++ + + + + + + + + + + + + + + + + + + + + +
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Enhanced Cryptographic Provider7.00.2872 [1] and 8.00.6246 [2]2957

      FIPS Approved algorithms: AES (Certs.#4433and#4434); CKG (vendor affirmed); DRBG (Certs.#1432and#1433); HMAC (Certs.#2946and#2945); RSA (Certs.#2414and#2415); SHS (Certs.#3651and#3652); Triple-DES (Certs.#2383and#2384)

      +

      Allowed algorithms: HMAC-MD5; MD5; NDRNG

      Cryptographic Primitives Library (bcrypt.dll)7.00.2872 [1] and 8.00.6246 [2]2956

      FIPS Approved algorithms: AES (Certs.#4430and#4431); CKG (vendor affirmed); CVL (Certs.#1139and#1140); DRBG (Certs.#1429and#1430); DSA (Certs.#1187and#1188); ECDSA (Certs.#1072and#1073); HMAC (Certs.#2942and#2943); KAS (Certs.#114and#115); RSA (Certs.#2411and#2412); SHS (Certs.#3648and#3649); Triple-DES (Certs.#2381and#2382)

      +

      Allowed algorithms: MD5; NDRNG; RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength

      + + + +##### Windows CE 6.0 and Windows Embedded Compact 7 + + ++++++ + + + + + + + + + + + + + + +
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Enhanced Cryptographic Provider6.00.1937 [1] and 7.00.1687 [2]825

      FIPS Approved algorithms: AES (Certs. #516 [1] and #2024 [2]); HMAC (Certs. #267 [1] and #1227 [2]); RNG (Certs. #292 [1] and #1060 [2]); RSA (Cert. #230 [1] and #1052 [2]); SHS (Certs. #589 [1] and #1774 [2]); Triple-DES (Certs. #526 [1] and #1308 [2])

      +

      Other algorithms: MD5; HMAC-MD5; RC2; RC4; DES

      + + +##### Outlook Cryptographic Provider + + ++++++ + + + + + + + + + + + + + + +
      Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
      Outlook Cryptographic Provider (EXCHCSP)SR-1A (3821)SR-1A (3821)110

      FIPS Approved algorithms: Triple-DES (Cert. #18); SHA-1 (Certs. #32); RSA (vendor affirmed)

      +

      Other algorithms: DES (Certs. #91); DES MAC; RC2; MD2; MD5

      + + + +### Cryptographic Algorithms + +The following tables are organized by cryptographic algorithms with their modes, states, and key sizes. For each algorithm implementation (operating system / platform), there is a link to the Cryptographic Algorithm Validation Program (CAVP) issued certificate. + +### Advanced Encryption Standard (AES) + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      Modes / States / Key SizesAlgorithm Implementation and Certificate #
        +
      • AES-CBC:
        • +
        • +
        • Modes: Decrypt, Encrypt
          • +
        • Key Lengths: 128, 192, 256 (bits)
          • +
        • +
      • AES-CFB128:
        • +
        • +
        • Modes: Decrypt, Encrypt
          • +
        • Key Lengths: 128, 192, 256 (bits)
          • +
        • +
      • AES-CTR:
        • +
        • +
        • Counter Source: Internal
          • +
        • Key Lengths: 128, 192, 256 (bits)
          • +
        • +
      • AES-OFB:
        • +
        • +
        • Modes: Decrypt, Encrypt
          • +
        • Key Lengths: 128, 192, 256 (bits)
          • +
        • +

      Microsoft Surface Hub Virtual TPM Implementations #4904

      +

      Version 10.0.15063.674

        +
      • AES-CBC:
        • +
        • +
        • Modes: Decrypt, Encrypt
          • +
        • Key Lengths: 128, 192, 256 (bits)
          • +
        • +
      • AES-CFB128:
        • +
        • +
        • Modes: Decrypt, Encrypt
          • +
        • Key Lengths: 128, 192, 256 (bits)
          • +
        • +
      • AES-CTR:
        • +
        • +
        • Counter Source: Internal
          • +
        • Key Lengths: 128, 192, 256 (bits)
          • +
        • +
      • AES-OFB:
        • +
        • +
        • Modes: Decrypt, Encrypt
          • +
        • Key Lengths: 128, 192, 256 (bits)
          • +
        • +

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #4903

      +

      Version 10.0.16299

        +
      • AES-CBC:
        • +
        • +
        • Modes: Decrypt, Encrypt
          • +
        • Key Lengths: 128, 192, 256 (bits)
          • +
        • +
      • AES-CCM:
        • +
        • +
        • Key Lengths: 128, 192, 256 (bits)
          • +
        • Tag Lengths: 32, 48, 64, 80, 96, 112, 128 (bits)
          • +
        • IV Lengths: 56, 64, 72, 80, 88, 96, 104 (bits)
          • +
        • Plain Text Length: 0-32
          • +
        • AAD Length: 0-65536
          • +
        • +
      • AES-CFB128:
        • +
        • +
        • Modes: Decrypt, Encrypt
          • +
        • Key Lengths: 128, 192, 256 (bits)
          • +
        • +
      • AES-CFB8:
        • +
        • +
        • Modes: Decrypt, Encrypt
          • +
        • Key Lengths: 128, 192, 256 (bits)
          • +
        • +
      • AES-CMAC:
        • +
        • +
        • Generation:
          • +
          • +
          • AES-128:
            • +
            • +
            • Block Sizes: Full, Partial
              • +
            • Message Length: 0-65536
              • +
            • Tag Length: 16-16
              • +
            • +
          • AES-192:
            • +
            • +
            • Block Sizes: Full, Partial
              • +
            • Message Length: 0-65536
              • +
            • Tag Length: 16-16
              • +
            • +
          • AES-256:
            • +
            • +
            • Block Sizes: Full, Partial
              • +
            • Message Length: 0-65536
              • +
            • Tag Length: 16-16
              • +
            • +
          • +
        • Verification:
          • +
          • +
          • AES-128:
            • +
            • +
            • Block Sizes: Full, Partial
              • +
            • Message Length: 0-65536
              • +
            • Tag Length: 16-16
              • +
            • +
          • AES-192:
            • +
            • +
            • Block Sizes: Full, Partial
              • +
            • Message Length: 0-65536
              • +
            • Tag Length: 16-16
              • +
            • +
          • AES-256:
            • +
            • +
            • Block Sizes: Full, Partial
              • +
            • Message Length: 0-65536
              • +
            • Tag Length: 16-16
              • +
            • +
          • +
        • +
      • AES-CTR:
        • +
        • +
        • Counter Source: Internal
          • +
        • Key Lengths: 128, 192, 256 (bits)
          • +
        • +
      • AES-ECB:
        • +
        • +
        • Modes: Decrypt, Encrypt
          • +
        • Key Lengths: 128, 192, 256 (bits)
          • +
        • +
      • AES-GCM:
        • +
        • +
        • Modes: Decrypt, Encrypt
          • +
        • Key Lengths: 128, 192, 256 (bits)
          • +
        • Tag Lengths: 96, 104, 112, 120, 128 (bits)
          • +
        • Plain Text Lengths: 0, 8, 1016, 1024 (bits)
          • +
        • AAD Lengths: 0, 8, 1016, 1024 (bits)
          • +
        • 96 bit IV supported
          • +
        • +
      • AES-XTS:
        • +
        • +
        • Key Size: 128:
          • +
          • +
          • Modes: Decrypt, Encrypt
            • +
          • Block Sizes: Full
            • +
          • +
        • Key Size: 256:
          • +
          • +
          • Modes: Decrypt, Encrypt
            • +
          • Block Sizes: Full
            • +
          • +
        • +

      Microsoft Surface Hub SymCrypt Cryptographic Implementations #4902

      +

      Version 10.0.15063.674

        +
      • AES-CBC:
        • +
        • +
        • Modes: Decrypt, Encrypt
          • +
        • Key Lengths: 128, 192, 256 (bits)
          • +
        • +
      • AES-CCM:
        • +
        • +
        • Key Lengths: 128, 192, 256 (bits)
          • +
        • Tag Lengths: 32, 48, 64, 80, 96, 112, 128 (bits)
          • +
        • IV Lengths: 56, 64, 72, 80, 88, 96, 104 (bits)
          • +
        • Plain Text Length: 0-32
          • +
        • AAD Length: 0-65536
          • +
        • +
      • AES-CFB128:
        • +
        • +
        • Modes: Decrypt, Encrypt
          • +
        • Key Lengths: 128, 192, 256 (bits)
          • +
        • +
      • AES-CFB8:
        • +
        • +
        • Modes: Decrypt, Encrypt
          • +
        • Key Lengths: 128, 192, 256 (bits)
          • +
        • +
      • AES-CMAC:
        • +
        • +
        • Generation:
          • +
          • +
          • AES-128:
            • +
            • +
            • Block Sizes: Full, Partial
              • +
            • Message Length: 0-65536
              • +
            • Tag Length: 16-16
              • +
            • +
          • AES-192:
            • +
            • +
            • Block Sizes: Full, Partial
              • +
            • Message Length: 0-65536
              • +
            • Tag Length: 16-16
              • +
            • +
          • AES-256:
            • +
            • +
            • Block Sizes: Full, Partial
              • +
            • Message Length: 0-65536
              • +
            • Tag Length: 16-16
              • +
            • +
          • +
        • Verification:
          • +
          • +
          • AES-128:
            • +
            • +
            • Block Sizes: Full, Partial
              • +
            • Message Length: 0-65536
              • +
            • Tag Length: 16-16
              • +
            • +
          • AES-192:
            • +
            • +
            • Block Sizes: Full, Partial
              • +
            • Message Length: 0-65536
              • +
            • Tag Length: 16-16
              • +
            • +
          • AES-256:
            • +
            • +
            • Block Sizes: Full, Partial
              • +
            • Message Length: 0-65536
              • +
            • Tag Length: 16-16
              • +
            • +
          • +
        • +
      • AES-CTR:
        • +
        • +
        • Counter Source: Internal
          • +
        • Key Lengths: 128, 192, 256 (bits)
          • +
        • +
      • AES-ECB:
        • +
        • +
        • Modes: Decrypt, Encrypt
          • +
        • Key Lengths: 128, 192, 256 (bits)
          • +
        • +
      • AES-GCM:
        • +
        • +
        • Modes: Decrypt, Encrypt
          • +
        • Key Lengths: 128, 192, 256 (bits)
          • +
        • Tag Lengths: 96, 104, 112, 120, 128 (bits)
          • +
        • Plain Text Lengths: 0, 8, 1016, 1024 (bits)
          • +
        • AAD Lengths: 0, 8, 1016, 1024 (bits)
          • +
        • 96 bit IV supported
          • +
        • +
      • AES-XTS:
        • +
        • +
        • Key Size: 128:
          • +
          • +
          • Modes: Decrypt, Encrypt
            • +
          • Block Sizes: Full
            • +
          • +
        • Key Size: 256:
          • +
          • +
          • Modes: Decrypt, Encrypt
            • +
          • Block Sizes: Full
            • +
          • +
        • +

      Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #4901

      +

      Version 10.0.15254

        +
      • AES-CBC:
        • +
        • +
        • Modes: Decrypt, Encrypt
          • +
        • Key Lengths: 128, 192, 256 (bits)
          • +
        • +
      • AES-CCM:
        • +
        • +
        • Key Lengths: 128, 192, 256 (bits)
          • +
        • Tag Lengths: 32, 48, 64, 80, 96, 112, 128 (bits)
          • +
        • IV Lengths: 56, 64, 72, 80, 88, 96, 104 (bits)
          • +
        • Plain Text Length: 0-32
          • +
        • AAD Length: 0-65536
          • +
        • +
      • AES-CFB128:
        • +
        • +
        • Modes: Decrypt, Encrypt
          • +
        • Key Lengths: 128, 192, 256 (bits)
          • +
        • +
      • AES-CFB8:
        • +
        • +
        • Modes: Decrypt, Encrypt
          • +
        • Key Lengths: 128, 192, 256 (bits)
          • +
        • +
      • AES-CMAC:
        • +
        • +
        • Generation:
          • +
          • +
          • AES-128:
            • +
            • +
            • Block Sizes: Full, Partial
              • +
            • Message Length: 0-65536
              • +
            • Tag Length: 16-16
              • +
            • +
          • AES-192:
            • +
            • +
            • Block Sizes: Full, Partial
              • +
            • Message Length: 0-65536
              • +
            • Tag Length: 16-16
              • +
            • +
          • AES-256:
            • +
            • +
            • Block Sizes: Full, Partial
              • +
            • Message Length: 0-65536
              • +
            • Tag Length: 16-16
              • +
            • +
          • +
        • Verification:
          • +
          • +
          • AES-128:
            • +
            • +
            • Block Sizes: Full, Partial
              • +
            • Message Length: 0-65536
              • +
            • Tag Length: 16-16
              • +
            • +
          • AES-192:
            • +
            • +
            • Block Sizes: Full, Partial
              • +
            • Message Length: 0-65536
              • +
            • Tag Length: 16-16
              • +
            • +
          • AES-256:
            • +
            • +
            • Block Sizes: Full, Partial
              • +
            • Message Length: 0-65536
              • +
            • Tag Length: 16-16
              • +
            • +
          • +
        • +
      • AES-CTR:
        • +
        • +
        • Counter Source: Internal
          • +
        • Key Lengths: 128, 192, 256 (bits)
          • +
        • +
      • AES-ECB:
        • +
        • +
        • Modes: Decrypt, Encrypt
          • +
        • Key Lengths: 128, 192, 256 (bits)
          • +
        • +
      • AES-GCM:
        • +
        • +
        • Modes: Decrypt, Encrypt
          • +
        • IV Generation: External
          • +
        • Key Lengths: 128, 192, 256 (bits)
          • +
        • Tag Lengths: 96, 104, 112, 120, 128 (bits)
          • +
        • Plain Text Lengths: 0, 8, 1016, 1024 (bits)
          • +
        • AAD Lengths: 0, 8, 1016, 1024 (bits)
          • +
        • 96 bit IV supported
          • +
        • +
      • AES-XTS:
        • +
        • +
        • Key Size: 128:
          • +
          • +
          • Modes: Decrypt, Encrypt
            • +
          • Block Sizes: Full
            • +
          • +
        • Key Size: 256:
          • +
          • +
          • Modes: Decrypt, Encrypt
            • +
          • Block Sizes: Full
            • +
          • +
        • +

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #4897

      +

      Version 10.0.16299

      AES-KW:

      +
        +
      • Modes: Decrypt, Encrypt
        • +
      • CIPHK transformation direction: Forward
        • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • Plain Text Lengths: 128, 192, 256, 320, 2048 (bits)
        • +
      +

      AES Val#4902

      Microsoft Surface Hub Cryptography Next Generation (CNG) Implementations #4900

      +

      Version 10.0.15063.674

      AES-KW:

      +
        +
      • Modes: Decrypt, Encrypt
        • +
      • CIPHK transformation direction: Forward
        • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • Plain Text Lengths: 128, 192, 256, 320, 2048 (bits)
        • +
      +

      AES Val#4901

      Windows 10 Mobile (version 1709) Cryptography Next Generation (CNG) Implementations #4899

      +

      Version 10.0.15254

      AES-KW:

      +
        +
      • Modes: Decrypt, Encrypt
        • +
      • CIPHK transformation direction: Forward
        • +
      • Key Lengths: 128, 192, 256 (bits)
        • +
      • Plain Text Lengths: 128, 192, 256, 320, 2048 (bits)
        • +
      +

      AES Val#4897

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Cryptography Next Generation (CNG) Implementations #4898

      +

      Version 10.0.16299

      AES-CCM:

      +
        +
      • Key Lengths: 256 (bits)
        • +
      • Tag Lengths: 128 (bits)
        • +
      • IV Lengths: 96 (bits)
        • +
      • Plain Text Length: 0-32
        • +
      • AAD Length: 0-65536
        • +
      +

      AES Val#4902

      Microsoft Surface Hub BitLocker(R) Cryptographic Implementations #4896

      +

      Version 10.0.15063.674

      AES-CCM:

      +
        +
      • Key Lengths: 256 (bits)
        • +
      • Tag Lengths: 128 (bits)
        • +
      • IV Lengths: 96 (bits)
        • +
      • Plain Text Length: 0-32
        • +
      • AAD Length: 0-65536
        • +
      +

      AES Val#4901

      Windows 10 Mobile (version 1709) BitLocker(R) Cryptographic Implementations #4895

      +

      Version 10.0.15254

      AES-CCM:

      +
        +
      • Key Lengths: 256 (bits)
        • +
      • Tag Lengths: 128 (bits)
        • +
      • IV Lengths: 96 (bits)
        • +
      • Plain Text Length: 0-32
        • +
      • AAD Length: 0-65536
        • +
      +

      AES Val#4897

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); BitLocker(R) Cryptographic Implementations #4894

      +

      Version 10.0.16299

      CBC ( e/d; 128 , 192 , 256 );

      +

      CFB128 ( e/d; 128 , 192 , 256 );

      +

      OFB ( e/d; 128 , 192 , 256 );

      +

      CTR ( int only; 128 , 192 , 256 )

      Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #4627

      +

      Version 10.0.15063

      KW ( AE , AD , AES-128 , AES-192 , AES-256 , FWD , 128 , 256 , 192 , 320 , 2048 )

      +

      AES Val#4624

      Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile Cryptography Next Generation (CNG) Implementations #4626

      +

      Version 10.0.15063

      CCM (KS: 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 12 (Tag Length(s): 16 )

      +

      AES Val#4624

      +

       

      Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile BitLocker(R) Cryptographic Implementations #4625

      +

      Version 10.0.15063

      ECB ( e/d; 128 , 192 , 256 );

      +

      CBC ( e/d; 128 , 192 , 256 );

      +

      CFB8 ( e/d; 128 , 192 , 256 );

      +

      CFB128 ( e/d; 128 , 192 , 256 );

      +

      CTR ( int only; 128 , 192 , 256 )

      +

      CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )

      +

      CMAC (Generation/Verification ) (KS: 128; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 16 Max: 16 ) (KS: 192; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 16 Max: 16 ) (KS: 256; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 16 Max: 16 )

      +

      GCM (KS: AES_128( e/d ) Tag Length(s): 128 120 112 104 96 ) (KS: AES_192( e/d ) Tag Length(s): 128 120 112 104 96 )

      +

      (KS: AES_256( e/d ) Tag Length(s): 128 120 112 104 96 )

      +

      IV Generated: ( External ) ; PT Lengths Tested: ( 0 , 1024 , 8 , 1016 ) ; AAD Lengths tested: ( 0 , 1024 , 8 , 1016 ) ; 96BitIV_Supported

      +

      GMAC_Supported

      +

      XTS( (KS: XTS_128( (e/d) (f) ) KS: XTS_256( (e/d) (f) )

      Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #4624

      +

      Version 10.0.15063

      ECB ( e/d; 128 , 192 , 256 );

      +

      CBC ( e/d; 128 , 192 , 256 );

      Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #4434

      +

      Version 7.00.2872

      ECB ( e/d; 128 , 192 , 256 );

      +

      CBC ( e/d; 128 , 192 , 256 );

      Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #4433

      +

      Version 8.00.6246

      ECB ( e/d; 128 , 192 , 256 );

      +

      CBC ( e/d; 128 , 192 , 256 );

      +

      CTR ( int only; 128 , 192 , 256 )

      Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #4431

      +

      Version 7.00.2872

      ECB ( e/d; 128 , 192 , 256 );

      +

      CBC ( e/d; 128 , 192 , 256 );

      +

      CTR ( int only; 128 , 192 , 256 )

      Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #4430

      +

      Version 8.00.6246

      CBC ( e/d; 128 , 192 , 256 );

      +

      CFB128 ( e/d; 128 , 192 , 256 );

      +

      OFB ( e/d; 128 , 192 , 256 );

      +

      CTR ( int only; 128 , 192 , 256 )

      Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #4074

      +

      Version 10.0.14393

      ECB ( e/d; 128 , 192 , 256 ); CBC ( e/d; 128 , 192 , 256 ); CFB8 ( e/d; 128 , 192 , 256 ); CFB128 ( e/d; 128 , 192 , 256 ); CTR ( int only; 128 , 192 , 256 )

      +

      CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )

      +

      CMAC (Generation/Verification ) (KS: 128; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 192; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 256; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 )

      +

      GCM (KS: AES_128( e/d ) Tag Length(s): 128 120 112 104 96 ) (KS: AES_192( e/d ) Tag Length(s): 128 120 112 104 96 )
      +(KS: AES_256( e/d ) Tag Length(s): 128 120 112 104 96 )
      +IV Generated:  ( Externally ) ; PT Lengths Tested:  ( 0 , 1024 , 8 , 1016 ) ; AAD Lengths tested:  ( 0 , 1024 , 8 , 1016 ) ; IV Lengths Tested:  ( 0 , 0 ) ; 96BitIV_Supported
      +GMAC_Supported

      +

      XTS( (KS: XTS_128( (e/d) (f) ) KS: XTS_256( (e/d) (f) )

      Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update SymCrypt Cryptographic Implementations #4064

      +

      Version 10.0.14393

      ECB ( e/d; 128 , 192 , 256 );

      +

      CBC ( e/d; 128 , 192 , 256 );

      +

      CFB8 ( e/d; 128 , 192 , 256 );

      +

       

      		Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update RSA32 Algorithm Implementations #4063
      +Version 10.0.14393

      KW  ( AE , AD , AES-128 , AES-192 , AES-256 , FWD , 128 , 192 , 256 , 320 , 2048 )

      +

      AES Val#4064

      Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #4062

      +

      Version 10.0.14393

      CCM (KS: 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 12 (Tag Length(s): 16 )

      +

      AES Val#4064

      Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update BitLocker® Cryptographic Implementations #4061

      +

      Version 10.0.14393

      KW  ( AE , AD , AES-128 , AES-192 , AES-256 , FWD , 128 , 256 , 192 , 320 , 2048 )

      +

      AES Val#3629

      Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” Cryptography Next Generation (CNG) Implementations #3652

      +

      Version 10.0.10586

      CCM (KS: 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 12 (Tag Length(s): 16 )

      +

      AES Val#3629

      Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” BitLocker® Cryptographic Implementations #3653

      +

      Version 10.0.10586

      ECB ( e/d; 128 , 192 , 256 );

      +

      CBC ( e/d; 128 , 192 , 256 );

      +

      CFB8 ( e/d; 128 , 192 , 256 );

      +

       

      		Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” RSA32 Algorithm Implementations #3630
      +Version 10.0.10586

      ECB ( e/d; 128 , 192 , 256 ); CBC ( e/d; 128 , 192 , 256 ); CFB8 ( e/d; 128 , 192 , 256 ); CFB128 ( e/d; 128 , 192 , 256 ); CTR ( int only; 128 , 192 , 256 )

      +

      CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )

      +

      CMAC (Generation/Verification ) (KS: 128; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 192; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 256; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 )

      +

      GCM (KS: AES_128( e/d ) Tag Length(s): 128 120 112 104 96 ) (KS: AES_192( e/d ) Tag Length(s): 128 120 112 104 96 )
      +(KS: AES_256( e/d ) Tag Length(s): 128 120 112 104 96 )
      +IV Generated:  ( Externally ) ; PT Lengths Tested:  ( 0 , 1024 , 8 , 1016 ) ; AAD Lengths tested:  ( 0 , 1024 , 8 , 1016 ) ; IV Lengths Tested:  ( 0 , 0 ) ; 96BitIV_Supported
      +GMAC_Supported

      +

      XTS( (KS: XTS_128( (e/d) (f) ) KS: XTS_256( (e/d) (f) )

      Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” SymCrypt Cryptographic Implementations #3629
      +
      +

      +

      Version 10.0.10586

      KW  ( AE , AD , AES-128 , AES-192 , AES-256 , FWD , 128 , 256 , 192 , 320 , 2048 )

      +

      AES Val#3497

      Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #3507

      +

      Version 10.0.10240

      CCM (KS: 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 12 (Tag Length(s): 16 )

      +

      AES Val#3497

      Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 BitLocker® Cryptographic Implementations #3498

      +

      Version 10.0.10240

      ECB ( e/d; 128 , 192 , 256 ); CBC ( e/d; 128 , 192 , 256 ); CFB8 ( e/d; 128 , 192 , 256 ); CFB128 ( e/d; 128 , 192 , 256 ); CTR ( int only; 128 , 192 , 256 )

      +

      CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )

      +

      CMAC(Generation/Verification ) (KS: 128; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 192; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 256; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 )

      +

      GCM (KS: AES_128( e/d ) Tag Length(s): 128 120 112 104 96 ) (KS: AES_192( e/d ) Tag Length(s): 128 120 112 104 96 )
      +(KS: AES_256( e/d ) Tag Length(s): 128 120 112 104 96 )
      +IV Generated:  ( Externally ) ; PT Lengths Tested:  ( 0 , 1024 , 8 , 1016 ) ; AAD Lengths tested:  ( 0 , 1024 , 8 , 1016 ) ; IV Lengths Tested:  ( 0 , 0 ) ; 96BitIV_Supported
      +GMAC_Supported

      +

      XTS( (KS: XTS_128( (e/d) (f) ) KS: XTS_256( (e/d) (f) )

      		Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 SymCrypt Cryptographic Implementations #3497
      +Version 10.0.10240

      ECB ( e/d; 128 , 192 , 256 );

      +

      CBC ( e/d; 128 , 192 , 256 );

      +

      CFB8 ( e/d; 128 , 192 , 256 );

      +

       

      		Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 RSA32 Algorithm Implementations #3476
      +Version 10.0.10240

      ECB ( e/d; 128 , 192 , 256 );

      +

      CBC ( e/d; 128 , 192 , 256 );

      +

      CFB8 ( e/d; 128 , 192 , 256 );

      +

       

      Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry RSA32 Algorithm Implementations #2853

      +

      Version 6.3.9600

      CCM (KS: 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 12 (Tag Length(s): 16 )

      +

      AES Val#2832

      Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 BitLocker� Cryptographic Implementations #2848

      +

      Version 6.3.9600

      CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 0 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )

      +

      CMAC (Generation/Verification ) (KS: 128; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 192; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 256; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 )

      +

      GCM (KS: AES_128( e/d ) Tag Length(s): 128 120 112 104 96 ) (KS: AES_192( e/d ) Tag Length(s): 128 120 112 104 96 )

      +

      (KS: AES_256( e/d ) Tag Length(s): 128 120 112 104 96 )

      +

      IV Generated:  ( Externally ) ; PT Lengths Tested:  ( 0 , 128 , 1024 , 8 , 1016 ) ; AAD Lengths tested:  ( 0 , 128 , 1024 , 8 , 1016 ) ; IV Lengths Tested:  ( 8 , 1024 ) ; 96BitIV_Supported ;
      +OtherIVLen_Supported
      +GMAC_Supported

      Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 SymCrypt Cryptographic Implementations #2832

      +

      Version 6.3.9600

      CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )
      +AES Val#2197

      +

      CMAC (Generation/Verification ) (KS: 128; Block Size(s): ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 16 Max: 16 ) (KS: 192; Block Size(s): ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 16 Max: 16 ) (KS: 256; Block Size(s): ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 16 Max: 16 )
      +AES Val#2197

      +

      GCM(KS: AES_128( e/d ) Tag Length(s): 128 120 112 104 96 ) (KS: AES_192( e/d ) Tag Length(s): 128 120 112 104 96 )
      +(KS: AES_256( e/d ) Tag Length(s): 128 120 112 104 96 )
      +IV Generated: ( Externally ) ; PT Lengths Tested: ( 0 , 128 , 1024 , 8 , 1016 ) ; AAD Lengths tested: ( 0 , 128 , 1024 , 8 , 1016 ) ; IV Lengths Tested: ( 8 , 1024 ) ; 96BitIV_Supported
      +GMAC_Supported

      		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #2216

      CCM (KS: 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 12 (Tag Length(s): 16 )

      +

      AES Val#2196

      		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 BitLocker® Cryptographic Implementations #2198

      ECB ( e/d; 128 , 192 , 256 );

      +

      CBC ( e/d; 128 , 192 , 256 );

      +

      CFB8 ( e/d; 128 , 192 , 256 );

      +

      CFB128 ( e/d; 128 , 192 , 256 );

      +

      CTR ( int only; 128 , 192 , 256 )

      		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Next Generation Symmetric Cryptographic Algorithms Implementations (SYMCRYPT) #2197

      ECB ( e/d; 128 , 192 , 256 );

      +

      CBC ( e/d; 128 , 192 , 256 );

      +

      CFB8 ( e/d; 128 , 192 , 256 );

      +

       

      		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Symmetric Algorithm Implementations (RSA32) #2196
      CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 – 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )
      +AES Val#1168

      Windows Server 2008 R2 and SP1 CNG algorithms #1187

      +

      Windows 7 Ultimate and SP1 CNG algorithms #1178

      CCM (KS: 128 , 256 ) (Assoc. Data Len Range: 0 - 8 ) (Payload Length Range: 4 - 32 ( Nonce Length(s): 7 8 12 13 (Tag Length(s): 4 6 8 14 16 )
      +AES Val#1168      		Windows 7 Ultimate and SP1 and Windows Server 2008 R2 and SP1 BitLocker Algorithm Implementations #1177

      ECB ( e/d; 128 , 192 , 256 );

      +

      CBC ( e/d; 128 , 192 , 256 );

      +

      CFB8 ( e/d; 128 , 192 , 256 );

      +

       

      		Windows 7 and SP1 and Windows Server 2008 R2 and SP1 Symmetric Algorithm Implementation #1168

      GCM

      +

      GMAC

      		Windows 7 and SP1 and Windows Server 2008 R2 and SP1 Symmetric Algorithm Implementation #1168 , vendor-affirmed
      CCM (KS: 128 , 256 ) (Assoc. Data Len Range: 0 - 8 ) (Payload Length Range: 4 - 32 ( Nonce Length(s): 7 8 12 13 (Tag Length(s): 4 6 8 14 16 )Windows Vista Ultimate SP1 and Windows Server 2008 BitLocker Algorithm Implementations #760
      CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 1 - 32 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )

      Windows Server 2008 CNG algorithms #757

      +

      Windows Vista Ultimate SP1 CNG algorithms #756

      CBC ( e/d; 128 , 256 );

      +

      CCM (KS: 128 , 256 ) (Assoc. Data Len Range: 0 - 8 ) (Payload Length Range: 4 - 32 ( Nonce Length(s): 7 8 12 13 (Tag Length(s): 4 6 8 14 16 )

      Windows Vista Ultimate BitLocker Drive Encryption #715

      +

      Windows Vista Ultimate BitLocker Drive Encryption #424

      ECB ( e/d; 128 , 192 , 256 );

      +

      CBC ( e/d; 128 , 192 , 256 );

      +

      CFB8 ( e/d; 128 , 192 , 256 );

      Windows Vista Ultimate SP1 and Windows Server 2008 Symmetric Algorithm Implementation #739

      +

      Windows Vista Symmetric Algorithm Implementation #553

      ECB ( e/d; 128 , 192 , 256 );

      +

      CBC ( e/d; 128 , 192 , 256 );

      +

      CTR ( int only; 128 , 192 , 256 )

      		Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #2023

      ECB ( e/d; 128 , 192 , 256 );

      +

      CBC ( e/d; 128 , 192 , 256 );

      Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #2024

      +

      Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #818

      +

      Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #781

      +

      Windows 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #548

      +

      Windows CE 6.0 and Windows CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #516

      +

      Windows CE and Windows Mobile 6, 6.1, and 6.5 Enhanced Cryptographic Provider (RSAENH) #507

      +

      Windows Server 2003 SP1 Enhanced Cryptographic Provider (RSAENH) #290

      +

      Windows CE 5.0 and 5.1 Enhanced Cryptographic Provider (RSAENH) #224

      +

      Windows Server 2003 Enhanced Cryptographic Provider (RSAENH) #80

      +

      Windows XP, SP1, and SP2 Enhanced Cryptographic Provider (RSAENH) #33

      + + +Deterministic Random Bit Generator (DRBG) + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      Modes / States / Key SizesAlgorithm Implementation and Certificate #
        +
      • Counter:
        • +
        • +
        • Modes: AES-256
          • +
        • Derivation Function States: Derivation Function not used
          • +
        • Prediction Resistance Modes: Not Enabled
          • +
        • +
      +

      Prerequisite: AES #4904

      Microsoft Surface Hub Virtual TPM Implementations #1734

      +

      Version 10.0.15063.674

        +
      • Counter:
        • +
        • +
        • Modes: AES-256
          • +
        • Derivation Function States: Derivation Function not used
          • +
        • Prediction Resistance Modes: Not Enabled
          • +
        • +
      +

      Prerequisite: AES #4903

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #1733

      +

      Version 10.0.16299

        +
      • Counter:
        • +
        • +
        • Modes: AES-256
          • +
        • Derivation Function States: Derivation Function used
          • +
        • Prediction Resistance Modes: Not Enabled
          • +
        • +
      +

      Prerequisite: AES #4902

      Microsoft Surface Hub SymCrypt Cryptographic Implementations #1732

      +

      Version 10.0.15063.674

        +
      • Counter:
        • +
        • +
        • Modes: AES-256
          • +
        • Derivation Function States: Derivation Function used
          • +
        • Prediction Resistance Modes: Not Enabled
          • +
        • +
      +

      Prerequisite: AES #4901

      Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1731

      +

      Version 10.0.15254

        +
      • Counter:
        • +
        • +
        • Modes: AES-256
          • +
        • Derivation Function States: Derivation Function used
          • +
        • Prediction Resistance Modes: Not Enabled
          • +
        • +
      +

      Prerequisite: AES #4897

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1730

      +

      Version 10.0.16299

      CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#4627 ) ]

      Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #1556

      +

      Version 10.0.15063

      CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: ( AES-256 ) ( AES Val#4624 ) ]

      Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1555

      +

      Version 10.0.15063

      CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#4434 ) ]

      Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #1433

      +

      Version 7.00.2872

      CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#4433 ) ]

      Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #1432

      +

      Version 8.00.6246

      CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#4431 ) ]

      Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1430

      +

      Version 7.00.2872

      CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#4430 ) ]

      Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1429

      +

      Version 8.00.6246

      CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#4074 ) ]

      Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #1222

      +

      Version 10.0.14393

      CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: ( AES-256 ) ( AES Val#4064 ) ]

      Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update SymCrypt Cryptographic Implementations #1217

      +

      Version 10.0.14393

      CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: ( AES-256 ) ( AES Val#3629 ) ]

      Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub SymCrypt Cryptographic Implementations #955

      +

      Version 10.0.10586

      CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: ( AES-256 ) ( AES Val#3497 ) ]

      Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 SymCrypt Cryptographic Implementations #868

      +

      Version 10.0.10240

      CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: ( AES-256 ) ( AES Val#2832 ) ]

      Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 SymCrypt Cryptographic Implementations #489

      +

      Version 6.3.9600

      CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: ( AES-256 ) ( AES Val#2197 ) ]Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Next Generation Symmetric Cryptographic Algorithms Implementations (SYMCRYPT) #258
      CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#2023 ) ]Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #193
      CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#1168 ) ]Windows 7 Ultimate and SP1 and Windows Server 2008 R2 and SP1 RNG Library #23
      DRBG (SP 800–90)Windows Vista Ultimate SP1, vendor-affirmed
      + + +#### Digital Signature Algorithm (DSA) + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      Modes / States / Key SizesAlgorithm Implementation and Certificate #
        +
      • DSA:
        • +
        • +
        • 186-4:
          • +
          • +
          • PQGGen:
            • +
            • +
            • L = 2048, N = 256 SHA: SHA-256
              • +
            • L = 3072, N = 256 SHA: SHA-256
              • +
            • +
          • PQGVer:
            • +
            • +
            • L = 2048, N = 256 SHA: SHA-256
              • +
            • L = 3072, N = 256 SHA: SHA-256
              • +
            • +
          • SigGen:
            • +
            • +
            • L = 2048, N = 256 SHA: SHA-256
              • +
            • L = 3072, N = 256 SHA: SHA-256
              • +
            • +
          • SigVer:
            • +
            • +
            • L = 2048, N = 256 SHA: SHA-256
              • +
            • L = 3072, N = 256 SHA: SHA-256
              • +
            • +
          • KeyPair:
            • +
            • +
            • L = 2048, N = 256
              • +
            • L = 3072, N = 256
              • +
            • +
          • +
        • +
      +

      Prerequisite: SHS #4011, DRBG #1732

      Microsoft Surface Hub SymCrypt Cryptographic Implementations #1303

      +

      Version 10.0.15063.674

        +
      • DSA:
        • +
        • +
        • 186-4:
          • +
          • +
          • PQGGen:
            • +
            • +
            • L = 2048, N = 256 SHA: SHA-256
              • +
            • L = 3072, N = 256 SHA: SHA-256
              • +
            • +
          • PQGVer:
            • +
            • +
            • L = 2048, N = 256 SHA: SHA-256
              • +
            • L = 3072, N = 256 SHA: SHA-256
              • +
            • +
          • SigGen:
            • +
            • +
            • L = 2048, N = 256 SHA: SHA-256
              • +
            • L = 3072, N = 256 SHA: SHA-256
              • +
            • +
          • SigVer:
            • +
            • +
            • L = 2048, N = 256 SHA: SHA-256
              • +
            • L = 3072, N = 256 SHA: SHA-256
              • +
            • +
          • KeyPair:
            • +
            • +
            •  
              • +
            •  
              • +
            • L = 2048, N = 256
              • +
            • L = 3072, N = 256
              • +
            • +
          • +
        • +
      +

      Prerequisite: SHS #4010, DRBG #1731

      Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1302

      +

      Version 10.0.15254

        +
      • DSA:
        • +
        • +
        • 186-4:
          • +
          • +
          • PQGGen:
            • +
            • +
            • L = 2048, N = 256 SHA: SHA-256
              • +
            • L = 3072, N = 256 SHA: SHA-256
              • +
            • +
          • PQGVer:
            • +
            • +
            • L = 2048, N = 256 SHA: SHA-256
              • +
            • L = 3072, N = 256 SHA: SHA-256
              • +
            • +
          • SigGen:
            • +
            • +
            • L = 2048, N = 256 SHA: SHA-256
              • +
            • L = 3072, N = 256 SHA: SHA-256
              • +
            • +
          • SigVer:
            • +
            • +
            • L = 2048, N = 256 SHA: SHA-256
              • +
            • L = 3072, N = 256 SHA: SHA-256
              • +
            • +
          • KeyPair:
            • +
            • +
            • L = 2048, N = 256
              • +
            • L = 3072, N = 256
              • +
            • +
          • +
        • +
      +

      Prerequisite: SHS #4009, DRBG #1730

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1301

      +

      Version 10.0.16299

      FIPS186-4:

      +

      PQG(gen)PARMS TESTED:   [ (2048,256)SHA( 256 ); (3072,256) SHA( 256 ) ]

      +

      PQG(ver)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]

      +

      KeyPairGen:   [ (2048,256) ; (3072,256) ]

      +

      SIG(gen)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ); ]

      +

      SIG(ver)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]

      +

      SHS: Val#3790

      +

      DRBG: Val# 1555

      Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1223

      +

      Version 10.0.15063

      FIPS186-4:
      +PQG(ver)PARMS TESTED:         [ (1024,160) SHA( 1 ); ]
      +SIG(ver)PARMS TESTED:   [ (1024,160) SHA( 1 ); ]
      +SHS: Val# 3649

      Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1188

      +

      Version 7.00.2872

      FIPS186-4:
      +PQG(ver)PARMS TESTED:         [ (1024,160) SHA( 1 ); ]
      +SIG(ver)PARMS TESTED:   [ (1024,160) SHA( 1 ); ]
      +SHS: Val#3648

      Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1187

      +

      Version 8.00.6246

      FIPS186-4:
      +PQG(gen)      PARMS TESTED: [
      +(2048,256)SHA( 256 ); (3072,256) SHA( 256 ) ]
      +PQG(ver)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]
      +KeyPairGen:    [ (2048,256) ; (3072,256) ]
      +SIG(gen)PARMS TESTED:   [ (2048,256)
      +SHA( 256 ); (3072,256) SHA( 256 ); ]
      +SIG(ver)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]

      +

      SHS: Val# 3347
      +DRBG: Val# 1217

      Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update MsBignum Cryptographic Implementations #1098

      +

      Version 10.0.14393

      FIPS186-4:
      +PQG(gen)      PARMS TESTED:   [ (2048,256)SHA( 256 ); (3072,256) SHA( 256 ) ] PQG(ver)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 )]
      +KeyPairGen:    [ (2048,256) ; (3072,256) ] SIG(gen)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ); ]
      +SIG(ver)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]

      +

      SHS: Val# 3047
      +DRBG: Val# 955

      Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” MsBignum Cryptographic Implementations #1024

      +

      Version 10.0.10586

      FIPS186-4:
      +PQG(gen)      PARMS TESTED:   [ (2048,256)SHA( 256 ); (3072,256) SHA( 256 ) ]
      +PQG(ver)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]
      +KeyPairGen:    [ (2048,256) ; (3072,256) ]
      +SIG(gen)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ); ] SIG(ver)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]

      +

      SHS: Val# 2886
      +DRBG: Val# 868

      Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 MsBignum Cryptographic Implementations #983

      +

      Version 10.0.10240

      FIPS186-4:
      +PQG(gen)      PARMS TESTED:   [
      +(2048,256)SHA( 256 ); (3072,256) SHA( 256 ) ]
      +PQG(ver)PARMS TESTED:   [ (2048,256)
      +SHA( 256 ); (3072,256) SHA( 256 ) ]
      +KeyPairGen:    [ (2048,256) ; (3072,256) ]
      +SIG(gen)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ); ]
      +SIG(ver)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]

      +

      SHS: Val# 2373
      +DRBG: Val# 489

      Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #855

      +

      Version 6.3.9600

      FIPS186-2:
      +PQG(ver) MOD(1024);
      +SIG(ver) MOD(1024);
      +SHS: #1903
      +DRBG: #258

      +

      FIPS186-4:
      +PQG(gen)PARMS TESTED      : [ (2048,256)SHA( 256 ); (3072,256) SHA( 256 ) ]
      +PQG(ver)PARMS TESTED: [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]
      +SIG(gen)PARMS TESTED: [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ); ]
      +SIG(ver)PARMS TESTED: [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]
      +SHS: #1903
      +DRBG: #258
      +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#687.

      		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #687
      FIPS186-2:
      +PQG(ver)       MOD(1024);
      +SIG(ver) MOD(1024);
      +SHS: #1902
      +DRBG: #258
      +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#686.      		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 DSS and Diffie-Hellman Enhanced Cryptographic Provider (DSSENH) #686
      FIPS186-2:
      +SIG(ver)       MOD(1024);
      +SHS: Val# 1773
      +DRBG: Val# 193
      +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#645.      		Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #645
      FIPS186-2:
      +SIG(ver)       MOD(1024);
      +SHS: Val# 1081
      +DRBG: Val# 23
      +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#391. See Historical DSA List Val#386.

      Windows Server 2008 R2 and SP1 CNG algorithms #391

      +

      Windows 7 Ultimate and SP1 CNG algorithms #386

      FIPS186-2:
      +SIG(ver)       MOD(1024);
      +SHS: Val# 1081
      +RNG: Val# 649
      +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#390. See Historical DSA List Val#385.

      Windows Server 2008 R2 and SP1 Enhanced DSS (DSSENH) #390

      +

      Windows 7 Ultimate and SP1 Enhanced DSS (DSSENH) #385

      FIPS186-2:
      +SIG(ver)       MOD(1024);
      +SHS: Val# 753
      +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#284. See Historical DSA List Val#283.

      Windows Server 2008 CNG algorithms #284

      +

      Windows Vista Ultimate SP1 CNG algorithms #283

      FIPS186-2:
      +SIG(ver)       MOD(1024);
      +SHS: Val# 753
      +RNG: Val# 435
      +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#282. See Historical DSA List Val#281.

      Windows Server 2008 Enhanced DSS (DSSENH) #282

      +

      Windows Vista Ultimate SP1 Enhanced DSS (DSSENH) #281

      FIPS186-2:
      +SIG(ver)       MOD(1024);
      +SHS: Val# 618
      +RNG: Val# 321
      +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#227. See Historical DSA List Val#226.

      Windows Vista CNG algorithms #227

      +

      Windows Vista Enhanced DSS (DSSENH) #226

      FIPS186-2:
      +SIG(ver)       MOD(1024);
      +SHS: Val# 784
      +RNG: Val# 448
      +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#292.      		Windows XP Professional SP3 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #292
      FIPS186-2:
      +SIG(ver)       MOD(1024);
      +SHS: Val# 783
      +RNG: Val# 447
      +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#291.      		Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #291
      FIPS186-2:
      +PQG(gen)       MOD(1024);
      +PQG(ver) MOD(1024);
      +KEYGEN(Y) MOD(1024);
      +SIG(gen) MOD(1024);
      +SIG(ver) MOD(1024);
      +SHS: Val# 611
      +RNG: Val# 314      		Windows 2003 SP2 Enhanced DSS and Diffie-Hellman Cryptographic Provider #221
      FIPS186-2:
      +PQG(gen)       MOD(1024);
      +PQG(ver) MOD(1024);
      +KEYGEN(Y) MOD(1024);
      +SIG(gen) MOD(1024);
      +SIG(ver) MOD(1024);
      +SHS: Val# 385      		Windows Server 2003 SP1 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #146
      FIPS186-2:
      +PQG(ver)       MOD(1024);
      +KEYGEN(Y) MOD(1024);
      +SIG(gen) MOD(1024);
      +SIG(ver) MOD(1024);
      +SHS: Val# 181
      +
      +      		Windows Server 2003 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #95
      FIPS186-2:
      +PQG(gen)       MOD(1024);
      +PQG(ver) MOD(1024);
      +KEYGEN(Y) MOD(1024);
      +SIG(gen) MOD(1024);
      +SHS: SHA-1 (BYTE)
      +SIG(ver) MOD(1024);
      +SHS: SHA-1 (BYTE)

      Windows 2000 DSSENH.DLL #29

      +

      Windows 2000 DSSBASE.DLL #28

      +

      Windows NT 4 SP6 DSSENH.DLL #26

      +

      Windows NT 4 SP6 DSSBASE.DLL #25

      FIPS186-2: PRIME;
      +FIPS186-2:

      +

      KEYGEN(Y):
      +SHS: SHA-1 (BYTE)

      +

      SIG(gen):
      +SIG(ver)       MOD(1024);
      +SHS: SHA-1 (BYTE)

      		Windows NT 4.0 SP4 Microsoft Enhanced DSS and Diffie-Hellman Cryptographic Provider #17
      + + +#### Elliptic Curve Digital Signature Algorithm (ECDSA) + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      Modes / States / Key SizesAlgorithm Implementation and Certificate #
        +
      • ECDSA:
        • +
        • +
        • 186-4:
          • +
          • +
          • Key Pair Generation:
            • +
            • +
            • Curves: P-256, P-384, P-521
              • +
            • Generation Methods: Extra Random Bits
              • +
            • +
          • Public Key Validation:
            • +
            • +
            • Curves: P-256, P-384, P-521
              • +
            • +
          • Signature Generation:
            • +
            • +
            • P-256 SHA: SHA-256
              • +
            • P-384 SHA: SHA-384
              • +
            • P-521 SHA: SHA-512
              • +
            • +
          • Signature Verification:
            • +
            • +
            • P-256 SHA: SHA-256
              • +
            • P-384 SHA: SHA-384
              • +
            • P-521 SHA: SHA-512
              • +
            • +
          • +
        • +
      +

      Prerequisite: SHS #2373, DRBG #489

      Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #1263

      +

      Version 6.3.9600

        +
      • ECDSA:
        • +
        • +
        • 186-4:
          • +
          • +
          • Key Pair Generation:
            • +
            • +
            • Curves: P-256, P-384
              • +
            • Generation Methods: Testing Candidates
              • +
            • +
          • +
        • +
      +

      Prerequisite: SHS #4011, DRBG #1734

      Microsoft Surface Hub Virtual TPM Implementations #1253

      +

      Version 10.0.15063.674

        +
      • ECDSA:
        • +
        • +
        • 186-4:
          • +
          • +
          • Key Pair Generation:
            • +
            • +
            • Curves: P-256, P-384
              • +
            • Generation Methods: Testing Candidates
              • +
            • +
          • +
        • +
      +

      Prerequisite: SHS #4009, DRBG #1733

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #1252

      +

      Version 10.0.16299

        +
      • ECDSA:
        • +
        • +
        • 186-4:
          • +
          • +
          • Key Pair Generation:
            • +
            • +
            • Curves: P-256, P-384, P-521
              • +
            • Generation Methods: Extra Random Bits
              • +
            • +
          • Public Key Validation:
            • +
            • +
            • Curves: P-256, P-384, P-521
              • +
            • +
          • Signature Generation:
            • +
            • +
            • P-256 SHA: SHA-256
              • +
            • P-384 SHA: SHA-384
              • +
            • P-521 SHA: SHA-512
              • +
            • +
          • Signature Verification:
            • +
            • +
            • P-256 SHA: SHA-256
              • +
            • P-384 SHA: SHA-384
              • +
            • P-521 SHA: SHA-512
              • +
            • +
          • +
        • +
      +

      Prerequisite: SHS #4011, DRBG #1732

      Microsoft Surface Hub MsBignum Cryptographic Implementations #1251

      +

      Version 10.0.15063.674

        +
      • ECDSA:
        • +
        • +
        • 186-4:
          • +
          • +
          • Key Pair Generation:
            • +
            • +
            • Curves: P-256, P-384, P-521
              • +
            • Generation Methods: Extra Random Bits
              • +
            • +
          • Public Key Validation:
            • +
            • +
            • Curves: P-256, P-384, P-521
              • +
            • +
          • Signature Generation:
            • +
            • +
            • P-256 SHA: SHA-256
              • +
            • P-384 SHA: SHA-384
              • +
            • P-521 SHA: SHA-512
              • +
            • +
          • Signature Verification:
            • +
            • +
            • P-256 SHA: SHA-256
              • +
            • P-384 SHA: SHA-384
              • +
            • P-521 SHA: SHA-512
              • +
            • +
          • +
        • +
      +

      Prerequisite: SHS #4011, DRBG #1732

      Microsoft Surface Hub SymCrypt Cryptographic Implementations #1250

      +

      Version 10.0.15063.674

        +
      • ECDSA:
        • +
        • +
        • 186-4:
          • +
          • +
          • Key Pair Generation:
            • +
            • +
            • Curves: P-256, P-384, P-521
              • +
            • Generation Methods: Extra Random Bits
              • +
            • +
          • Public Key Validation:
            • +
            • +
            • Curves: P-256, P-384, P-521
              • +
            • +
          • Signature Generation:
            • +
            • +
            • P-256 SHA: SHA-256
              • +
            • P-384 SHA: SHA-384
              • +
            • P-521 SHA: SHA-512
              • +
            • +
          • Signature Verification:
            • +
            • +
            • P-256 SHA: SHA-256
              • +
            • P-384 SHA: SHA-384
              • +
            • P-521 SHA: SHA-512
              • +
            • +
          • +
        • +
      +

      Prerequisite: SHS #4010, DRBG #1731

      Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1249

      +

      Version 10.0.15254

        +
      • ECDSA:
        • +
        • +
        • 186-4:
          • +
          • +
          • Key Pair Generation:
            • +
            • +
            • Curves: P-256, P-384, P-521
              • +
            • Generation Methods: Extra Random Bits
              • +
            • +
          • Public Key Validation:
            • +
            • +
            • Curves: P-256, P-384, P-521
              • +
            • +
          • Signature Generation:
            • +
            • +
            • P-256 SHA: SHA-256
              • +
            • P-384 SHA: SHA-384
              • +
            • P-521 SHA: SHA-512
              • +
            • +
          • Signature Verification:
            • +
            • +
            • P-256 SHA: SHA-256
              • +
            • P-384 SHA: SHA-384
              • +
            • P-521 SHA: SHA-512
              • +
            • +
          • +
        • +
      +

      Prerequisite: SHS #4010, DRBG #1731

      Windows 10 Mobile (version 1709) MsBignum Cryptographic Implementations #1248

      +

      Version 10.0.15254

        +
      • ECDSA:
        • +
        • +
        • 186-4:
          • +
          • +
          • Key Pair Generation:
            • +
            • +
            • Curves: P-256, P-384, P-521
              • +
            • Generation Methods: Extra Random Bits
              • +
            • +
          • Public Key Validation:
            • +
            • +
            • Curves: P-256, P-384, P-521
              • +
            • +
          • Signature Generation:
            • +
            • +
            • P-256 SHA: SHA-256
              • +
            • P-384 SHA: SHA-384
              • +
            • P-521 SHA: SHA-512
              • +
            • +
          • Signature Verification:
            • +
            • +
            • P-256 SHA: SHA-256
              • +
            • P-384 SHA: SHA-384
              • +
            • P-521 SHA: SHA-512
              • +
            • +
          • +
        • +
      +

      Prerequisite: SHS #4009, DRBG #1730

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); MsBignum Cryptographic Implementations #1247

      +

      Version 10.0.16299

        +
      • ECDSA:
        • +
        • +
        • 186-4:
          • +
          • +
          • Key Pair Generation:
            • +
            • +
            • Curves: P-256, P-384, P-521
              • +
            • Generation Methods: Extra Random Bits
              • +
            • +
          • Public Key Validation:
            • +
            • +
            • Curves: P-256, P-384, P-521
              • +
            • +
          • Signature Generation:
            • +
            • +
            • P-256 SHA: SHA-256
              • +
            • P-384 SHA: SHA-384
              • +
            • P-521 SHA: SHA-512
              • +
            • +
          • Signature Verification:
            • +
            • +
            • P-256 SHA: SHA-256
              • +
            • P-384 SHA: SHA-384
              • +
            • P-521 SHA: SHA-512
              • +
            • +
          • +
        • +
      +

      Prerequisite: SHS #4009, DRBG #1730

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1246

      +

      Version 10.0.16299

      FIPS186-4:
      +PKG: CURVES      ( P-256 P-384 TestingCandidates )
      +SHS: Val#3790
      +DRBG: Val# 1555

      Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #1136

      +

      Version 10.0.15063

      FIPS186-4:
      +PKG: CURVES      ( P-256 P-384 P-521 ExtraRandomBits )
      +PKV: CURVES( P-256 P-384 P-521 )
      +SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
      +SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )
      +SHS: Val#3790
      +DRBG: Val# 1555

      Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile MsBignum Cryptographic Implementations #1135

      +

      Version 10.0.15063

      FIPS186-4:
      +PKG: CURVES      ( P-256 P-384 P-521 ExtraRandomBits )
      +PKV: CURVES( P-256 P-384 P-521 )
      +SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
      +SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )
      +SHS: Val#3790
      +DRBG: Val# 1555

      Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1133

      +

      Version 10.0.15063

      FIPS186-4:
      +PKG: CURVES      ( P-256 P-384 P-521 ExtraRandomBits )
      +PKV: CURVES( P-256 P-384 P-521 )
      +SigGen: CURVES( P-256: (SHA-1, 256) P-384: (SHA-1, 384) P-521: (SHA-1, 512) SIG(gen) with SHA-1 affirmed for use with protocols only.
      +SigVer: CURVES( P-256: (SHA-1, 256) P-384: (SHA-1, 384) P-521: (SHA-1, 512) )
      +SHS:Val# 3649
      +DRBG:Val# 1430

      Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1073

      +

      Version 7.00.2872

      FIPS186-4:
      +PKG: CURVES      ( P-256 P-384 P-521 ExtraRandomBits )
      +PKV: CURVES( P-256 P-384 P-521 )
      +SigGen: CURVES( P-256: (SHA-1, 256) P-384: (SHA-1, 384) P-521: (SHA-1, 512) SIG(gen) with SHA-1 affirmed for use with protocols only.
      +SigVer: CURVES( P-256: (SHA-1, 256) P-384: (SHA-1, 384) P-521: (SHA-1, 512) )
      +SHS:Val#3648
      +DRBG:Val# 1429

      Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1072

      +

      Version 8.00.6246

      FIPS186-4:
      +PKG: CURVES      ( P-256 P-384 TestingCandidates )
      +PKV: CURVES( P-256 P-384 )
      +SigGen: CURVES( P-256: (SHA-1, 256) P-384: (SHA-1, 256, 384) SIG(gen) with SHA-1 affirmed for use with protocols only.
      +SigVer: CURVES( P-256: (SHA-1, 256) P-384: (SHA-1, 256, 384) )

      +

      SHS: Val# 3347
      +DRBG: Val# 1222

      Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #920

      +

      Version 10.0.14393

      FIPS186-4:
      +PKG: CURVES      ( P-256 P-384 P-521 ExtraRandomBits )
      +PKV: CURVES( P-256 P-384 P-521 )
      +SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
      +SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )

      +

      SHS: Val# 3347
      +DRBG: Val# 1217

      Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update MsBignum Cryptographic Implementations #911

      +

      Version 10.0.14393

      FIPS186-4:
      +PKG: CURVES      ( P-256 P-384 P-521 ExtraRandomBits )
      +SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
      +SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )

      +

      SHS: Val# 3047
      +DRBG: Val# 955

      Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” MsBignum Cryptographic Implementations #760

      +

      Version 10.0.10586

      FIPS186-4:
      +PKG: CURVES      ( P-256 P-384 P-521 ExtraRandomBits )
      +SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
      +SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )

      +

      SHS: Val# 2886
      +DRBG: Val# 868

      Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 MsBignum Cryptographic Implementations #706

      +

      Version 10.0.10240

      FIPS186-4:
      +PKG: CURVES      ( P-256 P-384 P-521 ExtraRandomBits )
      +SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
      +SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )

      +

      SHS: Val#2373
      +DRBG: Val# 489

      Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #505

      +

      Version 6.3.9600

      FIPS186-2:
      +PKG: CURVES      ( P-256 P-384 P-521 )
      +SHS: #1903
      +DRBG: #258
      +SIG(ver):CURVES( P-256 P-384 P-521 )
      +SHS: #1903
      +DRBG: #258

      +

      FIPS186-4:
      +PKG: CURVES      ( P-256 P-384 P-521 ExtraRandomBits )
      +SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
      +SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )
      +SHS: #1903
      +DRBG: #258
      +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical ECDSA List Val#341.

      		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #341

      FIPS186-2:
      +PKG: CURVES      ( P-256 P-384 P-521 )
      +SHS: Val#1773
      +DRBG: Val# 193
      +SIG(ver): CURVES( P-256 P-384 P-521 )
      +SHS: Val#1773
      +DRBG: Val# 193

      +

      FIPS186-4:
      +PKG: CURVES      ( P-256 P-384 P-521 ExtraRandomBits )
      +SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
      +SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )
      +SHS: Val#1773
      +DRBG: Val# 193
      +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical ECDSA List Val#295.

      		Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #295
      FIPS186-2:
      +PKG: CURVES      ( P-256 P-384 P-521 )
      +SHS: Val#1081
      +DRBG: Val# 23
      +SIG(ver): CURVES( P-256 P-384 P-521 )
      +SHS: Val#1081
      +DRBG: Val# 23
      +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical ECDSA List Val#142. See Historical ECDSA List Val#141.

      Windows Server 2008 R2 and SP1 CNG algorithms #142

      +

      Windows 7 Ultimate and SP1 CNG algorithms #141

      FIPS186-2:
      +PKG: CURVES      ( P-256 P-384 P-521 )
      +SHS: Val#753
      +SIG(ver): CURVES( P-256 P-384 P-521 )
      +SHS: Val#753
      +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical ECDSA List Val#83. See Historical ECDSA List Val#82.

      Windows Server 2008 CNG algorithms #83

      +

      Windows Vista Ultimate SP1 CNG algorithms #82

      FIPS186-2:
      +PKG: CURVES      ( P-256 P-384 P-521 )
      +SHS: Val#618
      +RNG: Val# 321
      +SIG(ver): CURVES( P-256 P-384 P-521 )
      +SHS: Val#618
      +RNG: Val# 321
      +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical ECDSA List Val#60.      		Windows Vista CNG algorithms #60
      + + +#### Keyed-Hash Message Authentication Code (HMAC) + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      Modes / States / Key SizesAlgorithm Implementation and Certificate #
        +
      • HMAC-SHA-1:
        • +
        • +
        • Key Sizes &lt; Block Size
          • +
        • Key Sizes &gt; Block Size
          • +
        • Key Sizes = Block Size
          • +
        • +
      • HMAC-SHA2-256:
        • +
        • +
        • Key Sizes &lt; Block Size
          • +
        • Key Sizes &gt; Block Size
          • +
        • Key Sizes = Block Size
          • +
        • +
      • HMAC-SHA2-384:
        • +
        • +
        • Key Sizes &lt; Block Size
          • +
        • Key Sizes &gt; Block Size
          • +
        • Key Sizes = Block Size
          • +
        • +
      +

      Prerequisite: SHS #4011

      Microsoft Surface Hub Virtual TPM Implementations #3271

      +

      Version 10.0.15063.674

        +
      • HMAC-SHA-1:
        • +
        • +
        • Key Sizes &lt; Block Size
          • +
        • Key Sizes &gt; Block Size
          • +
        • Key Sizes = Block Size
          • +
        • +
      • HMAC-SHA2-256:
        • +
        • +
        • Key Sizes &lt; Block Size
          • +
        • Key Sizes &gt; Block Size
          • +
        • Key Sizes = Block Size
          • +
        • +
      • HMAC-SHA2-384:
        • +
        • +
        • Key Sizes &lt; Block Size
          • +
        • Key Sizes &gt; Block Size
          • +
        • Key Sizes = Block Size
          • +
        • +
      +

      Prerequisite: SHS #4009

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #3270

      +

      Version 10.0.16299

        +
      • HMAC-SHA-1:
        • +
        • +
        • Key Sizes &lt; Block Size
          • +
        • Key Sizes &gt; Block Size
          • +
        • Key Sizes = Block Size
          • +
        • +
      • HMAC-SHA2-256:
        • +
        • +
        • Key Sizes &lt; Block Size
          • +
        • Key Sizes &gt; Block Size
          • +
        • Key Sizes = Block Size
          • +
        • +
      • HMAC-SHA2-384:
        • +
        • +
        • Key Sizes &lt; Block Size
          • +
        • Key Sizes &gt; Block Size
          • +
        • Key Sizes = Block Size
          • +
        • +
      • HMAC-SHA2-512:
        • +
        • +
        • Key Sizes &lt; Block Size
          • +
        • Key Sizes &gt; Block Size
          • +
        • Key Sizes = Block Size
          • +
        • +
      +

      Prerequisite: SHS #4011

      Microsoft Surface Hub SymCrypt Cryptographic Implementations #3269

      +

      Version 10.0.15063.674

        +
      • HMAC-SHA-1:
        • +
        • +
        • Key Sizes &lt; Block Size
          • +
        • Key Sizes &gt; Block Size
          • +
        • Key Sizes = Block Size
          • +
        • +
      • HMAC-SHA2-256:
        • +
        • +
        • Key Sizes &lt; Block Size
          • +
        • Key Sizes &gt; Block Size
          • +
        • Key Sizes = Block Size
          • +
        • +
      • HMAC-SHA2-384:
        • +
        • +
        • Key Sizes &lt; Block Size
          • +
        • Key Sizes &gt; Block Size
          • +
        • Key Sizes = Block Size
          • +
        • +
      • HMAC-SHA2-512:
        • +
        • +
        • Key Sizes &lt; Block Size
          • +
        • Key Sizes &gt; Block Size
          • +
        • Key Sizes = Block Size
          • +
        • +
      +

      Prerequisite: SHS #4010

      Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #3268

      +

      Version 10.0.15254

        +
      • HMAC-SHA-1:
        • +
        • +
        • Key Sizes &lt; Block Size
          • +
        • Key Sizes &gt; Block Size
          • +
        • Key Sizes = Block Size
          • +
        • +
      • HMAC-SHA2-256:
        • +
        • +
        • Key Sizes &lt; Block Size
          • +
        • Key Sizes &gt; Block Size
          • +
        • Key Sizes = Block Size
          • +
        • +
      • HMAC-SHA2-384:
        • +
        • +
        • Key Sizes &lt; Block Size
          • +
        • Key Sizes &gt; Block Size
          • +
        • Key Sizes = Block Size
          • +
        • +
      • HMAC-SHA2-512:
        • +
        • +
        • Key Sizes &lt; Block Size
          • +
        • Key Sizes &gt; Block Size
          • +
        • Key Sizes = Block Size
          • +
        • +
      +

      Prerequisite: SHS #4009

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #3267

      +

      Version 10.0.16299

      HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS Val#3790

      +

      HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val#3790

      +

      HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val#3790

      Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #3062

      +

      Version 10.0.15063

      HMAC-SHA1(Key Sizes Ranges Tested: KSBS ) SHS Val#3790

      +

      HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val#3790

      +

      HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val#3790

      +

      HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHS Val#3790

      Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #3061

      +

      Version 10.0.15063

      HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS Val#3652

      +

      HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val#3652

      +

      HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val#3652

      +

      HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#3652

      Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2946

      +

      Version 7.00.2872

      HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS Val#3651

      +

      HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val#3651

      +

      HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val#3651

      +

      HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#3651

      Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2945

      +

      Version 8.00.6246

      HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS Val# 3649

      +

      HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val# 3649

      +

      HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val# 3649

      +

      HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal# 3649

      Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2943

      +

      Version 7.00.2872

      HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS Val#3648

      +

      HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val#3648

      +

      HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val#3648

      +

      HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#3648

      Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2942

      +

      Version 8.00.6246

      HMAC-SHA1 (Key Sizes Ranges Tested:  KSBS )
      +SHS Val# 3347

      +

      HMAC-SHA256 ( Key Size Ranges Tested:  KSBS )
      +SHS Val# 3347

      +

      HMAC-SHA384 ( Key Size Ranges Tested:  KSBS )
      +SHS Val# 3347

      Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #2661

      +

      Version 10.0.14393

      HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS Val# 3347

      +

      HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val# 3347

      +

      HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val# 3347

      +

      HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHS Val# 3347

      Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update SymCrypt Cryptographic Implementations #2651

      +

      Version 10.0.14393

      HMAC-SHA1 (Key Sizes Ranges Tested:  KSBS )
      +SHS Val# 3047

      +

      HMAC-SHA256 ( Key Size Ranges Tested:  KSBS )
      +SHS Val# 3047

      +

      HMAC-SHA384 ( Key Size Ranges Tested:  KSBS )
      +SHS Val# 3047

      +

      HMAC-SHA512 ( Key Size Ranges Tested:  KSBS )
      +SHS Val# 3047

      Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” SymCrypt Cryptographic Implementations #2381

      +

      Version 10.0.10586

      HMAC-SHA1 (Key Sizes Ranges Tested:  KSBS )
      +SHSVal# 2886

      +

      HMAC-SHA256 ( Key Size Ranges Tested:  KSBS )
      +SHSVal# 2886

      +

      HMAC-SHA384 ( Key Size Ranges Tested:  KSBS )
      + SHSVal# 2886

      +

      HMAC-SHA512 ( Key Size Ranges Tested:  KSBS )
      +SHSVal# 2886

      Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 SymCrypt Cryptographic Implementations #2233

      +

      Version 10.0.10240

      HMAC-SHA1 (Key Sizes Ranges Tested:  KSBS )
      +SHS Val#2373

      +

      HMAC-SHA256 ( Key Size Ranges Tested:  KSBS )
      +SHS Val#2373

      +

      HMAC-SHA384 ( Key Size Ranges Tested:  KSBS )
      +SHS Val#2373

      +

      HMAC-SHA512 ( Key Size Ranges Tested:  KSBS )
      +SHS Val#2373

      Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 SymCrypt Cryptographic Implementations #1773

      +

      Version 6.3.9600

      HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS Val#2764

      +

      HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val#2764

      +

      HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val#2764

      +

      HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHS Val#2764

      Windows CE and Windows Mobile, and Windows Embedded Handheld Enhanced Cryptographic Provider (RSAENH) #2122

      +

      Version 5.2.29344

      HMAC-SHA1 (Key Sizes Ranges Tested: KS#1902

      +

      HMAC-SHA256 ( Key Size Ranges Tested: KS#1902

      		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 BitLocker® Cryptographic Implementations #1347

      HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS#1902

      +

      HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS#1902

      +

      HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS#1902

      +

      HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHS#1902

      		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Enhanced Cryptographic Provider (RSAENH) #1346

      HMAC-SHA1 (Key Sizes Ranges Tested: KSBS )

      +

      SHS#1903

      +

      HMAC-SHA256 ( Key Size Ranges Tested: KSBS )

      +

      SHS#1903

      +

      HMAC-SHA384 ( Key Size Ranges Tested: KSBS )

      +

      SHS#1903

      +

      HMAC-SHA512 ( Key Size Ranges Tested: KSBS )

      +

      SHS#1903

      		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Next Generation Symmetric Cryptographic Algorithms Implementations (SYMCRYPT) #1345

      HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#1773

      +

      HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#1773

      +

      Tinker HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#1773

      +

      HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#1773

      		Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #1364

      HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#1774

      +

      HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#1774

      +

      HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#1774

      +

      HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#1774

      		Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #1227

      HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#1081

      +

      HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#1081

      +

      HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#1081

      +

      HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#1081

      Windows Server 2008 R2 and SP1 CNG algorithms #686

      +

      Windows 7 and SP1 CNG algorithms #677

      +

      Windows Server 2008 R2 Enhanced Cryptographic Provider (RSAENH) #687

      +

      Windows 7 Enhanced Cryptographic Provider (RSAENH) #673

      HMAC-SHA1(Key Sizes Ranges Tested: KSVal#1081

      +

      HMAC-SHA256 ( Key Size Ranges Tested: KSVal#1081

      		Windows 7 and SP1 and Windows Server 2008 R2 and SP1 BitLocker Algorithm Implementations #675

      HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#816

      +

      HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#816

      +

      HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#816

      +

      HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#816

      		Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #452

      HMAC-SHA1 (Key Sizes Ranges Tested: KSVal#753

      +

      HMAC-SHA256 ( Key Size Ranges Tested: KSVal#753

      		Windows Vista Ultimate SP1 and Windows Server 2008 BitLocker Algorithm Implementations #415

      HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#753

      +

      HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#753

      +

      HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#753

      +

      HMAC-SHA512 ( Key Size Ranges Tested: KSBS )SHS Val#753

      Windows Server 2008 Enhanced Cryptographic Provider (RSAENH) #408

      +

      Windows Vista Enhanced Cryptographic Provider (RSAENH) #407

      HMAC-SHA1 (Key Sizes Ranges Tested: KSBS )SHSVal#618

      +

      HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#618

      +

      HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#618

      +

      HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#618

      		Windows Vista Enhanced Cryptographic Provider (RSAENH) #297
      HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#785

      Windows XP Professional SP3 Kernel Mode Cryptographic Module (fips.sys) #429

      +

      Windows XP, vendor-affirmed

      HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#783

      +

      HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#783

      +

      HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#783

      +

      HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#783

      		Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #428

      HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#613

      +

      HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#613

      +

      HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#613

      +

      HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#613

      		Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #289
      HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#610Windows Server 2003 SP2 Kernel Mode Cryptographic Module (fips.sys) #287

      HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#753

      +

      HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#753

      +

      HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#753

      +

      HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#753

      Windows Server 2008 CNG algorithms #413

      +

      Windows Vista Ultimate SP1 CNG algorithms #412

      HMAC-SHA1 (Key Sizes Ranges Tested: KSVal#737

      +

      HMAC-SHA256 ( Key Size Ranges Tested: KSVal#737

      		Windows Vista Ultimate BitLocker Drive Encryption #386

      HMAC-SHA1 ( Key Sizes Ranges Tested: KSBS ) SHSVal#618

      +

      HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#618

      +

      HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#618

      +

      HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#618

      		Windows Vista CNG algorithms #298

      HMAC-SHA1 ( Key Sizes Ranges Tested: KSBS ) SHSVal#589

      +

      HMAC-SHA256 ( Key Size Ranges Tested: KSBS )SHSVal#589

      +

      HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#589

      +

      HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#589

      		Windows CE 6.0 and Windows CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #267

      HMAC-SHA1 ( Key Sizes Ranges Tested: KSBS ) SHSVal#578

      +

      HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#578

      +

      HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#578

      +

      HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#578

      		Windows CE and Windows Mobile 6.0 and Windows Mobil 6.5 Enhanced Cryptographic Provider (RSAENH) #260

      HMAC-SHA1 (Key Sizes Ranges Tested: KSVal#495

      +

      HMAC-SHA256 ( Key Size Ranges Tested: KSVal#495

      		Windows Vista BitLocker Drive Encryption #199
      HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#364

      Windows Server 2003 SP1 Enhanced Cryptographic Provider (RSAENH) #99

      +

      Windows XP, vendor-affirmed

      HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#305

      +

      HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#305

      +

      HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#305

      +

      HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#305

      		Windows CE 5.00 and Windows CE 5.01 Enhanced Cryptographic Provider (RSAENH) #31
      + + +#### Key Agreement Scheme (KAS) + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      Modes / States / Key SizesAlgorithm Implementation and Certificate #
        +
      • KAS ECC:
        • +
        • +
        • Functions: Domain Parameter Generation, Domain Parameter Validation, Full Public Key Validation, Key Pair Generation, Public Key Regeneration
          • +
        • Schemes:
          • +
          • +
          • Full Unified:
            • +
            • +
            • Key Agreement Roles: Initiator, Responder
              • +
            • KDFs: Concatenation
              • +
            • Parameter Sets:
              • +
              • +
              • EC:
                • +
                • +
                • Curve: P-256
                  • +
                • SHA: SHA-256
                  • +
                • MAC: HMAC
                  • +
                • +
              • ED:
                • +
                • +
                • Curve: P-384
                  • +
                • SHA: SHA-384
                  • +
                • MAC: HMAC
                  • +
                • +
              • +
            • +
          • +
        • +
      +

      Prerequisite: SHS #4011, ECDSA #1253, DRBG #1734

      Microsoft Surface Hub Virtual TPM Implementations #150

      +

      Version 10.0.15063.674

        +
      • KAS ECC:
        • +
        • +
        • Functions: Domain Parameter Generation, Domain Parameter Validation, Full Public Key Validation, Key Pair Generation, Public Key Regeneration
          • +
        • Schemes:
          • +
          • +
          • Full Unified:
            • +
            • +
            • Key Agreement Roles: Initiator, Responder
              • +
            • KDFs: Concatenation
              • +
            • Parameter Sets:
              • +
              • +
              • EC:
                • +
                • +
                • Curve: P-256
                  • +
                • SHA: SHA-256
                  • +
                • MAC: HMAC
                  • +
                • +
              • ED:
                • +
                • +
                • Curve: P-384
                  • +
                • SHA: SHA-384
                  • +
                • MAC: HMAC
                  • +
                • +
              • +
            • +
          • +
        • +
      +

      Prerequisite: SHS #4009, ECDSA #1252, DRBG #1733

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #149

      +

      Version 10.0.16299

        +
      • KAS ECC:
        • +
        • +
        • Functions: Domain Parameter Generation, Domain Parameter Validation, Key Pair Generation, Partial Public Key Validation, Public Key Regeneration
          • +
        • Schemes:
          • +
          • +
          • Ephemeral Unified:
            • +
            • +
            • Key Agreement Roles: Initiator, Responder
              • +
            • KDFs: Concatenation
              • +
            • Parameter Sets:
              • +
              • +
              • EC:
                • +
                • +
                • Curve: P-256
                  • +
                • SHA: SHA-256
                  • +
                • MAC: HMAC
                  • +
                • +
              • ED:
                • +
                • +
                • Curve: P-384
                  • +
                • SHA: SHA-384
                  • +
                • MAC: HMAC
                  • +
                • +
              • EE:
                • +
                • +
                • Curve: P-521
                  • +
                • SHA: SHA-512
                  • +
                • MAC: HMAC
                  • +
                • +
              • +
            • +
          • One Pass DH:
            • +
            • +
            • Key Agreement Roles: Initiator, Responder
              • +
            • Parameter Sets:
              • +
              • +
              • EC:
                • +
                • +
                • Curve: P-256
                  • +
                • SHA: SHA-256
                  • +
                • MAC: HMAC
                  • +
                • +
              • ED:
                • +
                • +
                • Curve: P-384
                  • +
                • SHA: SHA-384
                  • +
                • MAC: HMAC
                  • +
                • +
              • EE:
                • +
                • +
                • Curve: P-521
                  • +
                • SHA: SHA-512
                  • +
                • MAC: HMAC
                  • +
                • +
              • +
            • +
          • Static Unified:
            • +
            • +
            • Key Agreement Roles: Initiator, Responder
              • +
            • Parameter Sets:
              • +
              • +
              • EC:
                • +
                • +
                • Curve: P-256
                  • +
                • SHA: SHA-256
                  • +
                • MAC: HMAC
                  • +
                • +
              • ED:
                • +
                • +
                • Curve: P-384
                  • +
                • SHA: SHA-384
                  • +
                • MAC: HMAC
                  • +
                • +
              • EE:
                • +
                • +
                • Curve: P-521
                  • +
                • SHA: SHA-512
                  • +
                • MAC: HMAC
                  • +
                • +
              • +
            • +
          • +
        • +
      +

      Prerequisite: SHS #4011, ECDSA #1250, DRBG #1732

      +
        +
      • KAS FFC:
        • +
        • +
        • Functions: Domain Parameter Generation, Domain Parameter Validation, Key Pair Generation, Partial Public Key Validation
          • +
        • Schemes:
          • +
          • +
          • dhEphem:
            • +
            • +
            • Key Agreement Roles: Initiator, Responder
              • +
            • Parameter Sets:
              • +
              • +
              • FB:
                • +
                • +
                • SHA: SHA-256
                  • +
                • MAC: HMAC
                  • +
                • +
              • FC:
                • +
                • +
                • SHA: SHA-256
                  • +
                • MAC: HMAC
                  • +
                • +
              • +
            • +
          • dhOneFlow:
            • +
            • +
            • Key Agreement Roles: Initiator, Responder
              • +
            • Parameter Sets:
              • +
              • +
              • FB:
                • +
                • +
                • SHA: SHA-256
                  • +
                • MAC: HMAC
                  • +
                • +
              • FC:
                • +
                • +
                • SHA: SHA-256
                  • +
                • MAC: HMAC
                  • +
                • +
              • +
            • +
          • dhStatic:
            • +
            • +
            • Key Agreement Roles: Initiator, Responder
              • +
            • Parameter Sets:
              • +
              • +
              • FB:
                • +
                • +
                • SHA: SHA-256
                  • +
                • MAC: HMAC
                  • +
                • +
              • FC:
                • +
                • +
                • SHA: SHA-256
                  • +
                • MAC: HMAC
                  • +
                • +
              • +
            • +
          • +
        • +
      +

      Prerequisite: SHS #4011, DSA #1303, DRBG #1732

      Microsoft Surface Hub SymCrypt Cryptographic Implementations #148

      +

      Version 10.0.15063.674

        +
      • KAS ECC:
        • +
        • +
        • Functions: Domain Parameter Generation, Domain Parameter Validation, Key Pair Generation, Partial Public Key Validation, Public Key Regeneration
          • +
        • Schemes:
          • +
          • +
          • Ephemeral Unified:
            • +
            • +
            • Key Agreement Roles: Initiator, Responder
              • +
            • KDFs: Concatenation
              • +
            • Parameter Sets:
              • +
              • +
              • EC:
                • +
                • +
                • Curve: P-256
                  • +
                • SHA: SHA-256
                  • +
                • MAC: HMAC
                  • +
                • +
              • ED:
                • +
                • +
                • Curve: P-384
                  • +
                • SHA: SHA-384
                  • +
                • MAC: HMAC
                  • +
                • +
              • EE:
                • +
                • +
                • Curve: P-521
                  • +
                • SHA: SHA-512
                  • +
                • MAC: HMAC
                  • +
                • +
              • +
            • +
          • One Pass DH:
            • +
            • +
            • Key Agreement Roles: Initiator, Responder
              • +
            • Parameter Sets:
              • +
              • +
              • EC:
                • +
                • +
                • Curve: P-256
                  • +
                • SHA: SHA-256
                  • +
                • MAC: HMAC
                  • +
                • +
              • ED:
                • +
                • +
                • Curve: P-384
                  • +
                • SHA: SHA-384
                  • +
                • MAC: HMAC
                  • +
                • +
              • EE:
                • +
                • +
                • Curve: P-521
                  • +
                • SHA: SHA-512
                  • +
                • MAC: HMAC
                  • +
                • +
              • +
            • +
          • Static Unified:
            • +
            • +
            • Key Agreement Roles: Initiator, Responder
              • +
            • Parameter Sets:
              • +
              • +
              • EC:
                • +
                • +
                • Curve: P-256
                  • +
                • SHA: SHA-256
                  • +
                • MAC: HMAC
                  • +
                • +
              • ED:
                • +
                • +
                • Curve: P-384
                  • +
                • SHA: SHA-384
                  • +
                • MAC: HMAC
                  • +
                • +
              • EE:
                • +
                • +
                • Curve: P-521
                  • +
                • SHA: SHA-512
                  • +
                • MAC: HMAC
                  • +
                • +
              • +
            • +
          • +
        • +
      +

      Prerequisite: SHS #4010, ECDSA #1249, DRBG #1731

      +
        +
      • KAS FFC:
        • +
        • +
        • Functions: Domain Parameter Generation, Domain Parameter Validation, Key Pair Generation, Partial Public Key Validation
          • +
        • Schemes:
          • +
          • +
          • dhEphem:
            • +
            • +
            • Key Agreement Roles: Initiator, Responder
              • +
            • Parameter Sets:
              • +
              • +
              • FB:
                • +
                • +
                • SHA: SHA-256
                  • +
                • MAC: HMAC
                  • +
                • +
              • FC:
                • +
                • +
                • SHA: SHA-256
                  • +
                • MAC: HMAC
                  • +
                • +
              • +
            • +
          • dhOneFlow:
            • +
            • +
            • Key Agreement Roles: Initiator, Responder
              • +
            • Parameter Sets:
              • +
              • +
              • FB:
                • +
                • +
                • SHA: SHA-256
                  • +
                • MAC: HMAC
                  • +
                • +
              • FC:
                • +
                • +
                • SHA: SHA-256
                  • +
                • MAC: HMAC
                  • +
                • +
              • +
            • +
          • dhStatic:
            • +
            • +
            • Key Agreement Roles: Initiator, Responder
              • +
            • Parameter Sets:
              • +
              • +
              • FB:
                • +
                • +
                • SHA: SHA-256
                  • +
                • MAC: HMAC
                  • +
                • +
              • FC:
                • +
                • +
                • SHA: SHA-256
                  • +
                • MAC: HMAC
                  • +
                • +
              • +
            • +
          • +
        • +
      +

      Prerequisite: SHS #4010, DSA #1302, DRBG #1731

      Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #147

      +

      Version 10.0.15254

        +
      • KAS ECC:
        • +
        • +
        • Functions: Domain Parameter Generation, Domain Parameter Validation, Key Pair Generation, Partial Public Key Validation, Public Key Regeneration
          • +
        • Schemes:
          • +
          • +
          • Ephemeral Unified:
            • +
            • +
            • Key Agreement Roles: Initiator, Responder
              • +
            • KDFs: Concatenation
              • +
            • Parameter Sets:
              • +
              • +
              • EC:
                • +
                • +
                • Curve: P-256
                  • +
                • SHA: SHA-256
                  • +
                • MAC: HMAC
                  • +
                • +
              • ED:
                • +
                • +
                • Curve: P-384
                  • +
                • SHA: SHA-384
                  • +
                • MAC: HMAC
                  • +
                • +
              • EE:
                • +
                • +
                • Curve: P-521
                  • +
                • SHA: SHA-512
                  • +
                • MAC: HMAC
                  • +
                • +
              • +
            • +
          • One Pass DH:
            • +
            • +
            • Key Agreement Roles: Initiator, Responder
              • +
            • Parameter Sets:
              • +
              • +
              • EC:
                • +
                • +
                • Curve: P-256
                  • +
                • SHA: SHA-256
                  • +
                • MAC: HMAC
                  • +
                • +
              • ED:
                • +
                • +
                • Curve: P-384
                  • +
                • SHA: SHA-384
                  • +
                • MAC: HMAC
                  • +
                • +
              • EE:
                • +
                • +
                • Curve: P-521
                  • +
                • SHA: SHA-512
                  • +
                • MAC: HMAC
                  • +
                • +
              • +
            • +
          • Static Unified:
            • +
            • +
            • Key Agreement Roles: Initiator, Responder
              • +
            • Parameter Sets:
              • +
              • +
              • EC:
                • +
                • +
                • Curve: P-256
                  • +
                • SHA: SHA-256
                  • +
                • MAC: HMAC
                  • +
                • +
              • ED:
                • +
                • +
                • Curve: P-384
                  • +
                • SHA: SHA-384
                  • +
                • MAC: HMAC
                  • +
                • +
              • EE:
                • +
                • +
                • Curve: P-521
                  • +
                • SHA: SHA-512
                  • +
                • MAC: HMAC
                  • +
                • +
              • +
            • +
          • +
        • +
      +

      Prerequisite: SHS #4009, ECDSA #1246, DRBG #1730

      +
        +
      • KAS FFC:
        • +
        • +
        • Functions: Domain Parameter Generation, Domain Parameter Validation, Key Pair Generation, Partial Public Key Validation
          • +
        • Schemes:
          • +
          • +
          • dhEphem:
            • +
            • +
            • Key Agreement Roles: Initiator, Responder
              • +
            • Parameter Sets:
              • +
              • +
              • FB:
                • +
                • +
                • SHA: SHA-256
                  • +
                • MAC: HMAC
                  • +
                • +
              • FC:
                • +
                • +
                • SHA: SHA-256
                  • +
                • MAC: HMAC
                  • +
                • +
              • +
            • +
          • dhOneFlow:
            • +
            • +
            • Key Agreement Roles: Initiator, Responder
              • +
            • Parameter Sets:
              • +
              • +
              • FB:
                • +
                • +
                • SHA: SHA-256
                  • +
                • MAC: HMAC
                  • +
                • +
              • FC:
                • +
                • +
                • SHA: SHA-256
                  • +
                • MAC: HMAC
                  • +
                • +
              • +
            • +
          • dhStatic:
            • +
            • +
            • Key Agreement Roles: Initiator, Responder
              • +
            • Parameter Sets:
              • +
              • +
              • FB:
                • +
                • +
                • SHA: SHA-256
                  • +
                • MAC: HMAC
                  • +
                • +
              • FC:
                • +
                • +
                • SHA: SHA-256
                  • +
                • MAC: HMAC
                  • +
                • +
              • +
            • +
          • +
        • +
      +

      Prerequisite: SHS #4009, DSA #1301, DRBG #1730

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #146

      +

      Version 10.0.16299

      ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Full Validation   Key Regeneration ) SCHEMES [ FullUnified ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ]

      +

      SHS Val#3790
      +DSA Val#1135
      +DRBG Val#1556

      Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #128

      +

      Version 10.0.15063

      FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation ) SCHEMES [ dhEphem ( KARole(s): Initiator / Responder )
      +( FB: SHA256 ) ( FC: SHA256 ) ]
      +[ dhOneFlow ( FB: SHA256 ) ( FC: SHA256 ) ] [ dhStatic ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( FB: SHA256 HMAC ) ( FC: SHA256   HMAC ) ]
      +SHS Val#3790
      +DSA Val#1223
      +DRBG Val#1555

      +

      ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation ) SCHEMES [ EphemeralUnified ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
      +[ OnePassDH ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ( EE: P-521   HMAC (SHA512, HMAC_SHA512) ) ]
      +[ StaticUnified ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ( EE: P-521   HMAC (SHA512, HMAC_SHA512) ) ]
      +
      +SHS Val#3790
      +ECDSA Val#1133
      +DRBG Val#1555

      Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #127

      +

      Version 10.0.15063

      FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation ) SCHEMES [ dhEphem ( KARole(s): Initiator / Responder )
      +( FB: SHA256 ) ( FC: SHA256 ) ]
      +[ dhOneFlow ( KARole(s): Initiator / Responder ) ( FB: SHA256 ) ( FC: SHA256 ) ] [ dhStatic ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( FB: SHA256 HMAC ) ( FC: SHA256   HMAC ) ]
      +SHS Val# 3649
      +DSA Val#1188
      +DRBG Val#1430

      +

      ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation   Key Regeneration ) SCHEMES [ EphemeralUnified ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
      +[ OnePassDH ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ( EE: P-521   HMAC (SHA512, HMAC_SHA512) ) ]
      +[ StaticUnified ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ( EE: P-521   HMAC (SHA512, HMAC_SHA512) ) ]

      Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #115

      +

      Version 7.00.2872

      FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation ) SCHEMES [ dhEphem ( KARole(s): Initiator / Responder )
      +( FB: SHA256 ) ( FC: SHA256 ) ]
      +[ dhHybridOneFlow ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( FB:SHA256 HMAC ) ( FC: SHA256   HMAC ) ]
      +[ dhStatic ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( FB:SHA256 HMAC ) ( FC: SHA256   HMAC ) ]
      +SHS Val#3648
      +DSA Val#1187
      +DRBG Val#1429

      +

      ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation   Key Regeneration ) SCHEMES [ EphemeralUnified ( No_KC ) ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
      +[ OnePassDH ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ( EE: P-521   HMAC (SHA512, HMAC_SHA512) ) ]
      +[ StaticUnified ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ( EE: P-521   HMAC (SHA512, HMAC_SHA512) ) ]
      +
      +SHS Val#3648
      +ECDSA Val#1072
      +DRBG Val#1429

      Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #114

      +

      Version 8.00.6246

      ECC:  (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Full Validation   Key Regeneration )
      +SCHEMES  [ FullUnified  ( No_KC  &lt; KARole(s): Initiator / Responder &gt; &lt; KDF: CONCAT &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ]

      +

      SHS Val# 3347 ECDSA Val#920 DRBG Val#1222

      Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #93

      +

      Version 10.0.14393

      FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation )
      +SCHEMES  [ dhEphem  ( KARole(s): Initiator / Responder )
      +( FB: SHA256 ) ( FC: SHA256 ) ]
      +[ dhOneFlow ( KARole(s): Initiator / Responder ) ( FB:  SHA256 ) ( FC:  SHA256 ) ] [ dhStatic (No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( FB:  SHA256 HMAC ) ( FC:  SHA256   HMAC ) ]

      +

      SHS Val# 3347 DSA Val#1098 DRBG Val#1217

      +

      ECC:  (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation   Key Regeneration ) SCHEMES  [ EphemeralUnified ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
      +[ OnePassDH  ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521   HMAC (SHA512, HMAC_SHA512) ) ]
      +[ StaticUnified ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521   HMAC (SHA512, HMAC_SHA512) ) ]

      +

      SHS Val# 3347 DSA Val#1098 ECDSA Val#911 DRBG Val#1217 HMAC Val#2651

      Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #92

      +

      Version 10.0.14393

      FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation ) SCHEMES  [ dhEphem  ( KARole(s): Initiator / Responder )
      +( FB: SHA256 ) ( FC: SHA256 ) ]
      +[ dhOneFlow ( KARole(s): Initiator / Responder ) ( FB:  SHA256 ) ( FC:  SHA256 ) ] [ dhStatic ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( FB:  SHA256 HMAC ) ( FC:  SHA256   HMAC ) ]

      +

      SHS Val# 3047 DSA Val#1024 DRBG Val#955

      +

      ECC:  (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation   Key Regeneration ) SCHEMES  [ EphemeralUnified ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
      +[ OnePassDH  ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521   HMAC (SHA512, HMAC_SHA512) ) ]
      +[ StaticUnified ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521   HMAC (SHA512, HMAC_SHA512) ) ]

      +

      SHS Val# 3047 ECDSA Val#760 DRBG Val#955

      Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub Cryptography Next Generation (CNG) Implementations #72

      +

      Version 10.0.10586

      FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation ) SCHEMES  [ dhEphem  ( KARole(s): Initiator / Responder )
      +( FB: SHA256 ) ( FC: SHA256 ) ]
      +[ dhOneFlow ( KARole(s): Initiator / Responder ) ( FB:  SHA256 ) ( FC:  SHA256 ) ] [ dhStatic ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( FB:  SHA256 HMAC ) ( FC:  SHA256   HMAC ) ]

      +

      SHS Val# 2886 DSA Val#983 DRBG Val#868

      +

      ECC:  (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation   Key Regeneration ) SCHEMES  [ EphemeralUnified ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
      +[ OnePassDH  ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521   HMAC (SHA512, HMAC_SHA512) ) ]
      +[ StaticUnified ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521   HMAC (SHA512, HMAC_SHA512) ) ]

      +

      SHS Val# 2886 ECDSA Val#706 DRBG Val#868

      Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 Cryptography Next Generation (CNG) Implementations #64

      +

      Version 10.0.10240

      FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation ) SCHEMES  [ dhEphem  ( KARole(s): Initiator / Responder )
      +( FB: SHA256 ) ( FC: SHA256 ) ]
      +[ dhOneFlow ( KARole(s): Initiator / Responder ) ( FB:  SHA256 ) ( FC:  SHA256 ) ] [ dhStatic ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( FB:  SHA256 HMAC ) ( FC:  SHA256   HMAC ) ]

      +

      SHS Val#2373 DSA Val#855 DRBG Val#489

      +

      ECC:  (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation   Key Regeneration ) SCHEMES  [ EphemeralUnified ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
      +[ OnePassDH  ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521   HMAC (SHA512, HMAC_SHA512) ) ]
      +[ StaticUnified ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521   HMAC (SHA512, HMAC_SHA512) ) ]

      +

      SHS Val#2373 ECDSA Val#505 DRBG Val#489

      Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 Cryptography Next Generation Cryptographic Implementations #47

      +

      Version 6.3.9600

      FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG DPV KPG Partial Validation ) SCHEMES [ dhEphem ( KARole(s): Initiator / Responder )
      +( FA: SHA256 ) ( FB: SHA256 ) ( FC: SHA256 ) ]
      +[ dhOneFlow ( KARole(s): Initiator / Responder ) ( FA: SHA256 ) ( FB: SHA256 ) ( FC: SHA256 ) ]
      +[ dhStatic ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( FA: SHA256 HMAC ) ( FB: SHA256 HMAC ) ( FC: SHA256 HMAC ) ]
      +SHS #1903 DSA Val#687 DRBG #258

      +

      ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG DPV KPG Partial Validation Key Regeneration ) SCHEMES [ EphemeralUnified ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
      +[ OnePassDH( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256 SHA256 ) ( ED: P-384 SHA384 ) ( EE: P-521 (SHA512, HMAC_SHA512) ) ) ]
      +[ StaticUnified ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ]
      +
      +SHS #1903 ECDSA Val#341 DRBG #258

      		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #36

      KAS (SP 800–56A)

      +

      key agreement

      +

      key establishment methodology provides 80 to 256 bits of encryption strength

      Windows 7 and SP1, vendor-affirmed

      +

      Windows Server 2008 R2 and SP1, vendor-affirmed

      + + +SP 800-108 Key-Based Key Derivation Functions (KBKDF) + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      Modes / States / Key SizesAlgorithm Implementation and Certificate #
        +
      • Counter:
        • +
        • +
        • MACs: HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384
          • +
        • +
      +

      MAC prerequisite: HMAC #3271

      +
      +
        +
      • Counter Location: Before Fixed Data
        • +
      • R Length: 32 (bits)
        • +
      • SPs used to generate K: SP 800-56A, SP 800-90A
        • +
      +
      +

      K prerequisite: DRBG #1734, KAS #150

      Microsoft Surface Hub Virtual TPM Implementations #161

      +

      Version 10.0.15063.674

        +
      • Counter:
        • +
        • +
        • MACs: HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384
          • +
        • +
      +

      MAC prerequisite: HMAC #3270

      +
      +
        +
      • Counter Location: Before Fixed Data
        • +
      • R Length: 32 (bits)
        • +
      • SPs used to generate K: SP 800-56A, SP 800-90A
        • +
      +
      +

      K prerequisite: DRBG #1733, KAS #149

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #160

      +

      Version 10.0.16299

        +
      • Counter:
        • +
        • +
        • MACs: CMAC-AES-128, CMAC-AES-192, CMAC-AES-256, HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384, HMAC-SHA-512
          • +
        • +
      +

      MAC prerequisite: AES #4902, HMAC #3269

      +
      +
        +
      • Counter Location: Before Fixed Data
        • +
      • R Length: 32 (bits)
        • +
      • SPs used to generate K: SP 800-56A, SP 800-90A
        • +
      • K prerequisite: KAS #148
        • +
      +

      Microsoft Surface Hub Cryptography Next Generation (CNG) Implementations #159

      +

      Version 10.0.15063.674

        +
      • Counter:
        • +
        • +
        • MACs: CMAC-AES-128, CMAC-AES-192, CMAC-AES-256, HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384, HMAC-SHA-512
          • +
        • +
      +

      MAC prerequisite: AES #4901, HMAC #3268

      +
      +
        +
      • Counter Location: Before Fixed Data
        • +
      • R Length: 32 (bits)
        • +
      • SPs used to generate K: SP 800-56A, SP 800-90A
        • +
      +
      +

      K prerequisite: KAS #147

      Windows 10 Mobile (version 1709) Cryptography Next Generation (CNG) Implementations #158

      +

      Version 10.0.15254

        +
      • Counter:
        • +
        • +
        • MACs: CMAC-AES-128, CMAC-AES-192, CMAC-AES-256, HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384, HMAC-SHA-512
          • +
        • +
      +

      MAC prerequisite: AES #4897, HMAC #3267

      +
      +
        +
      • Counter Location: Before Fixed Data
        • +
      • R Length: 32 (bits)
        • +
      • SPs used to generate K: SP 800-56A, SP 800-90A
        • +
      +
      +

      K prerequisite: KAS #146

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Cryptography Next Generation (CNG) Implementations #157

      +

      Version 10.0.16299

      CTR_Mode: ( Llength( Min0 Max0 ) MACSupported( [HMACSHA1] [HMACSHA256] [HMACSHA384] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )
      +
      +KAS Val#128
      +DRBG Val#1556
      +MAC Val#3062

      Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #141

      +

      Version 10.0.15063

      CTR_Mode: ( Llength( Min20 Max64 ) MACSupported( [CMACAES128] [CMACAES192] [CMACAES256] [HMACSHA1] [HMACSHA256] [HMACSHA384] [HMACSHA512] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )
      +
      +KAS Val#127
      +AES Val#4624
      +DRBG Val#1555
      +MAC Val#3061

      Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile Cryptography Next Generation (CNG) Implementations #140

      +

      Version 10.0.15063

      CTR_Mode:  ( Llength( Min20 Max64 ) MACSupported( [HMACSHA1] [HMACSHA256] [HMACSHA384] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )

      +

      KAS Val#93 DRBG Val#1222 MAC Val#2661

      Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #102

      +

      Version 10.0.14393

      CTR_Mode:  ( Llength( Min20 Max64 ) MACSupported( [CMACAES128] [CMACAES192] [CMACAES256] [HMACSHA1] [HMACSHA256] [HMACSHA384] [HMACSHA512] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )

      +

      KAS Val#92 AES Val#4064 DRBG Val#1217 MAC Val#2651

      Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #101

      +

      Version 10.0.14393

      CTR_Mode:  ( Llength( Min20 Max64 ) MACSupported( [CMACAES128] [CMACAES192] [CMACAES256] [HMACSHA1] [HMACSHA256] [HMACSHA384] [HMACSHA512] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )

      +

      KAS Val#72 AES Val#3629 DRBG Val#955 MAC Val#2381

      Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” Cryptography Next Generation (CNG) Implementations #72

      +

      Version 10.0.10586

      CTR_Mode:  ( Llength( Min20 Max64 ) MACSupported( [CMACAES128] [CMACAES192] [CMACAES256] [HMACSHA1] [HMACSHA256] [HMACSHA384] [HMACSHA512] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )

      +

      KAS Val#64 AES Val#3497 RBG Val#868 MAC Val#2233

      Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 Cryptography Next Generation (CNG) Implementations #66

      +

      Version 10.0.10240

      CTR_Mode:  ( Llength( Min0 Max0 ) MACSupported( [HMACSHA1] [HMACSHA256] [HMACSHA512] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )

      +

      DRBG Val#489 MAC Val#1773

      Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 Cryptography Next Generation Cryptographic Implementations #30

      +

      Version 6.3.9600

      CTR_Mode: ( Llength( Min0 Max4 ) MACSupported( [HMACSHA1] [HMACSHA256] [HMACSHA512] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )

      +

      DRBG #258 HMAC Val#1345

      		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #3
      + + +Random Number Generator (RNG) + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + +
      Modes / States / Key SizesAlgorithm Implementation and Certificate #

      FIPS 186-2 General Purpose

      +

      [ (x-Original); (SHA-1) ]

      		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #1110
      FIPS 186-2
      +[ (x-Original); (SHA-1) ]

      Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #1060

      +

      Windows CE 6.0 and Windows CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #292

      +

      Windows CE and Windows Mobile 6.0 and Windows Mobile 6.5 Enhanced Cryptographic Provider (RSAENH) #286

      +

      Windows CE 5.00 and Window CE 5.01 Enhanced Cryptographic Provider (RSAENH) #66

      FIPS 186-2
      +[ (x-Change Notice); (SHA-1) ]

      +

      FIPS 186-2 General Purpose
      +[ (x-Change Notice); (SHA-1) ]

      Windows 7 and SP1 and Windows Server 2008 R2 and SP1 RNG Library #649

      +

      Windows Vista Ultimate SP1 and Windows Server 2008 RNG Implementation #435

      +

      Windows Vista RNG implementation #321

      FIPS 186-2 General Purpose
      +[ (x-Change Notice); (SHA-1) ]

      Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #470

      +

      Windows XP Professional SP3 Kernel Mode Cryptographic Module (fips.sys) #449

      +

      Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #447

      +

      Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #316

      +

      Windows Server 2003 SP2 Kernel Mode Cryptographic Module (fips.sys) #313

      FIPS 186-2
      +[ (x-Change Notice); (SHA-1) ]

      Windows XP Professional SP3 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #448

      +

      Windows Server 2003 SP2 Enhanced DSS and Diffie-Hellman Cryptographic Provider #314

      + + +#### RSA + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      Modes / States / Key SizesAlgorithm Implementation and Certificate #

      RSA:

      +
        +
      • 186-4:
        • +
        • +
        • Signature Generation PKCS1.5:
          • +
          • +
          • Mod 2048 SHA: SHA-1, SHA-256, SHA-384
            • +
          • +
        • Signature Generation PSS:
          • +
          • +
          • Mod 2048:
            • +
            • +
            • SHA-1: Salt Length: 160 (bits)
              • +
            • SHA-256: Salt Length: 256 (bits)
              • +
            • SHA-384: Salt Length: 384 (bits)
              • +
            • +
          • +
        • Signature Verification PKCS1.5:
          • +
          • +
          • Mod 1024 SHA: SHA-1, SHA-256, SHA-384
            • +
          • Mod 2048 SHA: SHA-1, SHA-256, SHA-384
            • +
          • +
        • Signature Verification PSS:
          • +
          • +
          • Mod 2048:
            • +
            • +
            • SHA-1: Salt Length: 160 (bits)
              • +
            • SHA-256: Salt Length: 256 (bits)
              • +
            • SHA-384: Salt Length: 384 (bits)
              • +
            • +
          • Mod 3072:
            • +
            • +
            • SHA-1: Salt Length: 160 (bits)
              • +
            • SHA-256: Salt Length: 256 (bits)
              • +
            • SHA-384: Salt Length: 384 (bits)
              • +
            • +
          • +
        • +
      +

      Prerequisite: SHS #4011, DRBG #1734

      Microsoft Surface Hub Virtual TPM Implementations #2677

      +

      Version 10.0.15063.674

      RSA:

      +
        +
      • 186-4:
        • +
        • +
        • Signature Generation PKCS1.5:
          • +
          • +
          • Mod 2048 SHA: SHA-1, SHA-256, SHA-384
            • +
          • +
        • Signature Generation PSS:
          • +
          • +
          • Mod 2048:
            • +
            • +
            • SHA-1: Salt Length: 240 (bits)
              • +
            • SHA-256: Salt Length: 256 (bits)
              • +
            • SHA-384: Salt Length: 384 (bits)
              • +
            • +
          • +
        • Signature Verification PKCS1.5:
          • +
          • +
          • Mod 1024 SHA: SHA-1, SHA-256, SHA-384
            • +
          • Mod 2048 SHA: SHA-1, SHA-256, SHA-384
            • +
          • +
        • Signature Verification PSS:
          • +
          • +
          • Mod 1024:
            • +
            • +
            • SHA-1: Salt Length: 160 (bits)
              • +
            • SHA-256: Salt Length: 256 (bits)
              • +
            • SHA-384: Salt Length: 384 (bits)
              • +
            • +
          • Mod 2048:
            • +
            • +
            • SHA-1: Salt Length: 160 (bits)
              • +
            • SHA-256: Salt Length: 256 (bits)
              • +
            • SHA-384: Salt Length: 384 (bits)
              • +
            • +
          • +
        • +
      +

      Prerequisite: SHS #4009, DRBG #1733

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #2676

      +

      Version 10.0.16299

      RSA:

      +
        +
      • 186-4:
        • +
        • +
        • Key Generation:
          • +
        • Signature Verification PKCS1.5:
          • +
          • +
          • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • +
          • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • +
          • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • +
          • +
        • +
      +

      Prerequisite: SHS #4011, DRBG #1732

      Microsoft Surface Hub RSA32 Algorithm Implementations #2675

      +

      Version 10.0.15063.674

      RSA:

      +
        +
      • 186-4:
        • +
        • +
        • Signature Verification PKCS1.5:
          • +
          • +
          • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • +
          • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • +
          • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • +
          • +
        • +
      +

      Prerequisite: SHS #4009, DRBG #1730

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); RSA32 Algorithm Implementations #2674

      +

      Version 10.0.16299

      RSA:

      +
        +
      • 186-4:
        • +
        • +
        • Signature Verification PKCS1.5:
          • +
          • +
          • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • +
          • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • +
          • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • +
          • +
        • +
      +

      Prerequisite: SHS #4010, DRBG #1731

      Windows 10 Mobile (version 1709) RSA32 Algorithm Implementations #2673

      +

      Version 10.0.15254

      RSA:

      +
        +
      • 186-4:
        • +
        • +
        • Key Generation:
          • +
          • +
          • Public Key Exponent: Fixed (10001)
            • +
          • Provable Primes with Conditions:
            • +
            • +
            • Mod lengths: 2048, 3072 (bits)
              • +
            • Primality Tests: C.3
              • +
            • +
          • +
        • Signature Generation PKCS1.5:
          • +
          • +
          • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • +
          • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • +
          • +
        • Signature Generation PSS:
          • +
          • +
          • Mod 2048:
            • +
            • +
            • SHA-1: Salt Length: 160 (bits)
              • +
            • SHA-256: Salt Length: 256 (bits)
              • +
            • SHA-384: Salt Length: 384 (bits)
              • +
            • SHA-512: Salt Length: 512 (bits)
              • +
            • +
          • Mod 3072:
            • +
            • +
            • SHA-1: Salt Length: 160 (bits)
              • +
            • SHA-256: Salt Length: 256 (bits)
              • +
            • SHA-384: Salt Length: 384 (bits)
              • +
            • SHA-512: Salt Length: 512 (bits)
              • +
            • +
          • +
        • Signature Verification PKCS1.5:
          • +
          • +
          • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • +
          • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • +
          • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • +
          • +
        • Signature Verification PSS:
          • +
          • +
          • Mod 1024:
            • +
            • +
            • SHA-1: Salt Length: 160 (bits)
              • +
            • SHA-256: Salt Length: 256 (bits)
              • +
            • SHA-384: Salt Length: 384 (bits)
              • +
            • SHA-512: Salt Length: 496 (bits)
              • +
            • +
          • Mod 2048:
            • +
            • +
            • SHA-1: Salt Length: 160 (bits)
              • +
            • SHA-256: Salt Length: 256 (bits)
              • +
            • SHA-384: Salt Length: 384 (bits)
              • +
            • SHA-512: Salt Length: 512 (bits)
              • +
            • +
          • Mod 3072:
            • +
            • +
            • SHA-1: Salt Length: 160 (bits)
              • +
            • SHA-256: Salt Length: 256 (bits)
              • +
            • SHA-384: Salt Length: 384 (bits)
              • +
            • SHA-512: Salt Length: 512 (bits)
              • +
            • +
          • +
        • +
      +

      Prerequisite: SHS #4011, DRBG #1732

      Microsoft Surface Hub MsBignum Cryptographic Implementations #2672

      +

      Version 10.0.15063.674

      RSA:

      +
        +
      • 186-4:
        • +
        • +
        • Key Generation:
          • +
          • +
          • Probable Random Primes:
            • +
            • +
            • Mod lengths: 2048, 3072 (bits)
              • +
            • Primality Tests: C.2
              • +
            • +
          • +
        • Signature Generation PKCS1.5:
          • +
          • +
          • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • +
          • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • +
          • +
        • Signature Generation PSS:
          • +
          • +
          • Mod 2048:
            • +
            • +
            • SHA-1: Salt Length: 160 (bits)
              • +
            • SHA-256: Salt Length: 256 (bits)
              • +
            • SHA-384: Salt Length: 384 (bits)
              • +
            • SHA-512: Salt Length: 512 (bits)
              • +
            • +
          • Mod 3072:
            • +
            • +
            • SHA-1: Salt Length: 160 (bits)
              • +
            • SHA-256: Salt Length: 256 (bits)
              • +
            • SHA-384: Salt Length: 384 (bits)
              • +
            • SHA-512: Salt Length: 512 (bits)
              • +
            • +
          • +
        • Signature Verification PKCS1.5:
          • +
          • +
          • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • +
          • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • +
          • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • +
          • +
        • Signature Verification PSS:
          • +
          • +
          • Mod 1024:
            • +
            • +
            • SHA-1: Salt Length: 160 (bits)
              • +
            • SHA-256: Salt Length: 256 (bits)
              • +
            • SHA-384: Salt Length: 384 (bits)
              • +
            • SHA-512: Salt Length: 496 (bits)
              • +
            • +
          • Mod 2048:
            • +
            • +
            • SHA-1: Salt Length: 160 (bits)
              • +
            • SHA-256: Salt Length: 256 (bits)
              • +
            • SHA-384: Salt Length: 384 (bits)
              • +
            • SHA-512: Salt Length: 512 (bits)
              • +
            • +
          • Mod 3072:
            • +
            • +
            • SHA-1: Salt Length: 160 (bits)
              • +
            • SHA-256: Salt Length: 256 (bits)
              • +
            • SHA-384: Salt Length: 384 (bits)
              • +
            • SHA-512: Salt Length: 512 (bits)
              • +
            • +
          • +
        • +
      +

      Prerequisite: SHS #4011, DRBG #1732

      Microsoft Surface Hub SymCrypt Cryptographic Implementations #2671

      +

      Version 10.0.15063.674

      RSA:

      +
        +
      • 186-4:
        • +
        • +
        • Key Generation:
          • +
          • +
          • Probable Random Primes:
            • +
            • +
            • Mod lengths: 2048, 3072 (bits)
              • +
            • Primality Tests: C.2
              • +
            • +
          • +
        • Signature Generation PKCS1.5:
          • +
          • +
          • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • +
          • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • +
          • +
        • Signature Generation PSS:
          • +
          • +
          • Mod 2048:
            • +
            • +
            • SHA-1: Salt Length: 160 (bits)
              • +
            • SHA-256: Salt Length: 256 (bits)
              • +
            • SHA-384: Salt Length: 384 (bits)
              • +
            • SHA-512: Salt Length: 512 (bits)
              • +
            • +
          • Mod 3072:
            • +
            • +
            • SHA-1: Salt Length: 160 (bits)
              • +
            • SHA-256: Salt Length: 256 (bits)
              • +
            • SHA-384: Salt Length: 384 (bits)
              • +
            • SHA-512: Salt Length: 512 (bits)
              • +
            • +
          • +
        • Signature Verification PKCS1.5:
          • +
          • +
          • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • +
          • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • +
          • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • +
          • +
        • Signature Verification PSS:
          • +
          • +
          • Mod 1024:
            • +
            • +
            • SHA-1: Salt Length: 160 (bits)
              • +
            • SHA-256: Salt Length: 256 (bits)
              • +
            • SHA-384: Salt Length: 384 (bits)
              • +
            • SHA-512: Salt Length: 496 (bits)
              • +
            • +
          • Mod 2048:
            • +
            • +
            • SHA-1: Salt Length: 160 (bits)
              • +
            • SHA-256: Salt Length: 256 (bits)
              • +
            • SHA-384: Salt Length: 384 (bits)
              • +
            • SHA-512: Salt Length: 512 (bits)
              • +
            • +
          • Mod 3072:
            • +
            • +
            • SHA-1: Salt Length: 160 (bits)
              • +
            • SHA-256: Salt Length: 256 (bits)
              • +
            • SHA-384: Salt Length: 384 (bits)
              • +
            • SHA-512: Salt Length: 512 (bits)
              • +
            • +
          • +
        • +
      +

      Prerequisite: SHS #4010, DRBG #1731

      Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #2670

      +

      Version 10.0.15254

      RSA:

      +
        +
      • 186-4:
        • +
        • +
        • Key Generation:
          • +
          • +
          • Public Key Exponent: Fixed (10001)
            • +
          • Provable Primes with Conditions:
            • +
            • +
            • Mod lengths: 2048, 3072 (bits)
              • +
            • Primality Tests: C.3
              • +
            • +
          • +
        • Signature Generation PKCS1.5:
          • +
          • +
          • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • +
          • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • +
          • +
        • Signature Generation PSS:
          • +
          • +
          • Mod 2048:
            • +
            • +
            • SHA-1: Salt Length: 160 (bits)
              • +
            • SHA-256: Salt Length: 256 (bits)
              • +
            • SHA-384: Salt Length: 384 (bits)
              • +
            • SHA-512: Salt Length: 512 (bits)
              • +
            • +
          • Mod 3072:
            • +
            • +
            • SHA-1: Salt Length: 160 (bits)
              • +
            • SHA-256: Salt Length: 256 (bits)
              • +
            • SHA-384: Salt Length: 384 (bits)
              • +
            • SHA-512: Salt Length: 512 (bits)
              • +
            • +
          • +
        • Signature Verification PKCS1.5:
          • +
          • +
          • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • +
          • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • +
          • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • +
          • +
        • Signature Verification PSS:
          • +
          • +
          • Mod 1024:
            • +
            • +
            • SHA-1: Salt Length: 160 (bits)
              • +
            • SHA-256: Salt Length: 256 (bits)
              • +
            • SHA-384: Salt Length: 384 (bits)
              • +
            • SHA-512: Salt Length: 496 (bits)
              • +
            • +
          • Mod 2048:
            • +
            • +
            • SHA-1: Salt Length: 160 (bits)
              • +
            • SHA-256: Salt Length: 256 (bits)
              • +
            • SHA-384: Salt Length: 384 (bits)
              • +
            • SHA-512: Salt Length: 512 (bits)
              • +
            • +
          • Mod 3072:
            • +
            • +
            • SHA-1: Salt Length: 160 (bits)
              • +
            • SHA-256: Salt Length: 256 (bits)
              • +
            • SHA-384: Salt Length: 384 (bits)
              • +
            • SHA-512: Salt Length: 512 (bits)
              • +
            • +
          • +
        • +
      +

      Prerequisite: SHS #4010, DRBG #1731

      Windows 10 Mobile (version 1709) MsBignum Cryptographic Implementations #2669

      +

      Version 10.0.15254

        +
      • 186-4:
        • +
        • +
        • Key Generation:
          • +
          • +
          • Public Key Exponent: Fixed (10001)
            • +
          • Provable Primes with Conditions:
            • +
            • +
            • Mod lengths: 2048, 3072 (bits)
              • +
            • Primality Tests: C.3
              • +
            • +
          • +
        • Signature Generation PKCS1.5:
          • +
          • +
          • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • +
          • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • +
          • +
        • Signature Generation PSS:
          • +
          • +
          • Mod 2048:
            • +
            • +
            • SHA-1: Salt Length: 160 (bits)
              • +
            • SHA-256: Salt Length: 256 (bits)
              • +
            • SHA-384: Salt Length: 384 (bits)
              • +
            • SHA-512: Salt Length: 512 (bits)
              • +
            • +
          • Mod 3072:
            • +
            • +
            • SHA-1: Salt Length: 160 (bits)
              • +
            • SHA-256: Salt Length: 256 (bits)
              • +
            • SHA-384: Salt Length: 384 (bits)
              • +
            • SHA-512: Salt Length: 512 (bits)
              • +
            • +
          • +
        • Signature Verification PKCS1.5:
          • +
          • +
          • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • +
          • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • +
          • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • +
          • +
        • Signature Verification PSS:
          • +
          • +
          • Mod 1024:
            • +
            • +
            • SHA-1: Salt Length: 160 (bits)
              • +
            • SHA-256: Salt Length: 256 (bits)
              • +
            • SHA-384: Salt Length: 384 (bits)
              • +
            • SHA-512: Salt Length: 496 (bits)
              • +
            • +
          • Mod 2048:
            • +
            • +
            • SHA-1: Salt Length: 160 (bits)
              • +
            • SHA-256: Salt Length: 256 (bits)
              • +
            • SHA-384: Salt Length: 384 (bits)
              • +
            • SHA-512: Salt Length: 512 (bits)
              • +
            • +
          • Mod 3072:
            • +
            • +
            • SHA-1: Salt Length: 160 (bits)
              • +
            • SHA-256: Salt Length: 256 (bits)
              • +
            • SHA-384: Salt Length: 384 (bits)
              • +
            • SHA-512: Salt Length: 512 (bits)
              • +
            • +
          • +
        • +
      +

      Prerequisite: SHS #4009, DRBG #1730

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); MsBignum Cryptographic Implementations #2668

      +

      Version 10.0.16299

        +
      • 186-4:
        • +
        • +
        • Key Generation:
          • +
          • +
          • Probable Random Primes:
            • +
            • +
            • Mod lengths: 2048, 3072 (bits)
              • +
            • Primality Tests: C.2
              • +
            • +
          • +
        • Signature Generation PKCS1.5:
          • +
          • +
          • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • +
          • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • +
          • +
        • Signature Generation PSS:
          • +
          • +
          • Mod 2048:
            • +
            • +
            • SHA-1: Salt Length: 160 (bits)
              • +
            • SHA-256: Salt Length: 256 (bits)
              • +
            • SHA-384: Salt Length: 384 (bits)
              • +
            • SHA-512: Salt Length: 512 (bits)
              • +
            • +
          • Mod 3072:
            • +
            • +
            • SHA-1: Salt Length: 160 (bits)
              • +
            • SHA-256: Salt Length: 256 (bits)
              • +
            • SHA-384: Salt Length: 384 (bits)
              • +
            • SHA-512: Salt Length: 512 (bits)
              • +
            • +
          • +
        • Signature Verification PKCS1.5:
          • +
          • +
          • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • +
          • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • +
          • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
            • +
          • +
        • Signature Verification PSS:
          • +
          • +
          • Mod 1024:
            • +
            • +
            • SHA-1: Salt Length: 160 (bits)
              • +
            • SHA-256: Salt Length: 256 (bits)
              • +
            • SHA-384: Salt Length: 384 (bits)
              • +
            • SHA-512: Salt Length: 496 (bits)
              • +
            • +
          • Mod 2048:
            • +
            • +
            • SHA-1: Salt Length: 160 (bits)
              • +
            • SHA-256: Salt Length: 256 (bits)
              • +
            • SHA-384: Salt Length: 384 (bits)
              • +
            • SHA-512: Salt Length: 512 (bits)
              • +
            • +
          • Mod 3072:
            • +
            • +
            • SHA-1: Salt Length: 160 (bits)
              • +
            • SHA-256: Salt Length: 256 (bits)
              • +
            • SHA-384: Salt Length: 384 (bits)
              • +
            • SHA-512: Salt Length: 512 (bits)
              • +
            • +
          • +
        • +
      +

      Prerequisite: SHS #4009, DRBG #1730

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #2667

      +

      Version 10.0.16299

      FIPS186-4:
      +ALG[RSASSA-PKCS1_V1_5]       SIG(gen) (2048 SHA( 1 , 256 , 384 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
      +       SIG(Ver) (1024 SHA( 1 , 256 , 384 )) (2048 SHA( 1 , 256 , 384 ))
      +[RSASSA-PSS]: Sig(Gen): (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) )) SIG(gen) with SHA-1 affirmed for use with protocols only.
      +       Sig(Ver): (1024 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) )) (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) ))
      +SHA Val#3790

      Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #2524

      +

      Version 10.0.15063

      FIPS186-4:
      +ALG[RSASSA-PKCS1_V1_5]       SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
      +SHA Val#3790

      Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile RSA32 Algorithm Implementations #2523

      +

      Version 10.0.15063

      FIPS186-4:
      +186-4KEY(gen):       FIPS186-4_Fixed_e ( 10001 ) ;
      +PGM(ProbPrimeCondition): 2048 , 3072 PPTT:( C.3 )
      +ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
      +       SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
      +[RSASSA-PSS]: Sig(Gen): (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) SIG(gen) with SHA-1 affirmed for use with protocols only.
      +       Sig(Ver): (1024 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 62 ) )) (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))
      +SHA Val#3790
      +DRBG: Val# 1555

      Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile MsBignum Cryptographic Implementations #2522

      +

      Version 10.0.15063

      FIPS186-4:
      +186-4KEY(gen):
      +PGM(ProbRandom:       ( 2048 , 3072 ) PPTT:( C.2 )
      +ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
      +       SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
      +[RSASSA-PSS]: Sig(Gen): (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) SIG(gen) with SHA-1 affirmed for use with protocols only.
      +       Sig(Ver): (1024 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 62 ) )) (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))
      +SHA Val#3790

      Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #2521

      +

      Version 10.0.15063

      FIPS186-2:
      +ALG[ANSIX9.31]:
      +SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#3652
      +ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 4096 , SHS: SHA-256Val#3652, SHA-384Val#3652, SHA-512Val#3652
      +SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#3652, SHA-256Val#3652, SHA-384Val#3652, SHA-512Val#3652

      +

      FIPS186-4:
      +ALG[ANSIX9.31]       Sig(Gen): (2048 SHA( 1 )) (3072 SHA( 1 ))
      +SIG(gen) with SHA-1 affirmed for use with protocols only.       Sig(Ver): (1024 SHA( 1 )) (2048 SHA( 1 )) (3072 SHA( 1 ))
      +ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
      +       SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
      +SHA Val#3652

      Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2415

      +

      Version 7.00.2872

      FIPS186-2:
      +ALG[ANSIX9.31]:
      +SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#3651
      +ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 4096 , SHS: SHA-256Val#3651, SHA-384Val#3651, SHA-512Val#3651
      +SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#3651, SHA-256Val#3651, SHA-384Val#3651, SHA-512Val#3651

      +

      FIPS186-4:
      +ALG[ANSIX9.31]       Sig(Gen): (2048 SHA( 1 )) (3072 SHA( 1 ))
      +SIG(gen) with SHA-1 affirmed for use with protocols only.       Sig(Ver): (1024 SHA( 1 )) (2048 SHA( 1 )) (3072 SHA( 1 ))
      +ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
      +       SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
      +SHA Val#3651

      Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2414

      +

      Version 8.00.6246

      FIPS186-2:
      +ALG[RSASSA-PKCS1_V1_5]:       SIG(gen) 4096 , SHS: SHA-256Val# 3649 , SHA-384Val# 3649 , SHA-512Val# 3649
      +SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val# 3649 , SHA-256Val# 3649 , SHA-384Val# 3649 , SHA-512Val# 3649

      +

      FIPS186-4:
      +186-4KEY(gen):       FIPS186-4_Fixed_e (10001) ;
      +PGM(ProbRandom: ( 2048 , 3072 ) PPTT:( C.2 )
      +ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
      +       SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
      +SHA Val# 3649
      +DRBG: Val# 1430

      Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2412

      +

      Version 7.00.2872

      FIPS186-2:
      +ALG[RSASSA-PKCS1_V1_5]:       SIG(gen) 4096 , SHS: SHA-256Val#3648, SHA-384Val#3648, SHA-512Val#3648
      +SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#3648, SHA-256Val#3648, SHA-384Val#3648, SHA-512Val#3648

      +

      FIPS186-4:
      +186-4KEY(gen):       FIPS186-4_Fixed_e (10001) ;
      +PGM(ProbRandom: ( 2048 , 3072 ) PPTT:( C.2 )
      +ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
      +       SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
      +SHA Val#3648
      +DRBG: Val# 1429

      Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2411

      +

      Version 8.00.6246

      FIPS186-4:
      +ALG[RSASSA-PKCS1_V1_5]       SIG(gen) (2048 SHA( 1 , 256 , 384 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
      +SIG(Ver) (1024 SHA( 1 , 256 , 384 )) (2048 SHA( 1 , 256 , 384 ))
      +[RSASSA-PSS]: Sig(Gen): (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) )) SIG(gen) with SHA-1 affirmed for use with protocols only.
      +Sig(Ver): (1024 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) )) (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) ))

      +

      SHA Val# 3347

      Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #2206

      +

      Version 10.0.14393

      FIPS186-4:
      +186-4KEY(gen):       FIPS186-4_Fixed_e ( 10001 ) ;
      +PGM(ProbPrimeCondition): 2048 , 3072 PPTT:( C.3 )

      +

      SHA Val# 3347 DRBG: Val# 1217

      Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update RSA Key Generation Implementation #2195

      +

      Version 10.0.14393

      FIPS186-4:
      +ALG[RSASSA-PKCS1_V1_5]       SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))

      +

      SHA Val#3346

      soft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update RSA32 Algorithm Implementations #2194

      +

      Version 10.0.14393

      FIPS186-4:
      +ALG[RSASSA-PKCS1_V1_5]       SIG(gen) (2048 SHA( 256 , 384 , 512 )) (3072 SHA( 256 , 384 , 512 ))
      +SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))

      +

      SHA Val# 3347 DRBG: Val# 1217

      Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update MsBignum Cryptographic Implementations #2193

      +

      Version 10.0.14393

      FIPS186-4:
      +[RSASSA-PSS]: Sig(Gen):       (2048 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))

      +

      Sig(Ver): (1024 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 62 ) )) (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))

      +

      SHA Val# 3347 DRBG: Val# 1217

      Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #2192

      +

      Version 10.0.14393

      FIPS186-4:
      +186-4KEY(gen)      :  FIPS186-4_Fixed_e ( 10001 ) ;
      +PGM(ProbPrimeCondition): 2048 , 3072 PPTT:( C.3 )

      +

      SHA Val# 3047 DRBG: Val# 955

      Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” RSA Key Generation Implementation #1889

      +

      Version 10.0.10586

      FIPS186-4:
      +ALG[RSASSA-PKCS1_V1_5]       SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))

      +

      SHA Val#3048

      Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub RSA32 Algorithm Implementations #1871

      +

      Version 10.0.10586

      FIPS186-4:
      +ALG[RSASSA-PKCS1_V1_5]       SIG(gen) (2048 SHA( 256 , 384 , 512 )) (3072 SHA( 256 , 384 , 512 ))
      +SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))

      +

      SHA Val# 3047

      Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub MsBignum Cryptographic Implementations #1888

      +

      Version 10.0.10586

      FIPS186-4:
      +[RSASSA-PSS]: Sig(Gen)      : (2048 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))
      +Sig(Ver): (1024 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 62 ) )) (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))

      +

      SHA Val# 3047

      Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub Cryptography Next Generation (CNG) Implementations #1887

      +

      Version 10.0.10586

      FIPS186-4:
      +186-4KEY(gen):       FIPS186-4_Fixed_e ( 10001 ) ;
      +PGM(ProbPrimeCondition): 2048 , 3072 PPTT:( C.3 )

      +

      SHA Val# 2886 DRBG: Val# 868

      Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 RSA Key Generation Implementation #1798

      +

      Version 10.0.10240

      FIPS186-4:
      +ALG[RSASSA-PKCS1_V1_5]       SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))

      +

      SHA Val#2871

      Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 RSA32 Algorithm Implementations #1784

      +

      Version 10.0.10240

      FIPS186-4:
      +ALG[RSASSA-PKCS1_V1_5]       SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))

      +

      SHA Val#2871

      Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 MsBignum Cryptographic Implementations #1783

      +

      Version 10.0.10240

      FIPS186-4:
      +[RSASSA-PSS]:       Sig(Gen): (2048 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))
      +Sig(Ver): (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))

      +

      SHA Val# 2886

      Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 Cryptography Next Generation (CNG) Implementations #1802

      +

      Version 10.0.10240

      FIPS186-4:
      +186-4KEY(gen):       FIPS186-4_Fixed_e ;
      +PGM(ProbPrimeCondition): 2048 , 3072 PPTT:( C.3 )

      +

      SHA Val#2373 DRBG: Val# 489

      Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 RSA Key Generation Implementation #1487

      +

      Version 6.3.9600

      FIPS186-4:
      +ALG[RSASSA-PKCS1_V1_5]       SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))

      +

      SHA Val#2373

      Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry RSA32 Algorithm Implementations #1494

      +

      Version 6.3.9600

      FIPS186-4:
      +ALG[RSASSA-PKCS1_V1_5      ] SIG(gen) (2048 SHA( 256 , 384 , 512 )) (3072 SHA( 256 , 384 , 512 ))
      +SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))

      +

      SHA Val#2373

      Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #1493

      +

      Version 6.3.9600

      FIPS186-4:
      +[RSASSA-PSS]:       Sig(Gen): (2048 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))
      + Sig(Ver): (1024 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 62 ) )) (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))

      +

      SHA Val#2373

      Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 Cryptography Next Generation Cryptographic Implementations #1519

      +

      Version 6.3.9600

      FIPS186-4:
      +ALG[RSASSA-PKCS1_V1_5]       SIG(gen) (2048 SHA( 256 , 384 , 512-256 )) (3072 SHA( 256 , 384 , 512-256 ))
      +SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512-256 )) (2048 SHA( 1 , 256 , 384 , 512-256 )) (3072 SHA( 1 , 256 , 384 , 512-256 ))
      +[RSASSA-PSS]: Sig(Gen): (2048 SHA( 256 , 384 , 512 )) (3072 SHA( 256 , 384 , 512 ))
      +Sig(Ver): (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 , 512 ))
      +SHA #1903

      +

      Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#1134.

      		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #1134
      FIPS186-4:
      +186-4KEY(gen):       FIPS186-4_Fixed_e , FIPS186-4_Fixed_e_Value
      +PGM(ProbPrimeCondition): 2048 , 3072 PPTT:( C.3 )
      +SHA #1903 DRBG: #258      		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 RSA Key Generation Implementation #1133
      FIPS186-2:
      +ALG[ANSIX9.31]:       Key(gen)(MOD: 2048 , 3072 , 4096 PubKey Values: 65537 DRBG: #258
      +ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256#1902, SHA-384#1902, SHA-512#1902,
      +SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1#1902, SHA-256#1902, SHA-#1902, SHA-512#1902,
      +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#1132.      		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Enhanced Cryptographic Provider (RSAENH) #1132
      FIPS186-2:
      +ALG[ANSIX9.31]:
      +SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#1774
      +ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#1774, SHA-384Val#1774, SHA-512Val#1774,
      +SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#1774, SHA-256Val#1774, SHA-384Val#1774, SHA-512Val#1774,
      +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#1052.      		Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #1052
      FIPS186-2:
      +ALG[ANSIX9.31]:       Key(gen)(MOD: 2048 , 3072 , 4096 PubKey Values: 65537 DRBG: Val# 193
      +ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#1773, SHA-384Val#1773, SHA-512Val#1773,
      +SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#1773, SHA-256Val#1773, SHA-384Val#1773, SHA-512Val#1773,
      +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#1051.      		Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1051
      FIPS186-2:
      +ALG[RSASSA-PKCS1_V1_5]:       SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081,
      +SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#1081, SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081,
      +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#568.      		Windows Server 2008 R2 and SP1 Enhanced Cryptographic Provider (RSAENH) #568
      FIPS186-2:
      +ALG[RSASSA-PKCS1_V1_5]:       SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081,
      +SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#1081, SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081,
      +ALG[RSASSA-PSS]: SIG(gen); 2048 , 3072 , 4096 , SHS: SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081
      +SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#1081, SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081
      +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#567. See Historical RSA List Val#560.

      Windows Server 2008 R2 and SP1 CNG algorithms #567

      +

      Windows 7 and SP1 CNG algorithms #560

      FIPS186-2:
      +ALG[ANSIX9.31]:       Key(gen)(MOD: 2048 , 3072 , 4096 PubKey Values: 65537 DRBG: Val# 23
      +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#559.      		Windows 7 and SP1 and Server 2008 R2 and SP1 RSA Key Generation Implementation #559
      FIPS186-2:
      +ALG[RSASSA-PKCS1_V1_5]:       SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081,
      +SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#1081, SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081,
      +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#557.      		Windows 7 and SP1 Enhanced Cryptographic Provider (RSAENH) #557
      FIPS186-2:
      +ALG[ANSIX9.31]:
      +ALG[RSASSA-PKCS1_V1_5]:       SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#816, SHA-384Val#816, SHA-512Val#816,
      +SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#816, SHA-256Val#816, SHA-384Val#816, SHA-512Val#816,
      +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#395.      		Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #395
      FIPS186-2:
      +ALG[ANSIX9.31]:
      +SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#783
      +ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#783, SHA-384Val#783, SHA-512Val#783,
      +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#371.      		Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #371
      FIPS186-2:
      +ALG[RSASSA-PKCS1_V1_5]:       SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#753, SHA-384Val#753, SHA-512Val#753,
      +SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#753, SHA-256Val#753, SHA-384Val#753, SHA-512Val#753,
      +ALG[RSASSA-PSS]: SIG(gen); 2048 , 3072 , 4096 , SHS: SHA-256Val#753, SHA-384Val#753, SHA-512Val#753
      +SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#753, SHA-256Val#753, SHA-384Val#753, SHA-512Val#753
      +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#358. See Historical RSA List Val#357.

      Windows Server 2008 CNG algorithms #358

      +

      Windows Vista SP1 CNG algorithms #357

      FIPS186-2:
      +ALG[ANSIX9.31]:
      +SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#753
      +ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#753, SHA-384Val#753, SHA-512Val#753,
      +SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#753, SHA-256Val#753, SHA-384Val#753, SHA-512Val#753,
      +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#355. See Historical RSA List Val#354.

      Windows Server 2008 Enhanced Cryptographic Provider (RSAENH) #355

      +

      Windows Vista SP1 Enhanced Cryptographic Provider (RSAENH) #354

      FIPS186-2:
      +ALG[ANSIX9.31]:       Key(gen)(MOD: 2048 , 3072 , 4096 PubKey Values: 65537
      +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#353.      		Windows Vista SP1 and Windows Server 2008 RSA Key Generation Implementation #353
      FIPS186-2:
      +ALG[ANSIX9.31]:       Key(gen)(MOD: 2048 , 3072 , 4096 PubKey Values: 65537 RNG: Val# 321
      +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#258.      		Windows Vista RSA key generation implementation #258
      FIPS186-2:
      +ALG[RSASSA-PKCS1_V1_5]:       SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#618, SHA-384Val#618, SHA-512Val#618,
      +SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#618, SHA-256Val#618, SHA-384Val#618, SHA-512Val#618,
      +ALG[RSASSA-PSS]: SIG(gen); 2048 , 3072 , 4096 , SHS: SHA-256Val#618, SHA-384Val#618, SHA-512Val#618
      +SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#618, SHA-256Val#618, SHA-384Val#618, SHA-512Val#618
      +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#257.      		Windows Vista CNG algorithms #257
      FIPS186-2:
      +ALG[RSASSA-PKCS1_V1_5]:       SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#618, SHA-384Val#618, SHA-512Val#618,
      +SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#618, SHA-256Val#618, SHA-384Val#618, SHA-512Val#618,
      +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#255.      		Windows Vista Enhanced Cryptographic Provider (RSAENH) #255
      FIPS186-2:
      +ALG[ANSIX9.31]:
      +SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#613
      +ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#613, SHA-384Val#613, SHA-512Val#613,
      +SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#613, SHA-256Val#613, SHA-384Val#613, SHA-512Val#613,
      +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#245.      		Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #245
      FIPS186-2:
      +ALG[ANSIX9.31]:
      +SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#589
      +ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#589, SHA-384Val#589, SHA-512Val#589,
      +SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#589, SHA-256Val#589, SHA-384Val#589, SHA-512Val#589,
      +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#230.      		Windows CE 6.0 and Windows CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #230
      FIPS186-2:
      +ALG[ANSIX9.31]:
      +SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#578
      +ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#578, SHA-384Val#578, SHA-512Val#578,
      +SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#578, SHA-256Val#578, SHA-384Val#578, SHA-512Val#578,
      +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#222.      		Windows CE and Windows Mobile 6 and Windows Mobile 6.1 Enhanced Cryptographic Provider (RSAENH) #222
      FIPS186-2:
      +ALG[RSASSA-PKCS1_V1_5]:
      +SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#364
      +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#81.      		Windows Server 2003 SP1 Enhanced Cryptographic Provider (RSAENH) #81
      FIPS186-2:
      +ALG[ANSIX9.31]:
      +SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#305
      +ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#305, SHA-384Val#305, SHA-512Val#305,
      +SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#305, SHA-256Val#305, SHA-384Val#305, SHA-512Val#305,
      +Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#52.      		Windows CE 5.00 and Windows CE 5.01 Enhanced Cryptographic Provider (RSAENH) #52

      FIPS186-2:

      +

      – PKCS#1 v1.5, signature generation and verification

      +

      – Mod sizes: 1024, 1536, 2048, 3072, 4096

      +

      – SHS: SHA–1/256/384/512

      Windows XP, vendor-affirmed

      +

      Windows 2000, vendor-affirmed

      + + +#### Secure Hash Standard (SHS) + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      Modes / States / Key SizesAlgorithm Implementation and Certificate #
        +
      • SHA-1:
        • +
        • +
        • Supports Empty Message
          • +
        • +
      • SHA-256:
        • +
        • +
        • Supports Empty Message
          • +
        • +
      • SHA-384:
        • +
        • +
        • Supports Empty Message
          • +
        • +
      • SHA-512:
        • +
        • +
        • Supports Empty Message
          • +
        • +

      Microsoft Surface Hub SymCrypt Cryptographic Implementations #4011

      +

      Version 10.0.15063.674

        +
      • SHA-1:
        • +
        • +
        • Supports Empty Message
          • +
        • +
      • SHA-256:
        • +
        • +
        • Supports Empty Message
          • +
        • +
      • SHA-384:
        • +
        • +
        • Supports Empty Message
          • +
        • +
      • SHA-512:
        • +
        • +
        • Supports Empty Message
          • +
        • +

      Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #4010

      +

      Version 10.0.15254

        +
      • SHA-1:
        • +
        • +
        • Supports Empty Message
          • +
        • +
      • SHA-256:
        • +
        • +
        • Supports Empty Message
          • +
        • +
      • SHA-384:
        • +
        • +
        • Supports Empty Message
          • +
        • +
      • SHA-512:
        • +
        • +
        • Supports Empty Message
          • +
        • +

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #4009

      +

      Version 10.0.16299

      SHA-1      (BYTE-only)
      +SHA-256  (BYTE-only)
      +SHA-384  (BYTE-only)
      +SHA-512  (BYTE-only)

      Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #3790

      +

      Version 10.0.15063

      SHA-1      (BYTE-only)
      +SHA-256  (BYTE-only)
      +SHA-384  (BYTE-only)
      +SHA-512  (BYTE-only)

      Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #3652

      +

      Version 7.00.2872

      SHA-1      (BYTE-only)
      +SHA-256  (BYTE-only)
      +SHA-384  (BYTE-only)
      +SHA-512  (BYTE-only)

      Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #3651

      +

      Version 8.00.6246

      SHA-1      (BYTE-only)
      +SHA-256  (BYTE-only)
      +SHA-384  (BYTE-only)
      +SHA-512  (BYTE-only)

      Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #3649

      +

      Version 7.00.2872

      SHA-1      (BYTE-only)
      +SHA-256  (BYTE-only)
      +SHA-384  (BYTE-only)
      +SHA-512  (BYTE-only)

      Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #3648

      +

      Version 8.00.6246

      SHA-1 (BYTE-only)
      +SHA-256 (BYTE-only)
      +SHA-384 (BYTE-only)
      +SHA-512 (BYTE-only)      		Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update SymCrypt Cryptographic Implementations #3347
      +Version 10.0.14393
      SHA-1 (BYTE-only)
      +SHA-256 (BYTE-only)
      +SHA-384 (BYTE-only)
      +SHA-512 (BYTE-only)      		Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update RSA32 Algorithm Implementations #3346
      +Version 10.0.14393
      SHA-1 (BYTE-only)
      +SHA-256 (BYTE-only)
      +SHA-384 (BYTE-only)
      +SHA-512 (BYTE-only)      		Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub RSA32 Algorithm Implementations #3048
      +Version 10.0.10586
      SHA-1 (BYTE-only)
      +SHA-256 (BYTE-only)
      +SHA-384 (BYTE-only)
      +SHA-512 (BYTE-only)      		Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub SymCrypt Cryptographic Implementations #3047
      +Version 10.0.10586
      SHA-1 (BYTE-only)
      +SHA-256 (BYTE-only)
      +SHA-384 (BYTE-only)
      +SHA-512 (BYTE-only)      		Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 SymCrypt Cryptographic Implementations #2886
      +Version 10.0.10240
      SHA-1 (BYTE-only)
      +SHA-256 (BYTE-only)
      +SHA-384 (BYTE-only)
      +SHA-512 (BYTE-only)      		Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 RSA32 Algorithm Implementations #2871
      +Version 10.0.10240
      SHA-1 (BYTE-only)
      +SHA-256 (BYTE-only)
      +SHA-384 (BYTE-only)
      +SHA-512 (BYTE-only)      		Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry RSA32 Algorithm Implementations #2396
      +Version 6.3.9600
      SHA-1 (BYTE-only)
      +SHA-256 (BYTE-only)
      +SHA-384 (BYTE-only)
      +SHA-512 (BYTE-only)      		Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 SymCrypt Cryptographic Implementations #2373
      +Version 6.3.9600

      SHA-1 (BYTE-only)

      +

      SHA-256 (BYTE-only)

      +

      SHA-384 (BYTE-only)

      +

      SHA-512 (BYTE-only)

      +

      Implementation does not support zero-length (null) messages.

      Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Next Generation Symmetric Cryptographic Algorithms Implementations (SYMCRYPT) #1903

      +

      Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Symmetric Algorithm Implementations (RSA32) #1902

      SHA-1 (BYTE-only)
      +SHA-256 (BYTE-only)
      +SHA-384 (BYTE-only)
      +SHA-512 (BYTE-only)

      Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #1774

      +

      Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #1773

      SHA-1 (BYTE-only)
      +SHA-256 (BYTE-only)
      +SHA-384 (BYTE-only)
      +SHA-512 (BYTE-only)

      Windows 7 and SP1 and Windows Server 2008 R2 and SP1 Symmetric Algorithm Implementation #1081

      +

      Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #816

      SHA-1 (BYTE-only)

      Windows XP Professional SP3 Kernel Mode Cryptographic Module (fips.sys) #785

      +

      Windows XP Professional SP3 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #784

      SHA-1 (BYTE-only)
      +SHA-256 (BYTE-only)
      +SHA-384 (BYTE-only)
      +SHA-512 (BYTE-only)      		Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #783
      SHA-1 (BYTE-only)
      +SHA-256 (BYTE-only)
      +SHA-384 (BYTE-only)
      +SHA-512 (BYTE-only)

      Windows Vista SP1 and Windows Server 2008 Symmetric Algorithm Implementation #753

      +

      Windows Vista Symmetric Algorithm Implementation #618

      SHA-1 (BYTE-only)
      +SHA-256 (BYTE-only)

      Windows Vista BitLocker Drive Encryption #737

      +

      Windows Vista Beta 2 BitLocker Drive Encryption #495

      SHA-1 (BYTE-only)
      +SHA-256 (BYTE-only)
      +SHA-384 (BYTE-only)
      +SHA-512 (BYTE-only)

      Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #613

      +

      Windows Server 2003 SP1 Enhanced Cryptographic Provider (RSAENH) #364

      SHA-1 (BYTE-only)

      Windows Server 2003 SP2 Enhanced DSS and Diffie-Hellman Cryptographic Provider #611

      +

      Windows Server 2003 SP2 Kernel Mode Cryptographic Module (fips.sys) #610

      +

      Windows Server 2003 SP1 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #385

      +

      Windows Server 2003 SP1 Kernel Mode Cryptographic Module (fips.sys) #371

      +

      Windows Server 2003 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #181

      +

      Windows Server 2003 Kernel Mode Cryptographic Module (fips.sys) #177

      +

      Windows Server 2003 Enhanced Cryptographic Provider (RSAENH) #176

      SHA-1 (BYTE-only)
      +SHA-256 (BYTE-only)
      +SHA-384 (BYTE-only)
      +SHA-512 (BYTE-only)

      Windows CE 6.0 and Windows CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #589

      +

      Windows CE and Windows Mobile 6 and Windows Mobile 6.5 Enhanced Cryptographic Provider (RSAENH) #578

      +

      Windows CE 5.00 and Windows CE 5.01 Enhanced Cryptographic Provider (RSAENH) #305

      SHA-1 (BYTE-only)

      Windows XP Microsoft Enhanced Cryptographic Provider #83

      +

      Crypto Driver for Windows 2000 (fips.sys) #35

      +

      Windows 2000 Microsoft Outlook Cryptographic Provider (EXCHCSP.DLL) SR-1A (3821) #32

      +

      Windows 2000 RSAENH.DLL #24

      +

      Windows 2000 RSABASE.DLL #23

      +

      Windows NT 4 SP6 RSAENH.DLL #21

      +

      Windows NT 4 SP6 RSABASE.DLL #20

      + + +#### Triple DES + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      Modes / States / Key SizesAlgorithm Implementation and Certificate #
        +
      • TDES-CBC:
        • +
        • +
        • Modes: Decrypt, Encrypt
          • +
        • Keying Option: 1
          • +
        • +
      • TDES-CFB64:
        • +
        • +
        • Modes: Decrypt, Encrypt
          • +
        • Keying Option: 1
          • +
        • +
      • TDES-CFB8:
        • +
        • +
        • Modes: Decrypt, Encrypt
          • +
        • Keying Option: 1
          • +
        • +
      • TDES-ECB:
        • +
        • +
        • Modes: Decrypt, Encrypt
          • +
        • Keying Option: 1
          • +
        • +

      Microsoft Surface Hub SymCrypt Cryptographic Implementations #2558

      +

      Version 10.0.15063.674

        +
      • TDES-CBC:
        • +
        • +
        • Modes: Decrypt, Encrypt
          • +
        • Keying Option: 1
          • +
        • +
      • TDES-CFB64:
        • +
        • +
        • Modes: Decrypt, Encrypt
          • +
        • Keying Option: 1
          • +
        • +
      • TDES-CFB8:
        • +
        • +
        • Modes: Decrypt, Encrypt
          • +
        • Keying Option: 1
          • +
        • +
      • TDES-ECB:
        • +
        • +
        • Modes: Decrypt, Encrypt
          • +
        • Keying Option: 1
          • +
        • +

      Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #2557

      +

      Version 10.0.15254

        +
      • TDES-CBC:
        • +
        • +
        • Modes: Decrypt, Encrypt
          • +
        • Keying Option: 1
          • +
        • +
      • TDES-CFB64:
        • +
        • +
        • Modes: Decrypt, Encrypt
          • +
        • Keying Option: 1
          • +
        • +
      • TDES-CFB8:
        • +
        • +
        • Modes: Decrypt, Encrypt
          • +
        • Keying Option: 1
          • +
        • +
      • TDES-ECB:
        • +
        • +
        • Modes: Decrypt, Encrypt
          • +
        • Keying Option: 1
          • +
        • +

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #2556

      +

      Version 10.0.16299

      TECB( KO 1 e/d, ) ; TCBC( KO 1 e/d, ) ; TCFB8( KO 1 e/d, ) ; TCFB64( KO 1 e/d, )

      Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #2459

      +

      Version 10.0.15063

      TECB( KO 1 e/d, ) ;

      +

      TCBC( KO 1 e/d, )

      Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2384

      +

      Version 8.00.6246

      TECB( KO 1 e/d, ) ;

      +

      TCBC( KO 1 e/d, )

      Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2383

      +

      Version 8.00.6246

      TECB( KO 1 e/d, ) ;

      +

      TCBC( KO 1 e/d, ) ;

      +

      CTR ( int only )

      Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2382

      +

      Version 7.00.2872

      TECB( KO 1 e/d, ) ;

      +

      TCBC( KO 1 e/d, )

      Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2381

      +

      Version 8.00.6246

      TECB( KO 1 e/d, ) ;

      +

      TCBC( KO 1 e/d, ) ;

      +

      TCFB8( KO 1 e/d, ) ;

      +

      TCFB64( KO 1 e/d, )

      Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update SymCrypt Cryptographic Implementations #2227
      +
      +

      +

      Version 10.0.14393

      TECB( KO 1 e/d, ) ;

      +

      TCBC( KO 1 e/d, ) ;

      +

      TCFB8( KO 1 e/d, ) ;

      +

      TCFB64( KO 1 e/d, )

      Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub SymCrypt Cryptographic Implementations #2024
      +
      +

      +

      Version 10.0.10586

      TECB( KO 1 e/d, ) ;

      +

      TCBC( KO 1 e/d, ) ;

      +

      TCFB8( KO 1 e/d, ) ;

      +

      TCFB64( KO 1 e/d, )

      Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 SymCrypt Cryptographic Implementations #1969
      +
      +

      +

      Version 10.0.10240

      TECB( KO 1 e/d, ) ;

      +

      TCBC( KO 1 e/d, ) ;

      +

      TCFB8( KO 1 e/d, ) ;

      +

      TCFB64( KO 1 e/d, )

      Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 SymCrypt Cryptographic Implementations #1692

      +

      Version 6.3.9600

      TECB( e/d; KO 1,2 ) ;

      +

      TCBC( e/d; KO 1,2 ) ;

      +

      TCFB8( e/d; KO 1,2 ) ;

      +

      TCFB64( e/d; KO 1,2 )

      		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Next Generation Symmetric Cryptographic Algorithms Implementations (SYMCRYPT) #1387

      TECB( e/d; KO 1,2 ) ;

      +

      TCBC( e/d; KO 1,2 ) ;

      +

      TCFB8( e/d; KO 1,2 )

      		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Symmetric Algorithm Implementations (RSA32) #1386

      TECB( e/d; KO 1,2 ) ;

      +

      TCBC( e/d; KO 1,2 ) ;

      +

      TCFB8( e/d; KO 1,2 )

      		Windows 7 and SP1 and Windows Server 2008 R2 and SP1 Symmetric Algorithm Implementation #846

      TECB( e/d; KO 1,2 ) ;

      +

      TCBC( e/d; KO 1,2 ) ;

      +

      TCFB8( e/d; KO 1,2 )

      		Windows Vista SP1 and Windows Server 2008 Symmetric Algorithm Implementation #656

      TECB( e/d; KO 1,2 ) ;

      +

      TCBC( e/d; KO 1,2 ) ;

      +

      TCFB8( e/d; KO 1,2 )

      		Windows Vista Symmetric Algorithm Implementation #549
      Triple DES MAC

      Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 #1386, vendor-affirmed

      +

      Windows 7 and SP1 and Windows Server 2008 R2 and SP1 #846, vendor-affirmed

      TECB( e/d; KO 1,2 ) ;

      +

      TCBC( e/d; KO 1,2 )

      Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #1308

      +

      Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #1307

      +

      Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #691

      +

      Windows XP Professional SP3 Kernel Mode Cryptographic Module (fips.sys) #677

      +

      Windows XP Professional SP3 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #676

      +

      Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #675

      +

      Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #544

      +

      Windows Server 2003 SP2 Enhanced DSS and Diffie-Hellman Cryptographic Provider #543

      +

      Windows Server 2003 SP2 Kernel Mode Cryptographic Module (fips.sys) #542

      +

      Windows CE 6.0 and Window CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #526

      +

      Windows CE and Windows Mobile 6 and Windows Mobile 6.1 and Windows Mobile 6.5 Enhanced Cryptographic Provider (RSAENH) #517

      +

      Windows Server 2003 SP1 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #381

      +

      Windows Server 2003 SP1 Kernel Mode Cryptographic Module (fips.sys) #370

      +

      Windows Server 2003 SP1 Enhanced Cryptographic Provider (RSAENH) #365

      +

      Windows CE 5.00 and Windows CE 5.01 Enhanced Cryptographic Provider (RSAENH) #315

      +

      Windows Server 2003 Kernel Mode Cryptographic Module (fips.sys) #201

      +

      Windows Server 2003 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #199

      +

      Windows Server 2003 Enhanced Cryptographic Provider (RSAENH) #192

      +

      Windows XP Microsoft Enhanced Cryptographic Provider #81

      +

      Windows 2000 Microsoft Outlook Cryptographic Provider (EXCHCSP.DLL) SR-1A (3821) #18

      +

      Crypto Driver for Windows 2000 (fips.sys) #16

      + + +#### SP 800-132 Password Based Key Derivation Function (PBKDF) + + + + + + + + + + + + + + +
      + Modes / States / Key Sizes + + Algorithm Implementation and Certificate # +
      + PBKDF (vendor affirmed) +

       Kernel Mode Cryptographic Primitives Library (cng.sys) Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll) in Microsoft Windows 10, Windows 10 Pro, Windows 10 Enterprise, Windows 10 Enterprise LTSB, Windows 10 Mobile, Windows Server 2016 Standard, Windows Server 2016 Datacenter, Windows Storage Server 2016 #2937
      (Software Version: 10.0.14393)

      +

      Microsoft Windows 10, Windows 10 Pro, Windows 10 Enterprise, Windows 10 Enterprise LTSB, Windows 10 Mobile, Windows Server 2016 Standard, Windows Server 2016 Datacenter, Windows Storage Server 2016 #2936
      (Software Version: 10.0.14393)

      +

      Code Integrity (ci.dll) in Microsoft Windows 10, Windows 10 Pro, Windows 10 Enterprise, Windows 10 Enterprise LTSB, Windows 10 Mobile, Windows Server 2016 Standard, Windows Server 2016 Datacenter, Windows Storage Server 2016 #2935
      (Software Version: 10.0.14393)

      +

      Boot Manager in Microsoft Windows 10, Windows 10 Pro, Windows 10 Enterprise, Windows 10 Enterprise LTSB, Windows 10 Mobile, Windows Server 2016 Standard, Windows Server 2016 Datacenter, Windows Storage Server 2016 #2931
      (Software Version: 10.0.14393)

      +
      + PBKDF (vendor affirmed) +

      Kernel Mode Cryptographic Primitives Library (cng.sys) in Microsoft Windows 10, Windows 10 Pro, Windows 10 Enterprise, Windows 10 Enterprise LTSB, Windows 10 Mobile, Windows Server 2016 Standard, Windows Server 2016 Datacenter, Windows Storage Server 2016 #2936
      (Software Version: 10.0.14393)

      +

      Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG), vendor-affirmed

      +
      + + +#### Component Validation List + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      Publication / Component Validated / DescriptionImplementation and Certificate #
        +
      • ECDSA SigGen:
        • +
        • +
        • P-256 SHA: SHA-256
          • +
        • P-384 SHA: SHA-384
          • +
        • P-521 SHA: SHA-512
          • +
        • +
      +

      Prerequisite: DRBG #489

      Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #1540

      +

      Version 6.3.9600

        +
      • RSASP1:
        • +
        • +
        • Modulus Size: 2048 (bits)
          • +
        • Padding Algorithms: PKCS 1.5
          • +
        • +

      Microsoft Surface Hub Virtual TPM Implementations #1519

      +

      Version 10.0.15063.674

        +
      • RSASP1:
        • +
        • +
        • Modulus Size: 2048 (bits)
          • +
        • Padding Algorithms: PKCS 1.5
          • +
        • +

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #1518

      +

      Version 10.0.16299

        +
      • RSADP:
        • +
        • +
        • Modulus Size: 2048 (bits)
          • +
        • +

      Microsoft Surface Hub MsBignum Cryptographic Implementations #1517

      +

      Version 10.0.15063.674

        +
      • RSASP1:
        • +
        • +
        • Modulus Size: 2048 (bits)
          • +
        • Padding Algorithms: PKCS 1.5
          • +
        • +

      Microsoft Surface Hub MsBignum Cryptographic Implementations #1516

      +

      Version 10.0.15063.674

        +
      • ECDSA SigGen:
        • +
        • +
        • P-256 SHA: SHA-256
          • +
        • P-384 SHA: SHA-384
          • +
        • P-521 SHA: SHA-512
          • +
        • +
      +

       Prerequisite: DRBG #1732

      Microsoft Surface Hub MsBignum Cryptographic Implementations #1515

      +

      Version 10.0.15063.674

        +
      • ECDSA SigGen:
        • +
        • +
        • P-256 SHA: SHA-256
          • +
        • P-384 SHA: SHA-384
          • +
        • P-521 SHA: SHA-512
          • +
        • +
      +

      Prerequisite: DRBG #1732

      Microsoft Surface Hub SymCrypt Cryptographic Implementations #1514

      +

      Version 10.0.15063.674

        +
      • RSADP:
        • +
        • +
        • Modulus Size: 2048 (bits)
          • +
        • +

      Microsoft Surface Hub SymCrypt Cryptographic Implementations #1513

      +

      Version 10.0.15063.674

        +
      • RSASP1:
        • +
        • +
        • Modulus Size: 2048 (bits)
          • +
        • Padding Algorithms: PKCS 1.5
          • +
        • +

      Microsoft Surface Hub SymCrypt Cryptographic Implementations #1512

      +

      Version 10.0.15063.674

        +
      • IKEv1:
        • +
        • +
        • Methods: Digital Signature, Pre-shared Key, Public Key Encryption
          • +
        • Pre-shared Key Length: 64-2048
          • +
        • Diffie-Hellman shared secrets:
          • +
          • +
          • Diffie-Hellman shared secret:
            • +
            • +
            • Length: 2048 (bits)
              • +
            • SHA Functions: SHA-256
              • +
            • +
          • Diffie-Hellman shared secret:
            • +
            • +
            • Length: 256 (bits)
              • +
            • SHA Functions: SHA-256
              • +
            • +
          • Diffie-Hellman shared secret:
            • +
            • +
            • Length: 384 (bits)
              • +
            • SHA Functions: SHA-384
              • +
            • +
          • +
        • +
      +

      Prerequisite: SHS #4011, HMAC #3269

      +
        +
      • IKEv2:
        • +
        • +
        • Derived Keying Material length: 192-1792
          • +
        • Diffie-Hellman shared secrets:
          • +
          • +
          • Diffie-Hellman shared secret:
            • +
            • +
            • Length: 2048 (bits)
              • +
            • SHA Functions: SHA-256
              • +
            • +
          • Diffie-Hellman shared secret:
            • +
            • +
            • Length: 256 (bits)
              • +
            • SHA Functions: SHA-256
              • +
            • +
          • Diffie-Hellman shared secret:
            • +
            • +
            • Length: 384 (bits)
              • +
            • SHA Functions: SHA-384
              • +
            • +
          • +
        • +
      +

      Prerequisite: SHS #4011, HMAC #3269

      +
        +
      • TLS:
        • +
        • +
        • Supports TLS 1.0/1.1
          • +
        • Supports TLS 1.2:
          • +
          • +
          • SHA Functions: SHA-256, SHA-384
            • +
          • +
        • +
      +

      Prerequisite: SHS #4011, HMAC #3269

      Microsoft Surface Hub SymCrypt Cryptographic Implementations #1511

      +

      Version 10.0.15063.674

        +
      • ECDSA SigGen:
        • +
        • +
        • P-256 SHA: SHA-256
          • +
        • P-384 SHA: SHA-384
          • +
        • P-521 SHA: SHA-512
          • +
        • +
      +

      Prerequisite: DRBG #1731

      Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1510

      +

      Version 10.0.15254

        +
      • RSADP:
        • +
        • +
        • Modulus Size: 2048 (bits)
          • +
        • +

      Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1509

      +

      Version 10.0.15254

        +
      • RSASP1:
        • +
        • +
        • Modulus Size: 2048 (bits)
          • +
        • Padding Algorithms: PKCS 1.5
          • +
        • +

      Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1508

      +

      Version 10.0.15254

        +
      • IKEv1:
        • +
        • +
        • Methods: Digital Signature, Pre-shared Key, Public Key Encryption
          • +
        • Pre-shared Key Length: 64-2048
          • +
        • Diffie-Hellman shared secrets:
          • +
          • +
          • Diffie-Hellman shared secret:
            • +
            • +
            • Length: 2048 (bits)
              • +
            • SHA Functions: SHA-256
              • +
            • +
          • Diffie-Hellman shared secret:
            • +
            • +
            • Length: 256 (bits)
              • +
            • SHA Functions: SHA-256
              • +
            • +
          • Diffie-Hellman shared secret:
            • +
            • +
            • Length: 384 (bits)
              • +
            • SHA Functions: SHA-384
              • +
            • +
          • +
        • +
      +

      Prerequisite: SHS #4010, HMAC #3268

      +
        +
      • IKEv2:
        • +
        • +
        • Derived Keying Material length: 192-1792
          • +
        • Diffie-Hellman shared secrets:
          • +
          • +
          • Diffie-Hellman shared secret:
            • +
            • +
            • Length: 2048 (bits)
              • +
            • SHA Functions: SHA-256
              • +
            • +
          • Diffie-Hellman shared secret:
            • +
            • +
            • Length: 256 (bits)
              • +
            • SHA Functions: SHA-256
              • +
            • +
          • Diffie-Hellman shared secret:
            • +
            • +
            • Length: 384 (bits)
              • +
            • SHA Functions: SHA-384
              • +
            • +
          • +
        • +
      +

      Prerequisite: SHS #4010, HMAC #3268

      +
        +
      • TLS:
        • +
        • +
        • Supports TLS 1.0/1.1
          • +
        • Supports TLS 1.2:
          • +
          • +
          • SHA Functions: SHA-256, SHA-384
            • +
          • +
        • +
      +

      Prerequisite: SHS #4010, HMAC #3268

      Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1507

      +

      Version 10.0.15254

        +
      • ECDSA SigGen:
        • +
        • +
        • P-256 SHA: SHA-256
          • +
        • P-384 SHA: SHA-384
          • +
        • P-521 SHA: SHA-512
          • +
        • +
      +

      Prerequisite: DRBG #1731

      Windows 10 Mobile (version 1709) MsBignum Cryptographic Implementations #1506

      +

      Version 10.0.15254

        +
      • RSADP:
        • +
        • +
        • Modulus Size: 2048 (bits)
          • +
        • +

      Windows 10 Mobile (version 1709) MsBignum Cryptographic Implementations #1505

      +

      Version 10.0.15254

        +
      • RSASP1:
        • +
        • +
        • Modulus Size: 2048 (bits)
          • +
        • Padding Algorithms: PKCS 1.5
          • +
        • +

      Windows 10 Mobile (version 1709) MsBignum Cryptographic Implementations #1504

      +

      Version 10.0.15254

        +
      • ECDSA SigGen:
        • +
        • +
        • P-256 SHA: SHA-256
          • +
        • P-384 SHA: SHA-384
          • +
        • P-521 SHA: SHA-512
          • +
        • +
      +

      Prerequisite: DRBG #1730

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); MsBignum Cryptographic Implementations #1503

      +

      Version 10.0.16299

        +
      • RSADP:
        • +
        • +
        • Modulus Size: 2048 (bits)
          • +
        • +

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); MsBignum Cryptographic Implementations #1502

      +

      Version 10.0.16299

        +
      • RSASP1:
        • +
        • +
        • Modulus Size: 2048 (bits)
          • +
        • Padding Algorithms: PKCS 1.5
          • +
        • +

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); MsBignum Cryptographic Implementations #1501

      +

      Version 10.0.16299

        +
      • ECDSA SigGen:
        • +
        • +
        • P-256 SHA: SHA-256
          • +
        • P-384 SHA: SHA-384
          • +
        • P-521 SHA: SHA-512
          • +
        • +
      +

      Prerequisite: DRBG #1730

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1499

      +

      Version 10.0.16299

        +
      • RSADP:
        • +
        • +
        • Modulus Size: 2048 (bits)
          • +
        • +

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1498

      +

      Version 10.0.16299

      +

       

        +
      • RSASP1:
        • +
        • +
        • Modulus Size: 2048 (bits)
          • +
        • Padding Algorithms: PKCS 1.5
          • +
        • +

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations  #1497

      +

      Version 10.0.16299

        +
      • IKEv1:
        • +
        • +
        • Methods: Digital Signature, Pre-shared Key, Public Key Encryption
          • +
        • Pre-shared Key Length: 64-2048
          • +
        • Diffie-Hellman shared secrets:
          • +
          • +
          • Diffie-Hellman shared secret:
            • +
            • +
            • Length: 2048 (bits)
              • +
            • SHA Functions: SHA-256
              • +
            • +
          • Diffie-Hellman shared secret:
            • +
            • +
            • Length: 256 (bits)
              • +
            • SHA Functions: SHA-256
              • +
            • +
          • Diffie-Hellman shared secret:
            • +
            • +
            • Length: 384 (bits)
              • +
            • SHA Functions: SHA-384
              • +
            • +
          • +
        • +
      +

      Prerequisite: SHS #4009, HMAC #3267

      +
        +
      • IKEv2:
        • +
        • +
        • Derived Keying Material length: 192-1792
          • +
        • Diffie-Hellman shared secrets:
          • +
          • +
          • Diffie-Hellman shared secret:
            • +
            • +
            • Length: 2048 (bits)
              • +
            • SHA Functions: SHA-256
              • +
            • +
          • Diffie-Hellman shared secret:
            • +
            • +
            • Length: 256 (bits)
              • +
            • SHA Functions: SHA-256
              • +
            • +
          • Diffie-Hellman shared secret:
            • +
            • +
            • Length: 384 (bits)
              • +
            • SHA Functions: SHA-384
              • +
            • +
          • +
        • +
      +

      Prerequisite: SHS #4009, HMAC #3267

      +
        +
      • TLS:
        • +
        • +
        • Supports TLS 1.0/1.1
          • +
        • Supports TLS 1.2:
          • +
          • +
          • SHA Functions: SHA-256, SHA-384
            • +
          • +
        • +
      +

      Prerequisite: SHS #4009, HMAC #3267

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations  #1496

      +

      Version 10.0.16299

      FIPS186-4 ECDSA

      +

      Signature Generation of hash sized messages

      +

      ECDSA SigGen Component: CURVES( P-256 P-384 P-521 )

      Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile MsBignum Cryptographic Implementations #1284
      +Version 10.0. 15063

      +

      Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1279
      +Version 10.0. 15063

      +

      Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update MsBignum Cryptographic Implementations #922
      +Version 10.0.14393

      +

      Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #894
      +Version 10.0.14393icrosoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” MsBignum Cryptographic Implementations #666
      +Version 10.0.10586

      +

      Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #288
      +Version 6.3.9600

      FIPS186-4 RSA; PKCS#1 v2.1

      +

      RSASP1 Signature Primitive

      +

      RSASP1: (Mod2048: PKCS1.5 PKCSPSS)

      Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #1285
      +Version 10.0.15063

      +

      Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile MsBignum Cryptographic Implementations #1282
      +Version 10.0.15063

      +

      Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1280
      +Version 10.0.15063

      +

      Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #893
      +Version 10.0.14393

      +

      Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update MsBignum Cryptographic Implementations #888
      +Version 10.0.14393

      +

      Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” MsBignum Cryptographic Implementations #665
      +Version 10.0.10586

      +

      Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 MsBignum Cryptographic Implementations #572
      +Version  10.0.10240

      +

      Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry MsBignum Cryptographic Implementations #289
      +Version 6.3.9600

      FIPS186-4 RSA; RSADP

      +

      RSADP Primitive

      +

      RSADP: (Mod2048)

      Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile MsBignum Cryptographic Implementations #1283
      +Version 10.0.15063

      +

      Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1281
      +Version 10.0.15063

      +

      Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #895
      +Version 10.0.14393

      +

      Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #887
      +Version 10.0.14393

      +

      Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” Cryptography Next Generation (CNG) Implementations #663
      +Version 10.0.10586

      +

      Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 Cryptography Next Generation (CNG) Implementations #576
      +Version  10.0.10240

      SP800-135

      +

      Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations  #1496

      +

      Version 10.0.16299

      +

      Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1278
      +Version 10.0.15063

      +

      Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1140
      +Version 7.00.2872

      +

      Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1139
      +Version 8.00.6246

      +

      Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update BcryptPrimitives and NCryptSSLp #886
      +Version 10.0.14393

      +

      Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” BCryptPrimitives and NCryptSSLp #664
      +Version 10.0.10586

      +

      Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 BCryptPrimitives and NCryptSSLp #575
      +Version  10.0.10240

      +

      Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 BCryptPrimitives and NCryptSSLp #323
      +Version 6.3.9600

      + + +## References + +\[[FIPS 140](http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf)\] - FIPS 140-2, Security Requirements for Cryptographic Modules + +\[[FIPS FAQ](http://csrc.nist.gov/groups/stm/cmvp/documents/cmvpfaq.pdf)\] - Cryptographic Module Validation Program (CMVP) FAQ + +\[[SP 800-57](http://csrc.nist.gov/publications/pubssps.html#800-57-part1)\] - Recommendation for Key Management – Part 1: General (Revised) + +\[[SP 800-131A](http://csrc.nist.gov/publications/nistpubs/800-131a/sp800-131a.pdf)\] - Transitions: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths \ No newline at end of file diff --git a/windows/security/threat-protection/index.md b/windows/security/threat-protection/index.md index 663976a44a..bbba6bbb82 100644 --- a/windows/security/threat-protection/index.md +++ b/windows/security/threat-protection/index.md @@ -1,7 +1,7 @@ --- title: Threat Protection (Windows 10) description: Learn how Microsoft Defender ATP helps protect against threats. -keywords: threat protection, Microsoft Defender Advanced Threat Protection, attack surface reduction, next generation protection, endpoint detection and response, automated investigation and response, microsoft threat experts, secure score, advanced hunting, cyber threat hunting +keywords: threat protection, Microsoft Defender Advanced Threat Protection, attack surface reduction, next generation protection, endpoint detection and response, automated investigation and response, microsoft threat experts, secure score, advanced hunting, cyber threat hunting, web threat protection search.product: eADQiWindows 10XVcnh ms.prod: w10 ms.mktglfcycl: deploy @@ -64,7 +64,7 @@ The attack surface reduction set of capabilities provide the first line of defen - [Application control](windows-defender-application-control/windows-defender-application-control.md) - [Device control](device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md) - [Exploit protection](microsoft-defender-atp/exploit-protection.md) -- [Network protection](microsoft-defender-atp/network-protection.md), [Web protection](microsoft-defender-atp/web-protection-overview.md) +- [Network protection](microsoft-defender-atp/network-protection.md), [web protection](microsoft-defender-atp/web-protection-overview.md) - [Controlled folder access](microsoft-defender-atp/controlled-folders.md) - [Network firewall](windows-firewall/windows-firewall-with-advanced-security.md) - [Attack surface reduction rules](microsoft-defender-atp/attack-surface-reduction.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference.md index e269b25de8..c0b6610350 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference.md @@ -25,6 +25,8 @@ ms.date: 10/08/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) +[!include[Prerelease information](prerelease.md)] + The [Advanced hunting](advanced-hunting-overview.md) schema is made up of multiple tables that provide either event information or information about machines and other entities. To effectively build queries that span multiple tables, you need to understand the tables and the columns in the Advanced hunting schema. ## Schema tables @@ -45,7 +47,11 @@ Table and column names are also listed within the Microsoft Defender Security Ce | **[LogonEvents](advanced-hunting-logonevents-table.md)** | Sign-ins and other authentication events | | **[ImageLoadEvents](advanced-hunting-imageloadevents-table.md)** | DLL loading events | | **[MiscEvents](advanced-hunting-miscevents-table.md)** | Multiple event types, including events triggered by security controls such as Windows Defender Antivirus and exploit protection | +| **[DeviceTvmSoftwareInventoryVulnerabilities](advanced-hunting-tvm-softwareinventory-table.md)** | Vulnerabilities in your software inventory | +| **[DeviceTvmSoftwareVulnerabilitiesKB ](advanced-hunting-tvm-softwarevulnerability-table.md)** | Publicly-available vulnerabilities and whether they exist in your software inventory | +| **[DeviceTvmSecureConfigurationAssessment](advanced-hunting-tvm-configassessment-table.md)** | Security configuration assessment information | +| **[DeviceTvmSecureConfigurationAssessmentKB](advanced-hunting-tvm-secureconfigkb-table.md)** | Basis of security configuration assessment such as security industry standards and benchmarks | ## Related topics - [Advanced hunting overview](advanced-hunting-overview.md) -- [Learn the query language](advanced-hunting-query-language.md) \ No newline at end of file +- [Learn the query language](advanced-hunting-query-language.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-configassessment-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-configassessment-table.md new file mode 100644 index 0000000000..35d38020d6 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-configassessment-table.md @@ -0,0 +1,53 @@ +--- +title: DeviceTvmSecureConfigurationAssessment table in the Advanced hunting schema +description: Learn about the DeviceTvmSecureConfigurationAssessment table in the Advanced hunting schema, such as machine ID, computer name, operating system platform, security configuration details, impact, and compliance information. +keywords: advanced hunting, atp query, device management, query atp data, query tvm data, query security configuration, intellisense, atp telemetry, events, events telemetry, azure log analytics, description, DeviceTvmSecureConfigurationAssessment +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: dolmont +author: DulceMontemayor +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +ms.date: 10/27/2019 +--- + +# DeviceTvmSecureConfigurationAssessment + +**Applies to:** + +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) + +[!include[Prerelease information](prerelease.md)] + +Each row in the DeviceTvmSecureConfigurationAssessment table contains an assessment event for a specific security configuration. Use this reference to check the latest assessment results and determine whether device are compliant. + +For information on other tables in the Advanced hunting schema, see [the Advanced hunting reference](advanced-hunting-reference.md). + +| Column name | Data type | Description | +|-------------|-----------|-------------| +| MachineId | string | Unique identifier for the machine in the service | +| ComputerName | string | Fully qualified domain name (FQDN) of the machine | +| OSPlatform | string | Platform of the operating system running on the machine. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7.| +| Timestamp | datetime |Date and time when the record was generated| +| ConfigurationId | string | Unique identifier for a specific configuration | +| ConfigurationCategory | string | Category or grouping to which the configuration belongs: Application, OS, Network, Accounts, Security controls| +| ConfigurationSubcategory | string |Subcategory or subgrouping to which the configuration belongs. In many cases, this describes specific capabilities or features. | +| ConfigurationImpact | string | Rated impact of the configuration to the overall configuration score (1-10) | +| IsCompliant | boolean | Indicates whether the configuration or policy is properly configured | + + +## Related topics + +- [Advanced hunting overview](overview-hunting.md) +- [All Advanced hunting tables](advanced-hunting-reference.md) +- [Advanced hunting query best practices](advanced-hunting-best-practices.md) +- [Query data using Advanced hunting](advanced-hunting.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-secureconfigkb-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-secureconfigkb-table.md new file mode 100644 index 0000000000..857a5731c6 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-secureconfigkb-table.md @@ -0,0 +1,53 @@ +--- +title: DeviceTvmSecureConfigurationAssessmentKB table in the Advanced hunting schema +description: Learn about the DeviceTvmSecureConfigurationAssessmentKB table in the Advanced hunting schema, security configuration details, and the associated industry benchmarks that it adheres to. +keywords: advanced hunting, atp query, device management, query atp data, query tvm data, query security configuration, intellisense, atp telemetry, events, events telemetry, azure log analytics, description, MITRE ATT&CK framework, DeviceTvmSecureConfigurationAssessmentKB +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: dolmont +author: DulceMontemayor +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +ms.date: 10/27/2019 +--- + +# DeviceTvmSecureConfigurationAssessmentKB + +**Applies to:** + +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) + +[!include[Prerelease information](prerelease.md)] + +The DeviceTvmSecureConfigurationAssessmentKB table in the Advanced hunting schema contains information about the various secure configuration TVM checks during assessments related to your organization. An example of a security configuration is to block JavaScript or VBScript from launching downloaded executable content to prevent accidentally downloading malicious files in your network. Use this reference to construct queries that return information from the table. + +For information on other tables in the Advanced hunting schema, see [the Advanced hunting reference](advanced-hunting-reference.md). + +| Column name | Data type | Description | +|-------------|-----------|-------------| +| ConfigurationId | string | Unique identifier for a specific configuration | +| ConfigurationImpact | string | Rated impact of the configuration to the overall configuration score (1-10) | +| ConfigurationName | string | Display name of the configuration | +| ConfigurationDescription | string | Description of the configuration | +| RiskDescription | string | Description of the associated risk | +| ConfigurationCategory | string | Category or grouping to which the configuration belongs: Application, OS, Network, Accounts, Security controls| +| ConfigurationSubcategory | string |Subcategory or subgrouping to which the configuration belongs. In many cases, this describes specific capabilities or features. | +| ConfigurationBenchmarks | string | List of industry benchmarks recommending the same or similar configuration | +| RelatedMitreTechniques | string | List of Mitre ATT&CK framework techniques related to the configuration | +| RelatedMitreTactics | string | List of Mitre ATT&CK framework tactics related to the configuration| + +## Related topics + +- [Advanced hunting overview](overview-hunting.md) +- [All Advanced hunting tables](advanced-hunting-reference.md) +- [Advanced hunting query best practices](advanced-hunting-best-practices.md) +- [Query data using Advanced hunting](advanced-hunting.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-softwareinventory-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-softwareinventory-table.md new file mode 100644 index 0000000000..fcf0c2e4bd --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-softwareinventory-table.md @@ -0,0 +1,56 @@ +--- +title: DeviceTvmSoftwareInventoryVulnerabilities table in the Advanced hunting schema +description: Learn about the DeviceTvmSoftwareInventoryVulnerabilities table in the Advanced hunting schema, such as operating system platform, version, and architecture, software vendor, name, and version, CVE ID, vulnerability severity, and descriptions +keywords: advanced hunting, atp query, device management, query atp data, query tvm data, query software inventory, query software vulnerability inventory, intellisense, atp telemetry, events, events telemetry, azure log analytics, description, DeviceTvmSoftwareInventoryVulnerabilities +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: dolmont +author: DulceMontemayor +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +ms.date: 10/27/2019 +--- + +# DeviceTvmSoftwareInventoryVulnerabilities + +**Applies to:** + +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) + + +[!include[Prerelease information](prerelease.md)] + +The DeviceTvmSoftwareInventoryVulnerabilities table in the Advanced hunting schema contains an inventory of the software on your devices as well as any known vulnerabilities in the software products. Use this reference to construct queries that return information from the table. + +For information on other tables in the Advanced hunting schema, see [the Advanced hunting reference](advanced-hunting-reference.md). + +| Column name | Data type | Description | +|-------------|-----------|-------------| +| MachineId | string | Unique identifier for the machine in the service | +| ComputerName | string | Fully qualified domain name (FQDN) of the machine | +| OSPlatform | string | Platform of the operating system running on the machine. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7.| +| OSVersion | string | Version of the operating system running on the machine | +| OSArchitecture | string | Architecture of the operating system running on the machine| +| SoftwareVendor | string | Severity level assigned to the security vulnerability based on the CVSS score and dynamic factors influenced by the threat landscape| +| SoftwareName | string | Name of the software product| +|SoftwareVersion | string | Version number of the software product| +| CveId | string | Unique identifier assigned to the security vulnerability under the Common Vulnerabilities and Exposures (CVE) system| +| VulnerabilitySeverityLevel | string | Severity level assigned to the security vulnerability based on the CVSS score and dynamic factors influenced by the threat landscape| + + + +## Related topics + +- [Advanced hunting overview](overview-hunting.md) +- [All Advanced hunting tables](advanced-hunting-reference.md) +- [Advanced hunting query best practices](advanced-hunting-best-practices.md) +- [Query data using Advanced hunting](advanced-hunting.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-softwarevulnerability-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-softwarevulnerability-table.md new file mode 100644 index 0000000000..757ad9858c --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-softwarevulnerability-table.md @@ -0,0 +1,51 @@ +--- +title: DeviceTvmSoftwareVulnerabilitiesKB table in the Advanced hunting schema +description: Learn about the DeviceTvmSoftwareVulnerabilitiesKB table in the Advanced hunting schema, such as CVE ID, CVSS score, exploit availability, vulnerability severity, last modified time, date the vulnerability was disclosed to public, and affected software in your network. +keywords: advanced hunting, atp query, device management, query atp data, query tvm data, query software vulnerability inventory, intellisense, atp telemetry, events, events telemetry, azure log analytics, description, DeviceTvmSoftwareVulnerabilitiesKB +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: dolmont +author: DulceMontemayor +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +ms.date: 10/27/2019 +--- + +# DeviceTvmSoftwareVulnerabilitiesKB + +**Applies to:** + +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) + +[!include[Prerelease information](prerelease.md)] + +The DeviceTvmSoftwareInventoryVulnerabilities table in the Advanced hunting schema contains information about the vulnerabilities Threat & Vulnerability Management assesses devices for. Use this reference along with DeviceTvmSoftwareInventoryVulnerabilities to construct queries that return information on the metadata related to the vulnerabilities in your inventory. + +For information on other tables in the Advanced hunting schema, see [the Advanced hunting reference](advanced-hunting-reference.md). + +| Column name | Data type | Description | +|-------------|-----------|-------------| +| CveId | string | Unique identifier assigned to the security vulnerability under the Common Vulnerabilities and Exposures (CVE) system| +| CvssScore | string | Severity score assigned to the security vulnerability under th Common Vulnerability Scoring System (CVSS)| +| IsExploitAvailable | boolean | Indicates whether exploit code for the vulnerability is publicly available| +| VulnerabilitySeverityLevel | string | Severity level assigned to the security vulnerability based on the CVSS score and dynamic factors influenced by the threat landscape| +| LastModifiedTime | datetime | Date and time the item or related metadata was last modified| +| PublishedDate | datetime | Date vulnerability was disclosed to public| +| VulnerabilityDescription | string | Description of vulnerability and associated risks| +| AffectedSoftware | string | List of all software products affected by the vulnerability| + +## Related topics + +- [Advanced hunting overview](overview-hunting.md) +- [All Advanced hunting tables](advanced-hunting-reference.md) +- [Advanced hunting query best practices](advanced-hunting-best-practices.md) +- [Query data using Advanced hunting](advanced-hunting.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configuration-score.md b/windows/security/threat-protection/microsoft-defender-atp/configuration-score.md index 4eafbbefa8..6a076bfb65 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configuration-score.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configuration-score.md @@ -60,7 +60,7 @@ See how you can [improve your security configuration](https://docs.microsoft.com >- RS3 customers | [KB 4516071](https://support.microsoft.com/help/4516071/windows-10-update-kb4516071) > >To download the security updates: ->1. Go to [Microsoft Update Catalog](http://www.catalog.update.microsoft.com/home.aspx). +>1. Go to [Microsoft Update Catalog](https://www.catalog.update.microsoft.com/home.aspx). >2. Key-in the security update KB number that you need to download, then click **Search**. ## Related topics @@ -68,7 +68,7 @@ See how you can [improve your security configuration](https://docs.microsoft.com - [Threat & Vulnerability Management dashboard overview](tvm-dashboard-insights.md) - [Exposure score](tvm-exposure-score.md) - [Security recommendations](tvm-security-recommendation.md) -- [Remediation](tvm-remediation.md) +- [Remediation and exception](tvm-remediation.md) - [Software inventory](tvm-software-inventory.md) - [Weaknesses](tvm-weaknesses.md) - [Scenarios](threat-and-vuln-mgt-scenarios.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/configure-attack-surface-reduction.md index d0dfe6add3..2373d0cf56 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-attack-surface-reduction.md @@ -33,10 +33,10 @@ The topics in this section describe how to configure attack surface reduction. E Topic | Description -|- -[Enable hardware-based isolation for Microsoft Edge](../windows-defender-application-guard/install-wd-app-guard.md) | How to preprare for and install Application Guard, including hardware and softeware requirements -[Enable application control](../windows-defender-application-control/windows-defender-application-control.md)|How to control applications run by users and potect kernel mode processes +[Enable hardware-based isolation for Microsoft Edge](../windows-defender-application-guard/install-wd-app-guard.md) | How to prepare for and install Application Guard, including hardware and software requirements +[Enable application control](../windows-defender-application-control/windows-defender-application-control.md)|How to control applications run by users and protect kernel mode processes [Exploit protection](./enable-exploit-protection.md)|How to automatically apply exploit mitigation techniques on both operating system processes and on individual apps -[Network protection](./enable-network-protection.md)|How to prevent users from using any apps to acces dangerous domains +[Network protection](./enable-network-protection.md)|How to prevent users from using any apps to access dangerous domains [Controlled folder access](./enable-controlled-folders.md)|How to protect valuable data from malicious apps -[Attack surface reduction](./enable-attack-surface-reduction.md)|How to prevent actions and apps that are typically used for by exploit-seeking malware +[Attack surface reduction](./enable-attack-surface-reduction.md)|How to prevent actions and apps that are typically used by exploit-seeking malware [Network firewall](../windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md)|How to protect devices and data across a network diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-microsoft-threat-experts.md b/windows/security/threat-protection/microsoft-defender-atp/configure-microsoft-threat-experts.md index 584f376ee3..6140a832e2 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-microsoft-threat-experts.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-microsoft-threat-experts.md @@ -23,10 +23,11 @@ ms.topic: article - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -[!include[Prerelease information](prerelease.md)] - ## Before you begin -Ensure that you have Microsoft Defender ATP deployed in your environment with machines enrolled, and not just on a laboratory set-up. +Ensure that you have Microsoft Defender ATP deployed in your environment with machines enrolled, and not just on a laboratory set-up. + +>[!NOTE] +>Microsoft Defender ATP customers need to apply for the Microsoft Threat Experts managed threat hunting service to get proactive targeted attack notifications and to collaborate with experts on demand. A Microsoft Threat Experts subscription is a prerequisite for experts on demand collaboration. ## Register to Microsoft Threat Experts managed threat hunting service If you're already a Microsoft Defender ATP customer, you can apply through the Microsoft Defender ATP portal. @@ -63,9 +64,6 @@ You'll start receiving targeted attack notification from Microsoft Threat Expert ## Consult a Microsoft threat expert about suspicious cybersecurity activities in your organization ->[!NOTE] ->The Microsoft Threat Experts' experts-on-demand capability is still in preview. You can only use the experts-on-demand capability if you have applied for preview and your application has been approved. - You can partner with Microsoft Threat Experts who can be engaged directly from within the Microsoft Defender Security Center for timely and accurate response. Experts provide insights to better understand complex threats, targeted attack notifications that you get, or if you need more information about the alerts, a potentially compromised machine, or a threat intelligence context that you see on your portal dashboard. >[!NOTE] @@ -77,10 +75,12 @@ You can partner with Microsoft Threat Experts who can be engaged directly from w >![Image of Microsoft Threat Experts Experts on Demand from the menu](images/mte-eod-menu.png) ->A flyout screen opens. - +>A flyout screen opens. The following screen shows when you are on a trial subscription. >![Image of Microsoft Threat Experts Experts on Demand screen](images/mte-eod.png) +> The following screen shows when you are on a full Microsoft Threat Experts - Experts on Demand subscription. +>![Image of Microsoft Threat Experts Experts on Demand full subscription screen](images/mte-eod-fullsubscription.png) + >The **Inquiry topic** field is pre-populated with the link to the relevant page for your investigation request. For example, a link to the incident, alert, or machine details page that you were at when you made the request. 3. In the next field, provide enough information to give the Microsoft Threat Experts enough context to start the investigation. @@ -120,7 +120,7 @@ Response from Microsoft Threat Experts varies according to your inquiry. They wi - Investigation requires more time - Initial information was enough to conclude the investigation -It is crucial to respond in a timely manner to keep the investigation moving. See the Premier customer service and support service level agreement for details. +It is crucial to respond in a timely manner to keep the investigation moving. ## Related topic - [Microsoft Threat Experts overview](microsoft-threat-experts.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md b/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md index 8c0c0aa43c..95e0136a97 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md @@ -141,7 +141,7 @@ Verify the proxy configuration completed successfully, that WinHTTP can discover 1. Download the [connectivity verification tool](https://aka.ms/mdatpanalyzer) to the PC where Microsoft Defender ATP sensor is running on. -2. Extract the contents of WDATPConnectivityAnalyzer on the machine. +2. Extract the contents of MDATPClientAnalyzer on the machine. 3. Open an elevated command-line: @@ -152,19 +152,19 @@ Verify the proxy configuration completed successfully, that WinHTTP can discover 4. Enter the following command and press **Enter**: ```PowerShell - HardDrivePath\WDATPConnectivityAnalyzer.cmd + HardDrivePath\MDATPClientAnalyzer.cmd ``` - Replace *HardDrivePath* with the path where the WDATPConnectivityAnalyzer tool was downloaded to, for example + Replace *HardDrivePath* with the path where the MDATPClientAnalyzer tool was downloaded to, for example ```PowerShell - C:\Work\tools\WDATPConnectivityAnalyzer\WDATPConnectivityAnalyzer.cmd + C:\Work\tools\MDATPClientAnalyzer\MDATPClientAnalyzer.cmd ``` -5. Extract the *WDATPConnectivityAnalyzerResult.zip* file created by tool in the folder used in the *HardDrivePath*. +5. Extract the *MDATPClientAnalyzerResult.zip* file created by tool in the folder used in the *HardDrivePath*. -6. Open *WDATPConnectivityAnalyzer.txt* and verify that you have performed the proxy configuration steps to enable server discovery and access to the service URLs.

      - The tool checks the connectivity of Microsoft Defender ATP service URLs that Microsoft Defender ATP client is configured to interact with. It then prints the results into the *WDATPConnectivityAnalyzer.txt* file for each URL that can potentially be used to communicate with the Microsoft Defender ATP services. For example: +6. Open *MDATPClientAnalyzerResult.txt* and verify that you have performed the proxy configuration steps to enable server discovery and access to the service URLs.

      + The tool checks the connectivity of Microsoft Defender ATP service URLs that Microsoft Defender ATP client is configured to interact with. It then prints the results into the *MDATPClientAnalyzerResult.txt* file for each URL that can potentially be used to communicate with the Microsoft Defender ATP services. For example: ```text Testing URL : https://xxx.microsoft.com/xxx diff --git a/windows/security/threat-protection/microsoft-defender-atp/enable-network-protection.md b/windows/security/threat-protection/microsoft-defender-atp/enable-network-protection.md index 97a6409ed0..7f23be0e27 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/enable-network-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/enable-network-protection.md @@ -83,8 +83,8 @@ You can use the following procedure to enable network protection on domain-joine You can confirm network protection is enabled on a local computer by using Registry editor: 1. Click **Start** and type **regedit** to open **Registry Editor**. -1. Navigate to Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection -1. Click **EnableNetworkProtection** and confirm the value: +2. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection +3. Click **EnableNetworkProtection** and confirm the value: * 0=Off * 1=On * 2=Audit diff --git a/windows/security/threat-protection/microsoft-defender-atp/endpoint-detection-response-mac-preview.md b/windows/security/threat-protection/microsoft-defender-atp/endpoint-detection-response-mac-preview.md new file mode 100644 index 0000000000..e0e7253afa --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/endpoint-detection-response-mac-preview.md @@ -0,0 +1,154 @@ +--- +title: Microsoft Defender ATP for Mac +ms.reviewer: +description: Describes how to install and use Microsoft Defender ATP for Mac. +keywords: microsoft, defender, atp, mac, installation, deploy, uninstallation, intune, jamf, macos, catalina, mojave, high sierra +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: dansimp +author: dansimp +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: conceptual +--- + +# Enable Microsoft Defender ATP Insider Machine + +The following instructions specify how to configure a macOS machine running Microsoft Defender ATP to be an "Insider" machine. For scale deployment we recommend using Jamf, or Intune. + +>[!IMPORTANT] +>Make sure you have enabled [Microsoft Defender ATP for Mac](microsoft-defender-atp-mac.md#how-to-install-microsoft-defender-atp-for-mac), and pay attention to the “earlyPreview” flag. See documentation for [Jamf](mac-install-with-jamf.md), [Intune](mac-install-with-intune.md) and [manual deployment](mac-install-manually.md) instructions. + +## Enable the Insider program with Jamf + +a. Create configuration profile com.microsoft.wdav.plist with the following content: + +```XML + + + + + edr + + earlyPreview + + + + +``` + +b. From the JAMF console, navigate to **Computers > Configuration Profiles**, navigate to the configuration profile you'd like to use, then select **Custom Settings**. + +c. Create an entry with com.microsoft.wdav as the preference domain and upload the .plist created earlier. + +>[!WARNING] +>You must enter the correct preference domain (com.microsoft.wdav), otherwise the preferences will not be recognized by the product + +## Enable the Insider program with Intune + +a. Create configuration profile com.microsoft.wdav.plist with the following content: + + ```XML + + + + + PayloadUUID + C4E6A782-0C8D-44AB-A025-EB893987A295 + PayloadType + Configuration + PayloadOrganization + Microsoft + PayloadIdentifier + com.microsoft.wdav + PayloadDisplayName + Microsoft Defender ATP settings + PayloadDescription + Microsoft Defender ATP configuration settings + PayloadVersion + 1 + PayloadEnabled + + PayloadRemovalDisallowed + + PayloadScope + System + PayloadContent + + + PayloadUUID + 99DBC2BC-3B3A-46A2-A413-C8F9BB9A7295 + PayloadType + com.microsoft.wdav + PayloadOrganization + Microsoft + PayloadIdentifier + com.microsoft.wdav + PayloadDisplayName + Microsoft Defender ATP configuration settings + PayloadDescription + + PayloadVersion + 1 + PayloadEnabled + + edr + + earlyPreview + + + + + + +``` + +b. Open **Manage > Device configuration**. Select **Manage > Profiles > Create Profile**. + +c. Choose a name for the profile. Change **Platform=macOS** to **Profile type=Custom**. Select **Configure**. + +d. Save the .plist created earlier as com.microsoft.wdav.xml. + +e. Enter com.microsoft.wdav as the custom configuration profile name. + +f. Open the configuration profile and upload com.microsoft.wdav.xml. This file was created in step 1. + +g. Select **OK**. + +h. Select **Manage > Assignments**. In the **Include** tab, select **Assign to All Users & All devices**. + +>[!WARNING] +>You must enter the correct custom configuration profile name, otherwise these preferences will not be recognized by the product. + +## Enable the Insider program manually on a single machine + +In the command prompt, run: + +```bash + mdatp --edr --early-preview true + ``` + +## Troubleshooting + +### Verify you are running the correct version + +To verify you are running the correct version, run ‘mdatp --health’ on the machine. + +* The required version is 100.72.15 or later. +* If the version is not as expected, verify that Microsoft Auto Update is set to automatically download and install updates by running ‘defaults read com.microsoft.autoupdate2’ from terminal. +* To change update settings use documentation in Update Office for Mac automatically. +* If you are not using Office for Mac, download and run the AutoUpdate tool. + +### A machine still does not appear on Microsoft Defender Security Center + +After a successful deployment and onboarding of the correct version, check that the machine has connectivity to the cloud service by running ‘mdatp --connectivity-test’. + +* Check that you enabled the early preview flag. In terminal run “mdatp –health” and look for the value of “edrEarlyPreviewEnabled”. It should be “Enabled”. + +If you followed the manual deployment instructions, you were prompted to enable Kernel Extensions. Pay attention to the “System Extension note” in the manual deployment documentation and use the “Manual Deployment” section in the troubleshoot kernel extension documentation. \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/mte-eod-fullsubscription.png b/windows/security/threat-protection/microsoft-defender-atp/images/mte-eod-fullsubscription.png new file mode 100644 index 0000000000..aecffb5789 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/mte-eod-fullsubscription.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-cancellation.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-cancellation.png new file mode 100644 index 0000000000..27b00fdd87 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-cancellation.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-confirmation.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-confirmation.png new file mode 100644 index 0000000000..d0eb92e377 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-confirmation.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-dashboard.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-dashboard.png new file mode 100644 index 0000000000..3f8ead879c Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-dashboard.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-details.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-details.png new file mode 100644 index 0000000000..9acba5c77f Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-details.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-dropdown.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-dropdown.png new file mode 100644 index 0000000000..31d16836b0 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-dropdown.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-filters.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-filters.png new file mode 100644 index 0000000000..6cafba6c3d Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-filters.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-flyout.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-flyout.png new file mode 100644 index 0000000000..e01d9f53a5 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-flyout.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-impact.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-impact.png new file mode 100644 index 0000000000..072835588a Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-impact.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-list.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-list.png new file mode 100644 index 0000000000..dbd99451af Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-list.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-option.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-option.png new file mode 100644 index 0000000000..98d59f5c07 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-option.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm-granular-exploit.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-granular-exploit.png new file mode 100644 index 0000000000..00d29b4a0c Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-granular-exploit.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm-threat-insights.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-threat-insights.png index a40e39c3d0..2f9717883f 100644 Binary files a/windows/security/threat-protection/microsoft-defender-atp/images/tvm-threat-insights.png and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-threat-insights.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm-weaknesses-page.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-weaknesses-page.png new file mode 100644 index 0000000000..36ca63f7bf Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-weaknesses-page.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm_alert_icon.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_alert_icon.png index ebd390bd98..863c7e4fbe 100644 Binary files a/windows/security/threat-protection/microsoft-defender-atp/images/tvm_alert_icon.png and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_alert_icon.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm_bug_icon.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_bug_icon.png index b87ba02a90..e81d73f631 100644 Binary files a/windows/security/threat-protection/microsoft-defender-atp/images/tvm_bug_icon.png and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_bug_icon.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml.md b/windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml.md index c46302a04f..38b96e9451 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml.md +++ b/windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml.md @@ -53,6 +53,9 @@ When you have configured exploit protection to your desired state (including bot 3. At the bottom of the **Exploit protection** section, click **Export settings** and then choose the location and name of the XML file where you want the configuration to be saved. +> [!IMPORTANT] +> If you want to use Default configuration, use the settings "On by default" instead of "Use Default (On)" to get the settings exported correctly on the XML file. + ![Highlight of the Export Settings option](../images/wdsc-exp-prot-export.png) > [!NOTE] diff --git a/windows/security/threat-protection/microsoft-defender-atp/mac-exclusions.md b/windows/security/threat-protection/microsoft-defender-atp/mac-exclusions.md new file mode 100644 index 0000000000..2dda7ca218 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-exclusions.md @@ -0,0 +1,81 @@ +--- +title: Configure and validate exclusions for Microsoft Defender ATP for Mac +description: Provide and validate exclusions for Microsoft Defender ATP for Mac. Exclusions can be set for files, folders, and processes. +keywords: microsoft, defender, atp, mac, exclusions, scans, antivirus +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: dansimp +author: dansimp +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: conceptual +--- + +# Configure and validate exclusions for Microsoft Defender ATP for Mac + +**Applies to:** + +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac](microsoft-defender-atp-mac.md) + +This article provides information on how to define exclusions that apply to on-demand scans, and real-time protection and monitoring. + +>[!IMPORTANT] +>The exclusions described in this article don't apply to other Microsoft Defender ATP for Mac capabilities, including endpoint detection and response (EDR). Files that you exclude using the methods described in this article can still trigger EDR alerts and other detections. + +You can exclude certain files, folders, processes, and process-opened files from Microsoft Defender ATP for Mac scans. + +Exclusions can be useful to avoid incorrect detections on files or software that are unique or customized to your organization. They can also be useful for mitigating performance issues caused by Microsoft Defender ATP for Mac. + +>[!WARNING] +>Defining exclusions lowers the protection offered by Microsoft Defender ATP for Mac. You should always evaluate the risks that are associated with implementing exclusions, and you should only exclude files that you are confident are not malicious. + +## Supported exclusion types + +The follow table shows the exclusion types supported by Microsoft Defender ATP for Mac. + +Exclusion | Definition | Examples +---|---|--- +File extension | All files with the extension, anywhere on the machine | .test +File | A specific file identified by the full path | /var/log/test.log +Folder | All files under the specified folder | /var/log/ +Process | A specific process (specified either by the full path or file name) and all files opened by it | /bin/cat
      cat + +## How to configure the list of exclusions + +### From the management console + +For more information on how to configure exclusions from JAMF, Intune, or another management console, see [Set preferences for Microsoft Defender ATP for Mac](mac-preferences.md). + +### From the user interface + +Open the Microsoft Defender ATP application and navigate to **Manage settings** > **Add or Remove Exclusion...**, as shown in the following screenshot: + +![[Manage exclusions screenshot](../windows-defender-antivirus/images/mdatp-37-exclusions.png) + +Select the type of exclusion that you wish to add and follow the prompts. + +## Validate exclusions lists with the EICAR test file + +You can validate that your exclusion lists are working by using `curl` to download a test file. + +In the following Bash snippet, replace *test.txt* with a file that conforms to your exclusion rules. For example, if you have excluded the *.testing extension*, replace *test.txt* with *test.testing*. If you are testing a path, ensure that you run the command within that path. + +```bash +$ curl -o test.txt http://www.eicar.org/download/eicar.com.txt +``` + +If Microsoft Defender ATP for Mac reports malware, then the rule is not working. If there is no report of malware, and the downloaded file exists, then the exclusion is working. You can open the file to confirm that the contents are the same as what is described on the [EICAR test file website](http://2016.eicar.org/86-0-Intended-use.html). + +If you do not have internet access, you can create your own EICAR test file. Write the EICAR string to a new text file with the following Bash command: + +```bash +echo 'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*' > test.txt +``` + +You can also copy the string into a blank text file and attempt to save it with the file name or in the folder you are attempting to exclude. diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-manually.md b/windows/security/threat-protection/microsoft-defender-atp/mac-install-manually.md similarity index 53% rename from windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-manually.md rename to windows/security/threat-protection/microsoft-defender-atp/mac-install-manually.md index bed05f108c..117296a474 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-manually.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-install-manually.md @@ -1,8 +1,7 @@ --- -title: Installing Microsoft Defender ATP for Mac manually -ms.reviewer: -description: Describes how to install Microsoft Defender ATP for Mac manually, from the command line. -keywords: microsoft, defender, atp, mac, installation, deploy, uninstallation, intune, jamf, macos, mojave, high sierra, sierra +title: Manual deployment for Microsoft Defender ATP for Mac +description: Install Microsoft Defender ATP for Mac manually, from the command line. +keywords: microsoft, defender, atp, mac, installation, deploy, uninstallation, intune, jamf, macos, catalina, mojave, high sierra search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -18,7 +17,7 @@ ms.collection: M365-security-compliance ms.topic: conceptual --- -# Manual deployment +# Manual deployment for Microsoft Defender ATP for Mac **Applies to:** @@ -42,7 +41,7 @@ Download the installation and onboarding packages from Windows Defender Security 3. In Section 2 of the page, select **Download installation package**. Save it as wdav.pkg to a local directory. 4. In Section 2 of the page, select **Download onboarding package**. Save it as WindowsDefenderATPOnboardingPackage.zip to the same directory. - ![Windows Defender Security Center screenshot](images/ATP_Portal_Onboarding_page.png) + ![Windows Defender Security Center screenshot](../windows-defender-antivirus/images/ATP-Portal-Onboarding-page.png) 5. From a command prompt, verify that you have the two files. Extract the contents of the .zip files: @@ -63,83 +62,28 @@ To complete this process, you must have admin privileges on the machine. 1. Navigate to the downloaded wdav.pkg in Finder and open it. - ![App install screenshot](images/MDATP_28_AppInstall.png) + ![App install screenshot](../windows-defender-antivirus/images/MDATP-28-AppInstall.png) 2. Select **Continue**, agree with the License terms, and enter the password when prompted. - ![App install screenshot](images/MDATP_29_AppInstallLogin.png) + ![App install screenshot](../windows-defender-antivirus/images/MDATP-29-AppInstallLogin.png) > [!IMPORTANT] - > You will be prompted to allow a driver from Microsoft to be installed (either "System Exception Blocked" or "Installation is on hold" or both. The driver must be allowed to be installed. + > You will be prompted to allow a driver from Microsoft to be installed (either "System Extension Blocked" or "Installation is on hold" or both. The driver must be allowed to be installed. - ![App install screenshot](images/MDATP_30_SystemExtension.png) + ![App install screenshot](../windows-defender-antivirus/images/MDATP-30-SystemExtension.png) 3. Select **Open Security Preferences** or **Open System Preferences > Security & Privacy**. Select **Allow**: - ![Security and privacy window screenshot](images/MDATP_31_SecurityPrivacySettings.png) + ![Security and privacy window screenshot](../windows-defender-antivirus/images/MDATP-31-SecurityPrivacySettings.png) The installation proceeds. -> [!NOTE] -> If you don't select **Allow**, the installation will proceed after 5 minutes. Defender ATP will be loaded, but real-time protection will be disabled. +> [!CAUTION] +> If you don't select **Allow**, the installation will proceed after 5 minutes. Defender ATP will be loaded, but some features, such as real-time protection, will be disabled. See [Troubleshoot kernel extension issues](mac-support-kext.md) for information on how to resolve this. > [!NOTE] -> macOS may request to reboot the machine upon the first installation of Microsoft Defender. Real-Time Protection will not be available until the machine is rebooted. - -### Fixing disabled Real-Time Protection - -If you did not enable Microsoft's driver during installation, then the application displays a banner prompting you to enable it: - - ![RTP disabled screenshot](images/MDATP_32_Main_App_Fix.png) - -You can also run ```mdatp --health```. It reports if Real-Time Protection is enabled but not available: - -```bash -$ mdatp --health -... -realTimeProtectionAvailable : false -realTimeProtectionEnabled : true -... -``` - -> [!NOTE] -> You have a 30 minute window to enable Real-Time Protection from the warning banner, immediately following installation. - -The warning banner contains a **Fix** button, which allows you to quickly enable Real-Time Protection, without having to open a command prompt. Select the **Fix** button. It prompts the **Security & Privacy** system window, where you have to **Allow** system software from developers "Microsoft Corporation". - -If you don't see a prompt, it means that 30 or more minutes have already passed, and Real-Time Protection has still not been enabled: - -![Security and privacy window after prompt expired screenshot](images/MDATP_33_SecurityPrivacySettings_NoPrompt.png) - -In this case, you need to perform the following steps to enable Real-Time Protection instead. - -1. In Terminal, attempt to install the driver. (The operation will fail) - ```bash - $ sudo kextutil /Library/Extensions/wdavkext.kext - Kext rejected due to system policy: { URL = "file:///Library/StagedExtensions/Library/Extensions/wdavkext.kext/", ID = "com.microsoft.wdavkext" } - Kext rejected due to system policy: { URL = "file:///Library/StagedExtensions/Library/Extensions/wdavkext.kext/", ID = "com.microsoft.wdavkext" } - Diagnostics for /Library/Extensions/wdavkext.kext: - ``` - -2. Open **System Preferences...** > **Security & Privacy** from the menu. (Close it first, if it's opened.) - -3. **Allow** system software from developers "Microsoft Corporation" - -4. In Terminal, install the driver again. This time the operation will succeed: - -```bash -$ sudo kextutil /Library/Extensions/wdavkext.kext -``` - -The banner should disappear from the Defender application, and ```mdatp --health``` should now report that Real-Time Protection is both enabled and available: - -```bash -$ mdatp --health -... -realTimeProtectionAvailable : true -realTimeProtectionEnabled : true -... -``` +> macOS may request to reboot the machine upon the first installation of Microsoft Defender. Real-time protection will not be available until the machine is rebooted. ## Client configuration @@ -167,7 +111,7 @@ realTimeProtectionEnabled : true After installation, you'll see the Microsoft Defender icon in the macOS status bar in the top-right corner. - ![Microsoft Defender icon in status bar screenshot](images/MDATP_Icon_Bar.png) + ![Microsoft Defender icon in status bar screenshot](../windows-defender-antivirus/images/MDATP-Icon-Bar.png) ## How to Allow Full Disk Access @@ -178,8 +122,8 @@ To grant consent, open System Preferences -> Security & Privacy -> Privacy -> Fu ## Logging installation issues -See [Logging installation issues](microsoft-defender-atp-mac-resources.md#logging-installation-issues) for more information on how to find the automatically generated log that is created by the installer when an error occurs. +See [Logging installation issues](mac-resources.md#logging-installation-issues) for more information on how to find the automatically generated log that is created by the installer when an error occurs. ## Uninstallation -See [Uninstalling](microsoft-defender-atp-mac-resources.md#uninstalling) for details on how to remove Microsoft Defender ATP for Mac from client devices. +See [Uninstalling](mac-resources.md#uninstalling) for details on how to remove Microsoft Defender ATP for Mac from client devices. diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md b/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-intune.md similarity index 85% rename from windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md rename to windows/security/threat-protection/microsoft-defender-atp/mac-install-with-intune.md index 84e9cb78dd..6a79d9fca6 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-intune.md @@ -1,8 +1,7 @@ --- -title: Installing Microsoft Defender ATP for Mac with Microsoft Intune -ms.reviewer: -description: Describes how to install Microsoft Defender ATP for Mac, using Microsoft Intune. -keywords: microsoft, defender, atp, mac, installation, deploy, uninstallation, intune, jamf, macos, mojave, high sierra, sierra +title: Intune-based deployment for Microsoft Defender ATP for Mac +description: Install Microsoft Defender ATP for Mac, using Microsoft Intune. +keywords: microsoft, defender, atp, mac, installation, deploy, uninstallation, intune, jamf, macos, catalina, mojave, high sierra search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -18,7 +17,7 @@ ms.collection: M365-security-compliance ms.topic: conceptual --- -# Microsoft Intune-based deployment +# Intune-based deployment for Microsoft Defender ATP for Mac **Applies to:** @@ -44,7 +43,7 @@ Download the installation and onboarding packages from Microsoft Defender Securi 4. In Section 2 of the page, select **Download onboarding package**. Save it as _WindowsDefenderATPOnboardingPackage.zip_ to the same directory. 5. Download **IntuneAppUtil** from [https://docs.microsoft.com/intune/lob-apps-macos](https://docs.microsoft.com/intune/lob-apps-macos). - ![Windows Defender Security Center screenshot](images/MDATP_2_DownloadPackages.png) + ![Windows Defender Security Center screenshot](../windows-defender-antivirus/images/MDATP-2-DownloadPackages.png) 6. From a command prompt, verify that you have the three files. Extract the contents of the .zip files: @@ -91,11 +90,11 @@ You need no special provisioning for a Mac device beyond a standard [Company Por 1. You are asked to confirm device management. -![Confirm device management screenshot](images/MDATP_3_ConfirmDeviceMgmt.png) +![Confirm device management screenshot](../windows-defender-antivirus/images/MDATP-3-ConfirmDeviceMgmt.png) Select **Open System Preferences**, locate **Management Profile** on the list, and select **Approve...**. Your Management Profile would be displayed as **Verified**: -![Management profile screenshot](images/MDATP_4_ManagementProfile.png) +![Management profile screenshot](../windows-defender-antivirus/images/MDATP-4-ManagementProfile.png) 2. Select **Continue** and complete the enrollment. @@ -103,7 +102,7 @@ You may now enroll more devices. You can also enroll them later, after you have 3. In Intune, open **Manage** > **Devices** > **All devices**. Here you can see your device among those listed: -![Add Devices screenshot](images/MDATP_5_allDevices.png) +![Add Devices screenshot](../windows-defender-antivirus/images/MDATP-5-allDevices.png) ## Create System Configuration profiles @@ -112,7 +111,7 @@ You may now enroll more devices. You can also enroll them later, after you have 3. Open the configuration profile and upload intune/kext.xml. This file was created in one of the preceding sections. 4. Select **OK**. - ![System configuration profiles screenshot](images/MDATP_6_SystemConfigurationProfiles.png) + ![System configuration profiles screenshot](../windows-defender-antivirus/images/MDATP-6-SystemConfigurationProfiles.png) 5. Select **Manage** > **Assignments**. In the **Include** tab, select **Assign to All Users & All devices**. 6. Repeat steps 1 through 5 for more profiles. @@ -287,7 +286,7 @@ You may now enroll more devices. You can also enroll them later, after you have Once the Intune changes are propagated to the enrolled devices, you can see them listed under **Monitor** > **Device status**: -![System configuration profiles screenshot](images/MDATP_7_DeviceStatusBlade.png) +![System configuration profiles screenshot](../windows-defender-antivirus/images/MDATP-7-DeviceStatusBlade.png) ## Publish application @@ -295,43 +294,43 @@ Once the Intune changes are propagated to the enrolled devices, you can see them 2. Select **App type=Other/Line-of-business app**. 3. Select **file=wdav.pkg.intunemac**. Select **OK** to upload. 4. Select **Configure** and add the required information. -5. Use **macOS Sierra 10.12** as the minimum OS and set *Ignore app version* to **Yes**. Other settings can be any arbitrary value. +5. Use **macOS High Sierra 10.13** as the minimum OS and set *Ignore app version* to **Yes**. Other settings can be any arbitrary value. > [!CAUTION] - > Failure to set *Ignore app version* to **Yes** impacts the ability of the application to receive updates through Microsoft AutoUpdate. See [Deploy updates for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-updates.md) for additional information about how the product is updated. + > Failure to set *Ignore app version* to **Yes** impacts the ability of the application to receive updates through Microsoft AutoUpdate. See [Deploy updates for Microsoft Defender ATP for Mac](mac-updates.md) for additional information about how the product is updated. - ![Device status blade screenshot](images/MDATP_8_IntuneAppInfo.png) + ![Device status blade screenshot](../windows-defender-antivirus/images/MDATP-8-IntuneAppInfo.png) 6. Select **OK** and **Add**. - ![Device status blade screenshot](images/MDATP_9_IntunePkgInfo.png) + ![Device status blade screenshot](../windows-defender-antivirus/images/MDATP-9-IntunePkgInfo.png) 7. It may take a few moments to upload the package. After it's done, select the package from the list and go to **Assignments** and **Add group**. - ![Client apps screenshot](images/MDATP_10_ClientApps.png) + ![Client apps screenshot](../windows-defender-antivirus/images/MDATP-10-ClientApps.png) 8. Change **Assignment type** to **Required**. 9. Select **Included Groups**. Select **Make this app required for all devices=Yes**. Click **Select group to include** and add a group that contains the users you want to target. Select **OK** and **Save**. - ![Intune assignments info screenshot](images/MDATP_11_Assignments.png) + ![Intune assignments info screenshot](../windows-defender-antivirus/images/MDATP-11-Assignments.png) 10. After some time the application will be published to all enrolled devices. You can see it listed in **Monitor** > **Device**, under **Device install status**: - ![Intune device status screenshot](images/MDATP_12_DeviceInstall.png) + ![Intune device status screenshot](../windows-defender-antivirus/images/MDATP-12-DeviceInstall.png) ## Verify client device state 1. After the configuration profiles are deployed to your devices, open **System Preferences** > **Profiles** on your Mac device. - ![System Preferences screenshot](images/MDATP_13_SystemPreferences.png) - ![System Preferences Profiles screenshot](images/MDATP_14_SystemPreferencesProfiles.png) + ![System Preferences screenshot](../windows-defender-antivirus/images/MDATP-13-SystemPreferences.png)
      + ![System Preferences Profiles screenshot](../windows-defender-antivirus/images/MDATP-14-SystemPreferencesProfiles.png) 2. Verify that the following configuration profiles are present and installed. The **Management Profile** should be the Intune system profile. _Wdav-config_ and _wdav-kext_ are system configuration profiles that were added in Intune: - ![Profiles screenshot](images/MDATP_15_ManagementProfileConfig.png) + ![Profiles screenshot](../windows-defender-antivirus/images/MDATP-15-ManagementProfileConfig.png) 3. You should also see the Microsoft Defender icon in the top-right corner: - ![Microsoft Defender icon in status bar screenshot](images/MDATP_Icon_Bar.png) + ![Microsoft Defender icon in status bar screenshot](../windows-defender-antivirus/images/MDATP-Icon-Bar.png) ## Troubleshooting @@ -341,8 +340,8 @@ Solution: Follow the steps above to create a device profile using WindowsDefende ## Logging installation issues -For more information on how to find the automatically generated log that is created by the installer when an error occurs, see [Logging installation issues](microsoft-defender-atp-mac-resources.md#logging-installation-issues) . +For more information on how to find the automatically generated log that is created by the installer when an error occurs, see [Logging installation issues](mac-resources.md#logging-installation-issues) . ## Uninstallation -See [Uninstalling](microsoft-defender-atp-mac-resources.md#uninstalling) for details on how to remove Microsoft Defender ATP for Mac from client devices. +See [Uninstalling](mac-resources.md#uninstalling) for details on how to remove Microsoft Defender ATP for Mac from client devices. diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md b/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-jamf.md similarity index 85% rename from windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md rename to windows/security/threat-protection/microsoft-defender-atp/mac-install-with-jamf.md index 99a5b6cc89..259e8692cd 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-jamf.md @@ -1,8 +1,7 @@ --- -title: Installing Microsoft Defender ATP for Mac with JAMF -ms.reviewer: -description: Describes how to install Microsoft Defender ATP for Mac, using JAMF. -keywords: microsoft, defender, atp, mac, installation, deploy, uninstallation, intune, jamf, macos, mojave, high sierra, sierra +title: JAMF-based deployment for Microsoft Defender ATP for Mac +description: Install Microsoft Defender ATP for Mac, using JAMF. +keywords: microsoft, defender, atp, mac, installation, deploy, uninstallation, intune, jamf, macos, catalina, mojave, high sierra search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -18,7 +17,7 @@ ms.collection: M365-security-compliance ms.topic: conceptual --- -# JAMF-based deployment +# JAMF-based deployment for Microsoft Defender ATP for Mac **Applies to:** @@ -46,7 +45,7 @@ Download the installation and onboarding packages from Windows Defender Security 3. In Section 2 of the page, select **Download installation package**. Save it as _wdav.pkg_ to a local directory. 4. In Section 2 of the page, select **Download onboarding package**. Save it as _WindowsDefenderATPOnboardingPackage.zip_ to the same directory. - ![Windows Defender Security Center screenshot](images/MDATP_2_DownloadPackages.png) + ![Windows Defender Security Center screenshot](../windows-defender-antivirus/images/MDATP-2-DownloadPackages.png) 5. From the command prompt, verify that you have the two files. Extract the contents of the .zip files like so: @@ -79,7 +78,7 @@ To set the onboarding information, add a property list file with the name, _jamf >[!IMPORTANT] > You must set the Preference Domain as "com.microsoft.wdav.atp" -![Configuration profile screenshot](images/MDATP_16_PreferenceDomain.png) +![Configuration profile screenshot](../windows-defender-antivirus/images/MDATP-16-PreferenceDomain.png) ### Approved Kernel Extension @@ -88,7 +87,7 @@ To approve the kernel extension: 1. In **Computers > Configuration Profiles** select **Options > Approved Kernel Extensions**. 2. Use **UBF8T346G9** for Team Id. -![Approved kernel extensions screenshot](images/MDATP_17_approvedKernelExtensions.png) +![Approved kernel extensions screenshot](../windows-defender-antivirus/images/MDATP-17-approvedKernelExtensions.png) ### Privacy Preferences Policy Control @@ -104,7 +103,7 @@ Add the following JAMF policy to grant Full Disk Access to Microsoft Defender AT 3. Set Code Requirement to `identifier "com.microsoft.wdav" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = UBF8T346G9`. 4. Set app or service to SystemPolicyAllFiles and access to Allow. -![Privacy Preferences Policy Control](images/MDATP_35_JAMF_PrivacyPreferences.png) +![Privacy Preferences Policy Control](../windows-defender-antivirus/images/MDATP-35-JAMF-PrivacyPreferences.png) #### Configuration Profile's Scope @@ -112,7 +111,7 @@ Configure the appropriate scope to specify the devices that will receive the con Open **Computers** > **Configuration Profiles**, and select **Scope > Targets**. From there, select the devices you want to target. -![Configuration profile scope screenshot](images/MDATP_18_ConfigurationProfilesScope.png) +![Configuration profile scope screenshot](../windows-defender-antivirus/images/MDATP-18-ConfigurationProfilesScope.png) Save the **Configuration Profile**. @@ -132,7 +131,7 @@ Starting in macOS 10.15 (Catalina) a user must manually allow to display notific 1. Create a package in **Settings > Computer Management > Packages**. - ![Computer management packages screenshot](images/MDATP_19_MicrosoftDefenderWDAVPKG.png) + ![Computer management packages screenshot](../windows-defender-antivirus/images/MDATP-19-MicrosoftDefenderWDAVPKG.png) 2. Upload the package to the Distribution Point. 3. In the **filename** field, enter the name of the package. For example, _wdav.pkg_. @@ -141,7 +140,7 @@ Starting in macOS 10.15 (Catalina) a user must manually allow to display notific Your policy should contain a single package for Microsoft Defender. -![Microsoft Defender packages screenshot](images/MDATP_20_MicrosoftDefenderPackages.png) +![Microsoft Defender packages screenshot](../windows-defender-antivirus/images/MDATP-20-MicrosoftDefenderPackages.png) Configure the appropriate scope to specify the computers that will receive this policy. @@ -156,12 +155,12 @@ You'll need no special provisioning for a macOS computer, beyond the standard JA 1. Open **Device Profiles**, from the **General** tab, and make sure that **User Approved MDM** is set to **Yes**. If it's currently set to No, the user needs to open **System Preferences > Profiles** and select **Approve** on the MDM Profile. -![MDM approve button screenshot](images/MDATP_21_MDMProfile1.png) -![MDM screenshot](images/MDATP_22_MDMProfileApproved.png) +![MDM approve button screenshot](../windows-defender-antivirus/images/MDATP-21-MDMProfile1.png)
      +![MDM screenshot](../windows-defender-antivirus/images/MDATP-22-MDMProfileApproved.png) After a moment, the device's User Approved MDM status will change to **Yes**. -![MDM status screenshot](images/MDATP_23_MDMStatus.png) +![MDM status screenshot](../windows-defender-antivirus/images/MDATP-23-MDMStatus.png) You may now enroll additional devices. You may also enroll them later, after you have finished provisioning system configuration and application packages. @@ -176,17 +175,17 @@ You can monitor deployment status in the **Logs** tab: - **Pending** means that the deployment is scheduled but has not yet happened - **Completed** means that the deployment succeeded and is no longer scheduled -![Status on server screenshot](images/MDATP_24_StatusOnServer.png) +![Status on server screenshot](../windows-defender-antivirus/images/MDATP-24-StatusOnServer.png) ### Status on client device After the Configuration Profile is deployed, you'll see the profile for the device in **System Preferences** > **Profiles >**. -![Status on client screenshot](images/MDATP_25_StatusOnClient.png) +![Status on client screenshot](../windows-defender-antivirus/images/MDATP-25-StatusOnClient.png) Once the policy is applied, you'll see the Microsoft Defender ATP icon in the macOS status bar in the top-right corner. -![Microsoft Defender icon in status bar screenshot](images/MDATP_Icon_Bar.png) +![Microsoft Defender icon in status bar screenshot](../windows-defender-antivirus/images/MDATP-Icon-Bar.png) You can monitor policy installation on a device by following the JAMF log file: @@ -231,11 +230,11 @@ If the product is not healthy, the exit code (which can be checked through `echo ## Logging installation issues -See [Logging installation issues](microsoft-defender-atp-mac-resources.md#logging-installation-issues) for more information on how to find the automatically generated log that is created by the installer when an error occurs. +See [Logging installation issues](mac-resources.md#logging-installation-issues) for more information on how to find the automatically generated log that is created by the installer when an error occurs. ## Uninstallation -This method is based on the script described in [Uninstalling](microsoft-defender-atp-mac-resources.md#uninstalling). +This method is based on the script described in [Uninstalling](mac-resources.md#uninstalling). ### Script @@ -258,12 +257,12 @@ This script removes Microsoft Defender ATP from the /Applications directory: echo "Done!" ``` -![Microsoft Defender uninstall screenshot](images/MDATP_26_Uninstall.png) +![Microsoft Defender uninstall screenshot](../windows-defender-antivirus/images/MDATP-26-Uninstall.png) ### Policy Your policy should contain a single script: -![Microsoft Defender uninstall script screenshot](images/MDATP_27_UninstallScript.png) +![Microsoft Defender uninstall script screenshot](../windows-defender-antivirus/images/MDATP-27-UninstallScript.png) Configure the appropriate scope in the **Scope** tab to specify the machines that will receive this policy. diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-other-mdm.md b/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-other-mdm.md similarity index 77% rename from windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-other-mdm.md rename to windows/security/threat-protection/microsoft-defender-atp/mac-install-with-other-mdm.md index 91a5f56395..d67b31e398 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-other-mdm.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-other-mdm.md @@ -1,7 +1,7 @@ --- -title: Installing Microsoft Defender ATP for Mac with different MDM product -description: Describes how to install Microsoft Defender ATP for Mac on other management solutions. -keywords: microsoft, defender, atp, mac, installation, deploy, macos, mojave, high sierra, sierra +title: Deployment with a different Mobile Device Management (MDM) system for Microsoft Defender ATP for Mac +description: Install Microsoft Defender ATP for Mac on other management solutions. +keywords: microsoft, defender, atp, mac, installation, deploy, macos, catalina, mojave, high sierra search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -17,7 +17,7 @@ ms.collection: M365-security-compliance ms.topic: conceptual --- -# Deployment with a different Mobile Device Management (MDM) system +# Deployment with a different Mobile Device Management (MDM) system for Microsoft Defender ATP for Mac **Applies to:** @@ -49,21 +49,21 @@ You can deploy Defender without the last requirement from the preceding list, ho ## Deployment -Most MDM solutions use the same model for managing macOS machines, with similar terminology. Use [JAMF-based deployment](microsoft-defender-atp-mac-install-with-jamf.md) as a template. +Most MDM solutions use the same model for managing macOS machines, with similar terminology. Use [JAMF-based deployment](mac-install-with-jamf.md) as a template. ### Package -Configure deployment of a [required application package](microsoft-defender-atp-mac-install-with-jamf.md#package), -with the installation package (wdav.pkg) downloaded from [Microsoft Defender Security Center](microsoft-defender-atp-mac-install-with-jamf.md#download-installation-and-onboarding-packages). +Configure deployment of a [required application package](mac-install-with-jamf.md#package), +with the installation package (wdav.pkg) downloaded from [Microsoft Defender Security Center](mac-install-with-jamf.md#download-installation-and-onboarding-packages). In order to deploy the package to your enterprise, use the instructions associated with your MDM solution. ### License settings -Set up [a system configuration profile](microsoft-defender-atp-mac-install-with-jamf.md#configuration-profile). +Set up [a system configuration profile](mac-install-with-jamf.md#configuration-profile). Your MDM solution may call it something like "Custom Settings Profile", as Microsoft Defender ATP for Mac is not part of macOS. -Use the property list, jamf/WindowsDefenderATPOnboarding.plist, which can be extracted from an onboarding package downloaded from [Microsoft Defender Security Center](microsoft-defender-atp-mac-install-with-jamf.md#download-installation-and-onboarding-packages). +Use the property list, jamf/WindowsDefenderATPOnboarding.plist, which can be extracted from an onboarding package downloaded from [Microsoft Defender Security Center](mac-install-with-jamf.md#download-installation-and-onboarding-packages). Your system may support an arbitrary property list in XML format. You can upload the jamf/WindowsDefenderATPOnboarding.plist file as-is in that case. Alternatively, it may require you to convert the property list to a different format first. @@ -76,4 +76,4 @@ Set up a KEXT or kernel extension policy. Use team identifier **UBF8T346G9** to ## Check installation status -Run [mdatp](microsoft-defender-atp-mac-install-with-jamf.md#check-onboarding-status) on a client machine to check the onboarding status. +Run [mdatp](mac-install-with-jamf.md#check-onboarding-status) on a client machine to check the onboarding status. diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-preferences.md b/windows/security/threat-protection/microsoft-defender-atp/mac-preferences.md similarity index 96% rename from windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-preferences.md rename to windows/security/threat-protection/microsoft-defender-atp/mac-preferences.md index 80ec6a0f67..0d0904ba75 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-preferences.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-preferences.md @@ -1,8 +1,7 @@ --- title: Set preferences for Microsoft Defender ATP for Mac -ms.reviewer: -description: Describes how to configure Microsoft Defender ATP for Mac in enterprises. -keywords: microsoft, defender, atp, mac, management, preferences, enterprise, intune, jamf, macos, mojave, high sierra, sierra +description: Configure Microsoft Defender ATP for Mac in enterprises. +keywords: microsoft, defender, atp, mac, management, preferences, enterprise, intune, jamf, macos, catalina, mojave, high sierra search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -25,7 +24,7 @@ ms.topic: conceptual - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac](microsoft-defender-atp-mac.md) >[!IMPORTANT] ->This topic contains instructions for how to set preferences for Microsoft Defender ATP for Mac in enterprise environments. If you are interested in configuring the product on a device from the command-line, please refer to the [Resources](microsoft-defender-atp-mac-resources.md#configuring-from-the-command-line) page. +>This topic contains instructions for how to set preferences for Microsoft Defender ATP for Mac in enterprise environments. If you are interested in configuring the product on a device from the command-line, please refer to the [Resources](mac-resources.md#configuring-from-the-command-line) page. In enterprise environments, Microsoft Defender ATP for Mac can be managed through a configuration profile. This profile is deployed from management tool of your choice. Preferences managed by the enterprise take precedence over the ones set locally on the device. In other words, users in your enterprise are not able to change preferences that are set through this configuration profile. @@ -262,6 +261,28 @@ Whether the status menu icon (shown in the top-right corner of the screen) is hi | **Data type** | Boolean | | **Possible values** | false (default)
      true | +### EDR preferences + +The *edr* section of the configuration profile is used to manage the preferences of the EDR component of the product. + +||| +|:---|:---| +| **Domain** | com.microsoft.wdav | +| **Key** | edr | +| **Data type** | Dictionary (nested preference) | +| **Comments** | See the following sections for a description of the dictionary contents. | + +#### Enable / disable early preview + +Whether EDR early preview features are enabled or not. + +||| +|:---|:---| +| **Domain** | com.microsoft.wdav | +| **Key** | earlyPreview | +| **Data type** | Boolean | +| **Possible values** | true (default)
      false | + ## Recommended configuration profile To get started, we recommend the following configuration profile for your enterprise to take advantage of all protection features that Microsoft Defender ATP provides. diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-privacy.md b/windows/security/threat-protection/microsoft-defender-atp/mac-privacy.md similarity index 98% rename from windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-privacy.md rename to windows/security/threat-protection/microsoft-defender-atp/mac-privacy.md index 0c56970e6f..ab118ea2ca 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-privacy.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-privacy.md @@ -1,7 +1,6 @@ --- title: Privacy for Microsoft Defender ATP for Mac -ms.reviewer: -description: Describes privacy controls, how to configure policy settings that impact privacy and information about the diagnostic data collected in Microsoft Defender ATP for Mac. +description: Privacy controls, how to configure policy settings that impact privacy and information about the diagnostic data collected in Microsoft Defender ATP for Mac. keywords: microsoft, defender, atp, mac, privacy, diagnostic search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -62,7 +61,7 @@ When this feature is enabled and the sample that is collected is likely to conta If you're an IT administrator, you might want to configure these controls at the enterprise level. -The privacy controls for the various types of data described in the preceding section are described in detail in [Set preferences for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-preferences.md). +The privacy controls for the various types of data described in the preceding section are described in detail in [Set preferences for Microsoft Defender ATP for Mac](mac-preferences.md). As with any new policy settings, you should carefully test them out in a limited, controlled environment to ensure the settings that you configure have the desired effect before you implement the policy settings more widely in your organization. diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-pua.md b/windows/security/threat-protection/microsoft-defender-atp/mac-pua.md similarity index 82% rename from windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-pua.md rename to windows/security/threat-protection/microsoft-defender-atp/mac-pua.md index 2696590c99..0f63486ad1 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-pua.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-pua.md @@ -1,7 +1,6 @@ --- -title: Detect and block potentially unwanted applications -ms.reviewer: -description: Describes how to detect and block Potentially Unwanted Applications (PUA) using Microsoft Defender ATP for Mac. +title: Detect and block potentially unwanted applications with Microsoft Defender ATP for Mac +description: Detect and block Potentially Unwanted Applications (PUA) using Microsoft Defender ATP for Mac. keywords: microsoft, defender, atp, mac, pua, pus search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -18,7 +17,7 @@ ms.collection: M365-security-compliance ms.topic: conceptual --- -# Detect and block potentially unwanted applications +# Detect and block potentially unwanted applications with Microsoft Defender ATP for Mac **Applies to:** @@ -59,8 +58,8 @@ $ mdatp --threat --type-handling potentially_unwanted_application [off|audit|blo ### Use the management console to configure PUA protection: -In your enterprise, you can configure PUA protection from a management console, such as JAMF or Intune, similarly to how other product settings are configured. For more information, see the [Threat type settings](microsoft-defender-atp-mac-preferences.md#threat-type-settings) section of the [Set preferences for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-preferences.md) topic. +In your enterprise, you can configure PUA protection from a management console, such as JAMF or Intune, similarly to how other product settings are configured. For more information, see the [Threat type settings](mac-preferences.md#threat-type-settings) section of the [Set preferences for Microsoft Defender ATP for Mac](mac-preferences.md) topic. ## Related topics -- [Set preferences for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-preferences.md) \ No newline at end of file +- [Set preferences for Microsoft Defender ATP for Mac](mac-preferences.md) \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-resources.md b/windows/security/threat-protection/microsoft-defender-atp/mac-resources.md similarity index 85% rename from windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-resources.md rename to windows/security/threat-protection/microsoft-defender-atp/mac-resources.md index f37fa94b99..d8e6a4dfff 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-resources.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-resources.md @@ -1,8 +1,7 @@ --- -title: Microsoft Defender ATP for Mac Resources -ms.reviewer: -description: Describes resources for Microsoft Defender ATP for Mac, including how to uninstall it, how to collect diagnostic logs, CLI commands, and known issues with the product. -keywords: microsoft, defender, atp, mac, installation, deploy, uninstallation, intune, jamf, macos, mojave, high sierra, sierra +title: Resources for Microsoft Defender ATP for Mac +description: Resources for Microsoft Defender ATP for Mac, including how to uninstall it, how to collect diagnostic logs, CLI commands, and known issues with the product. +keywords: microsoft, defender, atp, mac, installation, deploy, uninstallation, intune, jamf, macos, catalina, mojave, high sierra search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -18,7 +17,7 @@ ms.collection: M365-security-compliance ms.topic: conceptual --- -# Resources +# Resources for Microsoft Defender ATP for Mac **Applies to:** @@ -95,18 +94,24 @@ Important tasks, such as controlling product settings and triggering on-demand s |Protection |Do a full scan |`mdatp --scan --full` | |Protection |Cancel an ongoing on-demand scan |`mdatp --scan --cancel` | |Protection |Request a security intelligence update |`mdatp --definition-update` | +|EDR |Turn on/off EDR preview for Mac |`mdatp --early-preview [true/false]` | +|EDR |Add group tag to machine. EDR tags are used for managing machine groups. For more information, please visit https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machine-groups |`mdatp --set-tag GROUP [name]` | +|EDR |Remove group tag from machine |`mdatp --remove-tag [name]` | ## Microsoft Defender ATP portal information -In the Microsoft Defender ATP portal, you'll see two categories of information: +In the Microsoft Defender ATP portal, you'll see two categories of information. + +Antivirus alerts, including: -- Antivirus alerts, including: - Severity - Scan type - Device information (hostname, machine identifier, tenant identifier, app version, and OS type) - File information (name, path, size, and hash) - Threat information (name, type, and state) -- Device information, including: + +Device information, including: + - Machine identifier - Tenant identifier - App version diff --git a/windows/security/threat-protection/microsoft-defender-atp/mac-support-kext.md b/windows/security/threat-protection/microsoft-defender-atp/mac-support-kext.md new file mode 100644 index 0000000000..bbf4825f45 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-support-kext.md @@ -0,0 +1,90 @@ +--- +title: Troubleshoot kernel extension issues in Microsoft Defender ATP for Mac +description: Troubleshoot kernel extension-related issues in Microsoft Defender ATP for Mac. +keywords: microsoft, defender, atp, mac, kernel, extension +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: dansimp +author: dansimp +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: conceptual +--- + +# Troubleshoot kernel extension issues in Microsoft Defender ATP for Mac + +**Applies to:** + +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac](microsoft-defender-atp-mac.md) + +This topic provides information on how to troubleshoot issues with the kernel extension that is installed as part of Microsoft Defender ATP for Mac. + +Starting with macOS High Sierra (10.13), macOS requires all kernel extensions to be explicitly approved before they are allowed to run on the device. + +If you did not approve the kernel extension during the deployment / installation of Microsoft Defender ATP for Mac, then the application displays a banner prompting you to enable it: + + ![RTP disabled screenshot](../windows-defender-antivirus/images/MDATP-32-Main-App-Fix.png) + +You can also run ```mdatp --health```. It reports if real-time protection is enabled but not available. This is an indication that the kernel extension is not approved to run on your device. + +```bash +$ mdatp --health +... +realTimeProtectionAvailable : false +realTimeProtectionEnabled : true +... +``` + +The following sections provide guidance on how to address this issue, depending on the method that you used to deploy Microsoft Defender ATP for Mac. + +## Managed deployment + +See the instructions corresponding to the management tool that you used to deploy the product: + +- [JAMF-based deployment](mac-install-with-jamf.md#configuration-profile) +- [Microsoft Intune-based deployment](mac-install-with-intune.md#create-system-configuration-profiles) + +## Manual deployment + +If less than 30 minutes have passed since the product was installed, navigate to **System Preferences** > **Security & Privacy**, where you have to **Allow** system software from developers "Microsoft Corporation". + +If you don't see this prompt, it means that 30 or more minutes have passed, and the kernel extension still not been approved to run on your device: + +![Security and privacy window after prompt expired screenshot](../windows-defender-antivirus/images/MDATP-33-SecurityPrivacySettings-NoPrompt.png) + +In this case, you need to perform the following steps to trigger the approval flow again. + +1. In Terminal, attempt to install the driver. The following operation will fail, because the kernel extension was not approved to run on the device, however it will trigger the approval flow again. + + ```bash + $ sudo kextutil /Library/Extensions/wdavkext.kext + Kext rejected due to system policy: { URL = "file:///Library/StagedExtensions/Library/Extensions/wdavkext.kext/", ID = "com.microsoft.wdavkext" } + Kext rejected due to system policy: { URL = "file:///Library/StagedExtensions/Library/Extensions/wdavkext.kext/", ID = "com.microsoft.wdavkext" } + Diagnostics for /Library/Extensions/wdavkext.kext: + ``` + +2. Open **System Preferences** > **Security & Privacy** from the menu. (Close it first, if it's opened.) + +3. **Allow** system software from developers "Microsoft Corporation" + +4. In Terminal, install the driver again. This time the operation will succeed: + +```bash +$ sudo kextutil /Library/Extensions/wdavkext.kext +``` + +The banner should disappear from the Defender application, and ```mdatp --health``` should now report that real-time protection is both enabled and available: + +```bash +$ mdatp --health +... +realTimeProtectionAvailable : true +realTimeProtectionEnabled : true +... +``` \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-atp/mac-support-perf.md b/windows/security/threat-protection/microsoft-defender-atp/mac-support-perf.md new file mode 100644 index 0000000000..3d1a203e82 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-support-perf.md @@ -0,0 +1,54 @@ +--- +title: Troubleshoot performance issues for Microsoft Defender ATP for Mac +description: Troubleshoot performance issues in Microsoft Defender ATP for Mac. +keywords: microsoft, defender, atp, mac, performance +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: dansimp +author: dansimp +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: conceptual +--- + +# Troubleshoot performance issues for Microsoft Defender ATP for Mac + +**Applies to:** + +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac](microsoft-defender-atp-mac.md) + +This topic provides some general steps that can be used to narrow down performance issues related to Microsoft Defender ATP for Mac. + +Real-time protection (RTP) is a feature of Microsoft Defender ATP for Mac that continuously monitors and protects your device against threats. It consists of file and process monitoring and other heuristics. + +Depending on the applications that you are running and your device characteristics, you may experience suboptimal performance when running Microsoft Defender ATP for Mac. In particular, applications or system processes that access many resources over a short timespan can lead to performance issues in Microsoft Defender ATP for Mac. + +The following steps can be used to troubleshoot and mitigate these issues: + +1. Disable real-time protection using one of the following methods and observe whether the performance improves. This approach helps narrow down whether Microsoft Defender ATP for Mac is contributing to the performance issues. + + If your device is not managed by your organization, real-time protection can be disabled using one of the following options: + + - From the user interface. Open Microsoft Defender ATP for Mac and navigate to **Manage settings**. + + ![Manage real-time protection screenshot](../windows-defender-antivirus/images/mdatp-36-rtp.png) + + - From the Terminal. For security purposes, this operation requires elevation. + + ```bash + $ mdatp --config realTimeProtectionEnabled false + ``` + + If your device is managed by your organization, real-time protection can be disabled by your administrator using the instructions in [Set preferences for Microsoft Defender ATP for Mac](mac-preferences.md). + +2. Open Finder and navigate to **Applications** > **Utilities**. Open **Activity Monitor** and analyze which applications are using the resources on your system. Typical examples include software updaters and compilers. + +3. Configure Microsoft Defender ATP for Mac with exclusions for the processes or disk locations that contribute to the performance issues and re-enable real-time protection. + + See [Configure and validate exclusions for Microsoft Defender ATP for Mac](mac-exclusions.md) for details. diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-updates.md b/windows/security/threat-protection/microsoft-defender-atp/mac-updates.md similarity index 97% rename from windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-updates.md rename to windows/security/threat-protection/microsoft-defender-atp/mac-updates.md index 50267f26bb..7770111d6d 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-updates.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-updates.md @@ -1,7 +1,6 @@ --- title: Deploy updates for Microsoft Defender ATP for Mac -ms.reviewer: -description: Describes how to control updates for Microsoft Defender ATP for Mac in enterprise environments. +description: Control updates for Microsoft Defender ATP for Mac in enterprise environments. keywords: microsoft, defender, atp, mac, updates, deploy search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -28,7 +27,7 @@ Microsoft regularly publishes software updates to improve performance, security, To update Microsoft Defender ATP for Mac, a program named Microsoft AutoUpdate (MAU) is used. By default, MAU automatically checks for updates daily, but you can change that to weekly, monthly, or manually. -![MAU screenshot](images/MDATP_34_MAU.png) +![MAU screenshot](../windows-defender-antivirus/images/MDATP-34-MAU.png) If you decide to deploy updates by using your software distribution tools, you should configure MAU to manually check for software updates. You can deploy preferences to configure how and when MAU checks for updates for the Macs in your organization. diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-whatsnew.md b/windows/security/threat-protection/microsoft-defender-atp/mac-whatsnew.md similarity index 76% rename from windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-whatsnew.md rename to windows/security/threat-protection/microsoft-defender-atp/mac-whatsnew.md index 7312d11a2d..e229fbbd91 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-whatsnew.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-whatsnew.md @@ -1,6 +1,5 @@ --- -title: Microsoft Defender ATP for Mac What's New -ms.reviewer: +title: What's new in Microsoft Defender Advanced Threat Protection for Mac description: List of major changes for Microsoft Defender ATP for Mac. keywords: microsoft, defender, atp, mac, installation, macos, whatsnew search.product: eADQiWindows 10XVcnh @@ -20,13 +19,17 @@ ms.topic: conceptual # What's new in Microsoft Defender Advanced Threat Protection for Mac +## 100.72.15 + +- Bug fixes + ## 100.70.99 - Addressed an issue that impacts the ability of some users to upgrade to macOS Catalina when real-time protection is enabled. This sporadic issue was caused by Microsoft Defender ATP locking files within Catalina upgrade package while scanning them for threats, which led to failures in the upgrade sequence. ## 100.68.99 -- Added the ability to configure the antivirus functionality to run in [passive mode](microsoft-defender-atp-mac-preferences.md#enable--disable-passive-mode) +- Added the ability to configure the antivirus functionality to run in [passive mode](mac-preferences.md#enable--disable-passive-mode) - Performance improvements & bug fixes ## 100.65.28 @@ -38,7 +41,7 @@ ms.topic: conceptual > > The mechanism for granting this consent depends on how you deployed Microsoft Defender ATP: > -> - For manual deployments, see the updated instructions in the [Manual deployment](microsoft-defender-atp-mac-install-manually.md#how-to-allow-full-disk-access) topic. -> - For managed deployments, see the updated instructions in the [JAMF-based deployment](microsoft-defender-atp-mac-install-with-jamf.md#privacy-preferences-policy-control) and [Microsoft Intune-based deployment](microsoft-defender-atp-mac-install-with-intune.md#create-system-configuration-profiles) topics. +> - For manual deployments, see the updated instructions in the [Manual deployment](mac-install-manually.md#how-to-allow-full-disk-access) topic. +> - For managed deployments, see the updated instructions in the [JAMF-based deployment](mac-install-with-jamf.md#privacy-preferences-policy-control) and [Microsoft Intune-based deployment](mac-install-with-intune.md#create-system-configuration-profiles) topics. - Performance improvements & bug fixes diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md index f0cf3d6772..d006defd48 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md @@ -23,7 +23,6 @@ ms.topic: article **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -[!include[Prerelease information](prerelease.md)] >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-automationexclusionlist-abovefoldlink) @@ -108,7 +107,7 @@ When you add an indicator hash for a file, you can choose to raise an alert and Files automatically blocked by an indicator won't show up in the files's Action center, but the alerts will still be visible in the Alerts queue. -## Create indicators for IPs and URLs/domains (preview) +## Create indicators for IPs and URLs/domains Microsoft Defender ATP can block what Microsoft deems as malicious IPs/URLs through SmartScreen for Microsoft browsers and Network Protection for non-Microsoft browsers and calls made outside the browser. The threat intelligence data set for this has been managed by Microsoft. diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac.md b/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-mac.md similarity index 71% rename from windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac.md rename to windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-mac.md index f87f5332c7..f073ddf397 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac.md +++ b/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-mac.md @@ -1,8 +1,8 @@ --- title: Microsoft Defender ATP for Mac -ms.reviewer: +ms.reviewer: description: Describes how to install and use Microsoft Defender ATP for Mac. -keywords: microsoft, defender, atp, mac, installation, deploy, uninstallation, intune, jamf, macos, mojave, high sierra, sierra +keywords: microsoft, defender, atp, mac, installation, deploy, uninstallation, intune, jamf, macos, catalina, mojave, high sierra search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -14,7 +14,7 @@ author: dansimp ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: conceptual --- @@ -27,36 +27,53 @@ This topic describes how to install, configure, update, and use Microsoft Defend ## What’s new in the latest release -[What's new](microsoft-defender-atp-mac-whatsnew.md) +[What's new](mac-whatsnew.md) If you have any feedback that you would like to share, submit it by opening Microsoft Defender ATP for Mac on your device and navigating to **Help** > **Send feedback**. +To learn how to configure a macOS machine running Microsoft Defender ATP to be an "Insider" machine, go to [Enable Microsoft Defender ATP Insider Machine](endpoint-detection-response-mac-preview.md) + ## How to install Microsoft Defender ATP for Mac ### Prerequisites -- Access to the Microsoft Defender Security Center portal +- A Microsoft Defender ATP subscription and access to the Microsoft Defender Security Center portal - Beginner-level experience in macOS and BASH scripting - Administrative privileges on the device (in case of manual deployment) +### Installation instructions + +There are several methods and deployment tools that you can use to install and configure Microsoft Defender ATP for Mac. + +* Third-party management tools: + * [Microsoft Intune-based deployment](mac-install-with-intune.md) + * [JAMF-based deployment](mac-install-with-jamf.md) + * [Other MDM products](mac-install-with-other-mdm.md) + +* Command-line tool: + * [Manual deployment](mac-install-manually.md) + ### System requirements -> [!CAUTION] -> The three most recent major releases of macOS are supported. Beta versions of macOS are not supported. +The three most recent major releases of macOS are supported. -- Supported macOS versions: 10.14 (Mojave), 10.13 (High Sierra), 10.12 (Sierra) +- 10.15 (Catalina), 10.14 (Mojave), 10.13 (High Sierra) - Disk space: 650 MB +Beta versions of macOS are not supported. macOS Sierra (10.12) support will end on January 1, 2020. + After you've enabled the service, you may need to configure your network or firewall to allow outbound connections between it and your endpoints. +### Network connections + The following table lists the services and their associated URLs that your network must be able to connect to. You should ensure that there are no firewall or network filtering rules that would deny access to these URLs, or you may need to create an *allow* rule specifically for them. | Service location | DNS record | | ---------------------------------------- | ----------------------- | -| Common URLs for all locations | x.cp.wd.microsoft.com
      cdn.x.cp.wd.microsoft.com
      eu-cdn.x.cp.wd.microsoft.com
      wu-cdn.x.cp.wd.microsoft.com
      *.blob.core.windows.net
      officecdn-microsoft-com.akamaized.net | -| European Union | europe.x.cp.wd.microsoft.com | -| United Kingdom | unitedkingdom.x.cp.wd.microsoft.com | -| United States | unitedstates.x.cp.wd.microsoft.com | +| Common URLs for all locations | x.cp.wd.microsoft.com
      cdn.x.cp.wd.microsoft.com
      eu-cdn.x.cp.wd.microsoft.com
      wu-cdn.x.cp.wd.microsoft.com
      *.blob.core.windows.net
      officecdn-microsoft-com.akamaized.net
      crl.microsoft.com
      events.data.microsoft.com | +| European Union | europe.x.cp.wd.microsoft.com
      eu-v20.events.data.microsoft.com | +| United Kingdom | unitedkingdom.x.cp.wd.microsoft.com
      uk-v20.events.data.microsoft.com | +| United States | unitedstates.x.cp.wd.microsoft.com
      us-v20.events.data.microsoft.com | Microsoft Defender ATP can discover a proxy server by using the following discovery methods: - Web Proxy Auto-discovery Protocol (WPAD) @@ -81,33 +98,23 @@ The output from this command should be similar to the following: > [!CAUTION] > We recommend that you keep [System Integrity Protection](https://support.apple.com/en-us/HT204899) (SIP) enabled on client machines. SIP is a built-in macOS security feature that prevents low-level tampering with the OS, and is enabled by default. -### Installation instructions - -There are several methods and deployment tools that you can use to install and configure Microsoft Defender ATP for Mac. - -In general you need to take the following steps: - -- Ensure that you have a Microsoft Defender ATP subscription and have access to the Microsoft Defender ATP Portal -- Deploy Microsoft Defender ATP for Mac using one of the following deployment methods: - - Via third-party management tools: - - [Microsoft Intune-based deployment](microsoft-defender-atp-mac-install-with-intune.md) - - [JAMF-based deployment](microsoft-defender-atp-mac-install-with-jamf.md) - - [Other MDM products](microsoft-defender-atp-mac-install-with-other-mdm.md) - - Via the command-line tool: - - [Manual deployment](microsoft-defender-atp-mac-install-manually.md) +Once Microsoft Defender ATP is installed, connectivity can be validated by running the following command in Terminal: +```bash +$ mdatp --connectivity-test +``` ## How to update Microsoft Defender ATP for Mac Microsoft regularly publishes software updates to improve performance, security, and to deliver new features. To update Microsoft Defender ATP for Mac, a program named Microsoft AutoUpdate (MAU) is used. -To read more on how to configure MAU in enterprise environments, refer to [Deploy updates for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-updates.md) +To read more on how to configure MAU in enterprise environments, refer to [Deploy updates for Microsoft Defender ATP for Mac](mac-updates.md) ## How to configure Microsoft Defender ATP for Mac -Guidance for how to configure the product in enterprise environments is available in [Set preferences for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-preferences.md). +Guidance for how to configure the product in enterprise environments is available in [Set preferences for Microsoft Defender ATP for Mac](mac-preferences.md). ## Resources -- For more information about logging, uninstalling, or other topics, see the [Resources](microsoft-defender-atp-mac-resources.md) page. +- For more information about logging, uninstalling, or other topics, see the [Resources](mac-resources.md) page. -- [Privacy for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-privacy.md) +- [Privacy for Microsoft Defender ATP for Mac](mac-privacy.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/microsoft-threat-experts.md b/windows/security/threat-protection/microsoft-defender-atp/microsoft-threat-experts.md index 71b44a53e7..358b596f33 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/microsoft-threat-experts.md +++ b/windows/security/threat-protection/microsoft-defender-atp/microsoft-threat-experts.md @@ -22,11 +22,12 @@ ms.topic: conceptual **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -[!include[Prerelease information](prerelease.md)] - Microsoft Threat Experts is a managed detection and response (MDR) service that provides Security Operation Centers (SOCs) with expert level monitoring and analysis to help them ensure that critical threats in their unique environments don’t get missed. This new capability provides expert-driven insights and data through targeted attack notification and access to experts on demand. + +>[!NOTE] +>Microsoft Defender ATP customers need to apply for the Microsoft Threat Experts managed threat hunting service to get proactive targeted attack notifications and to collaborate with experts on demand. A Microsoft Threat Experts subscription is a prerequisite for experts on demand collaboration. See [Configure Microsoft Threat Experts capabilities](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-microsoft-threat-experts#before-you-begin) for details. ## Targeted attack notification Microsoft Threat Experts provides proactive hunting for the most important threats to your network, including human adversary intrusions, hands-on-keyboard attacks, or advanced attacks like cyberespionage. The managed hunting service includes: @@ -36,9 +37,6 @@ Microsoft Threat Experts provides proactive hunting for the most important threa - Scope of compromise and as much context as can be quickly delivered to enable fast SOC response. ## Collaborate with experts, on demand ->[!NOTE] ->The Microsoft Threat Experts' experts-on-demand capability is still in preview. You can only use the experts-on-demand capability if you have applied for preview and your application has been approved. - Customers can engage our security experts directly from within Microsoft Defender Security Center for timely and accurate response. Experts provide insights needed to better understand the complex threats affecting your organization, from alert inquiries, potentially compromised machines, root cause of a suspicious network connection, to additional threat intelligence regarding ongoing advanced persistent threat campaigns. With this capability, you can: - Get additional clarification on alerts including root cause or scope of the incident diff --git a/windows/security/threat-protection/microsoft-defender-atp/minimum-requirements.md b/windows/security/threat-protection/microsoft-defender-atp/minimum-requirements.md index 57782a8e2b..e9723fa61e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/minimum-requirements.md +++ b/windows/security/threat-protection/microsoft-defender-atp/minimum-requirements.md @@ -37,7 +37,7 @@ Microsoft Defender Advanced Threat Protection requires one of the following Micr - Windows 10 Enterprise E5 - Windows 10 Education E5 - Microsoft 365 E5 (M365 E5) which includes Windows 10 Enterprise E5 -- Microsoft 365 E3 (M365 E3) with Identity and Threat Protection package + For more information on the array of features in Windows 10 editions, see [Compare Windows 10 editions](https://www.microsoft.com/windowsforbusiness/compare). diff --git a/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md b/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md index 3a670e00a5..eecae45f38 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md +++ b/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md @@ -62,7 +62,7 @@ Microsoft Defender ATP’s Threat & Vulnerability Management allows security adm - [Exposure score](tvm-exposure-score.md) - [Configuration score](configuration-score.md) - [Security recommendations](tvm-security-recommendation.md) -- [Remediation](tvm-remediation.md) +- [Remediation and exception](tvm-remediation.md) - [Software inventory](tvm-software-inventory.md) - [Weaknesses](tvm-weaknesses.md) - [Scenarios](threat-and-vuln-mgt-scenarios.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/preview.md b/windows/security/threat-protection/microsoft-defender-atp/preview.md index 5be2ae335a..90e4e88018 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/preview.md +++ b/windows/security/threat-protection/microsoft-defender-atp/preview.md @@ -42,13 +42,13 @@ Turn on the preview experience setting to be among the first to try upcoming fea ## Preview features The following features are included in the preview release: -- [Microsoft Threat Experts - Experts on Demand](microsoft-threat-experts.md)
      You now have the option to consult with Microsoft Threat Experts from several places in the portal to help you in the context of your investigation. +- [Threat & Vulnerability Management Report inaccuracy](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation#report-inaccuracy)
      You can report a false positive when you see any vague, inaccurate, incomplete, or already remediated [security recommendation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation#report-inaccuracy), [software inventory](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory#report-inaccuracy), and [discovered vulnerabilities](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses#report-inaccuracy). + +- [Threat & Vulnerability Management Advanced Hunting Schemas](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-registryevents-table)
      You can now use the Threat & Vulnerability Management tables in the Advanced hunting schema to query about software inventory, vulnerability knowledgebase, security configuration assessment, and security configuration knowledgebase. + + - [Threat & Vulnerability Management role-based access controls](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/user-roles#create-roles-and-assign-the-role-to-an-azure-active-directory-group)
      You can now use the new permissions to allow maximum flexibility to create SecOps-oriented roles, Threat & Vulnerability Management-oriented roles, or hybrid roles so only authorized users are accessing specific data to do their task. You can also achieve even further granularity by specifying whether a Threat & Vulnerability Management role can only view vulnerability-related data, or can create and manage remediation and exceptions. -- [Indicators for IP addresses, URLs/Domains](manage-indicators.md)
      You can now allow or block URLs/domains using your own threat intelligence. - -- [Microsoft Defender ATP for Mac](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac)
      Microsoft Defender ATP for Mac brings the next-generation protection, and endpoint detection and response coverage to Mac devices. Core components of the unified endpoint security platform will now be available for Mac devices. - -- [Threat & Vulnerability Management Report inaccuracy](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation#report-inaccuracy)
      You can report a false positive when you see any vague, inaccurate, incomplete, or already remediated [security recommendation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation#report-inaccuracy), [software inventory](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory#report-inaccuracy), and [discovered vulnerabilities](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses#report-inaccuracy). +- [Threat & Vulnerability Management granular exploit details](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses)
      You can now see a comprehensive set of details on the vulnerabilities found in your machine to give you informed decision on your next steps. The threat insights icon now shows more granular details, such as if the exploit is a part of an exploit kit, connected to specific advanced persistent campaigns or activity groups for which, Threat Analytics report links are provided that you can read, has associated zero-day exploitation news, disclosures, or related security advisories. - [Machine health and compliance report](machine-reports.md) The machine health and compliance report provides high-level information about the devices in your organization. diff --git a/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md b/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md index f7512247e0..df00947476 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md +++ b/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md @@ -143,12 +143,40 @@ When an exception is created for a recommendation, the recommendation is no long 2. Click the top-most recommendation. A flyout panel opens with the recommendation details. 3. Click **Exception options**. +![Screenshot of the exception option in the remediation flyout pane](images/tvm-exception-option.png) 4. Select your justification for the exception you need to file instead of remediating the security recommendation in question. Fill out the justification context, then set the exception duration. +> ![Screenshot of exception flyout page which details justification and context](images/tvm-exception-flyout.png) + 5. Click **Submit**. A confirmation message at the top of the page indicates that the exception has been created. +![Screenshot of exception confirmation message](images/tvm-exception-confirmation.png) 6. Navigate to the **Remediation** page under the **Threat & Vulnerability Management** menu and click the **Exceptions** tab to view all your exceptions (current and past). +![Screenshot of exception list of exceptions in the Remediation page](images/tvm-exception-list.png) + +## Use Advanced hunting query to search for machines with High active alerts or critical CVE public exploit + +1. Go to **Advanced hunting** from the left-hand navigation pane. + +2. Scroll down to the TVM advanced hunting schemas to familiarize yourself with the column names. + +3. Enter the following queries: + +``` +// Search for machines with High active alerts or Critical CVE public exploit +DeviceTvmSoftwareInventoryVulnerabilities +| join kind=inner(DeviceTvmSoftwareVulnerabilitiesKB) on CveId +| where IsExploitAvailable == 1 and CvssScore >= 7 +| summarize NumOfVulnerabilities=dcount(CveId), +ComputerName=any(ComputerName) by MachineId +| join kind =inner(AlertEvents) on MachineId +| summarize NumOfVulnerabilities=any(NumOfVulnerabilities), +ComputerName=any(ComputerName) by MachineId, AlertId +| project ComputerName, NumOfVulnerabilities, AlertId +| order by NumOfVulnerabilities desc + +``` ## Related topics - [Risk-based Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) @@ -156,6 +184,8 @@ When an exception is created for a recommendation, the recommendation is no long - [Exposure score](tvm-exposure-score.md) - [Configuration score](configuration-score.md) - [Security recommendations](tvm-security-recommendation.md) -- [Remediation](tvm-remediation.md) +- [Remediation and exception](tvm-remediation.md) - [Software inventory](tvm-software-inventory.md) - [Weaknesses](tvm-weaknesses.md) +- [Advanced hunting overview](overview-hunting.md) +- [All Advanced hunting tables](advanced-hunting-reference.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md index 1704845ac8..668b2a1cb4 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md @@ -53,7 +53,7 @@ Area | Description (2) Threat & Vulnerability Management navigation pane | Use the navigation pane to move across the **Threat and Vulnerability Management Dashboard**, **Security recommendations**, **Remediation**, **Software inventory**, and **Weaknesses**. **Dashboards** | Get a high-level view of the organization exposure score, organization configuration score, machine exposure distribution, top security recommendations, top vulnerable software, top remediation activities, and top exposed machines data. **Security recommendations** | See the list of security recommendations, their related components, insights, number or exposed devices, impact, and request for remediation. You can click each item on the list, a flyout panel opens with vulnerability details, open the software page, see the remediation, and exception options. You can also open a ticket in Intune if your machines are joined through Azure Active Directory and you have enabled your Intune connections in Microsoft Defender ATP. See [Security recommendations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation) for more information. -**Remediation** | See the remediation activity, related component, remediation type, status, due date, option to export the remediation and process data to CSV, and active exceptions. See [Remediation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation) for more information. +**Remediation** | See the remediation activity, related component, remediation type, status, due date, option to export the remediation and process data to CSV, and active exceptions. See [Remediation and exception](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation) for more information. **Software inventory** | See the list of applications, versions, weaknesses, whether there’s an exploit found on the application, prevalence in the organization, how many were installed, how many exposed devices are there, and the numerical value of the impact. You can select each item in the list and opt to open the software page which shows the associated vulnerabilities, misconfigurations, affected machine, version distribution details, and missing KBs or security updates. See [Software inventory](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory) for more information. **Weaknesses** | See the list of common vulnerabilities and exposures, the severity, its common vulnerability scoring system (CVSS) V3 score, related software, age, when it was published, related threat alerts, and how many exposed machines are there. You can select each item in the list and it opens a flyout panel with the vulnerability description and other details. See [Weaknesses](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses) for more information. (3) Threat & Vulnerability Management dashboard | Access the **Exposure score**, **Configuration score**, **Exposure distribution**, **Top security recommendations**, **Top vulnerable software**, **Top remediation activities**, and **Top exposed machines**. @@ -73,7 +73,7 @@ See [Microsoft Defender ATP icons](https://docs.microsoft.com/windows/security/t - [Exposure score](tvm-exposure-score.md) - [Configuration score](configuration-score.md) - [Security recommendations](tvm-security-recommendation.md) -- [Remediation](tvm-remediation.md) +- [Remediation and exception](tvm-remediation.md) - [Software inventory](tvm-software-inventory.md) - [Weaknesses](tvm-weaknesses.md) - [Scenarios](threat-and-vuln-mgt-scenarios.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-exposure-score.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-exposure-score.md index 8eebb66298..fca24b4b1f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-exposure-score.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-exposure-score.md @@ -42,7 +42,7 @@ Reduce the exposure score by addressing what needs to be remediated based on the - [Threat & Vulnerability Management dashboard overview](tvm-dashboard-insights.md) - [Configuration score](configuration-score.md) - [Security recommendations](tvm-security-recommendation.md) -- [Remediation](tvm-remediation.md) +- [Remediation and exception](tvm-remediation.md) - [Software inventory](tvm-software-inventory.md) - [Weaknesses](tvm-weaknesses.md) - [Scenarios](threat-and-vuln-mgt-scenarios.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation.md index 674d4b0309..99b1ae6759 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation.md @@ -1,6 +1,6 @@ --- -title: Remediation -description: You can lower down your organization's exposure from vulnerabilities and increase your security configuration by remediating the security recommendations. Threat & Vulnerability Management bridges the gap between security administration and IT administration during remediation process. It does so by creating a security task or ticket through integration with Microsoft Intune and Microsoft System Center Configuration Manager (SCCM). +title: Remediation and exception +description: You can lower down your organization's exposure from vulnerabilities and increase your security configuration by remediating the security recommendations or filing exceptions provided there are compensation controls. Threat & Vulnerability Management bridges the gap between security administration and IT administration during remediation process. It does so by creating a security task or ticket through integration with Microsoft Intune and Microsoft System Center Configuration Manager (SCCM). keywords: microsoft defender atp tvm remediation, mdatp tvm, threat & vulnerability management, threat & vulnerability management remediation, tvm remediation intune, tvm remediation sccm search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -17,7 +17,7 @@ ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 04/11/2019 --- -# Remediation +# Remediation and exception **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) @@ -47,11 +47,62 @@ When you submit a remediation request from Threat & Vulnerability Management, it It creates a security task which will be tracked in Threat & Vulnerability Management **Remediation** page, and it also creates a remediation ticket in Microsoft Intune. -You also have the option to export all remediation activity data to CSV for records, reporting purposes, or if you want to notify your IT administration counterpart that a remediation ticket has been submitted. The dashboard will show that status of your top remediation activities. Click any of the entries and it will take you to the **Remediation** page. You can mark the remediation activity as completed after the IT administration team remediates the task. -However, if the security recommendation stemmed from a false positive report, or if there are existing business justification that blocks the remediation, such as compensating control, productivity needs, compliance, or if there's already a planned remediation grace period, you can file an exception and indicate the reason. The exceptions you've filed will also show up in the **Remediation** page, in the **Exceptions** tab. +## When to file for exception instead of remediating issues +You can file exceptions to exclude certain recommendation from showing up in reports and affecting risk scores or secure scores. + +When you select a security recommendation, it opens up a flyout screen with details and options for your next step. You can either **Open software page**, choose from **Remediation options**, go through **Exception options** to file for exceptions, or **Report inaccuracy**. + +Select **Exception options** and a flyout screen opens. + +![Screenshot of exception flyout screen](images/tvm-exception-flyout.png) + +### Exception justification +If the security recommendation stemmed from a false positive report, or if there are existing business justification that blocks the remediation, such as compensating control, productivity needs, compliance, or if there's already a planned remediation grace period, you can file an exception and indicate the reason. The following list details the justifications behind the exception options: + +- **Compensating/alternate control** - A 3rd party control that mitigates this recommendation exists, for example, if Network Firewall - - prevents access to a machine, third party antivirus +- **Productivity/business need** - Remediation will impact productivity or interrupt business-critical workflow +- **Accept risk** - Poses low risk and/or implementing a compensating control is too expensive +- **Planned remediation (grace)** - Already planned but is awaiting execution or authorization +- **Other** - False positive + + + ![Screenshot of exception reason dropdown menu](images/tvm-exception-dropdown.png) + +### Exception visibility +The exceptions you've filed will show up in the **Remediation** page, in the **Exceptions** tab. +However, you also have the option to filter your view based on exception justification, type, and status. + +![Screenshot of exception tab and filters](images/tvm-exception-filters.png) + +Aside from that, there's also an option to **Show exceptions** at the bottom of the **Top security recommendations** card in the dashboard. + +![Screenshot of Show exceptions link in the Top security recommendations card in the dashboard](images/tvm-exception-dashboard.png) + +Clicking the link opens up to the **Security recommendations** page, where you can select the item exempted item with details. + +![Screenshot of exception details in the Security recommendation page](images/tvm-exception-details.png) + +### Actions on exceptions +- Cancel - You can cancel the exceptions you've filed any time +- Resurface - Your exception automatically becomes void and resurfaces in the security recommendation list when dynamic environmental factors change, which adversely affect the exposure impact associated with a recommendation that had previously been excluded + +### Exception status +- **Canceled** - The exception has been canceled and is no longer in effect +- **Expired** - The exception that you've filed is no longer in effect +- **In effect** - The exception that you've filed is in progress + +### Exception impact on scores +Creating an exception can potentially affect the Exposure Score (for both types of weaknesses) and Secure Score (for configurations) of your organization in the following manner: +- **No impact** - Removes the recommendation from the lists (which can be reverse through filters), but will not affect the scores +- **Mitigation-like impact** - As if the recommendation was mitigated (and scores will be adjusted accordingly) when you select it as a compensating control. +- **Hybrid** - Provides visibility on both No impact and Mitigation-like impact. It shows both the Exposure Score and Secure Score results out of the exception option that you made + +The exception impact shows on both the Security recommendations page column and in the flyout pane. + +![Screenshot of where to find the exception impact](images/tvm-exception-impact.png) ## Related topics - [Risk-based Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation.md index cb1913abcb..ee75d061da 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation.md @@ -79,14 +79,12 @@ You can report a false positive when you see any vague, inaccurate, incomplete, 6. Click **Submit**. Your feedback is immediately sent to the Threat & Vulnerability Management experts with its context. - - ## Related topics - [Risk-based Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) - [Threat & Vulnerability Management dashboard overview](tvm-dashboard-insights.md) - [Exposure score](tvm-exposure-score.md) - [Configuration score](configuration-score.md) -- [Remediation](tvm-remediation.md) +- [Remediation and exception](tvm-remediation.md) - [Software inventory](tvm-software-inventory.md) - [Weaknesses](tvm-weaknesses.md) - [Scenarios](threat-and-vuln-mgt-scenarios.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory.md index a7ff6812ce..e1d39cdf5d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory.md @@ -63,6 +63,6 @@ You can report a false positive when you see any vague, inaccurate version, inco - [Exposure score](tvm-exposure-score.md) - [Configuration score](configuration-score.md) - [Security recommendation](tvm-security-recommendation.md) -- [Remediation](tvm-remediation.md) +- [Remediation and exception](tvm-remediation.md) - [Weaknesses](tvm-weaknesses.md) - [Scenarios](threat-and-vuln-mgt-scenarios.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses.md index e2615c2319..7eefec6595 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses.md @@ -15,25 +15,32 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 04/11/2019 +ms.date: 10/31/2019 --- # Weaknesses **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559 + +[!include[Prerelease information](prerelease.md)] Threat & Vulnerability Management leverages the same signals in Microsoft Defender ATP's endpoint protection to scan and detect vulnerabilities. The **Weaknesses** page lists down the vulnerabilities found in the infected software running in your organization, their severity, Common Vulnerability Scoring System (CVSS) rating, its prevalence in your organization, corresponding breach, and threat insights. >[!IMPORTANT] ->To boost your vulnerability assessment detection rates, download the following mandatory security updates and deploy them in your network: +>To boost your vulnerability assessment detection rates, you can download the following mandatory security updates and deploy them in your network: >- 19H1 customers | [KB 4512941](https://support.microsoft.com/help/4512941/windows-10-update-kb4512941) >- RS5 customers | [KB 4516077](https://support.microsoft.com/help/4516077/windows-10-update-kb4516077) >- RS4 customers | [KB 4516045](https://support.microsoft.com/help/4516045/windows-10-update-kb4516045) >- RS3 customers | [KB 4516071](https://support.microsoft.com/help/4516071/windows-10-update-kb4516071) +>

      Downloading the above-mentioned security updates will be mandatory starting Patch Tuesday, October 8, 2019. ## Navigate through your organization's weaknesses page -You can see the list of vulnerabilities in four ways: +You can access the list of vulnerabilities in a few places in the portal: +- Global search +- Weaknesses option in the navigation menu +- Top vulnerable software widget in the dashboard +- Discovered vulnerabilities page in the machine page *Vulnerabilities in global search* 1. Click the global search drop-down menu. @@ -46,12 +53,13 @@ You can see the list of vulnerabilities in four ways: *Weaknesses page in the menu* 1. Go to the Threat & Vulnerability Management navigation menu and select **Weaknesses** to open up the list of vulnerabilities found in your organization. -2. Select the vulnerability that you want to investigate to open up a flyout panel with the vulnerability details, such as: CVE description, CVE ID, exploits available, CVSS V3 rating, severity, publish, and update dates. +2. Select the vulnerability that you want to investigate to open up a flyout panel with the vulnerability details, such as: CVE description, CVE ID, exploits available, CVSS V3 rating, severity, dates when it was published and updated, related software, exploit kits available, vulnerability type, link to useful reference, and number of exposed machines which users can also export. +![Screenshot of the CVE details in the flyout pane in the Weaknesses page](images/tvm-weaknesses-page.png) *Top vulnerable software widget in the dashboard* 1. Go to the Threat & Vulnerability Management dashboard and scroll down to the **Top vulnerable software** widget. You will see the number of vulnerabilities found in each software along with threat information and a high-level view of the device exposure trend over time. ![tvm-top-vulnerable-software](images/tvm-top-vulnerable-software.png) -2. Click the software that you want to investigate and it takes you to the software page. You will the weaknesses found in your machine per severity level, in which machines are they installed, version distribution, and the corresponding security recommendation. +2. Click the software that you want to investigate and it takes you to the software page. You will see the weaknesses found in your machine per severity level, in which machines are they installed, version distribution, and the corresponding security recommendation. 3. Select the **Discovered vulnerabilities** tab. 4. Select the vulnerability that you want to investigate to open up a flyout panel with the vulnerability details, such as: CVE description, CVE ID, exploits available, CVSS V3 rating, severity, publish, and update dates. @@ -68,22 +76,25 @@ You can see the list of vulnerabilities in four ways: 5. Select the vulnerability that you want to investigate to open up a flyout panel with the vulnerability details, such as: CVE description, CVE ID, exploits available, CVSS V3 rating, severity, publish, and update dates. ## How it works -When new vulnerabilities are released, you would want know how many of your assets are exposed. You can see the list of vulnerabilities and the details in the **Weaknesses** page. +When new vulnerabilities are released, you would want to know how many of your assets are exposed. You can see the list of vulnerabilities and the details in the **Weaknesses** page. -If the **Exposed Machines** column shows 0, that means you are not infected. +If the **Exposed Machines** column shows 0, that means you are not at risk. -If there's a number in the **Exposed Machines**, that means you need to remediate the vulnerabilities in those machines because they put the rest of your assets and your organization at risk. +If exposed machines exist, that means you need to remediate the vulnerabilities in those machines because they put the rest of your assets and your organization at risk. You can also see the related alert and threat insights in the **Threat** column. -The breach insights icons are highlighted if there are active alerts associated with the vulnerability found in your organization. +The breach insights icon is highlighted if there is a vulnerability found in your organization. Prioritize an investigation because it means there might be a breach in your organization. + ![tvm-breach-insights](images/tvm-breach-insights.png) -The threat insights icons are highlighted if there are associated exploits in the vulnerability found in your organization. It also shows whether the threat is connected to specific campaign for which, Threat Analytics report links are provided that you can read. +The threat insights icons are highlighted if there are associated exploits in the vulnerability found in your organization. It also shows whether the threat is a part of an exploit kit, connected to specific advanced persistent campaigns or activity groups for which, Threat Analytics report links are provided that you can read, has zero-day exploitation news, disclosures, or related security advisories. + ![tvm-threat-insights](images/tvm-threat-insights.png) + >[!NOTE] - > Always prioritize recommendations that are associated with ongoing threats. These recommendations are marked with the threat insight ![threat insight](images/tvm_bug_icon.png) icon and possible active alert ![possible active alert](images/tvm_alert_icon.png) icon. + > Always prioritize recommendations that are associated with ongoing threats. These recommendations are marked with the threat insight ![threat insight](images/tvm_bug_icon.png) icon and breach insight ![possible active alert](images/tvm_alert_icon.png) icon. ## Report inaccuracy @@ -115,6 +126,6 @@ You can report a false positive when you see any vague, inaccurate, missing, or - [Exposure score](tvm-exposure-score.md) - [Configuration score](configuration-score.md) - [Security recommendation](tvm-security-recommendation.md) -- [Remediation](tvm-remediation.md) +- [Remediation and exception](tvm-remediation.md) - [Software inventory](tvm-software-inventory.md) - [Scenarios](threat-and-vuln-mgt-scenarios.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/user-roles.md b/windows/security/threat-protection/microsoft-defender-atp/user-roles.md index 8d498f43b4..e3afd90910 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/user-roles.md +++ b/windows/security/threat-protection/microsoft-defender-atp/user-roles.md @@ -19,12 +19,12 @@ ms.topic: article # Create and manage roles for role-based access control **Applies to:** - - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) - >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-roles-abovefoldlink) +[!include[Prerelease information](prerelease.md)] + ## Create roles and assign the role to an Azure Active Directory group The following steps guide you on how to create roles in Microsoft Defender Security Center. It assumes that you have already created Azure Active Directory user groups. @@ -37,25 +37,31 @@ The following steps guide you on how to create roles in Microsoft Defender Secur - **Role name** - **Description** - **Permissions** - - **View data** - Users can view information in the portal. - - **Alerts investigation** - Users can manage alerts, initiate automated investigations, collect investigation packages, manage machine tags, and export machine timeline. - - **Active remediation actions** - Users can take response actions and approve or dismiss pending remediation actions. - - **Manage portal system settings** - Users can configure storage settings, SIEM and threat intel API settings (applies globally), advanced settings, automated file uploads, roles and machine groups. + - **View data** - Users can view information in the portal. + >[!NOTE] + >To view Threat & Vulnerability Management data, select **Threat and vulnerability management**. + + - **Alerts investigation** - Users can manage alerts, initiate automated investigations, collect investigation packages, manage machine tags, and export machine timeline. + - **Active remediation actions** - Users can take response actions and approve or dismiss pending remediation actions. + >[!NOTE] + >To enable your Security operation personnel to choose remediation options and file exceptions, select **Threat and vulnerability management - Remediation handling**, and **Threat and vulnerability management - Exception handling**. + + - **Manage portal system settings** - Users can configure storage settings, SIEM and threat intel API settings (applies globally), advanced settings, automated file uploads, roles and machine groups. > [!NOTE] > This setting is only available in the Microsoft Defender ATP administrator (default) role. - - **Manage security settings** - Users can configure alert suppression settings, manage allowed/blocked lists for automation, create and manage custom detections, manage folder exclusions for automation, onboard and offboard machines, and manage email notifications. + - **Manage security settings** - Users can configure alert suppression settings, manage allowed/blocked lists for automation, create and manage custom detections, manage folder exclusions for automation, onboard and offboard machines, and manage email notifications. - - **Live response capabilities** - Users can take basic or advanced live response commands. - - Basic commands allow users to: - - Start a live response session - - Run read only live response commands on a remote machine - - Advanced commands allow users to: - - Run basic actions - - Download a file from the remote machine - - View a script from the files library - - Run a script on the remote machine from the files library take read and write commands. + - **Live response capabilities** - Users can take basic or advanced live response commands. + - Basic commands allow users to: + - Start a live response session + - Run read only live response commands on a remote machine + - Advanced commands allow users to: + - Run basic actions + - Download a file from the remote machine + - View a script from the files library + - Run a script on the remote machine from the files library take read and write commands. For more information on the available commands, see [Investigate machines using Live response](live-response.md). diff --git a/windows/security/threat-protection/microsoft-defender-atp/web-protection-monitoring.md b/windows/security/threat-protection/microsoft-defender-atp/web-protection-monitoring.md index 0673d31c32..da6e550794 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/web-protection-monitoring.md +++ b/windows/security/threat-protection/microsoft-defender-atp/web-protection-monitoring.md @@ -1,7 +1,7 @@ --- title: Monitoring web browsing security in Microsoft Defender ATP description: Use web protection in Microsoft Defender ATP to monitor web browsing security -keywords: web protection, web browsing, monitoring, reports, cards, domain list, security, phishing, malware, exploit, websites, network protection, Edge, Internet Explorer, Chrome, Firefox, web browser +keywords: web protection, web threat protection, web browsing, monitoring, reports, cards, domain list, security, phishing, malware, exploit, websites, network protection, Edge, Internet Explorer, Chrome, Firefox, web browser search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -22,9 +22,7 @@ ms.date: 08/30/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-main-abovefoldlink&rtc=1) -[!include[Prerelease information](prerelease.md)] - -Web protection lets you monitor your organization’s web browsing security through reports under **Reports > Web protection** in the Microsoft Defender Security Center. The report contains the following cards that provide web threat detection statistics: +Web protection lets you monitor your organization’s web browsing security through reports under **Reports > Web protection** in the Microsoft Defender Security Center. The report contains cards that provide web threat detection statistics. - **Web threat protection detections over time** — this trending card displays the number of web threats detected by type during the selected time period (Last 30 days, Last 3 months, Last 6 months) @@ -44,7 +42,7 @@ Web protection categorizes malicious and unwanted websites as: - **Custom indicator** — websites whose URLs or domains you've added to your [custom indicator list](manage-indicators.md) for blocking ## View the domain list -Clicking on a specific web threat category in the **Web threat protection summary** card opens the **Domains** page, which shows a list of the domains prefiltered under that threat category. The page provides the following information for each domain: +Select a specific web threat category in the **Web threat protection summary** card to open the **Domains** page and display the list of the domains under that threat category. The page provides the following information for each domain: - **Access count** — number of requests for URLs in the domain - **Blocks** — number of times requests were blocked @@ -52,7 +50,7 @@ Clicking on a specific web threat category in the **Web threat protection summar - **Threat category** — type of web threat - **Machines** — number of machines with access attempts -Selecting a domain opens a panel that shows the list of URLs in that domain that have been accessed. The panel also lists machines that have attempted to access URLs in the domain. +Select a domain to view the list of machines that have attempted to access URLs in that domain as well as the list of URLs. ## Related topics - [Web protection overview](web-protection-overview.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/web-protection-overview.md b/windows/security/threat-protection/microsoft-defender-atp/web-protection-overview.md index 714ddb9915..37f62a101c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/web-protection-overview.md +++ b/windows/security/threat-protection/microsoft-defender-atp/web-protection-overview.md @@ -1,7 +1,7 @@ --- title: Overview of web protection in Microsoft Defender ATP description: Learn about web protection in Microsoft Defender ATP and how it can protect your organization -keywords: web protection, web browsing, security, phishing, malware, exploit, websites, network protection, Edge, Internet Explorer, Chrome, Firefox, web browser +keywords: web protection, web threat protection, web browsing, security, phishing, malware, exploit, websites, network protection, Edge, Internet Explorer, Chrome, Firefox, web browser search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -22,18 +22,16 @@ ms.date: 08/30/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-main-abovefoldlink&rtc=1) -[!include[Prerelease information](prerelease.md)] +Web protection in Microsoft Defender ATP uses [network protection](network-protection.md) to secure your machines against web threats. By integrating with Microsoft Edge and popular third-party browsers like Chrome and Firefox, web protection stops web threats without a web proxy and can protect machines while they are away or on premises. Web protection stops access to phishing sites, malware vectors, exploit sites, untrusted or low-reputation sites, as well as sites that you have blocked in your [custom indicator list](manage-indicators.md). -Web protection in Microsoft Defender ATP leverages [network protection](network-protection.md) to secure your machines against web threats without relying on a web proxy, providing security for devices that are either away or on premises. By integrating with Microsoft Edge as well as popular third-party browsers like Chrome and Firefox, web protection stops access to phishing sites, malware vectors, exploit sites, untrusted or low-reputation sites, as well as sites that you have blocked in your [custom indicator list](manage-indicators.md). +>[!Note] +>It can take up to an hour for machines to receive new customer indicators. With web protection, you also get: - Comprehensive visibility into web threats affecting your organization - Investigation capabilities over web-related threat activity through alerts and comprehensive profiles of URLs and the machines that access these URLs - A full set of security features that track general access trends to malicious and unwanted websites ->[!Note] ->It can take up to an hour for machines to receive new customer indicators. - ## Prerequisites Web protection uses network protection to provide web browsing security on Microsoft Edge and third-party web browsers. diff --git a/windows/security/threat-protection/microsoft-defender-atp/web-protection-response.md b/windows/security/threat-protection/microsoft-defender-atp/web-protection-response.md index 1d2a797e10..e963f8f504 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/web-protection-response.md +++ b/windows/security/threat-protection/microsoft-defender-atp/web-protection-response.md @@ -1,7 +1,7 @@ --- title: Respond to web threats in Microsoft Defender ATP description: Respond to alerts related to malicious and unwanted websites. Understand how web threat protection informs end users through their web browsers and Windows notifications -keywords: web protection, web browsing, alerts, response, security, phishing, malware, exploit, websites, network protection, Edge, Internet Explorer, Chrome, Firefox, web browser, notifications, end users, Windows notifications, blocking page, +keywords: web protection, web threat protection, web browsing, alerts, response, security, phishing, malware, exploit, websites, network protection, Edge, Internet Explorer, Chrome, Firefox, web browser, notifications, end users, Windows notifications, blocking page, search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -22,8 +22,6 @@ ms.date: 08/30/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-main-abovefoldlink&rtc=1) -[!include[Prerelease information](prerelease.md)] - Web protection in Microsoft Defender ATP lets you efficiently investigate and respond to alerts related to malicious websites and websites in your custom indicator list. ## View web threat alerts @@ -62,10 +60,10 @@ You can also check the machine that attempted to access a blocked URL. Selecting With web protection in Microsoft Defender ATP, your end users will be prevented from visiting malicious or unwanted websites using Microsoft Edge or other browsers. Because blocking is performed by [network protection](network-protection.md), they will see a generic error from the web browser. They will also see a notification from Windows. ![Image of Microsoft Edge showing a 403 error and the Windows notification](images/wtp-browser-blocking-page.png) -*Web threat blocked by Microsoft Edge* +*Web threat blocked on Microsoft Edge* -![Image of Chrome showing a secure connection warning and the Windows notification](images/wtp-chrome-browser-blocking-page.png) -*Web threat blocked by the Chrome web browser* +![Image of Chrome web browser showing a secure connection warning and the Windows notification](images/wtp-chrome-browser-blocking-page.png) +*Web threat blocked on Chrome* ## Related topics - [Web protection overview](web-protection-overview.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md b/windows/security/threat-protection/microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md index f93e5d7d22..e58d48a928 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md +++ b/windows/security/threat-protection/microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md @@ -30,6 +30,11 @@ For more information preview features, see [Preview features](https://docs.micro ## October 2019 +- [Indicators for IP addresses, URLs/Domains](manage-indicators.md)
      You can now allow or block URLs/domains using your own threat intelligence. + + +- [Microsoft Threat Experts - Experts on Demand](microsoft-threat-experts.md)
      You now have the option to consult with Microsoft Threat Experts from several places in the portal to help you in the context of your investigation. + - [Connected Azure AD applications](connected-applications.md)
      The Connected applications page provides information about the Azure AD applications connected to Microsoft Defender ATP in your organization. - [API Explorer](api-explorer.md)
      The API explorer makes it easy to construct and perform API queries, test and send requests for any available Microsoft Defender ATP API endpoint. diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md index e73bbfe476..d600158473 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md @@ -46,7 +46,7 @@ See [Enable cloud-delivered protection](enable-cloud-protection-windows-defender After you've enabled the service, you may need to configure your network or firewall to allow connections between it and your endpoints. -As a cloud service, it is required that computers have access to the internet and that the ATP machine learning services are reachable. The URL: "\*.blob.core.windows.net" should not be excluded from any kind of network inspection. The table below lists the services and their associated URLs. You should ensure there are no firewall or network filtering rules denying access to these URLs, or you may need to create an allow rule specifically for them (excluding the URL: "\*.blob.core.windows.net"). +As a cloud service, it is required that computers have access to the internet and that the ATP machine learning services are reachable. The URL: "\*.blob.core.windows.net" should not be excluded from any kind of network inspection. The table below lists the services and their associated URLs. You should ensure there are no firewall or network filtering rules denying access to these URLs, or you may need to create an allow rule specifically for them (excluding the URL: "\*.blob.core.windows.net"). Below mention URLs are using port 443 for communication. | **Service**| **Description** |**URL** | diff --git a/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md index 1fbf4b6b35..20f5db2632 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md @@ -11,6 +11,7 @@ ms.pagetype: security ms.localizationpriority: medium author: dansimp ms.author: dansimp +audience: ITPro ms.date: 10/02/2018 ms.reviewer: manager: dansimp @@ -21,76 +22,93 @@ manager: dansimp **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Edge](https://docs.microsoft.com/microsoft-edge/deploy/microsoft-edge) -The potentially unwanted application (PUA) protection feature in Windows Defender Antivirus can detect and block PUAs on endpoints in your network. +Potentially unwanted applications are not considered viruses, malware, or other types of threats, but they might perform actions on endpoints which adversely affect endpoint performance or use. _PUA_ can also refer to an application that has a poor reputation, as assessed by Microsoft Defender ATP, due to certain kinds of undesirable behavior. -These applications are not considered viruses, malware, or other types of threats, but might perform actions on endpoints that adversely affect their performance or use. PUA can also refer to applications that are considered to have poor reputation. +For example: -Typical PUA behavior includes: +* **Advertising software:** Software that displays advertisements or promotions, including software that inserts advertisements to webpages. +* **Bundling software:** Software that offers to install other software that is not digitally signed by the same entity. Also, software that offers to install other software that qualify as PUA. +* **Evasion software:** Software that actively tries to evade detection by security products, including software that behaves differently in the presence of security products. -- Various types of software bundling -- Ad injection into web browsers -- Driver and registry optimizers that detect issues, request payment to fix the errors, but remain on the endpoint and make no changes or optimizations (also known as "rogue antivirus" programs) +For more examples and a discussion of the criteria we use to label applications for special attention from security features, see [How Microsoft identifies malware and potentially unwanted applications](../intelligence/criteria.md). -These applications can increase the risk of your network being infected with malware, cause malware infections to be harder to identify, and can waste IT resources in cleaning up the applications. - ->[!TIP] ->You can also visit the Microsoft Defender ATP demo website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works. +Potentially unwanted applications can increase the risk of your network being infected with actual malware, make malware infections harder to identify, or waste IT resources in cleaning them up. ## How it works -Windows Defender Antivirus blocks detected PUA files and attempts to download, move, run, or install them. Blocked PUA files are then moved to quarantined. +### Microsoft Edge -When a PUA is detected on an endpoint, Windows Defender Antivirus presents a notification to the user ([unless notifications have been disabled](configure-notifications-windows-defender-antivirus.md)) in the same format as normal threat detections (prefaced with "PUA:"). +The next major version of Microsoft Edge, which is Chromium-based, blocks potentially unwanted application downloads and associated resource URLs. This feature is provided via [Windows Defender SmartScreen](../windows-defender-smartscreen/windows-defender-smartscreen-overview.md). -They will also appear in the usual [quarantine list in the Windows Security app](windows-defender-security-center-antivirus.md#detection-history). +#### Enable PUA protection in Chromium-based Microsoft Edge -## View PUA events +Although potentially unwanted application protection in Microsoft Edge (Chromium-based) is off by default, it can easily be turned on from within the browser. -PUA events are reported in the Windows Event Viewer, but not in System Center Configuration Manager or Intune. +1. From the tool bar, select **Settings and more** > **Settings** +1. Select **Privacy and services** +1. Under the **Services** section, you can toggle **Potentially unwanted app blocking** on or off -You can turn on email notifications for PUA detections. +> [!TIP] +> If you are running Microsoft Edge (Chromium-based), you can safely explore the URL-blocking feature of PUA protection by testing it out on one of our Windows Defender SmartScreen demo pages. -See [Troubleshoot event IDs](troubleshoot-windows-defender-antivirus.md) for details on viewing Windows Defender Antivirus events. PUA events are recorded under event ID 1160. + -## Configure PUA protection +### Windows Defender Antivirus -You can enable PUA protection with Microsoft Intune, System Center Configuration Manager, Group Policy, or PowerShell cmdlets. +The potentially unwanted application (PUA) protection feature in Windows Defender Antivirus can detect and block PUAs on endpoints in your network. -You can also use the PUA audit mode to detect PUA without blocking them. The detections will be captured in the Windows event log. +> [!NOTE] +> This feature is only available in Windows 10. -This feature is useful if your company is conducting an internal software security compliance check and you'd like to avoid any false positives. +Windows Defender Antivirus blocks detected PUA files, and any attempts to download, move, run, or install them. Blocked PUA files are then moved to quarantine. -**Use Intune to configure PUA protection** +When a PUA is detected on an endpoint, Windows Defender Antivirus sends a notification to the user ([unless notifications have been disabled](configure-notifications-windows-defender-antivirus.md)) in the same format as other threat detections. The notification will be prefaced with _PUA:_ to indicate its content. + +The notification will appear in the usual [quarantine list within the Windows Security app](windows-defender-security-center-antivirus.md#detection-history). + +#### Configure PUA protection in Windows Defender Antivirus + +You can enable PUA protection with Microsoft Intune, System Center Configuration Manager, Group Policy, or via PowerShell cmdlets. + +You can also use the PUA audit mode to detect PUAs without blocking them. The detections will be captured in the Windows event log. + +> [!TIP] +> You can visit the Microsoft Defender ATP demo website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com/Page/UrlRep) to confirm that the feature is working, and see it in action. + +PUA audit mode is useful if your company is conducting an internal software security compliance check and you'd like to avoid any false positives. + +##### Use Intune to configure PUA protection See [Configure device restriction settings in Microsoft Intune](https://docs.microsoft.com/intune/device-restrictions-configure) and [Windows Defender Antivirus device restriction settings for Windows 10 in Intune](https://docs.microsoft.com/intune/device-restrictions-windows-10#windows-defender-antivirus) for more details. -**Use Configuration Manager to configure PUA protection:** +##### Use Configuration Manager to configure PUA protection -PUA protection is enabled by default in System Center Configuration Manager (current branch), including version 1606 and later. +PUA protection is enabled by default in the System Center Configuration Manager (current branch), starting with version 1606. See [How to create and deploy antimalware policies: Scheduled scans settings](https://docs.microsoft.com/sccm/protect/deploy-use/endpoint-antimalware-policies#real-time-protection-settings) for details on configuring System Center Configuration Manager (current branch). For Configuration Manager 2012, see [How to Deploy Potentially Unwanted Application Protection Policy for Endpoint Protection in Configuration Manager](https://technet.microsoft.com/library/hh508770.aspx#BKMK_PUA). > [!NOTE] -> PUA events are reported in the Windows Event Viewer and not in System Center Configuration Manager. +> PUA events blocked by Windows Defender Antivirus are reported in the Windows Event Viewer and not in System Center Configuration Manager. -**Use Group Policy to configure PUA protection:** +##### Use Group Policy to configure PUA protection -1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. +1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure, and select **Edit**. -2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. +2. In the **Group Policy Management Editor**, go to **Computer configuration** and select **Administrative templates**. 3. Expand the tree to **Windows components > Windows Defender Antivirus**. 4. Double-click **Configure protection for potentially unwanted applications**. -5. Click **Enabled** to enable PUA protection. +5. Select **Enabled** to enable PUA protection. -6. In **Options**, select **Block** to block potentially unwanted applications, or select **Audit Mode** to test how the setting will work in your environment. Click **OK**. +6. In **Options**, select **Block** to block potentially unwanted applications, or select **Audit Mode** to test how the setting will work in your environment. Select **OK**. -**Use PowerShell cmdlets to configure PUA protection:** +##### Use PowerShell cmdlets to configure PUA protection Use the following cmdlet: @@ -98,12 +116,24 @@ Use the following cmdlet: Set-MpPreference -PUAProtection ``` -Setting the value for this cmdlet to `Enabled` will turn the feature on if it has been disabled. +Setting the value for this cmdlet to `Enabled` will turn the feature on if it has been disabled. -Setting `AuditMode` will detect PUAs but will not block them. +Setting `AuditMode` will detect PUAs without blocking them. See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/library/dn433280.aspx) for more information on how to use PowerShell with Windows Defender Antivirus. +#### View PUA events + +PUA events are reported in the Windows Event Viewer, but not in System Center Configuration Manager or in Intune. + +You can turn on email notifications to receive mail about PUA detections. + +See [Troubleshoot event IDs](troubleshoot-windows-defender-antivirus.md) for details on viewing Windows Defender Antivirus events. PUA events are recorded under event ID **1160**. + +#### Allow-listing apps + +Sometimes a file is erroneously blocked by PUA protection, or a feature of a PUA is required to complete a task. In these cases, a file can be allow-listed. See [How to Configure Endpoint Protection in Configuration Manager](https://docs.microsoft.com/previous-versions/system-center/system-center-2012-R2/hh508770(v=technet.10)#to-exclude-specific-files-or-folders) for information on allowing files which are currently blocked by PUA protection in Windows Defender Antivirus. + ## Related topics - [Next gen protection](windows-defender-antivirus-in-windows-10.md) diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/ATP_Portal_Onboarding_page.png b/windows/security/threat-protection/windows-defender-antivirus/images/atp-portal-onboarding-page.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/ATP_Portal_Onboarding_page.png rename to windows/security/threat-protection/windows-defender-antivirus/images/atp-portal-onboarding-page.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_1_RegisterApp.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-1-registerapp.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_1_RegisterApp.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-1-registerapp.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_10_ClientApps.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-10-clientapps.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_10_ClientApps.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-10-clientapps.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_11_Assignments.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-11-assignments.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_11_Assignments.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-11-assignments.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_12_DeviceInstall.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-12-deviceinstall.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_12_DeviceInstall.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-12-deviceinstall.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_13_SystemPreferences.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-13-systempreferences.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_13_SystemPreferences.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-13-systempreferences.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_14_SystemPreferencesProfiles.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-14-systempreferencesprofiles.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_14_SystemPreferencesProfiles.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-14-systempreferencesprofiles.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_15_ManagementProfileConfig.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-15-managementprofileconfig.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_15_ManagementProfileConfig.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-15-managementprofileconfig.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_16_PreferenceDomain.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-16-preferencedomain.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_16_PreferenceDomain.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-16-preferencedomain.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_17_approvedKernelExtensions.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-17-approvedkernelextensions.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_17_approvedKernelExtensions.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-17-approvedkernelextensions.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_18_ConfigurationProfilesScope.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-18-configurationprofilesscope.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_18_ConfigurationProfilesScope.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-18-configurationprofilesscope.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_19_MicrosoftDefenderWDAVPKG.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-19-microsoftdefenderwdavpkg.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_19_MicrosoftDefenderWDAVPKG.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-19-microsoftdefenderwdavpkg.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_2_DownloadPackages.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-2-downloadpackages.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_2_DownloadPackages.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-2-downloadpackages.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_20_MicrosoftDefenderPackages.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-20-microsoftdefenderpackages.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_20_MicrosoftDefenderPackages.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-20-microsoftdefenderpackages.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_21_MDMProfile1.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-21-mdmprofile1.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_21_MDMProfile1.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-21-mdmprofile1.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_22_MDMProfileApproved.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-22-mdmprofileapproved.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_22_MDMProfileApproved.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-22-mdmprofileapproved.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_23_MDMStatus.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-23-mdmstatus.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_23_MDMStatus.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-23-mdmstatus.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_24_StatusOnServer.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-24-statusonserver.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_24_StatusOnServer.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-24-statusonserver.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_25_StatusOnClient.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-25-statusonclient.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_25_StatusOnClient.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-25-statusonclient.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_26_Uninstall.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-26-uninstall.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_26_Uninstall.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-26-uninstall.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_27_UninstallScript.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-27-uninstallscript.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_27_UninstallScript.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-27-uninstallscript.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_28_AppInstall.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-28-appinstall.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_28_AppInstall.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-28-appinstall.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_29_AppInstallLogin.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-29-appinstalllogin.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_29_AppInstallLogin.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-29-appinstalllogin.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_3_ConfirmDeviceMgmt.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-3-confirmdevicemgmt.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_3_ConfirmDeviceMgmt.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-3-confirmdevicemgmt.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_30_SystemExtension.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-30-systemextension.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_30_SystemExtension.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-30-systemextension.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_31_SecurityPrivacySettings.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-31-securityprivacysettings.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_31_SecurityPrivacySettings.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-31-securityprivacysettings.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_32_Main_App_Fix.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-32-main-app-fix.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_32_Main_App_Fix.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-32-main-app-fix.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_33_SecurityPrivacySettings_NoPrompt.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-33-securityprivacysettings-noprompt.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_33_SecurityPrivacySettings_NoPrompt.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-33-securityprivacysettings-noprompt.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_34_MAU.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-34-mau.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_34_MAU.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-34-mau.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_35_JAMF_PrivacyPreferences.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-35-jamf-privacypreferences.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_35_JAMF_PrivacyPreferences.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-35-jamf-privacypreferences.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-36-rtp.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-36-rtp.png new file mode 100644 index 0000000000..dab113680f Binary files /dev/null and b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-36-rtp.png differ diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-37-exclusions.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-37-exclusions.png new file mode 100644 index 0000000000..d33e01e247 Binary files /dev/null and b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-37-exclusions.png differ diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_4_ManagementProfile.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-4-managementprofile.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_4_ManagementProfile.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-4-managementprofile.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_5_allDevices.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-5-alldevices.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_5_allDevices.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-5-alldevices.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_6_SystemConfigurationProfiles.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-6-systemconfigurationprofiles.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_6_SystemConfigurationProfiles.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-6-systemconfigurationprofiles.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_7_DeviceStatusBlade.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-7-devicestatusblade.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_7_DeviceStatusBlade.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-7-devicestatusblade.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_8_IntuneAppInfo.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-8-intuneappinfo.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_8_IntuneAppInfo.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-8-intuneappinfo.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_9_IntunePkgInfo.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-9-intunepkginfo.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_9_IntunePkgInfo.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-9-intunepkginfo.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_Icon_Bar.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-icon-bar.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_Icon_Bar.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-icon-bar.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_Icon.png b/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-icon.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/MDATP_Icon.png rename to windows/security/threat-protection/windows-defender-antivirus/images/mdatp-icon.png diff --git a/windows/security/threat-protection/windows-defender-application-control/LOB-win32-apps-on-s.md b/windows/security/threat-protection/windows-defender-application-control/LOB-win32-apps-on-s.md new file mode 100644 index 0000000000..d1fde8548c --- /dev/null +++ b/windows/security/threat-protection/windows-defender-application-control/LOB-win32-apps-on-s.md @@ -0,0 +1,232 @@ +--- +title: Allow LOB Win32 Apps on Intune-Managed S Mode Devices (Windows 10) +description: Using WDAC supplemental policies, you can expand the S mode base policy on your Intune-managed devices. +keywords: whitelisting, security, malware +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +audience: ITPro +ms.collection: M365-security-compliance +author: jsuther1974 +ms.reviewer: isbrahm +ms.author: dansimp +manager: dansimp +ms.date: 10/30/2019 +--- + +# Allow Line-of-Business Win32 Apps on Intune-Managed S Mode Devices + +**Applies to:** + +- Windows 10 + +Beginning with the Windows 10 November 2019 update (build 18363), Microsoft Intune enables customers to deploy and run business critical Win32 applications as well as Windows components that are normally blocked in S mode (ex. PowerShell.exe) on their Intune-managed Windows 10 in S mode devices. + +With Intune, IT Pros can now configure their managed S mode devices using a Windows Defender Application Control (WDAC) supplemental policy that expands the S mode base policy to authorize the apps their business uses. This feature changes the S mode security posture from “every app is Microsoft-verified" to “every app is verified by Microsoft or your organization”. + +# Policy Authorization Process +![Policy Authorization](images/wdac-intune-policy-authorization.png) +The general steps for expanding the S mode base policy on your devices are to generate a supplemental policy, sign that policy, and then upload the signed policy to Intune and assign it to user or device groups. +1. Generate a supplemental policy with WDAC tooling + + This policy will expand the S mode base policy to authorize additional applications. Anything authorized by either the S mode base policy or your supplemental policy will be allowed to run. Your supplemental policies can specify filepath rules, trusted publishers, and more. + + Refer to [Deploy multiple Windows Defender Application Control Policies](deploy-multiple-windows-defender-application-control-policies.md) for guidance on creating supplemental policies and [Deploy Windows Defender Application Control policy rules and file rules](select-types-of-rules-to-create.md) to choose the right type of rules to create for your policy. + + Below are a basic set of instructions for creating an S mode supplemental policy: + - Create a new base policy using [New-CIPolicy](https://docs.microsoft.com/powershell/module/configci/new-cipolicy?view=win10-ps) + + ```powershell + New-CIPolicy -MultiplePolicyFormat -ScanPath -UserPEs -FilePath "\SupplementalPolicy.xml" -Level Publisher -Fallback Hash + ``` + - Change it to a supplemental policy using [Set-CIPolicyIdInfo](https://docs.microsoft.com/powershell/module/configci/set-cipolicyidinfo?view=win10-ps) + + ```powershell + Set-CIPolicyIdInfo -SupplementsBasePolicyID 5951A96A-E0B5-4D3D-8FB8-3E5B61030784 -FilePath "\SupplementalPolicy.xml" + ``` + Policies which are supplementing the S mode base policy must use **-SupplementsBasePolicyID 5951A96A-E0B5-4D3D-8FB8-3E5B61030784**, as this is the S mode policy ID. + - Put the policy in enforce mode using [Set-RuleOption](https://docs.microsoft.com/powershell/module/configci/set-ruleoption?view=win10-ps) + + ```powershell + Set-RuleOption -FilePath "\SupplementalPolicy.xml>" -Option 3 –Delete + ``` + This deletes the ‘audit mode’ qualifier. + - Convert to .bin using [ConvertFrom-CIPolicy](https://docs.microsoft.com/powershell/module/configci/convertfrom-cipolicy?view=win10-ps) + + ```powershell + ConvertFrom-CIPolicy -XmlFilePath "\SupplementalPolicy.xml" -BinaryFilePath "\SupplementalPolicy.bin> + ``` + +2. Sign policy + + Supplemental S mode policies must be digitally signed. To sign your policy, you can choose to use the Device Guard Signing Service or your organization's custom Public Key Infrastructure (PKI). Refer to [Use the Device Guard Signing Portal in the Microsoft Store for Business](use-device-guard-signing-portal-in-microsoft-store-for-business.md) for guidance on using DGSS and [Create a code signing cert for WDAC](create-code-signing-cert-for-windows-defender-application-control.md) for guidance on signing using an internal CA. + + Once your policy is signed, you must authorize the signing certificate you used to sign the policy and optionally one or more additional signers that can be used to sign updates to the policy in the future. Use Add-SignerRule to add the signing certificate to the WDAC policy: + + ```powershell + Add-SignerRule -FilePath -CertificatePath -User -Update` + ``` + Rename your policy to "{PolicyID}.p7b" after you've signed it. PolicyID can be found by inspecting the Supplemental Policy XML + +3. Deploy the signed supplemental policy using Microsoft Intune + + Go to the Azure portal online and navigate to the Microsoft Intune page, then go to the Client apps blade and select 'S mode supplemental policies'. Upload the signed policy to Intune and assign it to user or device groups. Intune will generate tenant- and device- specific authorization tokens. Intune then deploys the corresponding authorization token and supplemental policy to each device in the assigned group. Together, these expand the S mode base policy on the device. + +> [!Note] +> When updating your supplemental policy, ensure that the new version number is strictly greater than the previous one. Using the same version number is not allowed by Intune. Refer to [Set-CIPolicyVersion](https://docs.microsoft.com/powershell/module/configci/set-cipolicyversion?view=win10-ps) for information on setting the version number. + +# Standard Process for Deploying Apps through Intune +![Deploying Apps through Intune](images/wdac-intune-app-deployment.png) +Refer to [Intune Standalone - Win32 app management](https://docs.microsoft.com/intune/apps-win32-app-management) for guidance on the existing procedure of packaging signed catalogs and app deployment. + +# Optional: Process for Deploying Apps using Catalogs +![Deploying Apps using Catalogs](images/wdac-intune-app-catalogs.png) +Your supplemental policy can be used to significantly relax the S mode base policy, but there are security trade-offs you must consider in doing so. For example, you can use a signer rule to trust an external signer, but that will authorize all apps signed by that certificate, which may include apps you don’t want to allow as well. + +Instead of authorizing signers external to your organization, Intune has added new functionality to make it easier to authorize existing applications (without requiring repackaging or access to the source code) through the use of signed catalogs. This works for apps which may be unsigned or even signed apps when you don’t want to trust all apps that may share the same signing certificate. + +The basic process is to generate a catalog file for each app using Package Inspector, then sign the catalog files using the DGSS or a custom PKI. After that, IT Pros can use the standard Intune app deployment process outlined above. Refer to [Deploy catalog files to support Windows Defender Application Control](deploy-catalog-files-to-support-windows-defender-application-control.md) for more in-depth guidance on generating catalogs. + +> [!Note] +> Every time an app updates, you will need to deploy an updated catalog. Because of this, IT Pros should try to avoid using catalog files for applications that auto-update and direct users not to update applications on their own. + +# Sample Policy +Below is a sample policy that allows kernel debuggers, PowerShell ISE, and Registry Editor. It also demonstrates how to specify your organization's code signing and policy signing certificates. +```xml + + + 10.0.0.0 + {2E07F7E4-194C-4D20-B7C9-6F44A6C5A234} + + {5951A96A-E0B5-4D3D-8FB8-3E5B61030784} + + {52671094-ACC6-43CF-AAF1-096DC69C1345} + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + 0 + + + + Example Policy Name + + + + + Example-Policy-10.0.0.0 + + + + +``` +# Policy Removal +> [!Note] +> This feature currently has a known a policy deletion bug, with a fix expected in the 2D update in late February 2020. Devices of users who are unenrolled will still have their WDAC policies removed. In the mentime, IT Pros are recommended to update their policy with the below 'empty' policy which makes no changes to S mode. + +```xml + + + 10.0.0.1 + {2E07F7E4-194C-4D20-B7C9-6F44A6C5A234} + {5951A96A-E0B5-4D3D-8FB8-3E5B61030784} + {52671094-ACC6-43CF-AAF1-096DC69C1345} + + + + + + + + + + + + + + + + + + + + + + + + + + + + + 0 + + + + Example Policy Name - Empty + + + + + Example-Policy-Empty-10.0.0.1 + + + + +``` diff --git a/windows/security/threat-protection/windows-defender-application-control/TOC.md b/windows/security/threat-protection/windows-defender-application-control/TOC.md index 196c8dc9a2..40e42e3eb4 100644 --- a/windows/security/threat-protection/windows-defender-application-control/TOC.md +++ b/windows/security/threat-protection/windows-defender-application-control/TOC.md @@ -13,7 +13,6 @@ ### [Types of devices](types-of-devices.md) ### Use WDAC with custom policies #### [Create an initial default policy](create-initial-default-policy.md) -#### [Create path-based rules](create-path-based-rules.md) #### [Microsoft recommended block rules](microsoft-recommended-block-rules.md) ### [Audit WDAC policies](audit-windows-defender-application-control-policies.md) ### [Merge WDAC policies](merge-windows-defender-application-control-policies.md) @@ -36,6 +35,8 @@ #### [Signing WDAC policies with SignTool.exe](signing-policies-with-signtool.md) ### [Disable WDAC policies](disable-windows-defender-application-control-policies.md) ### [Device Guard and AppLocker](windows-defender-device-guard-and-applocker.md) +### [LOB Win32 Apps on S Mode](LOB-win32-apps-on-s.md) + ## [AppLocker](applocker\applocker-overview.md) ### [Administer AppLocker](applocker\administer-applocker.md) diff --git a/windows/security/threat-protection/windows-defender-application-control/create-path-based-rules.md b/windows/security/threat-protection/windows-defender-application-control/create-path-based-rules.md deleted file mode 100644 index 4ac0c9fa6e..0000000000 --- a/windows/security/threat-protection/windows-defender-application-control/create-path-based-rules.md +++ /dev/null @@ -1,72 +0,0 @@ ---- -title: Windows Defender Application Control path-based rules (Windows 10) -description: Beginning with Windows 10 version 1903, Windows Defender Application Control (WDAC) policies can contain path-based rules. -keywords: whitelisting, security, malware -ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -audience: ITPro -ms.collection: M365-security-compliance -author: jsuther1974 -ms.reviewer: isbrahm -ms.author: dansimp -manager: dansimp -ms.date: 05/17/2019 ---- - -# Create Windows Defender Application Control path-based rules - -**Applies to:** - -- Windows 10 -- Windows Server 2016 - ->[!IMPORTANT] ->Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - -Beginning with Windows 10 version 1903, Windows Defender Application Control (WDAC) policies can contain path-based rules. - -- New-CIPolicy parameters - - FilePath: create path rules under path \ for anything not user-writeable (at the individual file level) - - ```powershell - New-CIPolicy -f .\mypolicy.xml -l FilePath -s -u - ``` - - Optionally, add -UserWriteablePaths to ignore user writeability - - - FilePathRule: create a rule where filepath string is directly set to value of \ - - ```powershell - New-CIPolicyRule -FilePathRule - ``` - - Useful for wildcards like C:\foo\\* - -- Usage follows the same flow as per-app rules: - - ```powershell - $rules = New-CIPolicyRule … - $rules += New-CIPolicyRule … - … - New-CIPolicyRule -f .\mypolicy.xml -u - ``` - -- Wildcards supported - - Suffix (ex. C:\foo\\*) OR Prefix (ex. *\foo\bar.exe) - - One or the other, not both at the same time - - Does not support wildcard in the middle (ex. C:\\*\foo.exe) -- Supported Macros: - - %WINDIR%\\... - - %SYSTEM32%\\... - - %OSDRIVE%\\... - -- Disable default FilePath rule protection of enforcing user-writeability. For example, to add “Disabled:Runtime FilePath Rule Protection” to the policy: - - ```powershell - Set-RuleOption -o 18 .\policy.xml - ``` - diff --git a/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md index 6505f27774..d70793409e 100644 --- a/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md @@ -24,9 +24,6 @@ ms.date: 05/17/2019 - Windows 10 - Windows Server 2016 ->[!IMPORTANT] ->Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - The restriction of only having a single code integrity policy active on a system at any given time has felt limiting for customers in situations where multiple policies with different intents would be useful. Beginning with Windows 10 version 1903, WDAC supports multiple simultaneous code integrity policies for one device in order to enable the following scenarios: 1. Enforce and Audit Side-by-Side @@ -53,7 +50,7 @@ Note that multiple policies will not work on pre-1903 systems. In order to allow multiple policies to exist and take effect on a single system, policies must be created using the new Multiple Policy Format. The "MultiplePolicyFormat" switch in [New-CIPolicy](https://docs.microsoft.com/powershell/module/configci/new-cipolicy?view=win10-ps) results in 1) random GUIDs being generated for the policy ID and 2) the policy type being specified as base. The below is an example of creating a new policy in the multiple policy format. ```powershell -New-CIPolicy -MultiplePolicyFormat -ScanPath '.\temp\' -UserPEs -FilePath ".\policy.xml" -Level Publisher -Fallback Hash +New-CIPolicy -MultiplePolicyFormat -ScanPath "" -UserPEs -FilePath ".\policy.xml" -Level Publisher -Fallback Hash ``` Optionally, you can choose to make the new base policy supplementable (allow supplemental policies). @@ -70,19 +67,19 @@ Add-SignerRule -FilePath -CertificatePath [-Kernel] [-User] [- ### Supplemental Policy Creation -In order to create a supplemental policy, begin by creating a new policy in the Multiple Policy Format. From there, use Set-CIPolicyIdInfo to convert it to a supplemental policy and specify which base policy it expands. -- "SupplementsBasePolicyID": guid of new supplemental policy -- "BasePolicyToSupplementPath": base policy that the supplemental policy applies to +In order to create a supplemental policy, begin by creating a new policy in the Multiple Policy Format. From there, use Set-CIPolicyIdInfo to convert it to a supplemental policy and specify which base policy it expands. You can use either SupplementsBasePolicyID or BasePolicyToSupplementPath to specify the base policy. +- "SupplementsBasePolicyID": GUID of base policy that the supplemental policy applies to +- "BasePolicyToSupplementPath": path to base policy file that the supplemental policy applies to ```powershell Set-CIPolicyIdInfo [-FilePath] [-PolicyName ] [-SupplementsBasePolicyID ] [-BasePolicyToSupplementPath ] [-ResetPolicyID] [-PolicyId ] [] ``` -Note that "ResetPolicyId" reverts a supplemental policy to a base policy, and resets the policy guids back to a random guid. +Note that "ResetPolicyId" reverts a supplemental policy to a base policy, and resets the policy GUIDs back to a random GUID. ### Merging policies -When merging, the policy type and ID of the leftmost/first policy specified is used. If the leftmost is a base policy with ID \, then regardless of what the GUIDS and types are for any subsequent policies, the merged policy will be a base policy with ID \. +When merging, the policy type and ID of the leftmost/first policy specified is used. If the leftmost is a base policy with ID \, then regardless of what the GUIDs and types are for any subsequent policies, the merged policy will be a base policy with ID \. ### Deploying policies diff --git a/windows/security/threat-protection/windows-defender-application-control/images/wdac-intune-app-catalogs.png b/windows/security/threat-protection/windows-defender-application-control/images/wdac-intune-app-catalogs.png new file mode 100644 index 0000000000..754cf041ba Binary files /dev/null and b/windows/security/threat-protection/windows-defender-application-control/images/wdac-intune-app-catalogs.png differ diff --git a/windows/security/threat-protection/windows-defender-application-control/images/wdac-intune-app-deployment.png b/windows/security/threat-protection/windows-defender-application-control/images/wdac-intune-app-deployment.png new file mode 100644 index 0000000000..91fc4f136b Binary files /dev/null and b/windows/security/threat-protection/windows-defender-application-control/images/wdac-intune-app-deployment.png differ diff --git a/windows/security/threat-protection/windows-defender-application-control/images/wdac-intune-policy-authorization.png b/windows/security/threat-protection/windows-defender-application-control/images/wdac-intune-policy-authorization.png new file mode 100644 index 0000000000..d011fc4408 Binary files /dev/null and b/windows/security/threat-protection/windows-defender-application-control/images/wdac-intune-policy-authorization.png differ diff --git a/windows/security/threat-protection/windows-defender-application-control/use-device-guard-signing-portal-in-microsoft-store-for-business.md b/windows/security/threat-protection/windows-defender-application-control/use-device-guard-signing-portal-in-microsoft-store-for-business.md index 12e20135ca..bb2b9834f3 100644 --- a/windows/security/threat-protection/windows-defender-application-control/use-device-guard-signing-portal-in-microsoft-store-for-business.md +++ b/windows/security/threat-protection/windows-defender-application-control/use-device-guard-signing-portal-in-microsoft-store-for-business.md @@ -36,11 +36,11 @@ Before you get started, be sure to review these best practices: **Best practices** - Test your code integrity policies on a pilot group of devices before deploying them to production. -- Use rule options 9 and 10 during testing. For more information, see the section Code integrity policy rules in the [Deploy Windows Defender Application Control policy rules and file rules](hhttps://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create). +- Use rule options 9 and 10 during testing. For more information, see the section Code integrity policy rules in the [Deploy Windows Defender Application Control policy rules and file rules](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create). **To sign a code integrity policy** -1. Sign in to the [Microsoft Store for Business](http://businessstore.microsoft.com) or [Microsoft Store for Education](https://educationstore.microsoft.com). +1. Sign in to the [Microsoft Store for Business](https://businessstore.microsoft.com) or [Microsoft Store for Education](https://educationstore.microsoft.com). 2. Click **Manage**, click **Store settings**, and then click **Device Guard**. 3. Click **Upload** to upload your code integrity policy. 4. After the files are uploaded, click **Sign** to sign the code integrity policy. diff --git a/windows/security/threat-protection/windows-defender-application-guard/configure-wd-app-guard.md b/windows/security/threat-protection/windows-defender-application-guard/configure-wd-app-guard.md index 990977f063..3f9f335b8f 100644 --- a/windows/security/threat-protection/windows-defender-application-guard/configure-wd-app-guard.md +++ b/windows/security/threat-protection/windows-defender-application-guard/configure-wd-app-guard.md @@ -56,7 +56,7 @@ These settings, located at **Computer Configuration\Administrative Templates\Win |Configure Windows Defender Application Guard print settings|Windows 10 Enterprise, 1709 or higher

      Windows 10 Pro, 1803 or higher|Determines whether Application Guard can use the print functionality.|**Enabled.** Turns On the print functionality and lets you choose whether to additionally:

      • Enable Application Guard to print into the XPS format.
      • Enable Application Guard to print into the PDF format.
      • Enable Application Guard to print to locally attached printers.
      • Enable Application Guard to print from previously connected network printers. Employees can't search for additional printers.
      **Disabled or not configured.** Completely turns Off the print functionality for Application Guard.| |Block enterprise websites to load non-enterprise content in IE and Edge|Windows 10 Enterprise, 1709 or higher|Determines whether to allow Internet access for apps not included on the **Allowed Apps** list.|**Enabled.** Prevents network traffic from both Internet Explorer and Microsoft Edge to non-enterprise sites that can't render in the Application Guard container.**Note** This may also block assets cached by CDNs and references to analytics sites. Please add them to the trusted enterprise resources to avoid broken pages.

      **Disabled or not configured.** Prevents Microsoft Edge to render network traffic to non-enterprise sites that can't render in Application Guard. | |Allow Persistence|Windows 10 Enterprise, 1709 or higher

      Windows 10 Pro, 1803 or higher|Determines whether data persists across different sessions in Windows Defender Application Guard.|**Enabled.** Application Guard saves user-downloaded files and other items (such as, cookies, Favorites, and so on) for use in future Application Guard sessions.

      **Disabled or not configured.** All user data within Application Guard is reset between sessions.

      **Note**
      If you later decide to stop supporting data persistence for your employees, you can use our Windows-provided utility to reset the container and to discard any personal data.
      **To reset the container:**
      1. Open a command-line program and navigate to Windows/System32.
      2. Type `wdagtool.exe cleanup`.
        The container environment is reset, retaining only the employee-generated data.
      3. Type `wdagtool.exe cleanup RESET_PERSISTENCE_LAYER`.
        The container environment is reset, including discarding all employee-generated data.
      | -|Turn on Windows Defender Application Guard in Enterprise Mode|Windows 10 Enterprise, 1709 or higher|Determines whether to turn on Application Guard for Microsoft Edge.|**Enabled.** Turns on Application Guard for Microsoft Edge, honoring the network isolation settings, rendering non-enterprise domains in the Application Guard container. Be aware that Application Guard won't actually be turned On unless the required prerequisites and network isolation settings are already set on the device.

      **Disabled.** Turns Off Application Guard, allowing all apps to run in Microsoft Edge.| +|Turn on Windows Defender Application Guard in Managed Mode|Windows 10 Enterprise, 1809 or higher|Determines whether to turn on Application Guard for Microsoft Edge and Microsoft Office.|**Enabled.** Turns on Application Guard for Microsoft Edge and/or Microsoft Office, honoring the network isolation settings, rendering non-enterprise domains in the Application Guard container. Be aware that Application Guard won't actually be turned On unless the required prerequisites and network isolation settings are already set on the device. Available options:
      • Enable Windows Defender Application Guard only for Microsoft Edge;
      • Enable Windows Defender Application Guard only for Microsoft Office;
      • Enable Windows Defender Application Guard for both Microsoft Edge and Microsoft Office.
      **Disabled.** Turns Off Application Guard, allowing all apps to run in Microsoft Edge and Microsoft Office.| |Allow files to download to host operating system|Windows 10 Enterprise, 1803 or higher|Determines whether to save downloaded files to the host operating system from the Windows Defender Application Guard container.|**Enabled.** Allows users to save downloaded files from the Windows Defender Application Guard container to the host operating system.

      **Disabled or not configured.** Users are not able to saved downloaded files from Application Guard to the host operating system.| |Allow hardware-accelerated rendering for Windows Defender Application Guard|Windows 10 Enterprise, 1803 or higher

      Windows 10 Pro, 1803 or higher|Determines whether Windows Defender Application Guard renders graphics using hardware or software acceleration.|**Enabled.** Windows Defender Application Guard uses Hyper-V to access supported, high-security rendering graphics hardware (GPUs). These GPUs improve rendering performance and battery life while using Windows Defender Application Guard, particularly for video playback and other graphics-intensive use cases. If this setting is enabled without connecting any high-security rendering graphics hardware, Windows Defender Application Guard will automatically revert to software-based (CPU) rendering.

        **Important**
        Be aware that enabling this setting with potentially compromised graphics devices or drivers might pose a risk to the host device.

      **Disabled or not configured.** Windows Defender Application Guard uses software-based (CPU) rendering and won’t load any third-party graphics drivers or interact with any connected graphics hardware.| |Allow camera and microphone access in Windows Defender Application Guard|Windows 10 Enterprise, 1809 or higher

      Windows 10 Pro, 1809 or higher|Determines whether to allow camera and microphone access inside Windows Defender Application Guard.|**Enabled.** Applications inside Windows Defender Application Guard are able to access the camera and microphone on the user's device.

**Important**
Be aware that enabling this policy with a potentially compromised container could bypass camera and microphone permissions and access the camera and microphone without the user's knowledge.

**Disabled or not configured.** Applications inside Windows Defender Application Guard are unable to access the camera and microphone on the user's device.| diff --git a/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md b/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md index 9d214a2b3c..475ce2cff3 100644 --- a/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md +++ b/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md @@ -7,38 +7,41 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security author: mjcaparas +ms.author: macapara +audience: ITPro ms.localizationpriority: medium ms.date: 07/27/2017 ms.reviewer: manager: dansimp -ms.author: macapara --- # Windows Defender SmartScreen + **Applies to:** - Windows 10 - Windows 10 Mobile -Windows Defender SmartScreen helps to protect your employees if they try to visit sites previously reported as phishing or malware websites, or if an employee tries to download potentially malicious files. +Windows Defender SmartScreen protects against phishing or malware websites, and the downloading of potentially malicious files. **SmartScreen determines whether a site is potentially malicious by:** -- Analyzing visited webpages looking for indications of suspicious behavior. If it finds suspicious pages, SmartScreen shows a warning page, advising caution. +- Analyzing visited webpages, looking for indications of suspicious behavior. If SmartScreen determines that a page is suspicious, it will show a warning page to advise caution. -- Checking the visited sites against a dynamic list of reported phishing sites and malicious software sites. If it finds a match, SmartScreen shows a warning to let the user know that the site might be malicious. +- Checking visited sites against a dynamic list of reported phishing and malicious software sites. If SmartScreen finds a match, it will show a warning indicating that the site might be malicious. **SmartScreen determines whether a downloaded app or app installer is potentially malicious by:** -- Checking downloaded files against a list of reported malicious software sites and programs known to be unsafe. If it finds a match, SmartScreen shows a warning to let the user know that the site might be malicious. +- Checking downloaded files against a list of reported malicious software sites and programs known to be unsafe. If SmartScreen finds a match, it will show a warning indicating that the site might be malicious. -- Checking downloaded files against a list of files that are well known and downloaded by many Windows users. If the file isn't on that list, SmartScreen shows a warning, advising caution. +- Checking downloaded files against a list of files that are well-known and downloaded by many Windows users. If the file isn't on that list, SmartScreen shows a warning, advising caution. - >[!NOTE] - >Before Windows 10, version 1703 this feature was called the SmartScreen Filter when used within the browser and Windows SmartScreen when used outside of the browser. + > [!NOTE] + > Before Windows 10, version 1703, this feature was called _the SmartScreen Filter_ when used within the browser and _Windows SmartScreen_ when used outside of the browser. ## Benefits of Windows Defender SmartScreen -Windows Defender SmartScreen helps to provide an early warning system against websites that might engage in phishing attacks or attempt to distribute malware through a socially-engineered attack. The primary benefits are: + +Windows Defender SmartScreen provide an early warning system against websites that might engage in phishing attacks or attempt to distribute malware through a socially-engineered attack. The primary benefits are: - **Anti-phishing and anti-malware support.** SmartScreen helps to protect your employees from sites that are reported to host phishing attacks or attempt to distribute malicious software. It can also help protect against deceptive advertisements, scam sites, and drive-by attacks. Drive-by attacks are web-based attacks that tend to start on a trusted site, targeting security vulnerabilities in commonly-used software. Because drive-by attacks can happen even if the user does not click or download anything on the page, the danger often goes unnoticed. For more info about drive-by attacks, see [Evolving Microsoft SmartScreen to protect you from drive-by attacks](https://blogs.windows.com/msedgedev/2015/12/16/SmartScreen-drive-by-improvements/#3B7Bb8bzeAPq8hXE.97) @@ -50,28 +53,27 @@ Windows Defender SmartScreen helps to provide an early warning system against we - **Management through Group Policy and Microsoft Intune.** SmartScreen supports using both Group Policy and Microsoft Intune settings. For more info about all available settings, see [Available Windows Defender SmartScreen Group Policy and mobile device management (MDM) settings](windows-defender-smartscreen-available-settings.md). +- **Blocking URLs associated with potentially unwanted applications.** In the next major version of Microsoft Edge (based on Chromium), SmartScreen will blocks URLs associated with potentially unwanted applications, or PUAs. For more information on blocking URLs associated with PUAs, see [Detect and block potentially unwanted applications](../windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md). + ## Viewing Windows Defender SmartScreen anti-phishing events + When Windows Defender SmartScreen warns or blocks an employee from a website, it's logged as [Event 1035 - Anti-Phishing](https://technet.microsoft.com/scriptcenter/dd565657(v=msdn.10).aspx). - ## Viewing Windows event logs for SmartScreen + SmartScreen events appear in the Microsoft-Windows-SmartScreen/Debug log in Event Viewer. > [!NOTE] > For information on how to use the Event Viewer, see [Windows Event Viewer](https://docs.microsoft.com/host-integration-server/core/windows-event-viewer1). -|EventID | Description | -| :---: | :---: | -|1000 | Application SmartScreen Event| -|1001 | Uri SmartScreen Event| -|1002 | User Decision SmartScreen Event| +EventID | Description +-|- +1000 | Application SmartScreen Event +1001 | Uri SmartScreen Event +1002 | User Decision SmartScreen Event ## Related topics + - [SmartScreen Frequently Asked Questions (FAQ)](https://feedback.smartscreen.microsoft.com/smartscreenfaq.aspx) - - [Threat protection](../index.md) - - [Available Windows Defender SmartScreen Group Policy and mobile device management (MDM) settings](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-available-settings) - ->[!NOTE] ->Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Contributing to TechNet content](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md).