+
[Deployment recommendations for school IT administrators](edu-deployment-recommendations.md)
Learn how to customize the OS privacy settings, Skype, and Xbox for Windows-based devices used in schools so that you can choose what information is shared with Microsoft.
+
[Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md)
Get step-by-step guidance to help you deploy Windows 10 in a school environment.
+
[Deploy Windows 10 in a school district](deploy-windows-10-in-a-school-district.md)
Get step-by-step guidance on how to deploy Windows 10 to PCs and devices across a school district.
+
+
Try it out: Windows 10 deployment (for education)
Learn how to upgrade devices running the Windows 7 operating system to Windows 10 Anniversary Update, and how to manage devices, apps, and users in Windows 10 Anniversary Update.
For the best experience, use this guide in tandem with the TechNet Virtual Lab: IT Pro Try-It-Out.
+
[Upgrade Windows 10 Pro to Pro Education from Windows Store for Business](windows-10-pro-to-pro-edu-upgrade.md)
If you have an education tenant and use Windows 10 Pro in your schools now, find out how you can opt-in to a free upgrade to Windows 10 Pro Education.
+## Windows 8.1
+Follow these links to find step-by-step guidance on how to deploy Windows 8.1 in an academic environment.
+
+
+
+
Windows 8.1 deployment planning
Explore key considerations and questions that should be answered when planning for Windows 8.1 deployment.
+
Windows 8.1 deployment to PCs
Get an overview of Windows 8.1 deployment to PCs in an educational environment.
+
BYOD
Explore Bring Your Own Device (BYOD) considerations, including device types, infrastructure, and deployment models.
+
Deploying Windows RT 8.1
Get step-by-step instructions on how to configure and deploy Windows RT devices (like Surface and other tablets) in educational environments.
+
+
+
Virtual Desktop Infrastructure
Learn how to address challenges related to BYOD scenarios using Virtual Desktop Infrastructure (VDI).
+
Windows Store apps
Explore Windows Store app deployment strategies and considerations for educational institutions running Windows 8.1.
+
Windows To Go
Learn about the benefits, limitations, and processes involved in deploying Windows To Go.
+
+
## Related topics
-- [Try it out: virtual labs and how-to videos for Windows 10 Education](https://technet.microsoft.com/en-us/windows/dn610356)
- [Windows 10 and Windows 10 Mobile](https://technet.microsoft.com/itpro/windows/index)
diff --git a/education/windows/take-a-test-multiple-pcs.md b/education/windows/take-a-test-multiple-pcs.md
index 1b80672e68..caa227ea97 100644
--- a/education/windows/take-a-test-multiple-pcs.md
+++ b/education/windows/take-a-test-multiple-pcs.md
@@ -9,7 +9,7 @@ ms.pagetype: edu
author: CelesteDG
---
-# Set up Take a Test on multiple PCs
+# Set up Take a Test on multiple PCs
**Applies to:**
- Windows 10
@@ -25,137 +25,120 @@ Many schools use online testing for formative and summative assessments. It's cr
- Students can’t change settings, extend their display, see notifications, get updates, or use autofill features.
- Cortana is turned off.
+## How to use Take a Test
+
-
-## How you use Take a Test
-
-
-
-- **Use a test URL and a [dedicated testing account](#set-up-a-dedicated-test-account)** - A user signs in to the account and the **Take a Test** app automatically launches the pre-configured assessment URL in Microsoft Edge in a single-app, kiosk mode. A student will never have access to the desktop in this configuration. We recommend this configuration for high stakes testing.
-- **[Put a test URL with an included prefix](#provide-link-to-test) on a web page or OneNote for students to click** - This allows teachers and test administrators an easier way to deploy assessments. We recommend this method for lower stakes assessments.
+- **Use an assessment URL and a [dedicated testing account](#set-up-a-dedicated-test-account)** - A user signs in to the account and the **Take a Test** app automatically launches the pre-configured assessment URL in Microsoft Edge in a single-app, kiosk mode. A student will never have access to the desktop in this configuration. We recommend this configuration for high stakes testing.
+- **[Put an assessment URL with an included prefix](#provide-link-to-test) on a web page or OneNote for students to click** - This allows teachers and test administrators an easier way to deploy assessments. We recommend this method for lower stakes assessments.
## Set up a dedicated test account
-
To configure a dedicated test account on multiple PCs, you can use:
-- [Mobile device management (MDM) or Microsoft System Center Configuration Manager](#set-up-test-account-in-mdm-or-configuration-manager)
-- [A provisioning package](#set-up-test-account-in-a-provisioning-package) created in Windows Imaging and Configuration Designer (ICD)
-- [Group Policy](#set-up-test-account-in-group-policy) to deploy a scheduled task that runs a Powershell script
-
-
-### Set up test account in MDM or Configuration Manager
+- [Mobile device management (MDM) or Microsoft System Center Configuration Manager](#set-up-a-test-account-in-mdm-or-configuration-manager)
+- [A provisioning package](#set-up-a-test-account-in-a-provisioning-package) created in Windows Imaging and Configuration Designer (ICD)
+- [Group Policy](#set-up-a-test-account-in-group-policy) to deploy a scheduled task that runs a Powershell script
+### Set up a test account in MDM or Configuration Manager
1. Launch your management console.
2. Create a policy to set up single app kiosk mode, using the following values:
- **Custom OMA-DM URI** = ./Vendor/MSFT/AssignedAccess/KioskModeApp
- **String value** = {"Account":"*redmond\\kioskuser*","AUMID":” Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy!App "}
- > Account can be in one of the following formats:
- > - username
- > - domain\username
- > - computer name\\username
- > - username@tenant.com
+ Account can be in one of the following formats:
+ - username
+ - domain\username
+ - computer name\\username
+ - username@tenant.com
3. Create a policy to configure the assessment URL, using the following values:
- **Custom OMA-DM URI** = ./Vendor/MSFT/SecureAssessment/LaunchURI
- **String value** = *assessment URL*
- > See [Assessment URLs](#assessment-urls)
-
+
+ See [Assessment URLs](#assessment-urls) for more information.
+
4. Create a policy that associates the assessment URL to the account, using the following values:
- **Custom OMA-DM URI** = ./Vendor/MSFT/SecureAssessment/TesterAccount
- **String value** = Enter the account that you specified in step 2, using the same account format.
-
+
5. To take the test, the student signs in to the test account.
-### Set up test account in a provisioning package
+### Set up a test account in a provisioning package
-Prerequisite: You must first [download the Windows ADK](https://msdn.microsoft.com/en-us/windows/hardware/dn913721.aspx) for Windows 10, Version 1607, and install Windows Imaging and Configuration Designer (ICD).
+**Prerequisite:** You must first download the Windows ADK for Windows 10, Version 1607, and install Windows Imaging and Configuration Designer (ICD). For more info, see [Install Windows Imaging and Configuration Designer](https://technet.microsoft.com/en-us/itpro/windows/deploy/provisioning-install-icd).
-**Create a provisioning package to set up a test account
+**Create a provisioning package to set up a test account**
-1. Open Windows ICD (by default, %windir%\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86\ICD.exe).
+1. Open Windows ICD (by default, %windir%\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86\ICD.exe).
2. Select **Advanced provisioning**.
3. Name your project, and click **Next**.
4. Select **All Windows desktop editions**, and click **Next**.
5. Click **Finish**.
-6. Go to **Runtime settings** > **AssignedAccess** > **AssignedAccessSettings**.
+6. Go to **Runtime settings** > **AssignedAccess** > **AssignedAccessSettings**.
7. Enter **{"Account":"*redmond\\kioskuser*","AUMID":” Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy!App "}**, using the account that you want to set up, as shown in the following image.
- > Account can be in one of the following formats:
- > - username
- > - domain\username
- > - computer name\\username
- > - username@tenant.com
-
+
+ Account can be in one of the following formats:
+ - username
+ - domain\username
+ - computer name\\username
+ - username@tenant.com
+
8. Go to **Runtime settings** > **TakeATest**.
-9. Enter the test URL in **LaunchURI**.
+9. Enter the assessment URL in **LaunchURI**.
10. Enter the test account from step 7 in **TesterAccount**.
On the **File** menu, select **Save.**
-
9. On the **Export** menu, select **Provisioning package**.
-
10. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next.**
-
11. Optional. In the **Provisioning package security** window, you can choose to encrypt the package and enable package signing.
-
- **Enable package encryption** - If you select this option, an auto-generated password will be shown on the screen.
-
- **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Select** and choosing the certificate you want to use to sign the package.
12. Click **Next** to specify the output location where you want the provisioning package to go when it's built. By default, Windows ICD uses the project folder as the output location.
- Optionally, you can click **Browse** to change the default output location.
+ Optionally, you can click **Browse** to change the default output location.
13. Click **Next**.
-
14. Click **Build** to start building the package. The provisioning package doesn't take long to build. The project information is displayed in the build page and the progress bar indicates the build status.
- If you need to cancel the build, click **Cancel**. This cancels the current build process, closes the wizard, and takes you back to the **Customizations Page**.
+ If you need to cancel the build, click **Cancel**. This cancels the current build process, closes the wizard, and takes you back to the **Customizations Page**.
15. If your build fails, an error message will show up that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again.
- If your build is successful, the name of the provisioning package, output directory, and project directory will be shown.
+ If your build is successful, the name of the provisioning package, output directory, and project directory will be shown.
- - If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, click **Back** to change the output package name and path, and then click **Next** to start another build.
- - If you are done, click **Finish** to close the wizard and go back to the **Customizations Page**.
+ - If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, click **Back** to change the output package name and path, and then click **Next** to start another build.
+ - If you are done, click **Finish** to close the wizard and go back to the **Customizations Page**.
- **Apply the provisioning package**
-
- 1. Select the provisioning package that you want to apply, double-click the file, and then allow admin privileges.
+**Apply the provisioning package**
+1. Select the provisioning package that you want to apply, double-click the file, and then allow admin privileges.
2. Consent to allow the package to be installed.
- After you allow the package to be installed, the settings will be applied to the device
+ After you allow the package to be installed, the settings will be applied to the device. [Learn how to apply a provisioning package in audit mode or OOBE](https://go.microsoft.com/fwlink/p/?LinkID=692012).
-[Learn how to apply a provisioning package in audit mode or OOBE.](https://go.microsoft.com/fwlink/p/?LinkID=692012)
+### Set up a test account in Group Policy
+To set up a test account using Group Policy, first create a Powershell script that configures the test account and assessment URL, and then create a scheduled task to run the script.
-### Set up test account in Group Policy
-
-To set up a test account using Group Policy, first create a Powershell script that configures the test account and test URL, and then create a scheduled task to run the script.
-
-#### Create a Powershell script
-
-This sample Powershell script configures the test account and the test URL. Edit the sample to:
+#### Create a PowerShell script
+This sample PowerShell script configures the test account and the assessment URL. Edit the sample to:
- Use your test account for **$obj.LaunchURI**
-- Use your test URL for **$obj.TesterAccount**
-- Use your test account for **-UserName**
+- Use your assessment URL for **$obj.TesterAccount**
+- Use your test account for **-UserName**
```
-$obj = get-wmiobject -namespace root/cimv2/mdm/dmmap -class MDM_SecureAssessment -filter "InstanceID='SecureAssessment' AND ParentID='./Vendor/MSFT'";
-$obj.LaunchURI='http://www.foo.com';
-$obj.TesterAccount='TestAccount';
+$obj = get-wmiobject -namespace root/cimv2/mdm/dmmap -class MDM_SecureAssessment -filter "InstanceID='SecureAssessment' AND ParentID='./Vendor/MSFT'";
+$obj.LaunchURI='http://www.foo.com';
+$obj.TesterAccount='TestAccount';
$obj.put()
Set-AssignedAccess -AppUserModelId Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy!App -UserName TestAccount
```
-
#### Create a scheduled task in Group Policy
-
-1. Open the Group Policy Management Console.
+1. Open the Group Policy Management Console.
2. Right-click the Group Policy object (GPO) that should contain the new preference item, and then click **Edit**.
3. In the console tree under **Computer Configuration** or **User Configuration**, go to **Preferences** > **Control Panel Settings**.
4. Right-click **Scheduled Tasks**, point to **New**, and select **Scheduled Task**.
@@ -164,42 +147,36 @@ Set-AssignedAccess -AppUserModelId Microsoft.Windows.SecureAssessmentBrowser_cw5
7. In the **Advanced** dialog box, click **Find Now**.
8. Select **System** in the search results
9. Go back to the **Properties** dialog box and select **Run with highest privileges** under **Security options**.
-9. Specify the operating system in the **Configure for** field.
-9. Navigate to the **Actions** tab.
-9. Create a new **Action**.
-9. Configure the action to **Start a program**.
-9. In the **Program/script** field, enter **powershell**.
-9. In the **Add arguments** field, enter **-file “
”**.
-9. Click **OK**.
-9. Navigate to the **Triggers** tab and create a new trigger.
-9. Specify the trigger to be **On a schedule**.
-9. Specify the trigger to be **One time**.
-9. Specify the time the trigger should start.
-9. Click **OK**.
-9. In the **Settings** tab, select **Run task as soon as possible after a scheduled start is missed**.
-9. Click **OK**.
-
-
+10. Specify the operating system in the **Configure for** field.
+11. Navigate to the **Actions** tab.
+12. Create a new **Action**.
+13. Configure the action to **Start a program**.
+14. In the **Program/script** field, enter **powershell**.
+15. In the **Add arguments** field, enter **-file “”**.
+16. Click **OK**.
+17. Navigate to the **Triggers** tab and create a new trigger.
+18. Specify the trigger to be **On a schedule**.
+19. Specify the trigger to be **One time**.
+20. Specify the time the trigger should start.
+21. Click **OK**.
+22. In the **Settings** tab, select **Run task as soon as possible after a scheduled start is missed**.
+23. Click **OK**.
## Provide link to test
+Anything hosted on the web can be presented in a locked down manner, not just assessments. To lock down online content, just embed a URL with a specific prefix and devices will be locked down when users follow the link. We recommend using this method for lower stakes assessments.
-Anything hosted on the web can be presented in a locked down manner, not just assessments. To lock down online content, just embed a URL with a specific prefix and devices will be locked down when users follow the link. We recommend using this method for lower stakes assessments.
-
-1. Create a link to the test URL. Use **ms-edu-secureassessment:** before the URL and **!enforceLockdown** after the URL.
-```
-ms-edu-secureassessment:!enforceLockdown
- ```
- > **Note**: You may want to remove !enforceLockdown for tests that utilizes our lockdown API that checks for running processes before locking down. Removing !enforceLockdown will result in the app not locking down immediately which allows you to close apps that are not allowed to run during lockdown. The test web application may lock down the device once you have closed the apps.
+1. Create a link to the assessment URL. Use **ms-edu-secureassessment:** before the URL and **!enforceLockdown** after the URL.
+ ```
+ ms-edu-secureassessment:!enforceLockdown
+ ```
+ > [!NOTE]
+ > You may want to remove !enforceLockdown for tests that utilizes our lockdown API that checks for running processes before locking down. Removing !enforceLockdown will result in the app not locking down immediately which allows you to close apps that are not allowed to run during lockdown. The test web application may lock down the device once you have closed the apps.
2. Distribute the link. You can use the web, email, OneNote, or any other method of your choosing.
3. To take the test, the student clicks on the link and provides user consent.
-
-
## Assessment URLs
-
This assessment URL uses our lockdown API:
-
- SBAC/AIR: [http://mobile.tds.airast.org/launchpad/](http://mobile.tds.airast.org/launchpad/).
diff --git a/education/windows/take-a-test-single-pc.md b/education/windows/take-a-test-single-pc.md
index 7b982a6f0a..52a6636b7d 100644
--- a/education/windows/take-a-test-single-pc.md
+++ b/education/windows/take-a-test-single-pc.md
@@ -26,50 +26,40 @@ The **Take a Test** app in Windows 10, Version 1607, creates the right environme
- Cortana is turned off.
> [!TIP]
-> To exit **Take a Test**, press Ctrl+Alt+Delete.
+> To exit **Take a Test**, press Ctrl+Alt+Delete.
-## How you use Take a Test
+## How to use Take a Test
-
+
-- **Use a test URL and a [dedicated testing account](#set-up-a-dedicated-test-account)** - A user signs in to the account and the **Take a Test** app automatically launches the pre-configured assessment URL in Microsoft Edge in a single-app, kiosk mode. A student will never have access to the desktop in this configuration. We recommend this configuration for high stakes testing.
-- **[Put a test URL with an included prefix](#provide-link-to-test) on a web page or OneNote for students to click** - This allows teachers and test administrators an easier way to deploy assessments. We recommend this method for lower stakes assessments.
+- **Use an assessment URL and a [dedicated testing account](#set-up-a-dedicated-test-account)** - A user signs in to the account and the **Take a Test** app automatically launches the pre-configured assessment URL in Microsoft Edge in a single-app, kiosk mode. A student will never have access to the desktop in this configuration. We recommend this configuration for high stakes testing.
+- **[Put an assessment URL with an included prefix](#provide-a-link-to-the-test) on a web page or OneNote for students to click** - This allows teachers and test administrators an easier way to deploy assessments. We recommend this method for lower stakes assessments.
## Set up a dedicated test account
-
-
-
-
-
-
1. Sign into the device with an administrator account.
2. Go to **Settings** > **Accounts** > **Work or school access** > **Set up an account for taking tests**.
3. Select an existing account to use as the dedicated testing account.
- > [!NOTE]
- > If you don't have an account on the device, you can create a new account. To do this, go to **Settings** > **Accounts** > **Other Users** > **Add someone else to this PC** > **I don’t have this person’s sign-in information** > **Add a user without a Microsoft account**.
-
+ > [!NOTE]
+ > If you don't have an account on the device, you can create a new account. To do this, go to **Settings** > **Accounts** > **Other Users** > **Add someone else to this PC** > **I don’t have this person’s sign-in information** > **Add a user without a Microsoft account**.
+
4. Specify an assessment URL.
-
5. Click **Save**.
-
6. To take the test, the student signs in to the selected account.
-
-
-
-## Provide link to test
+## Provide a link to the test
Anything hosted on the web can be presented in a locked down manner, not just assessments. To lock down online content, just embed a URL with a specific prefix and devices will be locked down when users follow the link. We recommend using this method for lower stakes assessments.
-1. Create a link to the test URL. Use **ms-edu-secureassessment:** before the URL and **!enforceLockdown** after the URL.
-```
-ms-edu-secureassessment:!enforceLockdown
- ```
+1. Create a link to the assessment URL. Use **ms-edu-secureassessment:** before the URL and **!enforceLockdown** after the URL.
+
+ ```
+ ms-edu-secureassessment:!enforceLockdown
+ ```
> [!NOTE]
- > You may want to remove !enforceLockdown for tests that utilizes our lockdown API that checks for running processes before locking down. Removing !enforceLockdown will result in the app not locking down immediately which allows you to close apps that are not allowed to run during lockdown. The test web application may lock down the device once you have closed the apps.
-
+ > You may want to remove !enforceLockdown for tests that utilizes our lockdown API that checks for running processes before locking down. Removing !enforceLockdown will result in the app not locking down immediately which allows you to close apps that are not allowed to run during lockdown. The test web application may lock down the device once you have closed the apps.
+
2. Distribute the link. You can use the web, email, OneNote, or any other method of your choosing.
3. To take the test, the student clicks on the link and provides user consent.
diff --git a/education/windows/take-tests-in-windows-10.md b/education/windows/take-tests-in-windows-10.md
index 06129d0ee1..6ba8afa38c 100644
--- a/education/windows/take-tests-in-windows-10.md
+++ b/education/windows/take-tests-in-windows-10.md
@@ -27,18 +27,17 @@ Many schools use online testing for formative and summative assessments. It's cr
-## How you use Take a Test
+## How to use Take a Test
-
-
-- **Use a test URL and a dedicated testing account** - A user signs in to the account and the **Take a Test** app automatically launches the pre-configured assessment URL in a single-app, kiosk mode. A student will never have access to the desktop in this configuration. We recommend this configuration for high stakes testing.
-- **Put a test URL with an included prefix on a web page or OneNote for students to click** - This allows teachers and test administrators an easier way to deploy assessments. We recommend this method for lower stakes assessments.
-
-[Learn how to set up Take a Test on a single PC](take-a-test-single-pc.md)
-
-[Learn how to set up Take a Test on multiple PCs](take-a-test-multiple-pcs.md)
+
+- **Use an assessment URL and a dedicated testing account** - A user signs in to the account and the **Take a Test** app automatically launches the pre-configured assessment URL in a single-app, kiosk mode. A student will never have access to the desktop in this configuration. We recommend this configuration for high stakes testing.
+- **Put an assessment URL with an included prefix on a web page or OneNote for students to click** - This allows teachers and test administrators an easier way to deploy assessments. We recommend this method for lower stakes assessments.
+## How to set up Take a Test on PCs
+You can use Take a Test to set up a test for a single PC or multiple PCs. Follow these links to learn how:
+- [Set up Take a Test on a single PC](take-a-test-single-pc.md)
+- [Set up Take a Test on multiple PCs](take-a-test-multiple-pcs.md)
## Related topics
diff --git a/windows/configure/configure-windows-10-taskbar.md b/windows/configure/configure-windows-10-taskbar.md
index bd5e26f4ba..dd1108511b 100644
--- a/windows/configure/configure-windows-10-taskbar.md
+++ b/windows/configure/configure-windows-10-taskbar.md
@@ -42,6 +42,8 @@ To configure the taskbar:
>[!IMPORTANT]
>If you use a provisioning package to configure the taskbar, your configuration will be reapplied each time the explorer.exe process restarts. If your configuration pins an app and the user then unpins that app, the user's change will be overwritten the next time the configuration is applied. To apply a taskbar configuration that allows users to make changes that will persist, apply your configuration by using Group Policy.
+>
+>If you use Group Policy and your configuration only contains a taskbar layout, the default Windows tile layout will be applied and cannot be changed by users. If you use Group Policy and your configuration includes taskbar and a full Start layout, users can only make changes to the taskbar. If you use Group Policy and your configuration includes taskbar and a [partial Start layout](https://technet.microsoft.com/itpro/windows/manage/customize-and-export-start-layout#configure-a-partial-start-layout), users can make changes to the taskbar and to tile groups not defined in the partial Start layout.
### Tips for finding AUMID and Desktop Application Link Path
diff --git a/windows/keep-secure/credential-guard.md b/windows/keep-secure/credential-guard.md
index 30a494b20e..8c70f3782d 100644
--- a/windows/keep-secure/credential-guard.md
+++ b/windows/keep-secure/credential-guard.md
@@ -85,7 +85,7 @@ Applications may cause performance issues when they attempt to hook the isolated
The following tables provide more information about the hardware, firmware, and software required for deployment of Credential Guard. The tables describe baseline protections, plus protections for improved security that are associated with hardware and firmware options available in 2015, available in 2016, and announced as options for 2017.
> [!NOTE]
-> For new computers running Windows 10, Trusted Platform Module (TPM 2.0) must be enabled by default. This requirement is not restated in the tables that follow.
+> Beginning with Windows 10, version 1607, Trusted Platform Module (TPM 2.0) must be enabled by default on new computers. This requirement is not restated in the tables that follow.
> If you are an OEM, see the requirements information at [PC OEM requirements for Device Guard and Credential Guard](https://msdn.microsoft.com/library/windows/hardware/mt767514.aspx).
> Starting in Widows 10, 1607, TPM 2.0 is required.
diff --git a/windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md b/windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md
index c00e795566..49742f17e8 100644
--- a/windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md
+++ b/windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md
@@ -42,7 +42,7 @@ You can deploy Device Guard in phases, and plan these phases in relation to the
The following tables provide more information about the hardware, firmware, and software required for deployment of various Device Guard features. The tables describe baseline protections, plus protections for improved security that are associated with hardware and firmware options available in 2015, available in 2016, and announced as options for 2017.
> **Notes**
-> • To understand the requirements in the following tables, you will need to be familiar with the main features in Device Guard: configurable code integrity policies, virtualization-based security (VBS), and Universal Extensible Firmware Interface (UEFI) Secure Boot. For information about these features, see [How Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md#how-device-guard-features-help-protect-against-threats).
+> • To understand the requirements in the following tables, you will need to be familiar with the main features in Device Guard: configurable code integrity policies, virtualization-based security (VBS), and Universal Extensible Firmware Interface (UEFI) Secure Boot. For information about these features, see [How Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md#how-device-guard-features-help-protect-against-threats).
> • Beginning with Windows 10, version 1607, Trusted Platform Module (TPM 2.0) must be enabled by default on new computers.
## Device Guard requirements for baseline protections